contrast-agent 4.14.1 → 5.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (389) hide show
  1. checksums.yaml +4 -4
  2. data/.simplecov +1 -1
  3. data/Gemfile +1 -1
  4. data/LICENSE.txt +1 -1
  5. data/Rakefile +1 -1
  6. data/exe/contrast_service +1 -1
  7. data/ext/build_funchook.rb +1 -1
  8. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  9. data/ext/cs__assess_array/extconf.rb +1 -1
  10. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  11. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  12. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  13. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  14. data/ext/cs__assess_hash/cs__assess_hash.c +1 -1
  15. data/ext/cs__assess_hash/extconf.rb +1 -1
  16. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  17. data/ext/cs__assess_kernel/extconf.rb +1 -1
  18. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  19. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  20. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  21. data/ext/cs__assess_module/extconf.rb +1 -1
  22. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  23. data/ext/cs__assess_regexp/extconf.rb +1 -1
  24. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  25. data/ext/cs__assess_string/extconf.rb +1 -1
  26. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  27. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  28. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  29. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  30. data/ext/cs__common/cs__common.c +1 -1
  31. data/ext/cs__common/extconf.rb +1 -1
  32. data/ext/cs__contrast_patch/cs__contrast_patch.c +1 -1
  33. data/ext/cs__contrast_patch/extconf.rb +1 -1
  34. data/ext/cs__os_information/cs__os_information.c +1 -1
  35. data/ext/cs__os_information/extconf.rb +1 -1
  36. data/ext/extconf_common.rb +1 -1
  37. data/lib/contrast/agent/assess/contrast_event.rb +7 -11
  38. data/lib/contrast/agent/assess/contrast_object.rb +1 -1
  39. data/lib/contrast/agent/assess/events/event_data.rb +30 -0
  40. data/lib/contrast/agent/assess/events/event_factory.rb +14 -6
  41. data/lib/contrast/agent/assess/events/source_event.rb +22 -3
  42. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  43. data/lib/contrast/agent/assess/finalizers/hash.rb +1 -1
  44. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +7 -7
  45. data/lib/contrast/agent/assess/policy/patcher.rb +1 -35
  46. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  47. data/lib/contrast/agent/assess/policy/policy_node.rb +2 -2
  48. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  49. data/lib/contrast/agent/assess/policy/preshift.rb +1 -1
  50. data/lib/contrast/agent/assess/policy/propagation_method.rb +55 -28
  51. data/lib/contrast/agent/assess/policy/propagation_node.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -1
  55. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +6 -2
  57. data/lib/contrast/agent/assess/policy/propagator/insert.rb +5 -2
  58. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  59. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +7 -3
  60. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  61. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb +1 -1
  63. data/lib/contrast/agent/assess/policy/propagator/remove.rb +1 -1
  64. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  65. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  66. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -2
  67. data/lib/contrast/agent/assess/policy/propagator/splat.rb +1 -1
  68. data/lib/contrast/agent/assess/policy/propagator/split.rb +27 -25
  69. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +3 -5
  70. data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb +190 -0
  71. data/lib/contrast/agent/assess/policy/propagator/trim.rb +9 -4
  72. data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/source_method.rb +39 -26
  74. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  75. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +1 -1
  76. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  77. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +7 -2
  78. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  79. data/lib/contrast/agent/assess/policy/trigger_method.rb +37 -24
  80. data/lib/contrast/agent/assess/policy/trigger_node.rb +1 -1
  81. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
  82. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  83. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +1 -1
  84. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -1
  85. data/lib/contrast/agent/assess/properties.rb +1 -1
  86. data/lib/contrast/agent/assess/property/evented.rb +25 -12
  87. data/lib/contrast/agent/assess/property/tagged.rb +1 -1
  88. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  89. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +1 -19
  90. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -13
  91. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +7 -59
  92. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  93. data/lib/contrast/agent/assess/rule/response/autocomplete_rule.rb +130 -0
