contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/utils/tag_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -56,20 +56,20 @@ module Contrast
         # Any overlapping ranges are merged before returning
         #
         # arr: the array of tags to which we are adding
-        # new_arr: misnomer. either an array of or a single Tag to be added
-        def ordered_merge arr, new_arr
+        # add_arr:  array of Tags or a single Tag to be added
+        def ordered_merge arr, add_arr
           # [Contrast::Agent::Assess::Tag, ...]
-          if new_arr.is_a?(Array)
-            return arr unless new_arr.any?
-            return new_arr unless arr&.any?
+          if add_arr.is_a?(Array)
+            return arr unless add_arr.any?
+            return add_arr unless arr&.any?
 
-            new_arr.each { |new_element| single_ordered_merge(arr, new_element) }
+            add_arr.each { |new_element| single_ordered_merge(arr, new_element) }
           # Contrast::Agent::Assess::Tag
           else
-            return arr unless new_arr
-            return [new_arr] unless arr
+            return arr unless add_arr
+            return [add_arr] unless arr
 
-            single_ordered_merge(arr, new_arr)
+            single_ordered_merge(arr, add_arr)
           end
           smallerize(arr)
         end
@@ -136,6 +136,7 @@ module Contrast
         def smallerize tags
           smallered = []
           curr = nil
+          tags.sort_by! { |tag| [tag.start_idx, tag.end_idx] }
           tags.each do |tag|
             if curr && tag.start_idx <= curr.end_idx
               curr.update_end(tag.end_idx) if tag.end_idx > curr.end_idx

data/lib/contrast/utils/telemetry.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/telemetry'
@@ -19,8 +19,10 @@ module Contrast
             "collects usage data in order to help us improve compatibility\n" \
             "and security coverage. The data is anonymous and does not contain application data. It is collected\n" \
             "by Contrast and is never shared. You can opt-out of telemetry by setting the\n" \
-            "'CONTRAST_AGENT_TELEMETRY_OPTOUT' environment variable to '1' or 'true'.\n\n" \
-          "===================================================================================================\n\n"
+            "'CONTRAST_AGENT_TELEMETRY_OPTOUT' environment variable to '1' or 'true'.\n" \
+            'Read more about [Contrast Security] [Ruby Agent] telemetry: ' \
+            "https://docs.contrastsecurity.com/en/ruby-telemetry.html \n\n" \
+            "===================================================================================================\n\n"
       }.cs__freeze
 
       # Here we create the .telemetry file. If the file exist we do nothing.
@@ -55,22 +57,21 @@ module Contrast
           # So for the MacOS we would use the config directory of the instrumented application.
           @dir = config_dir if Contrast::Utils::OS.mac?
           return false if File.file? @dir + file
+          return true if touch_marker(@dir, file)
 
-          begin
-            return true if touch @dir, file # rubocop:disable Rails/SkipsModelValidations
-          rescue Errno::EROFS
-            # If we don't have permission to write to root directory use config instead
-            return true if touch config_dir, file # rubocop:disable Rails/SkipsModelValidations
-          end
+          # If we don't have permission to write to root directory use config instead
+          touch_marker(config_dir, file)
         end
 
         # Touches .telemetry file
         #
         # @return[Boolean] true if success, false if fails
-        def touch dir, file
+        def touch_marker dir, file
           FileUtils.mkdir_p dir unless Dir.exist? dir
           FileUtils.touch dir + file
           File.file? dir + file
+        rescue StandardError => _e
+          false
         end
       end
     end

