contrast-agent 4.1.0 → 4.4.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Rakefile +1 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +22 -10
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +4 -3
- data/lib/contrast/agent.rb +5 -1
- data/lib/contrast/agent/assess.rb +0 -9
- data/lib/contrast/agent/assess/contrast_event.rb +49 -132
- data/lib/contrast/agent/assess/contrast_object.rb +54 -0
- data/lib/contrast/agent/assess/events/source_event.rb +4 -9
- data/lib/contrast/agent/assess/finalizers/hash.rb +7 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +17 -3
- data/lib/contrast/agent/assess/policy/patcher.rb +4 -3
- data/lib/contrast/agent/assess/policy/policy_node.rb +31 -59
- data/lib/contrast/agent/assess/policy/preshift.rb +3 -3
- data/lib/contrast/agent/assess/policy/propagation_method.rb +41 -32
- data/lib/contrast/agent/assess/policy/propagation_node.rb +12 -24
- data/lib/contrast/agent/assess/policy/propagator/append.rb +29 -15
- data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +21 -18
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
- data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +2 -4
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -4
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +25 -17
- data/lib/contrast/agent/assess/policy/propagator/split.rb +83 -120
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +41 -25
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +3 -7
- data/lib/contrast/agent/assess/policy/source_method.rb +2 -14
- data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +5 -8
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger_method.rb +13 -8
- data/lib/contrast/agent/assess/policy/trigger_node.rb +28 -7
- data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +59 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -3
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +6 -4
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +2 -4
- data/lib/contrast/agent/assess/properties.rb +0 -2
- data/lib/contrast/agent/assess/property/tagged.rb +56 -32
- data/lib/contrast/agent/assess/tracker.rb +16 -18
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +7 -0
- data/lib/contrast/agent/middleware.rb +134 -55
- data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
- data/lib/contrast/agent/patching/policy/patch.rb +6 -0
- data/lib/contrast/agent/patching/policy/patch_status.rb +1 -1
- data/lib/contrast/agent/patching/policy/patcher.rb +51 -44
- data/lib/contrast/agent/patching/policy/trigger_node.rb +5 -2
- data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +47 -1
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +53 -0
- data/lib/contrast/agent/protect/rule/base.rb +63 -14
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +12 -28
- data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -4
- data/lib/contrast/agent/protect/rule/deserialization.rb +4 -1
- data/lib/contrast/agent/protect/rule/no_sqli.rb +3 -3
- data/lib/contrast/agent/protect/rule/sqli.rb +20 -14
- data/lib/contrast/agent/protect/rule/xxe.rb +32 -11
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +10 -6
- data/lib/contrast/agent/reaction_processor.rb +1 -1
- data/lib/contrast/agent/request_context.rb +12 -0
- data/lib/contrast/agent/response.rb +5 -5
- data/lib/contrast/agent/rewriter.rb +3 -3
- data/lib/contrast/agent/scope.rb +81 -55
- data/lib/contrast/agent/static_analysis.rb +13 -7
- data/lib/contrast/agent/thread.rb +1 -1
- data/lib/contrast/agent/thread_watcher.rb +20 -5
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/api/communication/messaging_queue.rb +18 -21
- data/lib/contrast/api/communication/response_processor.rb +8 -1
- data/lib/contrast/api/communication/socket_client.rb +22 -14
- data/lib/contrast/api/decorators.rb +2 -0
- data/lib/contrast/api/decorators/agent_startup.rb +58 -0
- data/lib/contrast/api/decorators/application_startup.rb +51 -0
- data/lib/contrast/api/decorators/library.rb +1 -0
- data/lib/contrast/api/decorators/library_usage_update.rb +1 -0
- data/lib/contrast/api/decorators/route_coverage.rb +15 -5
- data/lib/contrast/api/decorators/trace_event.rb +58 -42
- data/lib/contrast/api/decorators/trace_event_object.rb +11 -3
