contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/agent/patching/policy/method_policy_extend.rb

@@ -0,0 +1,113 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Patching
+      module Policy
+        # This class is used to map each method to the trigger node that applies to it
+        module MethodPolicyExtend
+          # Given a Contrast::Agent::Patching::Policy::ModulePolicy, parse
+          # out its information for the given method in order to construct a
+          # Contrast::Agent::Patching::Policy::MethodPolicy
+          #
+          # @param method_name [Symbol] the name of the method for this policy
+          # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy]
+          #   the entire policy for this module
+          # @param instance_method [Boolean] true if this method is an
+          #   instance method
+          # @return [Contrast::Agent::Patching::Policy::MethodPolicy]
+          def build_method_policy method_name, module_policy, instance_method
+            source_node =      find_method_node(module_policy.source_nodes, method_name, instance_method)
+            propagation_node = find_method_node(module_policy.propagator_nodes, method_name, instance_method)
+            trigger_node =     find_method_node(module_policy.trigger_nodes, method_name, instance_method)
+            protect_node =     find_method_node(module_policy.protect_nodes, method_name, instance_method)
+            inventory_node =   find_method_node(module_policy.inventory_nodes, method_name, instance_method)
+            deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
+            method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
+                                                inventory_node, deadzone_node)
+            method_policy = MethodPolicy.new({
+                                                 method_name: method_name,
+                                                 method_visibility: method_visibility,
+                                                 instance_method: instance_method,
+                                                 source_node: source_node,
+                                                 propagation_node: propagation_node,
+                                                 trigger_node: trigger_node,
+                                                 protect_node: protect_node,
+                                                 inventory_node: inventory_node,
+                                                 deadzone_node: deadzone_node
+                                             })
+
+            return method_policy unless check_method_policy_nodes_empty? source_node, propagation_node, trigger_node,
+                                                                         protect_node, inventory_node, deadzone_node
+
+            create_new_node(module_policy, method_policy) if module_policy.deadzone_nodes&.any?
+            method_policy
+          end
+
+          def find_method_node nodes, method_name, is_instance_method
+            return unless nodes
+
+            nodes.find do |node|
+              node.instance_method? == is_instance_method && node.method_name == method_name
+            end
+          end
+
+          def find_visibility *nodes
+            nodes.find { |node| node }&.method_visibility
+          end
+
+          def check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node, protect_node,
+                                               inventory_node, deadzone_node)
+            return false unless source_node.nil? && propagation_node.nil? && trigger_node.nil? && protect_node.nil? &&
+                inventory_node.nil? && deadzone_node.nil?
+
+            true
+          end
+
+          private
+
+          def create_new_node module_policy, method_policy
+            return if module_policy.deadzone_nodes.empty?
+
+            module_policy.deadzone_nodes.map do |node|
+              next unless node.method_name.nil?
+
+              klass = Module.cs__const_get(node.class_name)
+              next unless it_defined? klass, method_policy.method_name
+
+              new_node = set_new_node method_policy, klass, node
+              method_policy.instance_variable_set(:@method_visibility, new_node.method_visibility)
+              method_policy.instance_variable_set(:@deadzone_node, node)
+              module_policy.deadzone_nodes << new_node
+              break unless method_policy.deadzone_node.nil?
+            end
+          end
+
+          # Helper method for creating new node
+          #
+          # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
+          #   used to map each method to the trigger node that applies to it
+          # @param klass [String] classname
+          # @param node [Contrast::Agent::Patching::Policy::PolicyNode]
+          # @return @_set_new_node [Contrast::Agent::Deadzone::Policy::DeadzoneNode]
+          def set_new_node method_policy, klass, node
+            new_node = {}
+            new_node['instance_method'] = method_policy.instance_method
+            new_node['method_visibility'] =
+              klass.private_method_defined?(method_policy.method_name) ? 'private' : 'public'
+            new_node['method_name'] = method_policy.method_name
+            new_node['class_name'] = node.class_name
+            @_set_new_node = Contrast::Agent::Deadzone::Policy::DeadzoneNode.new(new_node)
+          end
+
+          def it_defined? klass, method_name
+            klass.instance_methods(false).include?(method_name) ||
+                klass.private_instance_methods(false).include?(method_name) ||
+                klass.singleton_methods(false).include?(method_name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'

data/lib/contrast/agent/patching/policy/patch_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -125,7 +125,7 @@ module Contrast
             MOD_ARRAY = [Module].cs__freeze
           end
 
