contrast-agent 4.3.1 → 4.6.0

data/lib/contrast/api/communication/response_processor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reaction_processor'
@@ -11,6 +11,7 @@ module Contrast
         include Contrast::Components::Interface
         access_component :agent, :analysis, :logging, :settings
 
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process response
           logger.debug('Received a response', sent_ms: response&.sent_ms)
 
@@ -31,8 +32,10 @@ module Contrast
 
         private
 
-        # Given some protobuf messages, update settings.
+        # Given some protobuf messages, update server features.
         # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_server_response response
           server_features = response&.server_features
           return unless server_features
@@ -44,6 +47,10 @@ module Contrast
           server_features
         end
 
+        # Given some protobuf messages, update application settings.
+        # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_application_response response
           app_settings = response&.application_settings
           return unless app_settings
@@ -63,12 +70,12 @@ module Contrast
 
           logger.trace_with_time('Rebuilding rule modes') do
             SETTINGS.build_protect_rules if PROTECT.enabled?
-            SETTINGS.build_assess_rules  if ASSESS.enabled?
             AGENT.reset_ruleset
 
             logger.info('Current rule settings:')
+
             PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
-            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+            logger.info('Disabled Assess Rules', rules: ASSESS.disabled_rules)
           end
         end
       end

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket_client.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'socket'
@@ -26,6 +26,7 @@ module Contrast
         #
         # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
         #   Contrast::Api::Dtm::Message
+        # @return [Contrast::Api::Settings::AgentSettings]
         def send_one event
           msg = Contrast::Api::Dtm::Message.build(event)
           send_message(msg)
@@ -58,24 +59,31 @@ module Contrast
           end
 
           # Or something is not set.
-          msg = if CONFIG.root.agent.service.host
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.port` is not set. ' \
-                  'Falling back to default TCP socket port.'
-                elsif CONFIG.root.agent.service.port
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.host` is not set. ' \
-                  'Falling back to default TCP socket host.'
-                else
-                  'Missing a required connection value to the Contrast Service. ' \
-                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
-                  'Falling back to default TCP socket.'
-                end
-          logger.warn(msg,
+          logger.warn(log_connection_error_msg,
                       host: CONTRAST_SERVICE.host,
                       port: CONTRAST_SERVICE.port)
         end
 
+        # If our connection isn't built properly, we need to warn the user. This builds out the context specific
+        # message to provide that warning
+        #
+        # @return [String]
+        def log_connection_error_msg
+          if CONFIG.root.agent.service.host
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.port` is not set. ' \
+            'Falling back to default TCP socket port.'
+          elsif CONFIG.root.agent.service.port
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.host` is not set. ' \
+            'Falling back to default TCP socket host.'
+          else
+            'Missing a required connection value to the Contrast Service. ' \
+            'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+            'Falling back to default TCP socket.'
+          end
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/communication/speedracer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -73,7 +73,6 @@ module Contrast
 
         def send_initialization_messages
           agent_startup_msg = APP_CONTEXT.build_agent_startup_message
-          app_startup_msg = APP_CONTEXT.build_app_startup_message
 
           logger.debug('Preparing to send startup messages')
           # 1 initial attempt, + 3 potential retries.
@@ -82,7 +81,8 @@ module Contrast
             log_send_event(agent_startup_msg)
             next unless (agent_response = socket_client.send_one(agent_startup_msg))
 
-            # Connection was successful
+            # Connection was successful; send app create with the resolved features.
+            app_startup_msg = APP_CONTEXT.build_app_startup_message
             log_send_event(app_startup_msg)
             app_response = socket_client.send_one(app_startup_msg)
 

data/lib/contrast/api/communication/tcp_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/communication/unix_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/decorators.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,6 +10,8 @@ module Contrast
 end
 
 require 'contrast/api/decorators/message'
+require 'contrast/api/decorators/agent_startup'
+require 'contrast/api/decorators/application_startup'
 require 'contrast/api/decorators/application_update'
 require 'contrast/api/decorators/input_analysis'
 require 'contrast/api/decorators/application_settings'

data/lib/contrast/api/decorators/address.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/agent_startup.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the AgentStartup protobuf model to handle reporting Agent process start
+      module AgentStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis, :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration and Agent discovery
+          #
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @return [Contrast::Api::Dtm::AgentStartup]
+          def build name, path, type
+            msg = new
+            msg.server_version   = Contrast::Agent::VERSION
+            msg.server_name      = Contrast::Utils::StringUtils.protobuf_format name
+            msg.server_path      = Contrast::Utils::StringUtils.protobuf_format path
+            msg.server_type      = Contrast::Utils::StringUtils.protobuf_format type
+            config!(msg)
+            msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+            msg
+          end
+
+          private
+
+          # set the configuration driven values for this AgentStartup msg
+          #
+          # @param msg [Contrast::Api::Dtm::AgentStartup]
+          def config! msg
+            msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+            msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+            msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+            msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+            msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::AgentStartup.include(Contrast::Api::Decorators::AgentStartup)

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/application_startup.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/instrumentation_mode'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationCreate protobuf model to handle reporting Agent process start
+      module ApplicationStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::ApplicationCreate]
+          def build
+            msg = new
+            msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
+            msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+            msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
+            msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
+            msg.mode             = Contrast::Api::Dtm::InstrumentationMode.build
+            session!(msg)
+            msg
+          end
+
+          private
+
+          # Set the session metadata for this ApplicationCreate msg
+          #
+          # @param msg [Contrast::Api::Dtm::ApplicationCreate]
+          def session! msg
+            msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
+            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationCreate.include(Contrast::Api::Decorators::ApplicationStartup)

data/lib/contrast/api/decorators/application_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/api/decorators/http_request.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/instrumentation_mode.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InstrumentationMode protobuf model to handle reporting Agent process start
+      module InstrumentationMode
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::InstrumentationMode]
+          def build
+            msg = new
+            msg.assess =  ASSESS.enabled?
+            msg.protect = PROTECT.enabled?
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::InstrumentationMode.include(Contrast::Api::Decorators::InstrumentationMode)

data/lib/contrast/api/decorators/library.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/message.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -26,27 +26,37 @@ module Contrast
           end
 
           # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          #
           # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @param url [String, nil] use url from string instead of journey object.
           # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_action_dispatch_journey journey_obj
+          def from_action_dispatch_journey journey_obj, url = nil
             msg = new
             msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
 
             verb = source_or_string(journey_obj.verb)
             msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
 
-            url = source_or_string(journey_obj.path.spec)
+            url ||= source_or_string(journey_obj.path.spec)
             msg.url = Contrast::Utils::StringUtils.force_utf8(url)
             msg
           end
 
-          def from_sinatra_route clazz, method, pattern
+          # Convert Sinatra route data to dtm message.
+          #
+          # @param controller [::Sinatra::Base] the route's final controller.
+          # @param method [String] GET, PUT, POST, etc...
+          # @param method [::Mustermann::Sinatra]  the pattern that was matched in routing.
+          # @param url [String, nil] use url from string instead matched pattern.
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_sinatra_route controller, method, pattern, url = nil
             safe_pattern = source_or_string(pattern)
+            safe_url = source_or_string(url || pattern)
 
             msg = new
-            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.route = "#{ controller }##{ method } #{ safe_pattern }"
             msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
             msg
           end
         end