contrast-agent 4.3.1 → 4.6.0

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/policy/trigger_node'

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/trigger_node'

data/lib/contrast/agent/middleware.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ipaddr'
@@ -16,18 +16,17 @@ require 'contrast/utils/timer'
 
 module Contrast
   module Agent
-    # This class allows the Agent to plug into the Rack middleware stack. When the
-    # application is first started, we initialize ourselves as a rack middleware
-    # inside of #initialize. Afterwards, we process each http request and response
-    # as it goes through the middleware stack inside of #call.
+    # This class allows the Agent to plug into the Rack middleware stack. When the application is first started, we
+    # initialize ourselves as a rack middleware inside of #initialize. Afterwards, we process each http request and
+    # response as it goes through the middleware stack inside of #call.
     class Middleware
       include Contrast::Components::Interface
       access_component :agent, :config, :logging, :scope, :settings
 
       attr_reader :app
 
-      # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here
-      # since we're only going to be initialized a single time. Our initialization order is:
+      # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here since
+      # we're only going to be initialized a single time. Our initialization order is:
       # - capture the application
       # - setup the Agent
       # - startup the Agent
@@ -39,51 +38,27 @@ module Contrast
         setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
         unless AGENT.enabled?
           logger.error(
-              'The Agent was unable to initialize before the application middleware was initialized. Disabling permanently.')
+              'The Agent was unable to initialize before the application middleware was initialized. ' \
+              'Disabling permanently.')
           AGENT.disable! # ensure the agent is disabled (probably redundant)
           return
         end
         agent_startup_routine
       end
 
-      # Startup the Agent as part of the initialization process:
-      # - start the service sending thread, responsible for sending and
-      #   processing messages
-      # - start the heartbeat thread, which triggers service startup
-      # - start instrumenting libraries and do a 'catchup' patch for everything
-      #   we didn't see get loaded
-      # - enable TracePoint, which handles all class loads and required
-      #   instrumentation going forward
-      def agent_startup_routine
-        logger.debug_with_time('middleware: starting service') do
-          Contrast::Agent.thread_watcher.ensure_running?
-        end
-
-        logger.debug_with_time('middleware: instrument shared libraries and patch') do
-          Contrast::Agent::Patching::Policy::Patcher.patch
-        end
-
-        AGENT.enable_tracepoint
-        Contrast::Agent::AtExitHook.exit_hook
-      end
-
-      # This is where we're hooked into the middleware stack. If the agent is enabled, we're ready
-      # to do some processing on a per request basis. If not, we just pass the request along to the
-      # next middleware in the stack.
+      # This is where we're hooked into the middleware stack. If the agent is enabled, we're ready to do some
+      # processing on a per request basis. If not, we just pass the request along to the next middleware in the stack.
       #
-      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
-      #   and values of this Request
-      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back
-      #   to the user up the Rack framework.
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
+      #   the Rack framework.
       def call env
-        Contrast::Utils::HeapDumpUtil.run
+        return app.call(env) unless AGENT.enabled?
 
-        if AGENT.enabled?
-          handle_first_request
-          call_with_agent(env)
-        else
-          app.call(env)
-        end
+        Contrast::Agent.heapdump_util.start_thread!
+        handle_first_request
+        call_with_agent(env)
       end
 
       private
@@ -103,73 +78,56 @@ module Contrast
         end
       end
 
-      # Some things have to wait until first request to happen, either because
-      # resolution is not complete or because the framework will preload
-      # classes, which confuses some of our instrumentation.
+      # Startup the Agent as part of the initialization process:
+      # - start the service sending thread, responsible for sending and processing messages
+      # - start the heartbeat thread, which triggers service startup
+      # - start instrumenting libraries and do a 'catchup' patch for everything we didn't see get loaded
+      # - enable TracePoint, which handles all class loads and required instrumentation going forward
+      def agent_startup_routine
+        logger.debug_with_time('middleware: starting service') do
+          Contrast::Agent.thread_watcher.ensure_running?
+        end
+
+        logger.debug_with_time('middleware: instrument shared libraries and patch') do
+          Contrast::Agent::Patching::Policy::Patcher.patch
+        end
+
+        logger.debug_with_time('middleware: enabling tracepoint') do
+          AGENT.enable_tracepoint
+        end
+        Contrast::Agent::AtExitHook.exit_hook
+      end
+
+      # Some things have to wait until first request to happen, either because resolution is not complete or because
+      # the framework will preload classes, which confuses some of our instrumentation.
       def handle_first_request
         @_handle_first_request ||= begin
           Contrast::Agent::StaticAnalysis.catchup
-          force_patching
           true
         end
       end
 
