contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/utils/string_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -7,84 +7,86 @@ module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
-      include Contrast::Components::Logger::InstanceMethods
+      class << self
+        include Contrast::Components::Logger::InstanceMethods
 
-      UTF8 = 'utf-8'
-      HTTP_PREFIX = 'HTTP_'
+        UTF8 = 'utf-8'
+        HTTP_PREFIX = 'HTTP_'
 
-      # Convenience method. We assume that we're working on Strings or tags
-      # String representations of things. To that end, we'll to_s anything
-      # that comes in before returning its length.
-      #
-      # But don't worry though, String.to_s just returns self. teehee
-      def self.ret_length string
-        string.nil? ? 0 : string.to_s.length
-      end
+        # Convenience method. We assume that we're working on Strings or tags
+        # String representations of things. To that end, we'll to_s anything
+        # that comes in before returning its length.
+        #
+        # But don't worry though, String.to_s just returns self. teehee
+        def ret_length string
+          string.nil? ? 0 : string.to_s.length
+        end
 
-      def self.present? str
-        !str.nil? && !str.to_s.empty?
-      end
+        def present? str
+          !str.nil? && !str.to_s.empty?
+        end
 
-      def self.protobuf_format data, truncate: true
-        data = data&.to_s
-        data = Contrast::Utils::StringUtils.force_utf8(data)
-        data = Contrast::Utils::StringUtils.truncate(data) if truncate
-        data
-      end
+        def protobuf_format data, truncate: true
+          data = data&.to_s
+          data = Contrast::Utils::StringUtils.force_utf8(data)
+          data = Contrast::Utils::StringUtils.truncate(data) if truncate
+          data
+        end
 
-      # Protobuf has a very strict typing. Nil is not a String and will throw
-      # an exception if you try to set it. Use this to be safe.
-      # Uses the object share to avoid creating several new strings per request
-      def self.protobuf_safe_string string
-        string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
-      end
+        # Protobuf has a very strict typing. Nil is not a String and will throw
+        # an exception if you try to set it. Use this to be safe.
+        # Uses the object share to avoid creating several new strings per request
+        def protobuf_safe_string string
+          string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
+        end
 
-      # Truncate a string to 255 characters max length
-      def self.truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
-        return default if str.nil?
+        # Truncate a string to 255 characters max length
+        def truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
+          return default if str.nil?
 
-        str.to_s[0..255]
-      end
+          str.to_s[0..255]
+        end
 
-      def self.force_utf8 str
-        return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
+        def force_utf8 str
+          return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
 
-        str = str.to_s
-        if str.encoding == Encoding::UTF_8
-          str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
-        else
-          str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
-        end
-        str.to_s
-      rescue StandardError => e
-        # We were unable to switch the String to a UTF-8 format.
-        # Return non-nil so as not to throw an exception later when trying
-        # to do regexp or other compares on the String
-        logger.trace('Unable to cast String to UTF-8 format', e, value: str)
+          str = str.to_s
+          if str.encoding == Encoding::UTF_8
+            str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
+          else
+            str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
+          end
+          str.to_s
+        rescue StandardError => e
+          # We were unable to switch the String to a UTF-8 format.
+          # Return non-nil so as not to throw an exception later when trying
+          # to do regexp or other compares on the String
+          logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
-        Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
+          Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
 
-      # Given a string return a normalized version of that string.
-      # Keys are memoized so that the normalization process doesn't need
-      # to happen every time.
-      #
-      # @param str [String] the String to normalize
-      # @return [String] a copy of the given String, upper cased, trimmed,
-      #   dashes replaced with underscore, and HTTP trimmed
-      def self.normalized_key str
-        return unless str
+        # Given a string return a normalized version of that string.
+        # Keys are memoized so that the normalization process doesn't need
+        # to happen every time.
+        #
+        # @param str [String] the String to normalize
+        # @return [String] a copy of the given String, upper cased, trimmed,
+        #   dashes replaced with underscore, and HTTP trimmed
+        def normalized_key str
+          return unless str
 