  94. data/lib/contrast/agent/assess/rule/response/base_rule.rb +117 -0
  95. data/lib/contrast/agent/assess/tag.rb +1 -1
  96. data/lib/contrast/agent/assess/tracker.rb +1 -1
  97. data/lib/contrast/agent/assess.rb +1 -2
  98. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  99. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +13 -8
  100. data/lib/contrast/agent/deadzone/policy/policy.rb +1 -1
  101. data/lib/contrast/agent/disable_reaction.rb +1 -1
  102. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  103. data/lib/contrast/agent/inventory/database_config.rb +115 -77
  104. data/lib/contrast/agent/inventory/dependencies.rb +1 -1
  105. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  106. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +3 -3
  107. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  108. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  109. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  110. data/lib/contrast/agent/inventory.rb +1 -1
  111. data/lib/contrast/agent/metric_telemetry_event.rb +1 -1
  112. data/lib/contrast/agent/middleware.rb +3 -2
  113. data/lib/contrast/agent/module_data.rb +1 -1
  114. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  115. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +1 -1
  116. data/lib/contrast/agent/patching/policy/method_policy.rb +28 -15
  117. data/lib/contrast/agent/patching/policy/method_policy_extend.rb +12 -10
  118. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  119. data/lib/contrast/agent/patching/policy/patch.rb +1 -1
  120. data/lib/contrast/agent/patching/policy/patch_status.rb +2 -26
  121. data/lib/contrast/agent/patching/policy/patcher.rb +1 -5
  122. data/lib/contrast/agent/patching/policy/policy.rb +1 -1
  123. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  124. data/lib/contrast/agent/patching/policy/trigger_node.rb +1 -1
  125. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
  126. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
  127. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
  128. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -1
  129. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
  130. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
  131. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  132. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  133. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  134. data/lib/contrast/agent/protect/rule/base.rb +1 -1
  135. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  136. data/lib/contrast/agent/protect/rule/cmd_injection.rb +1 -1
  137. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  138. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  139. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  140. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -1
  141. data/lib/contrast/agent/protect/rule/no_sqli.rb +1 -1
  142. data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -1
  143. data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +1 -1
  144. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  145. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  146. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  147. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  148. data/lib/contrast/agent/protect/rule/sqli.rb +1 -1
  149. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  150. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  151. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -1
  152. data/lib/contrast/agent/protect/rule/xxe.rb +1 -1
  153. data/lib/contrast/agent/protect/rule.rb +1 -1
  154. data/lib/contrast/agent/reaction_processor.rb +1 -1
  155. data/lib/contrast/agent/reporting/report.rb +7 -1
  156. data/lib/contrast/agent/reporting/reporter.rb +21 -48
  157. data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb +49 -0
  158. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +82 -0
  159. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +80 -0
  160. data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +59 -0
  161. data/lib/contrast/agent/reporting/reporting_events/finding.rb +138 -43
  162. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +264 -0
  163. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +57 -0
  164. data/lib/contrast/agent/reporting/reporting_events/finding_object.rb +90 -0
  165. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +121 -0
  166. data/lib/contrast/agent/reporting/reporting_events/finding_signature.rb +105 -0
  167. data/lib/contrast/agent/reporting/reporting_events/finding_stack.rb +67 -0
  168. data/lib/contrast/agent/reporting/reporting_events/finding_taint_range.rb +58 -0
  169. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +93 -0
  170. data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +50 -0
  171. data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +54 -0
  172. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +66 -0
  173. data/lib/contrast/agent/reporting/reporting_events/preflight.rb +20 -6