data/lib/contrast/utils/telemetry_client.rb

@@ -0,0 +1,90 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'net/http'
+require 'contrast/utils/net_http_base'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/agent/version'
+require 'json'
+
+module Contrast
+  module Utils
+    # This module creates a Net::HTTP client and initiates a connection to the provided result
+    class TelemetryClient < NetHttpBase
+      ENDPOINT = 'api/v1/telemetry/metrics' # /TelemetryEvent.path
+      SERVICE_NAME = 'Telemetry'
+      include Contrast::Components::Logger::InstanceMethods
+      # This method initializes the Net::HTTP client we'll need. it will validate
+      # the connection and make the first request. If connection is valid and response
+      # is available then the open connection is returned.
+      #
+      # @param url [String]
+      # @return [Net::HTTP, nil] Return open connection or nil
+      def initialize_connection url
+        super(SERVICE_NAME, url, false, false)
+      end
+
+      # This method will be responsible for building the request. Because the telemetry collector expects to receive
+      # multiple events in a single request, we must always wrap the event in an array, even if there is only one.
+      #
+      # @param event [Contrast::Agent::TelemetryEvent,Contrast::Agent::StartupMetricsTelemetryEvent]
+      # @return [Net::HTTP::Post]
+      def build_request event
+        return unless valid_event? event
+
+        string_body = [event.to_hash].to_json
+        header = {
+            'User-Agent' => "<#{ Contrast::Utils::ObjectShare::RUBY }>-<#{ Contrast::Agent::VERSION }>",
+            'Content-Type' => 'application/json'
+        }
+        request = Net::HTTP::Post.new(build_path(event.path), header)
+        request.body = string_body
+        request
+      end
+
+      # This method will create the actual request and send it
+      # @param event[Contrast::Agent::TelemetryEvent]
+      # @param connection[Net::HTTP]
+      def send_request event, connection
+        return if connection.nil? || event.nil?
+        return unless valid_event? event
+
+        req = build_request event
+        connection.request req
+      end
+
+      # This method will handle the response from the tenant
+      # @param res [Net::HTTPResponse]
+      # @return sleep_time [Integer, nil]
+      def handle_response res
+        status_code = res.code.to_i
+        ready_after = if res.to_hash.keys.map(&:downcase).include?('ready-after')
+                        res['Ready-After']
+                      else
+                        60
+                      end
+        ready_after if status_code == 429
+      end
+
+      # This method will be responsible for validating the event
+      # @param event[Contrast::Agent::TelemetryEvent,Contrast::Agent::StartupMetricsTelemetryEvent]
+      def valid_event? event
+        return true if event.cs__is_a?(Contrast::Agent::TelemetryEvent)
+        return true if event.cs__is_a?(Contrast::Agent::StartupMetricsTelemetryEvent)
+
+        false
+      end
+
+      private
+
+      # The telemetry instance accepts any path to #{ Contrast::Agent::Telemetry::URL }#{ ENDPOINT }, using the
+      # remainder of the path to segregate messages.
+      #
+      # @return [String] the fully qualified path to send the request
+      def build_path event_path
+        "#{ Contrast::Agent::Telemetry::URL }#{ ENDPOINT }#{ event_path }"
+      end
+    end
+  end
+end

data/lib/contrast/utils/telemetry_identifier.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/telemetry'
@@ -34,11 +34,8 @@ module Contrast
         # @return [String, nil] MAC address of the primary network interface or
         # the first available one, or nil if nothing found
         def self.mac
-          @_mac = find_mac MAC_OS_PRIMARY if Contrast::Utils::OS.mac? && @_mac.nil?
-          @_mac = find_mac LINUX_PRIMARY if Contrast::Utils::OS.linux? && @_mac.nil?
-          # or find any available
-          @_mac = find_mac if @_mac.nil?
-          @_mac
+          primary = Contrast::Utils::OS.mac? ? MAC_OS_PRIMARY : LINUX_PRIMARY
+          @_mac = find_mac(primary) || find_mac
         end
 
         class << self
@@ -60,13 +57,15 @@ module Contrast
             while idx < interfaces.length
               addr = interfaces[idx].addr
               name = interfaces[idx].name # rubocop:disable Security/Module/Name
-              # retrieving MAC address from primary network interface or first available
-              mac = retrieve_mac name, addr, primary
               idx += 1
+              next if primary && !name.include?(primary)
+
+              # retrieving MAC address from primary network interface or first available
+              mac = retrieve_mac addr
               next unless mac
 