- data/lib/contrast/api/decorators/trace_event_signature.rb +27 -5
- data/lib/contrast/api/decorators/user_input.rb +2 -1
- data/lib/contrast/common_agent_configuration.rb +2 -1
- data/lib/contrast/components/agent.rb +2 -0
- data/lib/contrast/components/app_context.rb +4 -22
- data/lib/contrast/components/assess.rb +36 -0
- data/lib/contrast/components/interface.rb +5 -3
- data/lib/contrast/components/sampling.rb +48 -6
- data/lib/contrast/components/scope.rb +72 -6
- data/lib/contrast/components/settings.rb +11 -7
- data/lib/contrast/config/assess_configuration.rb +2 -1
- data/lib/contrast/extension/assess/array.rb +2 -3
- data/lib/contrast/extension/assess/erb.rb +1 -3
- data/lib/contrast/extension/assess/exec_trigger.rb +1 -4
- data/lib/contrast/extension/assess/fiber.rb +2 -3
- data/lib/contrast/extension/assess/hash.rb +4 -2
- data/lib/contrast/extension/assess/kernel.rb +1 -2
- data/lib/contrast/extension/assess/marshal.rb +34 -26
- data/lib/contrast/extension/assess/regexp.rb +3 -8
- data/lib/contrast/extension/assess/string.rb +1 -2
- data/lib/contrast/framework/base_support.rb +51 -53
- data/lib/contrast/framework/manager.rb +16 -14
- data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
- data/lib/contrast/framework/rack/support.rb +2 -1
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
- data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
- data/lib/contrast/framework/rails/support.rb +44 -44
- data/lib/contrast/framework/sinatra/support.rb +102 -42
- data/lib/contrast/logger/application.rb +0 -3
- data/lib/contrast/logger/log.rb +31 -15
- data/lib/contrast/utils/class_util.rb +3 -1
- data/lib/contrast/utils/duck_utils.rb +1 -1
- data/lib/contrast/utils/heap_dump_util.rb +103 -87
- data/lib/contrast/utils/invalid_configuration_util.rb +21 -12
- data/lib/contrast/utils/object_share.rb +3 -3
- data/lib/contrast/utils/preflight_util.rb +1 -1
- data/lib/contrast/utils/resource_loader.rb +1 -1
- data/lib/contrast/utils/sha256_builder.rb +2 -2
- data/lib/contrast/utils/string_utils.rb +1 -1
- data/lib/contrast/utils/tag_util.rb +9 -13
- data/resources/assess/policy.json +12 -18
- data/resources/deadzone/policy.json +156 -0
- data/resources/protect/policy.json +12 -0
- data/ruby-agent.gemspec +61 -19
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +126 -113
- data/lib/contrast/agent/assess/rule.rb +0 -18
- data/lib/contrast/agent/assess/rule/base.rb +0 -52
- data/lib/contrast/agent/assess/rule/redos.rb +0 -67
- data/lib/contrast/framework/sinatra/patch/base.rb +0 -83
- data/lib/contrast/framework/sinatra/patch/support.rb +0 -27
- data/lib/contrast/utils/prevent_serialization.rb +0 -52
@@ -13,46 +13,67 @@ module Contrast
|
|
13
13
|
klass.extend(ClassMethods)
|
14
14
|
end
|
15
15
|
|
16
|
+
# The TeamServer uses the Event's type and action to render it in the Details page. These values control the
|
17
|
+
# left-hand "What happened" column and the data shown in the right-hand data
|
18
|
+
#
|
19
|
+
# @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
|
20
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
21
|
+
def build_display_params! contrast_event
|
22
|
+
self.type = contrast_event.policy_node.node_type
|
23
|
+
self.action = contrast_event.policy_node.build_action
|
24
|
+
self
|
25
|
+
end
|
26
|
+
|
27
|
+
# The TeamServer uses the Event's representation of the data to render the actual data used in the dataflow on
|
28
|
+
# the Details page.
|
29
|
+
#
|
30
|
+
# @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
|
31
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
32
|
+
def build_dataflow! contrast_event
|
33
|
+
# Figure out what the target of this event was. This can't be pulled into the decorator because SourceEvent
|
34
|
+
# has a custom impl :/
|
35
|
+
taint_target = contrast_event.determine_taint_target(self)
|
36
|
+
truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
|
37
|
+
self.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
|
38
|
+
truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
|
39
|
+
self.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
|
40
|
+
build_event_args!(contrast_event, taint_target)
|
41
|
+
build_taint_ranges!(contrast_event)
