contrast-agent 4.3.0 → 4.5.0

data/lib/contrast/agent/worker_thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/connection_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/messaging_queue.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -10,7 +10,7 @@ module Contrast
       # Top level gateway to messaging with speedracer
       class MessagingQueue < Contrast::Agent::WorkerThread
         include Contrast::Components::Interface
-        access_component :analysis, :logging, :settings
+        access_component :agent, :analysis, :logging, :settings
 
         attr_reader :queue, :speedracer
 
@@ -22,11 +22,19 @@ module Contrast
 
         # Use this to bypass the messaging queue and leave response processing to the caller
         def send_event_immediately event
-          send_event(event, true)
+          if AGENT.disabled?
+            logger.warn('Attempted to send event immediately with Agent disabled', caller: caller, event: event)
+            return
+          end
+          speedracer.return_response(event)
         end
 
         # Use this to add a message to the queue and process the response internally
         def send_event_eventually event
+          if AGENT.disabled?
+            logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
+            return
+          end
           logger.debug('Enqueued event for sending', event_type: event.cs__class)
           queue << event if event
         end
@@ -35,13 +43,14 @@ module Contrast
           speedracer.ensure_startup!
           return if running?
 
+          @queue ||= Queue.new
           @_thread = Contrast::Agent::Thread.new do
             loop do
               event = queue.pop
 
               begin
                 logger.debug('Dequeued event for sending', event_type: event.cs__class)
-                send_event(event)
+                speedracer.process_internally(event)
               rescue StandardError => e
                 logger.error('Could not send message to service from messaging queue thread.', e)
               end
@@ -50,25 +59,13 @@ module Contrast
           logger.debug('Started background sending thread.')
         end
 
-        private
+        def stop!
+          return unless running?
 
-        # return_response is used to determine if we want to return the response to the caller or process it internally
-        def send_event event, return_response = false
-          preprocess_event(event)
-          if return_response
-            speedracer.return_response(event)
-          else
-            speedracer.process_internally(event)
-          end
-        end
-
-        # For now this only handles appending assess tags
-        # eventually we could break out preprocessors for every event type
-        def preprocess_event event
-          return unless event.is_a?(Contrast::Api::Dtm::Activity)
-
-          # See if they're even enabled
-          event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
+          super
+          @queue&.clear
+          @queue&.close
+          @queue = nil
         end
       end
     end

data/lib/contrast/api/communication/response_processor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reaction_processor'
@@ -11,6 +11,7 @@ module Contrast
         include Contrast::Components::Interface
         access_component :agent, :analysis, :logging, :settings
 
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process response
           logger.debug('Received a response', sent_ms: response&.sent_ms)
 
@@ -31,8 +32,10 @@ module Contrast
 
         private
 
-        # Given some protobuf messages, update settings.
+        # Given some protobuf messages, update server features.
         # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_server_response response
           server_features = response&.server_features
           return unless server_features
@@ -44,6 +47,10 @@ module Contrast
           server_features
         end
 
+        # Given some protobuf messages, update application settings.
+        # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_application_response response
           app_settings = response&.application_settings
           return unless app_settings

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket_client.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'socket'
@@ -26,6 +26,7 @@ module Contrast
         #
         # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
         #   Contrast::Api::Dtm::Message
+        # @return [Contrast::Api::Settings::AgentSettings]
         def send_one event
           msg = Contrast::Api::Dtm::Message.build(event)
           send_message(msg)
@@ -58,24 +59,31 @@ module Contrast
           end
 
           # Or something is not set.
-          msg = if CONFIG.root.agent.service.host
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.port` is not set. ' \
-                  'Falling back to default TCP socket port.'
-                elsif CONFIG.root.agent.service.port
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.host` is not set. ' \
-                  'Falling back to default TCP socket host.'
-                else
-                  'Missing a required connection value to the Contrast Service. ' \
-                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
-                  'Falling back to default TCP socket.'
-                end
-          logger.warn(msg,
+          logger.warn(log_connection_error_msg,
                       host: CONTRAST_SERVICE.host,
                       port: CONTRAST_SERVICE.port)
         end
 