-      # TODO: RUBY-1090 remove this method and those it calls.
-      #
-      # These modules are auto-loaded by Rails, meaning they are defined at
-      # startup, but that they don't actually exist. We account for this in
-      # most cases by using the ClassUtil.truly_defined? method, but it appears
-      # to fail for these Modules. In the short term, we can forcing a re-patch
-      # so that their dead zones apply.
-      def force_patching
-        force_patch(ActionDispatch::FileHandler) if defined?(ActionDispatch::FileHandler)
-        force_patch(ActionDispatch::Http::MimeNegotiation) if defined?(ActionDispatch::Http::MimeNegotiation)
-        force_patch(ActionView::Template) if defined?(ActionView::Template)
-      end
-
-      def force_patch mod
-        data = Contrast::Agent::ModuleData.new(mod)
-        Contrast::Agent::Patching::Policy::Patcher.send(:patch_into_module, data, true)
-      end
-
-      # This is where we process each request we intercept as a middleware. We make the request context
-      # available globally so that it can be accessed from anywhere. A RequestHandler object is made
-      # for each request, which handles prefilter and postfilter operations.
+      # This is where we process each request we intercept as a middleware. We make the request context available
+      # globally so that it can be accessed from anywhere. A RequestHandler object is made for each request, which
+      # handles prefilter and postfilter operations.
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user
+      #   up the Rack framework.
       def call_with_agent env
         Contrast::Agent.thread_watcher.ensure_running?
-        return unless AGENT.enabled?
-
         framework_request = Contrast::Agent.framework_manager.retrieve_request(env)
         context = Contrast::Agent::RequestContext.new(framework_request)
         response = nil
 
-        # make the context available for the lifecycle of this request
+        # Make the context available for the lifecycle of this request.
         Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
           logger.request_start
           request_handler = Contrast::Agent::RequestHandler.new(context)
 
-          # prefilter sequence
-          with_contrast_scope do
-            context.service_extract_request
-            request_handler.ruleset.prefilter
-          end
-
-          response = application_code(env) # pass request down the Rack chain with original env
-
-          # postfilter sequence
-          with_contrast_scope do
-            context.extract_after(response) # update context with final response information
-
-            if Contrast::Agent.framework_manager.streaming?(env)
-              context.reset_activity
-              request_handler.stream_safe_postfilter
-            else
-              request_handler.ruleset.postfilter
-              # return response stored in the context in case any postfilter rules updated the response data
-              response = context.response&.rack_response || response
-              request_handler.send_activity_messages
-            end
-          end
+          pre_call_with_agent(context, request_handler)
+          response = application_code(env)
+          post_call_with_agent(context, env, request_handler, response)
         ensure
           logger.request_end
         end
@@ -179,6 +137,47 @@ module Contrast
         handle_exception(e)
       end
 
+      # Handle the operations the Agent needs to accomplish prior to the Application code executing during this
+      # request.
+      #
+      # @param context [Contrast::Agent::RequestContext]
+      # @param request_handler [Contrast::Agent::RequestHandler]
+      def pre_call_with_agent context, request_handler
+        with_contrast_scope do
+          context.service_extract_request
+          request_handler.ruleset.prefilter
+        end
+      rescue StandardError => e
+        raise e if security_exception?(e)
+
+        logger.error('Unable to execute agent pre_call', e)
+      end
+
+      # Handle the operations the Agent needs to accomplish after the Application code executes during this request.
+      #
+      # @param context [Contrast::Agent::RequestContext]
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @param request_handler [Contrast::Agent::RequestHandler]
+      # @param response [Array,Rack::Response]
+      def post_call_with_agent context, env, request_handler, response
+        with_contrast_scope do
+          context.extract_after(response) # update context with final response information
+
+          if Contrast::Agent.framework_manager.streaming?(env)
+            context.reset_activity
+            request_handler.stream_safe_postfilter
+          else
+            request_handler.ruleset.postfilter
+            request_handler.send_activity_messages
+          end
+        end
+      rescue StandardError => e
+        raise e if security_exception?(e)
+
+        logger.error('Unable to execute agent post_call', e)
+      end
+
       def application_code env
         logger.trace_with_time('application') do
           app.call(env)
@@ -189,12 +188,10 @@ module Contrast
       end
 
       SECURITY_EXCEPTION_MARKER = 'Contrast::SecurityException'
-      # We're only going to suppress SecurityExceptions indicating a blocked attack.
-      # And, only if the config.agent.ruby.exceptions.capture? is set
+      # We're only going to suppress SecurityExceptions indicating a blocked attack. And, only if the
+      # config.agent.ruby.exceptions.capture? is set
       def handle_exception exception
-        if exception.is_a?(Contrast::SecurityException) ||
-              exception.message&.include?(SECURITY_EXCEPTION_MARKER)
-
+        if security_exception?(exception)
           exception_control = AGENT.exception_control
           raise exception unless exception_control[:enable]
 