|
42
|
+
self
|
43
|
+
end
|
44
|
+
|
16
45
|
# Wrapper around build_event_object for the args array. Handles
|
17
46
|
# tainting the correct argument.
|
18
|
-
|
47
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
48
|
+
def build_event_args! contrast_event, taint_target
|
19
49
|
contrast_event.args.each_index do |idx|
|
20
50
|
truncate_arg = taint_target != idx
|
21
51
|
event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
|
22
52
|
args << event_arg
|
23
53
|
end
|
54
|
+
self
|
24
55
|
end
|
25
56
|
|
26
|
-
# TeamServer only supports one object's taint ranges at a time.
|
27
|
-
#
|
28
|
-
|
57
|
+
# TeamServer only supports one object's taint ranges at a time. We keep
|
58
|
+
# those tags on the event directly, so we just need to convert them to
|
59
|
+
# their DTM form in order to report this.
|
60
|
+
#
|
61
|
+
# @param contrast_event [Contrast::Agent::AssessContrastEvent]
|
62
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
63
|
+
def build_taint_ranges! contrast_event
|
29
64
|
# If there's no taint_target, this isn't a dataflow trace, but a
|
30
65
|
# trigger one
|
31
|
-
return
|
32
|
-
|
33
|
-
properties = case taint_target
|
34
|
-
when Contrast::Utils::ObjectShare::OBJECT_KEY
|
35
|
-
Contrast::Agent::Assess::Tracker.properties(contrast_event.object)
|
36
|
-
when Contrast::Utils::ObjectShare::RETURN_KEY
|
37
|
-
Contrast::Agent::Assess::Tracker.properties(contrast_event.ret)
|
38
|
-
else
|
39
|
-
target = contrast_event.args[taint_target]
|
40
|
-
if target.is_a?(Hash)
|
41
|
-
if contrast_event.policy_node&.targets&.any?
|
42
|
-
Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.targets[0]])
|
43
|
-
else
|
44
|
-
Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.sources[0]])
|
45
|
-
end
|
46
|
-
else
|
47
|
-
Contrast::Agent::Assess::Tracker.properties(target)
|
48
|
-
end
|
49
|
-
end
|
50
|
-
return unless properties.tracked?
|
66
|
+
return self unless contrast_event&.tags
|
51
67
|
|
52
|
-
self.taint_ranges +=
|
68
|
+
self.taint_ranges += Contrast::Api::Dtm::TraceTaintRange.build_for_event(contrast_event.tags)
|
69
|
+
self
|
53
70
|
end
|
54
71
|
|
55
|
-
|
72
|
+
# For each Parent in the ContrastEvent, capture its id and report it to TeamServer.
|
73
|
+
#
|
74
|
+
# @param contrast_event [Contrast::Agent::AssessContrastEvent]
|
75
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
76
|
+
def build_parent_ids! contrast_event
|
56
77
|
contrast_event&.parent_events&.each do |event|
|
57
78
|
next unless event
|
58
79
|
|
@@ -60,35 +81,30 @@ module Contrast
|
|
60
81
|
parent.id = event.event_id.to_i
|
61
82
|
parent_object_ids << parent
|
62
83
|
end
|
84
|
+
self
|
63
85
|
end
|
64
86
|
|
65
|
-
|
87
|
+
# Convert the caller into the Stack DTM TeamServer consumes
|
88
|
+
#
|
89
|
+
# @param contrast_event [Contrast::Agent::AssessContrastEvent]
|
90
|
+
# @return [Contrast::Api::Dtm::TraceEvent]
|
91
|
+
def build_stack! contrast_event
|
66
92
|
# We delayed doing this as long as possible b/c it's expensive
|
67
93
|
stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
|
68
94
|
self.stack += stack_dtms
|
95
|
+
self
|
69
96
|
end
|
70
97
|
|
71
98
|
# Class methods for TraceEvent
|
72
99
|
module ClassMethods
|
73
100
|
def build contrast_event
|
74
101
|
event_dtm = new
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
taint_target = contrast_event.determine_taint_target(event_dtm) # This can't be pulled into the decorator because SourceEvent has a custom impl :/
|
79
|
-
|
80
|
-
event_dtm.type = contrast_event.policy_node.node_type
|
81
|
-
event_dtm.action = contrast_event.policy_node.build_action
|
102
|
+
event_dtm.build_display_params!(contrast_event)
|
103
|
+
event_dtm.build_dataflow!(contrast_event)
|
104
|
+
event_dtm.build_stack!(contrast_event)
|
82
105
|
event_dtm.timestamp_ms = contrast_event.time.to_i
|
83
106
|
event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
|
84
|
-
|
85
|
-
event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
|
86
|
-
truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
|
87
|
-
event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
|
88
|
-
event_dtm.build_event_args(contrast_event, taint_target)
|
89
|
-
event_dtm.build_parent_ids(contrast_event)
|
90
|
-
event_dtm.build_taint_ranges(contrast_event, taint_target)
|
91
|
-
event_dtm.build_stack(contrast_event)
|
107
|
+
event_dtm.build_parent_ids!(contrast_event)
|
92
108
|
event_dtm.object_id = contrast_event.event_id.to_i
|
93
109
|
event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
|
94
110
|
event_dtm
|
@@ -29,13 +29,21 @@ module Contrast
|
|
29
29
|
ELLIPSIS = '...'