               result = mac if mac && (mac.match? MAC_REGEX)
-              break if result && !primary
+              break if result
             end
             result
           end
@@ -74,35 +73,26 @@ module Contrast
           # Retrieves MAC address for primary or any network interface.
           # This is OS dependent search.
           #
-          # @param name [Sting] interface name of ifaddr
           # @param addr [String] address info
           # example: #<Addrinfo: LINK[en0 aa:bb:cc:00:11:22]>
-          # @param primary [nil, String] optional param if set look only for primary
-          # network adapter's name
           # @return mac [nil, String] MAC address of primary network interface,
           # any network interface, or nil if no interface is found.
-          def retrieve_mac name, addr, primary
-            mac = nil
+          def retrieve_mac addr
             # Mac OS allow us to use getnameinfo(sockaddr [, flags]) => [hostname, servicename]
             #
             # returned address:
             # <Socket::Ifaddr en0 UP,BROADCAST,RUNNING,NOTRAILERS,SIMPLEX,MULTICAST LINK[en0 aa:bb:cc:00:11:22]>
-            if Contrast::Utils::OS.mac?
-              mac = addr.getnameinfo[0] unless primary
-              mac = addr.getnameinfo[0] if primary && name.include?(primary)
-            end
+            return addr.getnameinfo[0] if Contrast::Utils::OS.mac?
+
             # In Linux using Socket::addr#getnameinfo results in ai_family not supported exception.
             # In this case we are relying on match filtering of addresses.
             #
             # returned address:
             # #<Socket::Ifaddr eth0 UP,BROADCAST,RUNNING,MULTICAST,0x10000
             # PACKET[protocol=0 eth0 hatype=1 HOST hwaddr=aa:bb:cc:00:11:22]>
-            if primary && Contrast::Utils::OS.linux?
-              mac = Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG && name.include?(primary)
-            elsif primary.nil? && Contrast::Utils::OS.linux?
-              mac = Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG
-            end
-            mac
+            return Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG
+
+            nil
           end
 
           # Returns array of network interfaces.
@@ -111,7 +101,10 @@ module Contrast
           # @return interfaces [Array] Returns an array of interface addresses.
           # Socket::Ifaddr - represents a result of getifaddrs().
           def interfaces
-            @_interfaces = []
+            @_interfaces ||= []
+
+            return @_interfaces unless @_interfaces.empty?
+
             arr = Socket.getifaddrs
             idx = 0
             check_family = 0

data/lib/contrast/utils/thread_tracker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/timer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast-agent.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # We need this to make bundler happy since it's the name of the gem, unless we

data/lib/contrast.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Used to prevent deprecation warnings from flooding stdout

data/ruby-agent.gemspec

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require_relative './lib/contrast/agent/version'
@@ -22,7 +22,7 @@ end
 def self.add_dev_dependencies spec
   add_builders(spec)
   add_debuggers(spec)
-  add_linters(spec) # if RUBY_VERSION >= '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+  add_linters(spec)
   add_specs(spec)
   add_custom_dependencies(spec)
 end
@@ -59,7 +59,7 @@ def self.add_linters spec
   spec.add_development_dependency 'debride', '1.8.2'
   spec.add_development_dependency 'fasterer', '0.9.0'
   spec.add_development_dependency 'flay', '2.12.1'
-  # spec.add_development_dependency 'steep', '0.44.1' # TODO: RUBY-714 uncomment w/ EOL of 2.5
+  spec.add_development_dependency 'steep', '0.44.1'
   add_rubocop(spec)
 end
 
@@ -89,11 +89,11 @@ end
 
 # Dependencies used to run all of our Rubocop during the linting phase.
 def self.add_rubocop spec
-  spec.add_development_dependency 'rubocop', '1.13.0'
-  spec.add_development_dependency 'rubocop-performance', '1.11.0'
-  spec.add_development_dependency 'rubocop-rails', '2.9.1'
-  spec.add_development_dependency 'rubocop-rake', '0.5.1'
-  spec.add_development_dependency 'rubocop-rspec', '2.2.0'
+  spec.add_development_dependency 'rubocop', '1.22.3'
+  spec.add_development_dependency 'rubocop-performance', '1.12.0'
+  spec.add_development_dependency 'rubocop-rails', '2.12.4'
+  spec.add_development_dependency 'rubocop-rake', '0.6.0'
+  spec.add_development_dependency 'rubocop-rspec', '2.6.0'
 end
 
 # Dependencies not mocked out during RSpec that we test real code of, beyond just frameworks.
@@ -113,7 +113,6 @@ end
 # corresponding update to the fake gem server data in TeamServer.
 def self.add_dependencies spec
   spec.add_dependency 'ougai', '~> 1.8'
-  spec.add_dependency 'parser', '>= 2.6' # if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
   spec.add_dependency 'protobuf', '~> 3.10'
   spec.add_dependency 'rack', '~> 2.0'
 end
@@ -174,7 +173,7 @@ Gem::Specification.new do |spec|
     'Testing and Protection.'
   spec.homepage     = 'https://www.contrastsecurity.com'
   spec.license      = 'CONTRAST SECURITY (see license file)'
-  spec.required_ruby_version = ['>= 2.5.0', '< 3.1.0']
+  spec.required_ruby_version = ['>= 2.6.0', '< 3.1.0']
 
   spec.bindir        = 'exe'
   spec.executables   = ['contrast_service']