  174. data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +36 -17
  175. data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +28 -18
  176. data/lib/contrast/agent/reporting/reporting_events/route_coverage.rb +76 -0
  177. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +66 -0
  178. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +65 -0
  179. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +52 -0
  180. data/lib/contrast/agent/reporting/reporting_events/trace_event_source.rb +30 -0
  181. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +22 -12
  182. data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +67 -0
  183. data/lib/contrast/agent/reporting/reporting_utilities/endpoints.rb +165 -0
  184. data/lib/contrast/agent/reporting/reporting_utilities/headers.rb +55 -0
  185. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +74 -156
  186. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +154 -0
  187. data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb +1 -1
  188. data/lib/contrast/agent/reporting/reporting_utilities/response.rb +30 -0
  189. data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +57 -0
  190. data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +196 -0
  191. data/lib/contrast/agent/reporting/settings/application_settings.rb +67 -0
  192. data/lib/contrast/agent/reporting/settings/assess.rb +45 -0
  193. data/lib/contrast/agent/reporting/settings/assess_server_feature.rb +136 -0
  194. data/lib/contrast/agent/reporting/settings/exclusions.rb +123 -0
  195. data/lib/contrast/agent/reporting/settings/protect.rb +89 -0
  196. data/lib/contrast/agent/reporting/settings/protect_server_feature.rb +243 -0
  197. data/lib/contrast/agent/reporting/settings/reaction.rb +30 -0
  198. data/lib/contrast/agent/reporting/settings/server_features.rb +78 -0
  199. data/lib/contrast/agent/request.rb +44 -3
  200. data/lib/contrast/agent/request_context.rb +20 -7
  201. data/lib/contrast/agent/request_context_extend.rb +26 -1
  202. data/lib/contrast/agent/request_handler.rb +41 -5
  203. data/lib/contrast/agent/response.rb +23 -15
  204. data/lib/contrast/agent/rule_set.rb +1 -1
  205. data/lib/contrast/agent/scope.rb +1 -1
  206. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  207. data/lib/contrast/agent/startup_metrics_telemetry_event.rb +34 -7
  208. data/lib/contrast/agent/static_analysis.rb +13 -3
  209. data/lib/contrast/agent/telemetry.rb +1 -1
  210. data/lib/contrast/agent/telemetry_event.rb +1 -1
  211. data/lib/contrast/agent/thread.rb +1 -1
  212. data/lib/contrast/agent/thread_watcher.rb +3 -3
  213. data/lib/contrast/agent/tracepoint_hook.rb +1 -4
  214. data/lib/contrast/agent/version.rb +2 -2
  215. data/lib/contrast/agent/worker_thread.rb +1 -1
  216. data/lib/contrast/agent.rb +4 -4
  217. data/lib/contrast/api/communication/connection_status.rb +1 -1
  218. data/lib/contrast/api/communication/messaging_queue.rb +4 -4
  219. data/lib/contrast/api/communication/response_processor.rb +9 -5
  220. data/lib/contrast/api/communication/service_lifecycle.rb +1 -1
  221. data/lib/contrast/api/communication/socket.rb +1 -1
  222. data/lib/contrast/api/communication/socket_client.rb +4 -1
  223. data/lib/contrast/api/communication/speedracer.rb +1 -1
  224. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  225. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  226. data/lib/contrast/api/communication.rb +1 -1
  227. data/lib/contrast/api/decorators/address.rb +1 -1
  228. data/lib/contrast/api/decorators/agent_startup.rb +1 -1
  229. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  230. data/lib/contrast/api/decorators/application_startup.rb +1 -1
  231. data/lib/contrast/api/decorators/application_update.rb +1 -1
  232. data/lib/contrast/api/decorators/architecture_component.rb +36 -0
  233. data/lib/contrast/api/decorators/finding.rb +1 -17
  234. data/lib/contrast/api/decorators/http_request.rb +3 -2
  235. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  236. data/lib/contrast/api/decorators/instrumentation_mode.rb +1 -1
  237. data/lib/contrast/api/decorators/library.rb +1 -1
  238. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  239. data/lib/contrast/api/decorators/message.rb +1 -1
  240. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  241. data/lib/contrast/api/decorators/route_coverage.rb +1 -1
  242. data/lib/contrast/api/decorators/server_features.rb +1 -1
  243. data/lib/contrast/api/decorators/trace_event.rb +1 -1
  244. data/lib/contrast/api/decorators/trace_event_object.rb +1 -1
  245. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  246. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  247. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -1
  248. data/lib/contrast/api/decorators/user_input.rb +1 -1
  249. data/lib/contrast/api/decorators.rb +2 -1
  250. data/lib/contrast/api.rb +1 -1
  251. data/lib/contrast/components/agent.rb +5 -24
  252. data/lib/contrast/components/api.rb +18 -9
  253. data/lib/contrast/components/app_context.rb +2 -1
  254. data/lib/contrast/components/app_context_extend.rb +1 -1
  255. data/lib/contrast/components/assess.rb +12 -8