-        str = str.to_s
-        @_normalized_keys ||= {}
-        if @_normalized_keys.key?(str)
-          @_normalized_keys[str]
-        else
-          upped = str.upcase
-          stripped = upped.strip! || upped
-          trimmed = stripped.tr!('-', '_') || stripped
-          cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..-1] : trimmed
-          @_normalized_keys[str] = cut
+          str = str.to_s
+          @_normalized_keys ||= {}
+          if @_normalized_keys.key?(str)
+            @_normalized_keys[str]
+          else
+            upped = str.upcase
+            stripped = upped.strip! || upped
+            trimmed = stripped.tr!('-', '_') || stripped
+            cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..] : trimmed
+            @_normalized_keys[str] = cut
+          end
         end
       end
     end

data/lib/contrast/utils/tag_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -56,20 +56,20 @@ module Contrast
         # Any overlapping ranges are merged before returning
         #
         # arr: the array of tags to which we are adding
-        # new_arr: misnomer. either an array of or a single Tag to be added
-        def ordered_merge arr, new_arr
+        # add_arr:  array of Tags or a single Tag to be added
+        def ordered_merge arr, add_arr
           # [Contrast::Agent::Assess::Tag, ...]
-          if new_arr.is_a?(Array)
-            return arr unless new_arr.any?
-            return new_arr unless arr&.any?
+          if add_arr.is_a?(Array)
+            return arr unless add_arr.any?
+            return add_arr unless arr&.any?
 
-            new_arr.each { |new_element| single_ordered_merge(arr, new_element) }
+            add_arr.each { |new_element| single_ordered_merge(arr, new_element) }
           # Contrast::Agent::Assess::Tag
           else
-            return arr unless new_arr
-            return [new_arr] unless arr
+            return arr unless add_arr
+            return [add_arr] unless arr
 
-            single_ordered_merge(arr, new_arr)
+            single_ordered_merge(arr, add_arr)
           end
           smallerize(arr)
         end
@@ -136,6 +136,7 @@ module Contrast
         def smallerize tags
           smallered = []
           curr = nil
+          tags.sort_by! { |tag| [tag.start_idx, tag.end_idx] }
           tags.each do |tag|
             if curr && tag.start_idx <= curr.end_idx
               curr.update_end(tag.end_idx) if tag.end_idx > curr.end_idx

data/lib/contrast/utils/telemetry.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/telemetry'
@@ -19,8 +19,10 @@ module Contrast
             "collects usage data in order to help us improve compatibility\n" \
             "and security coverage. The data is anonymous and does not contain application data. It is collected\n" \
             "by Contrast and is never shared. You can opt-out of telemetry by setting the\n" \
-            "'CONTRAST_AGENT_TELEMETRY_OPTOUT' environment variable to '1' or 'true'.\n\n" \
-          "===================================================================================================\n\n"
+            "'CONTRAST_AGENT_TELEMETRY_OPTOUT' environment variable to '1' or 'true'.\n" \
+            'Read more about [Contrast Security] [Ruby Agent] telemetry: ' \
+            "https://docs.contrastsecurity.com/en/ruby-telemetry.html \n\n" \
+            "===================================================================================================\n\n"
       }.cs__freeze
 