-          attr_reader :patch_status, :rewrite_status
+          attr_reader :patch_status
 
           def patching!
             @patch_status = :PATCHING
@@ -154,30 +154,6 @@ module Contrast
           def patched?
             @patch_status == :PATCHED || @patch_status == :NONE || @patch_status == :FAILED
           end
-
-          def rewriting!
-            @rewrite_status = :REWRITING
-          end
-
-          def no_rewrite!
-            @rewrite_status = :NO_REWRITE
-          end
-
-          def rewritten!
-            @rewrite_status = :REWRITTEN
-          end
-
-          def failed_rewrite!
-            @rewrite_status = :FAILED_REWRITE
-          end
-
-          def rewriting?
-            @rewrite_status == :REWRITING
-          end
-
-          def rewritten?
-            @rewrite_status == :REWRITTEN || @rewrite_status == :NO_REWRITE || @rewrite_status == :FAILED_REWRITE
-          end
         end
       end
     end

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'
@@ -15,8 +15,6 @@ require 'contrast/utils/patching/policy/patcher_utils'
 # assess
 require 'contrast/agent/assess/policy/policy'
 require 'contrast/agent/assess/policy/policy_scanner'
-# TODO: RUBY-714 remove guard w/ EOL of 2.5
-require 'contrast/agent/assess/policy/rewriter_patch' if RUBY_VERSION < '2.6.0'
 require 'contrast/agent/assess/policy/source_method'
 require 'contrast/agent/assess/policy/trigger_method'
 
@@ -56,8 +54,6 @@ module Contrast
             def patch
               catchup_after_load_patches
               catchup_loaded_methods
-              # TODO: RUBY-714 remove guard w/ EOL of 2.5
-              Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations if RUBY_VERSION < '2.6.0'
             end
 
             # Hook to only monkeypatch Contrast. This will not trigger any
@@ -151,6 +147,18 @@ module Contrast
                 return
               end
 
+              patch_methods status, module_data, module_policy
+            rescue StandardError => e
+              status&.failed_patch!
+              logger.warn('Patching failed', e, module: module_data.mod_name)
+            ensure
+              logger.trace('Patching complete',
+                           module: module_data.mod_name,
+                           result:
+                             Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod).patch_status)
+            end
+
+            def patch_methods status, module_data, module_policy
               status.patching!
               num_applied_patches = patch_into_instance_methods(module_data, module_policy)
               num_applied_patches += patch_into_singleton_methods(module_data, module_policy)
@@ -160,14 +168,6 @@ module Contrast
               else
                 status.partial_patch!
               end
-            rescue StandardError => e
-              status&.failed_patch!
-              logger.warn('Patching failed', e, module: module_data.mod_name)
-            ensure
-              logger.trace('Patching complete',
-                           module: module_data.mod_name,
-                           result:
-                             Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod).patch_status)
             end
 
             # Get all of the instance methods on the given module, excluding

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'json'

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/cmd_injection'

data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/deserialization'

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/no_sqli'

data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/path_traversal'

data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/sqli'

data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/xxe'

data/lib/contrast/agent/protect/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy'

data/lib/contrast/agent/protect/policy/rule_applicator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/protect/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/trigger_node'

data/lib/contrast/agent/protect/rule/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule/cmd_injection.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # The base class used to determine if a user input crosses a token boundary or