  256. data/lib/contrast/components/base.rb +1 -1
  257. data/lib/contrast/components/config.rb +30 -15
  258. data/lib/contrast/components/contrast_service.rb +1 -1
  259. data/lib/contrast/components/heap_dump.rb +1 -1
  260. data/lib/contrast/components/inventory.rb +5 -1
  261. data/lib/contrast/components/logger.rb +1 -1
  262. data/lib/contrast/components/protect.rb +6 -2
  263. data/lib/contrast/components/sampling.rb +1 -1
  264. data/lib/contrast/components/scope.rb +1 -1
  265. data/lib/contrast/components/settings.rb +25 -12
  266. data/lib/contrast/config/agent_configuration.rb +1 -1
  267. data/lib/contrast/config/api_configuration.rb +2 -2
  268. data/lib/contrast/config/api_proxy_configuration.rb +1 -1
  269. data/lib/contrast/config/application_configuration.rb +1 -1
  270. data/lib/contrast/config/assess_configuration.rb +1 -1
  271. data/lib/contrast/config/assess_rules_configuration.rb +1 -1
  272. data/lib/contrast/config/base_configuration.rb +1 -1
  273. data/lib/contrast/config/certification_configuration.rb +1 -1
  274. data/lib/contrast/config/env_variables.rb +1 -1
  275. data/lib/contrast/config/exception_configuration.rb +1 -1
  276. data/lib/contrast/config/heap_dump_configuration.rb +1 -1
  277. data/lib/contrast/config/inventory_configuration.rb +1 -1
  278. data/lib/contrast/config/logger_configuration.rb +1 -1
  279. data/lib/contrast/config/protect_configuration.rb +1 -1
  280. data/lib/contrast/config/protect_rule_configuration.rb +1 -1
  281. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  282. data/lib/contrast/config/request_audit_configuration.rb +1 -1
  283. data/lib/contrast/config/root_configuration.rb +1 -1
  284. data/lib/contrast/config/ruby_configuration.rb +4 -1
  285. data/lib/contrast/config/sampling_configuration.rb +1 -1
  286. data/lib/contrast/config/server_configuration.rb +1 -1
  287. data/lib/contrast/config/service_configuration.rb +1 -1
  288. data/lib/contrast/config.rb +1 -1
  289. data/lib/contrast/configuration.rb +1 -1
  290. data/lib/contrast/extension/assess/array.rb +4 -2
  291. data/lib/contrast/extension/assess/erb.rb +15 -5
  292. data/lib/contrast/extension/assess/eval_trigger.rb +3 -1
  293. data/lib/contrast/extension/assess/exec_trigger.rb +2 -1
  294. data/lib/contrast/extension/assess/fiber.rb +6 -3
  295. data/lib/contrast/extension/assess/hash.rb +1 -1
  296. data/lib/contrast/extension/assess/kernel.rb +8 -3
  297. data/lib/contrast/extension/assess/marshal.rb +6 -2
  298. data/lib/contrast/extension/assess/regexp.rb +8 -2
  299. data/lib/contrast/extension/assess/string.rb +8 -2
  300. data/lib/contrast/extension/assess.rb +1 -1
  301. data/lib/contrast/extension/delegator.rb +1 -1
  302. data/lib/contrast/extension/extension.rb +2 -4
  303. data/lib/contrast/extension/inventory.rb +1 -1
  304. data/lib/contrast/extension/kernel.rb +1 -1
  305. data/lib/contrast/extension/module.rb +1 -1
  306. data/lib/contrast/extension/protect/psych.rb +1 -1
  307. data/lib/contrast/extension/protect.rb +1 -1
  308. data/lib/contrast/extension/thread.rb +1 -1
  309. data/lib/contrast/framework/base_support.rb +5 -1
  310. data/lib/contrast/framework/grape/support.rb +25 -1
  311. data/lib/contrast/framework/manager.rb +26 -5
  312. data/lib/contrast/framework/manager_extend.rb +1 -1
  313. data/lib/contrast/framework/platform_version.rb +1 -1
  314. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  315. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  316. data/lib/contrast/framework/rack/support.rb +1 -1
  317. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  318. data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
  319. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  320. data/lib/contrast/framework/rails/patch/support.rb +1 -1
  321. data/lib/contrast/framework/rails/railtie.rb +1 -1
  322. data/lib/contrast/framework/rails/support.rb +46 -2
  323. data/lib/contrast/framework/sinatra/support.rb +24 -2
  324. data/lib/contrast/funchook/funchook.rb +21 -18
  325. data/lib/contrast/logger/application.rb +1 -1
  326. data/lib/contrast/logger/format.rb +1 -1
  327. data/lib/contrast/logger/log.rb +1 -1
  328. data/lib/contrast/logger/request.rb +1 -1
  329. data/lib/contrast/logger/time.rb +1 -1
  330. data/lib/contrast/security_exception.rb +1 -1
  331. data/lib/contrast/tasks/config.rb +1 -1
  332. data/lib/contrast/tasks/service.rb +1 -1
  333. data/lib/contrast/utils/assess/propagation_method_utils.rb +1 -1
  334. data/lib/contrast/utils/assess/property/tagged_utils.rb +1 -1
  335. data/lib/contrast/utils/assess/sampling_util.rb +4 -4
  336. data/lib/contrast/utils/assess/source_method_utils.rb +1 -1
  337. data/lib/contrast/utils/assess/split_utils.rb +23 -0
  338. data/lib/contrast/utils/assess/tracking_util.rb +1 -1
  339. data/lib/contrast/utils/assess/trigger_method_utils.rb +3 -2
  340. data/lib/contrast/utils/class_util.rb +1 -1
  341. data/lib/contrast/utils/duck_utils.rb +1 -1
  342. data/lib/contrast/utils/env_configuration_item.rb +2 -2
  343. data/lib/contrast/utils/exclude_key.rb +1 -1
  344. data/lib/contrast/utils/findings.rb +5 -2