|
30
30
|
UNTRUNCATED_PORTION_LENGTH = 25
|
31
31
|
TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
|
32
|
-
|
32
|
+
|
33
|
+
# Convert the given Object into a Contrast::Api::Dtm::TraceEventObject
|
34
|
+
#
|
35
|
+
# @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
|
36
|
+
# the thing to convert, if any
|
37
|
+
# @param truncate [Boolean] if the converted object can/should be
|
38
|
+
# truncated.
|
39
|
+
# @return [Contrast::Api::Dtm::TraceEventObject]
|
40
|
+
def build contrast_object, truncate
|
33
41
|
event_object = new
|
34
42
|
with_contrast_scope do
|
35
|
-
obj_string = Contrast::Utils::StringUtils.force_utf8(object)
|
43
|
+
obj_string = Contrast::Utils::StringUtils.force_utf8(contrast_object&.object)
|
36
44
|
obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
|
37
45
|
event_object.value = Base64.encode64(obj_string)
|
38
|
-
event_object.tracked =
|
46
|
+
event_object.tracked = contrast_object&.tracked?
|
39
47
|
end
|
40
48
|
event_object
|
41
49
|
end
|
@@ -17,27 +17,49 @@ module Contrast
|
|
17
17
|
|
18
18
|
# Class methods for TraceEventSignature
|
19
19
|
module ClassMethods
|
20
|
+
# Convert the given composites into components that TeamServer can
|
21
|
+
# understand in order to build a representation of the method
|
22
|
+
# invoked.
|
23
|
+
#
|
24
|
+
# @param ret_obj [Contrast::Agent::Assess::ContrastObject, nil] the
|
25
|
+
# return value of the method call.
|
26
|
+
# @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
|
27
|
+
# the policy which pertains to the method invoked.
|
28
|
+
# @param args [Array<Contrast::Agent::Assess::ContrastObject>, nil]
|
29
|
+
# @return [Contrast::Api::Dtm::TraceEventSignature]
|
20
30
|
def build ret_obj, policy_node, args
|
21
31
|
signature = new
|
22
|
-
return_type =
|
23
|
-
signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
|
32
|
+
signature.return_type = Contrast::Utils::StringUtils.force_utf8(type_name(ret_obj))
|
24
33
|
signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
|
25
34
|
signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
|
26
35
|
if args
|
27
36
|
args&.each do |arg|
|
28
|
-
|
29
|
-
signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
|
37
|
+
signature.arg_types << Contrast::Utils::StringUtils.force_utf8(type_name(arg))
|
30
38
|
end
|
31
39
|
end
|
32
40
|
signature.constructor = policy_node.method_name == :new
|
33
41
|
# if there's a ret, then this method isn't nil. not 100% full proof since you can
|
34
42
|
# return nil, but this is the best we've got currently.
|
35
|
-
signature.void_method = ret_obj.nil?
|
43
|
+
signature.void_method = ret_obj.nil? || ret_obj.object.nil?
|
36
44
|
# 8 is STATIC in Java... we have to placate them for now
|
37
45
|
# it has been requested that flags be removed since it isn't used
|
38
46
|
signature.flags = 8 unless policy_node.instance_method?