+        # If our connection isn't built properly, we need to warn the user. This builds out the context specific
+        # message to provide that warning
+        #
+        # @return [String]
+        def log_connection_error_msg
+          if CONFIG.root.agent.service.host
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.port` is not set. ' \
+            'Falling back to default TCP socket port.'
+          elsif CONFIG.root.agent.service.port
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.host` is not set. ' \
+            'Falling back to default TCP socket host.'
+          else
+            'Missing a required connection value to the Contrast Service. ' \
+            'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+            'Falling back to default TCP socket.'
+          end
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/communication/speedracer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -73,7 +73,6 @@ module Contrast
 
         def send_initialization_messages
           agent_startup_msg = APP_CONTEXT.build_agent_startup_message
-          app_startup_msg = APP_CONTEXT.build_app_startup_message
 
           logger.debug('Preparing to send startup messages')
           # 1 initial attempt, + 3 potential retries.
@@ -82,7 +81,8 @@ module Contrast
             log_send_event(agent_startup_msg)
             next unless (agent_response = socket_client.send_one(agent_startup_msg))
 
-            # Connection was successful
+            # Connection was successful; send app create with the resolved features.
+            app_startup_msg = APP_CONTEXT.build_app_startup_message
             log_send_event(app_startup_msg)
             app_response = socket_client.send_one(app_startup_msg)
 

data/lib/contrast/api/communication/tcp_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/communication/unix_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/decorators.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,6 +10,8 @@ module Contrast
 end
 
 require 'contrast/api/decorators/message'
+require 'contrast/api/decorators/agent_startup'
+require 'contrast/api/decorators/application_startup'
 require 'contrast/api/decorators/application_update'
 require 'contrast/api/decorators/input_analysis'
 require 'contrast/api/decorators/application_settings'

data/lib/contrast/api/decorators/address.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/agent_startup.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the AgentStartup protobuf model to handle reporting Agent process start
+      module AgentStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis, :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration and Agent discovery
+          #
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @return [Contrast::Api::Dtm::AgentStartup]
+          def build name, path, type
+            msg = new
+            msg.server_version   = Contrast::Agent::VERSION
+            msg.server_name      = Contrast::Utils::StringUtils.protobuf_format name
+            msg.server_path      = Contrast::Utils::StringUtils.protobuf_format path
+            msg.server_type      = Contrast::Utils::StringUtils.protobuf_format type
+            config!(msg)
+            msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+            msg
+          end
+
+          private
+
+          # set the configuration driven values for this AgentStartup msg
+          #
+          # @param msg [Contrast::Api::Dtm::AgentStartup]
+          def config! msg
+            msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+            msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+            msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+            msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+            msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::AgentStartup.include(Contrast::Api::Decorators::AgentStartup)

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/application_startup.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/instrumentation_mode'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationCreate protobuf model to handle reporting Agent process start
+      module ApplicationStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::ApplicationCreate]
+          def build
+            msg = new
+            msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
+            msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+            msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
+            msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
+            msg.mode             = Contrast::Api::Dtm::InstrumentationMode.build
+            session!(msg)
+            msg
+          end
+
+          private
+
+          # Set the session metadata for this ApplicationCreate msg
+          #
+          # @param msg [Contrast::Api::Dtm::ApplicationCreate]
+          def session! msg
+            msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
+            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationCreate.include(Contrast::Api::Decorators::ApplicationStartup)

data/lib/contrast/api/decorators/application_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/api/decorators/http_request.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/instrumentation_mode.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InstrumentationMode protobuf model to handle reporting Agent process start
+      module InstrumentationMode
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::InstrumentationMode]
+          def build
+            msg = new
+            msg.assess =  ASSESS.enabled?
+            msg.protect = PROTECT.enabled?
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::InstrumentationMode.include(Contrast::Api::Decorators::InstrumentationMode)