  345. data/lib/contrast/utils/hash_digest.rb +36 -6
  346. data/lib/contrast/utils/hash_digest_extend.rb +44 -1
  347. data/lib/contrast/utils/head_dump_utils_extend.rb +1 -1
  348. data/lib/contrast/utils/heap_dump_util.rb +1 -1
  349. data/lib/contrast/utils/invalid_configuration_util.rb +6 -5
  350. data/lib/contrast/utils/io_util.rb +1 -1
  351. data/lib/contrast/utils/job_servers_running.rb +1 -1
  352. data/lib/contrast/utils/log_utils.rb +1 -1
  353. data/lib/contrast/utils/lru_cache.rb +1 -1
  354. data/lib/contrast/utils/metrics_hash.rb +2 -2
  355. data/lib/contrast/utils/middleware_utils.rb +1 -1
  356. data/lib/contrast/utils/net_http_base.rb +14 -7
  357. data/lib/contrast/utils/object_share.rb +1 -6
  358. data/lib/contrast/utils/os.rb +9 -5
  359. data/lib/contrast/utils/patching/policy/patch_utils.rb +63 -99
  360. data/lib/contrast/utils/patching/policy/patcher_utils.rb +1 -1
  361. data/lib/contrast/utils/preflight_util.rb +1 -1
  362. data/lib/contrast/utils/request_utils.rb +9 -1
  363. data/lib/contrast/utils/resource_loader.rb +1 -1
  364. data/lib/contrast/utils/response_utils.rb +1 -1
  365. data/lib/contrast/utils/sha256_builder.rb +1 -1
  366. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  367. data/lib/contrast/utils/string_utils.rb +69 -67
  368. data/lib/contrast/utils/tag_util.rb +2 -1
  369. data/lib/contrast/utils/telemetry.rb +1 -1
  370. data/lib/contrast/utils/telemetry_client.rb +1 -1
  371. data/lib/contrast/utils/telemetry_identifier.rb +1 -1
  372. data/lib/contrast/utils/thread_tracker.rb +1 -1
  373. data/lib/contrast/utils/timer.rb +1 -1
  374. data/lib/contrast-agent.rb +1 -1
  375. data/lib/contrast.rb +1 -1
  376. data/ruby-agent.gemspec +4 -5
  377. metadata +58 -30
  378. data/ext/cs__assess_active_record_named/cs__active_record_named.c +0 -46
  379. data/ext/cs__assess_active_record_named/cs__active_record_named.h +0 -11
  380. data/ext/cs__assess_active_record_named/extconf.rb +0 -5
  381. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +0 -95
  382. data/lib/contrast/agent/class_reopener.rb +0 -258
  383. data/lib/contrast/agent/rewriter.rb +0 -259
  384. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +0 -37
  385. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +0 -41
  386. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +0 -75
  387. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +0 -35
  388. data/lib/contrast/utils/ruby_ast_rewriter.rb +0 -82
  389. data/lib/contrast/utils/substitution_utils.rb +0 -167
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  # The base class used to determine if a user input crosses a token boundary or
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  # This class is the concrete implementation of the DefaultSqlScanner designed
@@ -1,7 +1,7 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
4
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
5
5
  # frozen_string_literal: true
6
6
 
7
7
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/disable_reaction'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -16,6 +16,12 @@ end
16
16
  require 'contrast/agent/reporting/reporter'
17
17
  require 'contrast/agent/reporting/reporting_utilities/audit'
18
18
  require 'contrast/agent/reporting/reporting_utilities/reporter_client'
19
+ require 'contrast/agent/reporting/reporting_utilities/response_handler'
20
+ require 'contrast/agent/reporting/reporting_utilities/response'
21
+ # Events
19
22
  require 'contrast/agent/reporting/reporting_events/finding'
20
23
  require 'contrast/agent/reporting/reporting_events/preflight_message'
21
24
  require 'contrast/agent/reporting/reporting_events/preflight'
25
+ require 'contrast/agent/reporting/reporting_events/observed_route'
26
+ require 'contrast/agent/reporting/reporting_events/route_coverage'
27
+ require 'contrast/agent/reporting/reporting_events/observed_library_usage'
@@ -1,12 +1,9 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/worker_thread'
5
5
  require 'contrast/agent/reporting/report'
6
6
  require 'contrast/components/logger'
7
- require 'contrast/utils/object_share'
8
- require 'contrast/agent/version'
9
- require 'base64'
10
7
 
11
8
  module Contrast
12
9
  module Agent
@@ -14,10 +11,10 @@ module Contrast
14
11
  class Reporter < WorkerThread
15
12
  include Contrast::Components::Logger::InstanceMethods
16
13
  include Contrast::Utils::ObjectShare
14
+ # 15 min
15
+ TIMEOUT = 900.cs__freeze
17
16
 
18
17
  class << self
19
- include Contrast::Components::Logger::InstanceMethods
20
-
21
18
  # check if we can report to TS
22
19
  #
23
20
  # @return[Boolean] true if bypass is enabled, or false if bypass disabled
@@ -27,25 +24,8 @@ module Contrast
27
24
  end
28
25
  end
29
26
 
30
- def headers
31
- @_headers ||= {
32
- app_name: Base64.encode64(Contrast::APP_CONTEXT.app_name).chomp!,
33
- api_key: Contrast::API.api_key,
34
- agent_version: [RUBY, Contrast::Agent::VERSION].join(SPACE),
35
- app_language: RUBY,
36
- app_path: Base64.encode64(Contrast::APP_CONTEXT.path).chomp!,
37
- app_version: Contrast::APP_CONTEXT.app_version,
38