|
39
47
|
signature
|
40
48
|
end
|
49
|
+
|
50
|
+
private
|
51
|
+
|
52
|
+
# While Ruby signatures do not require neither a return type and can
|
53
|
+
# return anything depending on inputs, code paths, etc, nor constant
|
54
|
+
# parameter types, TeamServer was designed with strongly typed
|
55
|
+
# languages (Java) in mind, so we need types in our signatures.
|
56
|
+
#
|
57
|
+
# @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
|
58
|
+
# the object to find the type of
|
59
|
+
# @return [String] the name of the module of the ret_obj, or `nil`
|
60
|
+
def type_name contrast_object
|
61
|
+
contrast_object ? contrast_object.object_type : Contrast::Utils::ObjectShare::NIL_STRING
|
62
|
+
end
|
41
63
|
end
|
42
64
|
end
|
43
65
|
end
|
@@ -12,7 +12,8 @@ module Contrast
|
|
12
12
|
module UserInput
|
13
13
|
UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
|
14
14
|
user_input.input_type = :UNKNOWN
|
15
|
-
end
|
15
|
+
end
|
16
|
+
UNKNOWN_USER_INPUT.cs__freeze
|
16
17
|
|
17
18
|
def self.included klass
|
18
19
|
klass.extend(ClassMethods)
|
@@ -65,7 +65,8 @@ module Contrast
|
|
65
65
|
end
|
66
66
|
|
67
67
|
%w[name default description required_languages display].each do |field|
|
68
|
-
|
68
|
+
# TODO: RUBY-1052
|
69
|
+
define_method(field) { hsh[field].dup } # rubocop:disable Performance/Kernel/DefineMethod
|
69
70
|
end
|
70
71
|
end
|
71
72
|
|
@@ -2,6 +2,8 @@
|
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'rubygems/version'
|
5
|
+
require 'contrast/api/decorators/agent_startup'
|
6
|
+
require 'contrast/api/decorators/application_startup'
|
5
7
|
require 'contrast/utils/object_share'
|
6
8
|
|
7
9
|
module Contrast
|
@@ -77,31 +79,11 @@ module Contrast
|
|
77
79
|
end
|
78
80
|
|
79
81
|
def build_app_startup_message
|
80
|
-
|
81
|
-
|
82
|
-
msg.group = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
|
83
|
-
msg.app_version = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
|
84
|
-
msg.code = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
|
85
|
-
msg.metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
|
86
|
-
# Other fields have limits in TeamServer, the rest don't.
|
87
|
-
msg.session_id = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id, truncate: false
|
88
|
-
msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata, truncate: false
|
89
|
-
|
90
|
-
msg
|
82
|
+
Contrast::Api::Dtm::ApplicationCreate.build
|
91
83
|
end
|
92
84
|
|
93
85
|
def build_agent_startup_message
|
94
|
-
msg = Contrast::Api::Dtm::AgentStartup.
|
95
|
-
msg.server_name = Contrast::Utils::StringUtils.protobuf_format server_name
|
96
|
-
msg.server_path = Contrast::Utils::StringUtils.protobuf_format server_path
|
97
|
-
msg.server_type = Contrast::Utils::StringUtils.protobuf_format server_type
|
98
|
-
msg.server_version = Contrast::Agent::VERSION
|
99
|
-
msg.version = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
|
100
|
-
msg.environment = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
|
101
|
-
msg.server_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
|
102
|
-
msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
|
103
|
-
msg.library_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
|
104
|
-
msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
|
86
|
+
msg = Contrast::Api::Dtm::AgentStartup.build(server_name, server_path, server_type)
|
105
87
|
logger.info('Application context',
|
106
88
|
server_name: msg.server_name,
|
107
89
|
server_path: msg.server_path,
|
@@ -35,6 +35,42 @@ module Contrast
|
|
35
35
|
disabled_rules.include?(name)
|
36
36
|
end
|
37
37
|
|
38
|
+
# The value of the stacktrace should be treated as an ENUM. We upcase it for
|
39
|
+
# faster comparisons when we use it. Anything not one of the known values of
|
40
|
+
# 'NONE', 'SOME', or 'ALL' is treated as 'ALL'
|
41
|
+
#
|
42
|
+
# @return [Symbol] the normalized value of CONFIG.root.assess.stacktraces
|
43
|
+
def capture_stacktrace_value
|
44
|
+
@_capture_stacktrace_value ||= case CONFIG.root.assess.stacktraces.upcase
|
45
|
+
when 'NONE'
|
46
|
+
:NONE
|
47
|
+
when 'SOME'