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/sql_sample_builder.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This class is the concrete implementation of the DefaultSqlScanner designed

data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/reaction_processor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/disable_reaction'

data/lib/contrast/agent/reporting/report.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # This is the base module for our reporting functionality. It is intended to
+    # facilitate all the needed report generating functionality and eventual
+    # report to RS.
+    # Any class under this namespace should be required here, providing a
+    # single point of require for this functionality.
+    module Reporting
+    end
+  end
+end
+
+require 'contrast/agent/reporting/reporter'
+require 'contrast/agent/reporting/reporting_utilities/audit'
+require 'contrast/agent/reporting/reporting_utilities/reporter_client'
+require 'contrast/agent/reporting/reporting_utilities/response_handler'
+require 'contrast/agent/reporting/reporting_utilities/response'
+# Events
+require 'contrast/agent/reporting/reporting_events/finding'
+require 'contrast/agent/reporting/reporting_events/preflight_message'
+require 'contrast/agent/reporting/reporting_events/preflight'
+require 'contrast/agent/reporting/reporting_events/observed_route'
+require 'contrast/agent/reporting/reporting_events/route_coverage'
+require 'contrast/agent/reporting/reporting_events/observed_library_usage'

data/lib/contrast/agent/reporting/reporter.rb

@@ -0,0 +1,115 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/worker_thread'
+require 'contrast/agent/reporting/report'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    # This module will hold everything essential to reporting to TeamServer
+    class Reporter < WorkerThread
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Utils::ObjectShare
+      # 15 min
+      TIMEOUT = 900.cs__freeze
+
+      class << self
+        # check if we can report to TS
+        #
+        # @return[Boolean] true if bypass is enabled, or false if bypass disabled
+        def enabled?
+          @_enabled = Contrast::CONTRAST_SERVICE.use_agent_communication? if @_enabled.nil?
+          @_enabled
+        end
+      end
+
+      def client
+        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
+      end
+
+      def connection
+        @_connection ||= client.initialize_connection
+      end
+
+      def audit
+        @_audit ||= Contrast::Agent::Reporting::Audit.new
+      end
+
+      def attempt_to_start?
+        unless cs__class.enabled?
+          logger.warn('Reporter service is disabled!')
+          return false
+        end
+
+        logger.debug('Attempting to start Reporter thread') unless running?
+        true
+      end
+
+      def start_thread!
+        return if running?
+
+        client.startup!(connection)
+        @_thread = Contrast::Agent::Thread.new do
+          logger.debug('Starting background Reporter thread.')
+          loop do
+            event = queue.pop
+            begin
+              response = client.send_event(event, connection)
+              audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
+            rescue StandardError => e
+              logger.error('Could not send message to service from Reporter queue.', e)
+            end
+            sleep(TIMEOUT) if client.sleep?
+            client.wake_up
+          end
+        end
+      end
+
+      def send_event event
+        if ::Contrast::AGENT.disabled?
+          logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
+          return
+        end
+        return unless event
+        return unless cs__class.enabled?
+
+        logger.debug('Enqueued event for sending', event_type: event.cs__class)
+        audit&.audit_event(event) if ::Contrast::API.request_audit_enable?
+        queue << event
+      end
+
+      # Use this to bypass the messaging queue and leave response processing to the caller
+      def send_event_immediately event
+        if ::Contrast::AGENT.disabled?
+          logger.warn('Reporter attempted to send event immediately with Agent disabled', caller: caller, event: event)
+          return
+        end
+        response = client.send_event(event, connection, true)
+        client.send(:handle_response, event, response, connection) if response&.code == 200
+        audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
+      rescue StandardError => e
+        logger.error('Could not send message to service from Reporter queue.', e)
+      end
+
+      def delete_queue!
+        @_queue&.clear
+        @_queue&.close
+        @_queue = nil
+      end
+
+      def stop!
+        return unless running?
+
+        super
+        delete_queue!
+      end
+
+      private
+
+      def queue
+        @_queue ||= Queue.new
+      end
+    end
+  end
+end