- authorization: Base64.encode64("#{ Contrast::API.username }:#{ Contrast::API.service_key }").chomp!,
39
- server_name: Base64.encode64(Contrast::APP_CONTEXT.server_name).chomp!,
40
- server_path: Base64.encode64(Contrast::APP_CONTEXT.server_path).chomp!,
41
- server_type: Base64.encode64(Contrast::APP_CONTEXT.server_type).chomp!,
42
- content_type: 'application/json',
43
- encoding: 'base64'
44
- }.cs__freeze
45
- end
46
-
47
27
  def client
48
- @_client ||= Contrast::Utils::ReporterClient.new headers
28
+ @_client ||= Contrast::Agent::Reporting::ReporterClient.new
49
29
  end
50
30
 
51
31
  def connection
@@ -69,15 +49,19 @@ module Contrast
69
49
  def start_thread!
70
50
  return if running?
71
51
 
52
+ client.startup!(connection)
72
53
  @_thread = Contrast::Agent::Thread.new do
73
54
  logger.debug('Starting background Reporter thread.')
74
- event = queue.pop
75
-
76
- begin
77
- logger.debug('This is the current processed event', event)
78
- client.send_event event, connection
79
- rescue StandardError => e
80
- logger.error('Could not send message to service from Reporter queue.', e)
55
+ loop do
56
+ event = queue.pop
57
+ begin
58
+ response = client.send_event(event, connection)
59
+ audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
60
+ rescue StandardError => e
61
+ logger.error('Could not send message to service from Reporter queue.', e)
62
+ end
63
+ sleep(TIMEOUT) if client.sleep?
64
+ client.wake_up
81
65
  end
82
66
  end
83
67
  end
@@ -87,16 +71,12 @@ module Contrast
87
71
  logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
88
72
  return
89
73
  end
90
-
74
+ return unless event
91
75
  return unless cs__class.enabled?
92
76
 
93
77
  logger.debug('Enqueued event for sending', event_type: event.cs__class)
94
-
95
- result = queue << event if event
96
- return result unless ::Contrast::API.request_audit_enable
97
-
98
- audit&.audit_event(event)
99
- result
78
+ audit&.audit_event(event) if ::Contrast::API.request_audit_enable?
79
+ queue << event
100
80
  end
101
81
 
102
82
  # Use this to bypass the messaging queue and leave response processing to the caller
@@ -105,16 +85,9 @@ module Contrast
105
85
  logger.warn('Reporter attempted to send event immediately with Agent disabled', caller: caller, event: event)
106
86
  return
107
87
  end
108
- response_data = client.send_event event, connection, true
109
- if response_data.status == 200
110
- # handle_response
111
- client.send(:handle_response, event, response_data, connection)
112
- end
113
-
114
- return unless ::Contrast::API.request_audit_enable
115
-
116
- audit&.audit_event(event, response_data)
117
- response_data
88
+ response = client.send_event(event, connection, true)
89
+ client.send(:handle_response, event, response, connection) if response&.code == 200
90
+ audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
118
91
  rescue StandardError => e
119
92
  logger.error('Could not send message to service from Reporter queue.', e)
120
93
  end
@@ -0,0 +1,49 @@
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ require 'contrast/components/logger'
5
+ require 'contrast/agent/reporting/reporting_events/reporting_event'
6
+ require 'contrast/agent/reporting/reporting_events/discovered_route'
7
+
8
+ module Contrast
9
+ module Agent
10
+ module Reporting
11
+ # This is the new ApplicationInventory class which will include all the needed information
12
+ # for the new reporting system to report
13
+ class ApplicationInventory < Contrast::Agent::Reporting::ReportingEvent
14
+ attr_accessor :routes, :agent_session_id_value
15
+
16
+ class << self
17
+ def convert app_update_dtm
18
+ app_inventory = new
19
+ app_inventory.attach_data app_update_dtm
20
+ app_inventory
21
+ end
22
+ end
23
+
24
+ def initialize
25
+ @routes = []
26
+ @event_type = :application_inventory
27
+ @event_method = :POST
28
+ @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_inventory
29
+ super
30
+ end
31
+
32
+ def to_controlled_hash
33
+ {
34
+ session_id: agent_session_id_value,
35
+ routes: routes.map(&:to_controlled_hash)
36
+ }
37
+ end
38
+
39
+ # @param inventory_dtm [Contrast::Api::Dtm::ApplicationUpdate]
40
+ # @return [Contrast::Agent::Reporting::ApplicationInventory]
41
+ def attach_data inventory_dtm
42
+ inventory_dtm.routes.each do |route|
43
+ @routes << Contrast::Agent::Reporting::DiscoveredRoute.convert(route)
44
+ end
45
+ end
46
+ end
47
+ end
48
+ end
49
+ end
@@ -0,0 +1,82 @@
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ require 'contrast/agent/reporting/reporting_events/architecture_component'
5
+ require 'contrast/agent/reporting/reporting_events/library_discovery'
6
+ require 'contrast/agent/reporting/reporting_events/reporting_event'
7
+ require 'contrast/agent/reporting/reporting_events/route_discovery'
8
+ require 'contrast/api/dtm.pb'
9
+ require 'contrast/components/logger'
10
+ require 'json'
11
+
12
+ module Contrast
13
+ module Agent
14
+ module Reporting
15
+ # This is the new Application Update class which will include all the needed information for the new reporting
16
+ # system. Contains data used by TeamServer to render the Flow Map and SCA features.