|
48
|
+
:SOME
|
49
|
+
else
|
50
|
+
:ALL
|
51
|
+
end
|
52
|
+
end
|
53
|
+
|
54
|
+
# Consider capture_stacktrace_value along with the node type
|
55
|
+
# to dertmine whether stacktraces should be captured.
|
56
|
+
#
|
57
|
+
# capture_stacktrace_value -> (:ALL, :NONE, :SOME)
|
58
|
+
# node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
|
59
|
+
#
|
60
|
+
# @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
|
61
|
+
# @param return [Boolean] to capture or not to capture, that is the question.
|
62
|
+
def capture_stacktrace? policy_node
|
63
|
+
return true if capture_stacktrace_value == :ALL
|
64
|
+
|
65
|
+
return false if capture_stacktrace_value == :NONE
|
66
|
+
|
67
|
+
# Below here capture_stacktrace_value must be :SOME.
|
68
|
+
return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::SourceNode)
|
69
|
+
return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::TriggerNode)
|
70
|
+
|
71
|
+
false
|
72
|
+
end
|
73
|
+
|
38
74
|
def scan_response?
|
39
75
|
@_scan_response = !false?(CONFIG.root.assess.enable_scan_response) if @_scan_response.nil?
|
40
76
|
@_scan_response
|
@@ -168,9 +168,11 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:settings]
|
|
168
168
|
require 'contrast/components/assess'
|
169
169
|
require 'contrast/components/protect'
|
170
170
|
require 'contrast/components/inventory'
|
171
|
-
Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [
|
172
|
-
|
173
|
-
|
171
|
+
Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [
|
172
|
+
Contrast::Components::Protect,
|
173
|
+
Contrast::Components::Assess,
|
174
|
+
Contrast::Components::Inventory
|
175
|
+
]
|
174
176
|
|
175
177
|
require 'contrast/components/logger'
|
176
178
|
Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] = [Contrast::Components::Logger]
|
@@ -25,14 +25,14 @@ module Contrast
|
|
25
25
|
|
26
26
|
def sampling_control
|
27
27
|
@_sampling_control ||= begin
|
28
|
-
|
28
|
+
config_settings = CONFIG.root.assess&.sampling
|
29
29
|
settings = SETTINGS&.assess_state&.[](:sampling_settings)
|
30
30
|
{
|
31
|
-
enabled:
|
32
|
-
baseline:
|
33
|
-
request_frequency:
|
34
|
-
response_frequency:
|
35
|
-
window:
|
31
|
+
enabled: enabled?(config_settings, settings),
|
32
|
+
baseline: baseline(config_settings, settings),
|
33
|
+
request_frequency: request_frequency(config_settings, settings),
|
34
|
+
response_frequency: response_frequency(config_settings, settings),
|
35
|
+
window: window(config_settings, settings)
|
36
36
|
}
|
37
37
|
end
|
38
38
|
end
|
@@ -41,6 +41,48 @@ module Contrast
|
|
41
41
|
def reset_sampling_control
|
42
42
|
@_sampling_control = nil
|
43
43
|
end
|
44
|
+
|
45
|
+
private
|
46
|
+
|
47
|
+
# @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
|
48
|
+
# local user input
|
49
|
+
# @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
|
50
|
+
# @return [Boolean] the resolution of the config_settings, settings, and default value
|
51
|
+
def enabled? config_settings, settings
|
52
|
+
true?([config_settings&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0])
|
53
|
+
end
|
54
|
+
|
55
|
+
# @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
|
56
|
+
# local user input
|
57
|
+
# @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
|
58
|
+
# @return [Integer] the resolution of the config_settings, settings, and default value
|
59
|
+
def baseline config_settings, settings
|
60
|
+
[config_settings&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?)
|
61
|
+
end
|
62
|
+
|
63
|
+
# @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
|
64
|
+
# local user input
|
65
|
+
# @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
|
66
|
+
# @return [Integer] the resolution of the config_settings, settings, and default value
|
67
|
+
def request_frequency config_settings, settings
|
68
|
+
[config_settings&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?)
|
69
|
+
end
|
70
|
+
|
71
|
+
# @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
|
72
|
+
# local user input
|
73
|
+
# @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
|
74
|
+
# @return [Integer] the resolution of the config_settings, settings, and default value
|
75
|
+
def response_frequency config_settings, settings
|
76
|
+
[config_settings&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?)