       # Here we create the .telemetry file. If the file exist we do nothing.

data/lib/contrast/utils/telemetry_client.rb

@@ -0,0 +1,90 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'net/http'
+require 'contrast/utils/net_http_base'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/agent/version'
+require 'json'
+
+module Contrast
+  module Utils
+    # This module creates a Net::HTTP client and initiates a connection to the provided result
+    class TelemetryClient < NetHttpBase
+      ENDPOINT = 'api/v1/telemetry/metrics' # /TelemetryEvent.path
+      SERVICE_NAME = 'Telemetry'
+      include Contrast::Components::Logger::InstanceMethods
+      # This method initializes the Net::HTTP client we'll need. it will validate
+      # the connection and make the first request. If connection is valid and response
+      # is available then the open connection is returned.
+      #
+      # @param url [String]
+      # @return [Net::HTTP, nil] Return open connection or nil
+      def initialize_connection url
+        super(SERVICE_NAME, url, false, false)
+      end
+
+      # This method will be responsible for building the request. Because the telemetry collector expects to receive
+      # multiple events in a single request, we must always wrap the event in an array, even if there is only one.
+      #
+      # @param event [Contrast::Agent::TelemetryEvent,Contrast::Agent::StartupMetricsTelemetryEvent]
+      # @return [Net::HTTP::Post]
+      def build_request event
+        return unless valid_event? event
+
+        string_body = [event.to_hash].to_json
+        header = {
+            'User-Agent' => "<#{ Contrast::Utils::ObjectShare::RUBY }>-<#{ Contrast::Agent::VERSION }>",
+            'Content-Type' => 'application/json'
+        }
+        request = Net::HTTP::Post.new(build_path(event.path), header)
+        request.body = string_body
+        request
+      end
+
+      # This method will create the actual request and send it
+      # @param event[Contrast::Agent::TelemetryEvent]
+      # @param connection[Net::HTTP]
+      def send_request event, connection
+        return if connection.nil? || event.nil?
+        return unless valid_event? event
+
+        req = build_request event
+        connection.request req
+      end
+
+      # This method will handle the response from the tenant
+      # @param res [Net::HTTPResponse]
+      # @return sleep_time [Integer, nil]
+      def handle_response res
+        status_code = res.code.to_i
+        ready_after = if res.to_hash.keys.map(&:downcase).include?('ready-after')
+                        res['Ready-After']
+                      else
+                        60
+                      end
+        ready_after if status_code == 429
+      end
+
+      # This method will be responsible for validating the event
+      # @param event[Contrast::Agent::TelemetryEvent,Contrast::Agent::StartupMetricsTelemetryEvent]
+      def valid_event? event
+        return true if event.cs__is_a?(Contrast::Agent::TelemetryEvent)
+        return true if event.cs__is_a?(Contrast::Agent::StartupMetricsTelemetryEvent)
+
+        false
+      end
+
+      private
+
+      # The telemetry instance accepts any path to #{ Contrast::Agent::Telemetry::URL }#{ ENDPOINT }, using the
+      # remainder of the path to segregate messages.
+      #
+      # @return [String] the fully qualified path to send the request
+      def build_path event_path
+        "#{ Contrast::Agent::Telemetry::URL }#{ ENDPOINT }#{ event_path }"
+      end
+    end
+  end
+end

data/lib/contrast/utils/telemetry_identifier.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/telemetry'
@@ -34,11 +34,8 @@ module Contrast
         # @return [String, nil] MAC address of the primary network interface or
         # the first available one, or nil if nothing found
         def self.mac
-          @_mac = find_mac MAC_OS_PRIMARY if Contrast::Utils::OS.mac? && @_mac.nil?
-          @_mac = find_mac LINUX_PRIMARY if Contrast::Utils::OS.linux? && @_mac.nil?
-          # or find any available
-          @_mac = find_mac if @_mac.nil?
-          @_mac
+          primary = Contrast::Utils::OS.mac? ? MAC_OS_PRIMARY : LINUX_PRIMARY
+          @_mac = find_mac(primary) || find_mac
         end
 
         class << self
@@ -60,13 +57,15 @@ module Contrast
             while idx < interfaces.length
               addr = interfaces[idx].addr
               name = interfaces[idx].name # rubocop:disable Security/Module/Name
-              # retrieving MAC address from primary network interface or first available
-              mac = retrieve_mac name, addr, primary
               idx += 1
+              next if primary && !name.include?(primary)
+
+              # retrieving MAC address from primary network interface or first available
+              mac = retrieve_mac addr
               next unless mac
 
               result = mac if mac && (mac.match? MAC_REGEX)
-              break if result && !primary
+              break if result
             end
             result
           end
@@ -74,35 +73,26 @@ module Contrast
           # Retrieves MAC address for primary or any network interface.
           # This is OS dependent search.
           #
-          # @param name [Sting] interface name of ifaddr
           # @param addr [String] address info
           # example: #<Addrinfo: LINK[en0 aa:bb:cc:00:11:22]>
-          # @param primary [nil, String] optional param if set look only for primary
-          # network adapter's name
           # @return mac [nil, String] MAC address of primary network interface,
           # any network interface, or nil if no interface is found.
-          def retrieve_mac name, addr, primary
-            mac = nil
+          def retrieve_mac addr
             # Mac OS allow us to use getnameinfo(sockaddr [, flags]) => [hostname, servicename]
             #
             # returned address:
             # <Socket::Ifaddr en0 UP,BROADCAST,RUNNING,NOTRAILERS,SIMPLEX,MULTICAST LINK[en0 aa:bb:cc:00:11:22]>
-            if Contrast::Utils::OS.mac?
-              mac = addr.getnameinfo[0] unless primary
-              mac = addr.getnameinfo[0] if primary && name.include?(primary)
-            end
+            return addr.getnameinfo[0] if Contrast::Utils::OS.mac?
+
             # In Linux using Socket::addr#getnameinfo results in ai_family not supported exception.
             # In this case we are relying on match filtering of addresses.
             #
             # returned address:
             # #<Socket::Ifaddr eth0 UP,BROADCAST,RUNNING,MULTICAST,0x10000
             # PACKET[protocol=0 eth0 hatype=1 HOST hwaddr=aa:bb:cc:00:11:22]>
-            if primary && Contrast::Utils::OS.linux?
-              mac = Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG && name.include?(primary)
-            elsif primary.nil? && Contrast::Utils::OS.linux?
-              mac = Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG
-            end
-            mac
+            return Regexp.last_match(1) if addr.inspect =~ LINUX_OS_REG
+
+            nil
           end
 