@@ -205,18 +202,24 @@ module Contrast
         end
       end
 
-      # As we deprecate support to prepare to remove dead code, we need to
-      # inform our users still relying on the now deprecated and soon to be
-      # removed functionality. This method handles doing that by leveraging the
-      # standard Kernel#warn approach
+      # Is the given exception one raised by our Protect code?
+      #
+      # @param exception [Exception]
+      # @return [Boolean]
+      def security_exception? exception
+        exception.is_a?(Contrast::SecurityException) ||
+            exception.message&.include?(SECURITY_EXCEPTION_MARKER)
+      end
+
+      # As we deprecate support to prepare to remove dead code, we need to inform our users still relying on the now
+      # deprecated and soon to be removed functionality. This method handles doing that by leveraging the standard
+      # Kernel#warn approach
       def inform_deprecations
-        # Ruby 2.5 is currently in security maintenance, meaning int is only
-        # receiving updates for security issues. It will move to eol on 31
-        # March 2021. As such, we can remove support for it in Q2. We'll begin
-        # the deprecation warnings now so that customers have time to reach out
-        # if they'll be impacted.
-        # TODO: RUBY-715 remove this part of the method, leaving it empty if
-        #   there are no other deprecations, when we drop 2.5 support.
+        # Ruby 2.5 is currently in security maintenance, meaning int is only receiving updates for security issues. It
+        # will move to eol on 31 March 2021. As such, we can remove support for it in Q3. We'll begin the deprecation
+        # warnings now so that customers have time to reach out if they'll be impacted.
+        # TODO: RUBY-715 remove this part of the method, leaving it empty if there are no other deprecations, when we
+        #   drop 2.5 support.
         return unless RUBY_VERSION < '2.6.0'
 
         Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\

data/lib/contrast/agent/module_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/after_load_patch'
@@ -55,6 +55,10 @@ module Contrast
                   'Catching up on already loaded afterload patch - applying instrumentation',
                   module: after_load_patch.module_name)
               after_load_patch.instrument!
+            rescue NameError => e
+              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name, method: after_load_patch.method_to_instrument)
+            rescue StandardError => e
+              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name, method: after_load_patch.method_to_instrument)
             end
             after_load_patches.delete_if(&:applied?)
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'
@@ -178,7 +178,7 @@ module Contrast
               return ret unless method_policy && ASSESS.enabled?
 
               current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return ret unless current_context.analyze_request?
+              return ret if current_context && !current_context.analyze_request?
 
               trigger_node = method_policy.trigger_node
               Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args) if trigger_node
@@ -362,29 +362,27 @@ module Contrast
 
               case impl
               when :alias_instance, :alias_singleton
+                # Core to patching. Ignore define method usage cop.
+                # rubocop:disable Performance/Kernel/DefineMethod
                 unless target_module.instance_methods(false).include? underlying_method_name
                   # alias_method may be private
                   target_module.send(:alias_method, underlying_method_name, method_name)
-                  # TODO: RUBY-1052
-                  # rubocop:disable Performance/Kernel/DefineMethod
                   target_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                  # rubocop:enable Performance/Kernel/DefineMethod
                 end
                 target_module.send(visibility, method_name) # e.g., module.private(:my_method)
               when :prepend
                 prepending_module = Module.new
-                # TODO: RUBY-1052
-                # rubocop:disable Performance/Kernel/DefineMethod
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                # rubocop:enable Performance/Kernel/DefineMethod
                 prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
+                # rubocop:enable Performance/Kernel/DefineMethod
               end
               # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
               # can't invoke this logging method or we'll seg fault as we'd
               # change the method definition mid-call
-              # if method_name != :[]=
+              # if method_name != :[]= &&
+              #   Contrast::Agent::Logger.defined!
               #   logger.trace(
               #       'Registered C-defined patch',
               #       implementation: impl,
@@ -392,14 +390,15 @@ module Contrast
               #       method: method_name,
               #       visibility: visibility)
               # end
-              underlying_method_name.to_sym
+              underlying_method_name
             end
 
             # @return [Boolean]
             def skip_contrast_analysis?
               return true if in_contrast_scope?
-              return true unless defined?(Contrast::Agent::REQUEST_TRACKER)
-              return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+              return false unless defined?(Contrast::Agent::REQUEST_TRACKER)
+              return false unless Contrast::Agent::REQUEST_TRACKER.current
+              return true unless Contrast::Agent::REQUEST_TRACKER.current.analyze_request?
 
               false
             end
@@ -411,7 +410,7 @@ module Contrast
             def skip_assess_analysis?
               return true if skip_contrast_analysis?
 
-              !ASSESS.enabled?
+              !ASSESS&.enabled?
             end
           end
         end

data/lib/contrast/agent/patching/policy/patch_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,7 +13,7 @@ module Contrast
             # one does not exist.
             #
             # @param mod [Module] the Module for which the status is asked
-            # @return [Contrast::Agent::Patching::Policy::PolicyStatus]
+            # @return [Contrast::Agent::Patching::Policy::PatchStatus]
             def get_status mod
               if mod.cs__const_defined?(status_key, false)
                 mod.cs__const_get(status_key, false)