|
77
|
+
end
|
78
|
+
|
79
|
+
# @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
|
80
|
+
# local user input
|
81
|
+
# @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
|
82
|
+
# @return [Integer] the resolution of the config_settings, settings, and default value
|
83
|
+
def window config_settings, settings
|
84
|
+
[config_settings&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
|
85
|
+
end
|
44
86
|
end
|
45
87
|
|
46
88
|
module InstanceMethods #:nodoc:
|
@@ -42,18 +42,84 @@ module Contrast
|
|
42
42
|
# For each instance method on a scope, define a forwarder
|
43
43
|
# to the scope on the current execution context's scope.
|
44
44
|
|
45
|
-
Contrast::Agent::Scope.public_instance_methods(false).each do |method_sym|
|
46
|
-
define_method(method_sym) do |*args, &block|
|
47
|
-
scope_for_current_ec.send(method_sym, *args, &block)
|
48
|
-
end
|
49
|
-
end
|
50
|
-
|
51
45
|
def scope_for_current_ec
|
52
46
|
MONITOR.synchronize do
|
53
47
|
return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
|
54
48
|
end
|
55
49
|
end
|
56
50
|
|
51
|
+
def enter_contrast_scope!
|
52
|
+
scope_for_current_ec.enter_contrast_scope!
|
53
|
+
end
|
54
|
+
|
55
|
+
def enter_deserialization_scope!
|
56
|
+
scope_for_current_ec.enter_deserialization_scope!
|
57
|
+
end
|
58
|
+
|
59
|
+
def enter_split_scope!
|
60
|
+
scope_for_current_ec.enter_split_scope!
|
61
|
+
end
|
62
|
+
|
63
|
+
def enter_scope! name
|
64
|
+
scope_for_current_ec.enter_scope! name
|
65
|
+
end
|
66
|
+
|
67
|
+
def exit_contrast_scope!
|
68
|
+
scope_for_current_ec.exit_contrast_scope!
|
69
|
+
end
|
70
|
+
|
71
|
+
def exit_deserialization_scope!
|
72
|
+
scope_for_current_ec.exit_deserialization_scope!
|
73
|
+
end
|
74
|
+
|
75
|
+
def exit_split_scope!
|
76
|
+
scope_for_current_ec.exit_split_scope!
|
77
|
+
end
|
78
|
+
|
79
|
+
def exit_scope! name
|
80
|
+
scope_for_current_ec.exit_scope! name
|
81
|
+
end
|
82
|
+
|
83
|
+
def in_contrast_scope?
|
84
|
+
scope_for_current_ec.in_contrast_scope?
|
85
|
+
end
|
86
|
+
|
87
|
+
def in_deserialization_scope?
|
88
|
+
scope_for_current_ec.in_deserialization_scope?
|
89
|
+
end
|
90
|
+
|
91
|
+
def in_split_scope?
|
92
|
+
scope_for_current_ec.in_split_scope?
|
93
|
+
end
|
94
|
+
|
95
|
+
def split_scope_depth
|
96
|
+
scope_for_current_ec.split_scope_depth
|
97
|
+
end
|
98
|
+
|
99
|
+
def in_scope? name
|
100
|
+
scope_for_current_ec.in_scope? name
|
101
|
+
end
|
102
|
+
|
103
|
+
def with_contrast_scope
|
104
|
+
scope_for_current_ec.enter_contrast_scope!
|
105
|
+
yield
|
106
|
+
ensure
|
107
|
+
scope_for_current_ec.exit_contrast_scope!
|
108
|
+
end
|
109
|
+
|
110
|
+
def with_deserialization_scope
|
111
|
+
scope_for_current_ec.enter_deserialization_scope!
|
112
|
+
ensure
|
113
|
+
scope_for_current_ec.exit_deserialization_scope!
|
114
|
+
end
|
115
|
+
|
116
|
+
def with_split_scope
|
117
|
+
scope_for_current_ec.enter_split_scope!
|
118
|
+
yield
|
119
|
+
ensure
|
120
|
+
scope_for_current_ec.exit_split_scope!
|
121
|
+
end
|
122
|
+
|
57
123
|
# TODO: RUBY-572
|
58
124
|
#
|
59
125
|
# Current behavior is to no-op if we're not "in a request context".
|