17
+ #
18
+ # @attr_reader components [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
19
+ # @attr_reader libraries [Array<Contrast::Agent::Reporting::LibraryDiscovery>]
20
+ class ApplicationUpdate < Contrast::Agent::Reporting::ReportingEvent
21
+ attr_reader :components, :libraries
22
+
23
+ class << self
24
+ # @param app_update_dtm [Contrast::Api::Dtm::ApplicationUpdate]
25
+ # @return [Contrast::Agent::Reporting::ApplicationUpdate]
26
+ def convert app_update_dtm
27
+ report = new
28
+ report.attach_data(app_update_dtm)
29
+ report
30
+ end
31
+ end
32
+
33
+ def initialize
34
+ @event_method = :PUT
35
+ @event_endpoint = "#{ Contrast::API.api_url }/api/ng/update/application"
36
+ super
37
+ end
38
+
39
+ # Attach the data from the protobuf models to this reporter so that it can be sent to TeamServer directly.
40
+ #
41
+ # @param app_update_dtm [Contrast::Api::Dtm::ApplicationUpdate]
42
+ def attach_data app_update_dtm
43
+ @components = app_update_dtm.components.map do |component|
44
+ Contrast::Agent::Reporting::ArchitectureComponent.convert(component)
45
+ end
46
+ @libraries = app_update_dtm.libraries.values.map do |library|
47
+ Contrast::Agent::Reporting::LibraryDiscovery.convert(library)
48
+ end
49
+ end
50
+
51
+ # Convert the instance variables on the class, and other information, into the identifiers required for
52
+ # TeamServer to process the JSON form of this message.
53
+ #
54
+ # @return [Hash]
55
+ # @raise [ArgumentError]
56
+ def to_controlled_hash
57
+ validate
58
+ {
59
+ components: components.map(&:to_controlled_hash),
60
+ libraries: libraries.map(&:to_controlled_hash),
61
+ timestamp: timestamp
62
+ }
63
+ end
64
+
65
+ # Ensure the required fields are present.
66
+ #
67
+ # @raise [ArgumentError]
68
+ def validate; end
69
+
70
+ private
71
+
72
+ # The timestamp field is a bit of a misnomer. It's really the time, in ms, since the settings for this
73
+ # application have been updated.
74
+ #
75
+ # @return [Integer]
76
+ def timestamp
77
+ Contrast::Utils::Timer.now_ms - (Contrast::Agent.reporter&.client&.response_handler&.last_app_update_ms || 0)
78
+ end
79
+ end
80
+ end
81
+ end
82
+ end
@@ -0,0 +1,80 @@
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ require 'contrast/api/dtm.pb'
5
+
6
+ module Contrast
7
+ module Agent
8
+ module Reporting
9
+ # This is the new Architecture Component class which will include all the needed information for the new
10
+ # reporting system to relay this information in the Application Update and Application Activity messages. These
11
+ # components are used by TeamServer to construct the backend/ outbound connection section of the Flow Map
12
+ # feature.
13
+ #
14
+ # @attr_reader remote_host [String] the host section of the connection to the component.
15
+ # @attr_reader remote_port [Integer] the port section of the connection to the component.
16
+ # @attr_reader type [String] the type of the component. Only ::VALID_TYPES can be used. Required for reporting.
17
+ # @attr_reader url [String] the url used to connect to the component. Required for reporting.