           # Returns array of network interfaces.
@@ -111,7 +101,10 @@ module Contrast
           # @return interfaces [Array] Returns an array of interface addresses.
           # Socket::Ifaddr - represents a result of getifaddrs().
           def interfaces
-            @_interfaces = []
+            @_interfaces ||= []
+
+            return @_interfaces unless @_interfaces.empty?
+
             arr = Socket.getifaddrs
             idx = 0
             check_family = 0

data/lib/contrast/utils/thread_tracker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/timer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast-agent.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # We need this to make bundler happy since it's the name of the gem, unless we

data/lib/contrast.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Used to prevent deprecation warnings from flooding stdout

data/resources/assess/policy.json

@@ -634,6 +634,16 @@
       "source":"O",
       "target":"R",
       "action":"REMOVE"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"match",
+      "source":"O",
+      "target":"R",
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "square_bracket_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,

data/ruby-agent.gemspec

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require_relative './lib/contrast/agent/version'
@@ -22,7 +22,7 @@ end
 def self.add_dev_dependencies spec
   add_builders(spec)
   add_debuggers(spec)
-  add_linters(spec) # if RUBY_VERSION >= '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+  add_linters(spec)
   add_specs(spec)
   add_custom_dependencies(spec)
 end
@@ -59,7 +59,7 @@ def self.add_linters spec
   spec.add_development_dependency 'debride', '1.8.2'
   spec.add_development_dependency 'fasterer', '0.9.0'
   spec.add_development_dependency 'flay', '2.12.1'
-  # spec.add_development_dependency 'steep', '0.44.1' # TODO: RUBY-714 uncomment w/ EOL of 2.5
+  spec.add_development_dependency 'steep', '0.47.0'
   add_rubocop(spec)
 end
 
@@ -89,11 +89,11 @@ end
 
 # Dependencies used to run all of our Rubocop during the linting phase.
 def self.add_rubocop spec
-  spec.add_development_dependency 'rubocop', '1.13.0'
-  spec.add_development_dependency 'rubocop-performance', '1.11.0'
-  spec.add_development_dependency 'rubocop-rails', '2.9.1'
-  spec.add_development_dependency 'rubocop-rake', '0.5.1'
-  spec.add_development_dependency 'rubocop-rspec', '2.2.0'
+  spec.add_development_dependency 'rubocop', '1.22.3'
+  spec.add_development_dependency 'rubocop-performance', '1.12.0'
+  spec.add_development_dependency 'rubocop-rails', '2.12.4'
+  spec.add_development_dependency 'rubocop-rake', '0.6.0'
+  spec.add_development_dependency 'rubocop-rspec', '2.6.0'
 end
 
 # Dependencies not mocked out during RSpec that we test real code of, beyond just frameworks.
@@ -113,7 +113,6 @@ end
 # corresponding update to the fake gem server data in TeamServer.
 def self.add_dependencies spec
   spec.add_dependency 'ougai', '~> 1.8'
-  spec.add_dependency 'parser', '>= 2.6' # if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
   spec.add_dependency 'protobuf', '~> 3.10'
   spec.add_dependency 'rack', '~> 2.0'
 end
@@ -174,7 +173,7 @@ Gem::Specification.new do |spec|
     'Testing and Protection.'
   spec.homepage     = 'https://www.contrastsecurity.com'
   spec.license      = 'CONTRAST SECURITY (see license file)'
-  spec.required_ruby_version = ['>= 2.5.0', '< 3.1.0']
+  spec.required_ruby_version = ['>= 2.6.0', '< 3.1.0']
 
   spec.bindir        = 'exe'
   spec.executables   = ['contrast_service']