18
+ # @attr_reader vendor [String] the publisher of the component, like MySQL.
19
+ class ArchitectureComponent
20
+ # required attributes
21
+ attr_reader :type, :url
22
+ # optional attributes
23
+ attr_reader :remote_host, :remote_port, :vendor
24
+
25
+ # TeamServer only treats these specific values as valid for Architecture Components. It does not know how to
26
+ # process a message with a different type.
27
+ VALID_TYPES = %w[db ldap ws].cs__freeze
28
+
29
+ class << self
30
+ # Convert a DTM for SpeedRacer to an Event for TeamServer.
31
+ #
32
+ # @param component_dtm [Contrast::Api::Dtm::ArchitectureComponent]
33
+ # @return [Contrast::Agent::Reporting::ArchitectureComponent]
34
+ def convert component_dtm
35
+ report = new
36
+ report.attach_data(component_dtm)
37
+ report
38
+ end
39
+ end
40
+
41
+ # Attach the data from the protobuf models to this reporter so that it can be sent to TeamServer directly.
42
+ #
43
+ # @param component_dtm [Contrast::Api::Dtm::ArchitectureComponent]
44
+ def attach_data component_dtm
45
+ @remote_host = component_dtm.remote_host
46
+ @remote_port = component_dtm.remote_port
47
+ @type = component_dtm.type
48
+ @url = component_dtm.url
49
+ @vendor = component_dtm.vendor
50
+ end
51
+
52
+ # Convert the instance variables on the class, and other information, into the identifiers required for
53
+ # TeamServer to process the JSON form of this message.
54
+ #
55
+ # @return [Hash]
56
+ # @raise [ArgumentError]
57
+ def to_controlled_hash
58
+ validate
59
+ {
60
+ remoteHost: remote_host,
61
+ remotePort: remote_port,
62
+ type: type,
63
+ url: url,
64
+ vendor: vendor
65
+ }
66
+ end
67
+
68
+ # Ensure the required fields are present.
69
+ #
70
+ # @raise [ArgumentError]
71
+ def validate
72
+ unless VALID_TYPES.include?(type)
73
+ raise(ArgumentError, "#{ self } did not have a proper type - '#{ type }'. Unable to continue.")
74
+ end
75
+ raise(ArgumentError, "#{ self } did not have a proper URL. Unable to continue.") unless url
76
+ end
77
+ end
78
+ end
79
+ end
80
+ end
@@ -0,0 +1,59 @@
1
+ # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ require 'json'
5
+ require 'contrast/components/logger'
6
+ require 'contrast/agent/reporting/reporting_events/reporting_event'
7
+ require 'contrast/utils/object_share'
8
+
9
+ module Contrast
10
+ module Agent
11
+ module Reporting
12
+ # This is the new Discovered Route class which will include all the needed information for the new reporting
13
+ # system to relay this information in the Route Observation messages. These observations are used by TeamServer
14
+ # to construct the route coverage information for the assess feature. They represent those methods which map to
15
+ # externally accessible endpoints within the application, as registered to the application framework. This also
16
+ # includes the literal URL and HTTP Verb used to invoke them, as they must have been called at this point to be
17
+ # recorded.
18
+ class DiscoveredRoute < Contrast::Agent::Reporting::ObservedRoute
19
+ class << self
20
+ # @param dtm [Contrast::Api::Dtm::RouteCoverage]
21
+ # @return [Contrast::Agent::Reporting::DiscoveredRoute]
22
+ def convert dtm
23
+ discovered_route = new
24
+ discovered_route.attach_data dtm
25
+ discovered_route
26
+ end
27
+ end
28
+
29
+ def initialize
30
+ super
31
+ @event_type = :discovered_route
32
+ @signature = Contrast::Utils::ObjectShare::EMPTY_STRING
33
+ @verb = Contrast::Utils::ObjectShare::EMPTY_STRING
34
+ @url = Contrast::Utils::ObjectShare::EMPTY_STRING
35
+ end
36
+
37
+ # @param dtm[Contrast::Api::Dtm::RouteCoverage]
38
+ def attach_data dtm
39
+ @signature = dtm.route
40
+ @verb = dtm.verb
41
+ @url = dtm.url
42
+ end
43
+
44
+ def to_controlled_hash
45
+ validate
46
+ dr_hash = { session_id: @agent_session_id_value, signature: @signature, verb: @verb, url: @url }
47
+ dr_hash.delete(:verb) unless @verb
48
+ dr_hash
49
+ end
50
+
51
+ def validate
52
+ raise(ArgumentError, "#{ self } did not have a proper signature. Unable to continue.") unless signature
53
+
54
+ nil
55
+ end
56
+ end
57
+ end
58
+ end
59
+ end