contrast-agent 4.3.2 → 4.7.0

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 require 'contrast/components/interface'
 
 module Contrast

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'
@@ -27,8 +27,8 @@ module Contrast
 
           def application_name
             app_class = ::Rails.application.cs__class
-            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
-            # and instead we need to use parent_module_name
+            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed
+            # entirely and instead we need to use parent_module_name
             return app_class.parent_module_name if Gem::Version.new(::Rails.version) >= RAILS_MODULE_NAME_VERSION
 
             app_class.parent_name
@@ -47,32 +47,34 @@ module Contrast
           end
 
           # Find the current route, based on the provided Request wrapper
+          #
           # @param request[Contrast::Agent::Request]
           # @return [Contrast::Api::Dtm::RouteCoverage]
           def current_route request
             return unless ::Rails.cs__respond_to?(:application)
 
-            # returns array of arrays [[match_data, path_parameters, route]], sorted by
-            # precedence
-            # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
-            # path_parameters: hash of various things
-            # route: ActionDispatch::Journey::Route
-            full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
-            return if full_routes.empty?
+            match, _params, route, path = get_full_route(request.rack_request)
 
-            full_route = full_routes[0]
+            original_url = request.rack_request.path_info
 
-            # the route is directly implemented within the application
-            if direct_route?(full_route)
-              route = full_route[2] # route w/ highest precedence
-              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
-            else
-              engine_route(full_route, request)
+            # Route is either the final rails route, or a router that points to a Sinatra controller.
+            if Contrast::Framework::Sinatra::Support.sinatra_controller?(route.app.app)
+              # Create a request copied from current request, but with the base path removed from path_info.
+              new_req = ::ActionDispatch::Request.new(request.env)
+              new_req.path_info = new_req.path_info.gsub((path << match).join, '')
+
+              return Contrast::Framework::Sinatra::Support.current_route(new_req, route.app.app, original_url)
             end
+
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route, original_url)
           rescue StandardError => _e
             nil
           end
 
+          # Copy a request for modification.
+          #
+          # @param [::ActionDispatch::Request] original env.
+          # @return [::ActionDispatch::Request] a copy of original env with rails env merged.
           def retrieve_request env
             rails_env = ::Rails.application.env_config.merge(env)
             ::ActionDispatch::Request.new(rails_env || env)
@@ -87,37 +89,34 @@ module Contrast
 
           private
 
-          # route is not mounted within an engine
-          def direct_route? full_route
-            full_route[2]&.app&.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher ||
-                (full_route[2].cs__class == ActionDispatch::Journey::Route && full_route[2]&.app&.cs__class == ActionDispatch::Routing::Mapper::Constraints)
+          # Determine if route is a Rails engine route.
+          #
+          # @param [Object] app or route that points to a ::Rails::Engine
+          # @return [bool] whether the router is an engine or not.
+          def engine_route? route
+            route.app.is_a?(::ActionDispatch::Routing::Mapper::Constraints) && route.app.app < ::Rails::Engine
           end
 
-          def engine_route full_route, request
-            engine_route = full_route[2] # supposed route - but actually an Engine mount point
-            return unless engine_route
-
-            engine_mount_name = engine_route.name
-            return unless engine_mount_name
-
-            engine_path_segments = request.rack_request.path_info.split(engine_mount_name)
-            return if engine_path_segments.empty?
-
-            path_within_engine = engine_path_segments[-1]
-            return unless path_within_engine
-
-            engine_router = engine_route.app&.app&.routes&.router
-            return unless engine_router
-
-            # Get all routes regardless of http method
-            matching_routes = engine_router.send(:filter_routes, path_within_engine)
-            return unless matching_routes
-
-            # filter for current http method
-            reportable_routes = engine_router.send(:match_routes, matching_routes, request.rack_request)
-            return if reportable_routes.empty?
-
-            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(reportable_routes[0])
+          # Recursively get final route traversing engines as required.
+          #
+          # @param request [::Rack::Request] the rack request as will be handed to rails controller.
+          # @param top_router [::ActionDispatch::Journer::Router] the current router relative to the previous.
+          # @param path [Array<String>] the chunks of path that have been seen.
+          # @return [Array<array>] the final set of rails route classes.
+          def get_full_route request, top_router = ::Rails.application.routes.router, path = []
+            return if (route_matches = top_router.send(:find_routes, request)).empty?
+
+            match, params, route = route_matches.first
+
+            # If the current routing node points to a sub-app (::Rais::Engine), dive deeper.
+            # Have sub-app route the remainder of the url.
+            if engine_route?(route)
+              new_req = retrieve_request request.env
+              new_req.path_info = new_req.path_info.gsub(match.to_s, '')
+              get_full_route(new_req, route.app.app.routes.router, path << match.to_s)
+            else
+              [match, params, route, path]
+            end
           end
 
           # Rails engine routes need to be detected by inspecting Engine class route set

data/lib/contrast/framework/sinatra/support.rb

@@ -1,8 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'
-require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
   module Framework
@@ -10,7 +9,6 @@ module Contrast
       # Used when Sinatra is present to define framework specific behavior
       class Support
         extend Contrast::Framework::BaseSupport
-        extend Contrast::Framework::Sinatra::Patch::Support
         class << self
           def detection_class
             'Sinatra'
@@ -21,44 +19,74 @@ module Contrast
           end
 
           def application_name
-            return unless app_class
-
-            app_class.cs__class.cs__name
+            app_class&.cs__name
           end
 
           def application_root
-            return unless app_class
-
-            app_class.root
+            app_instance&.root
           end
 
           def server_type
             'sinatra'
           end
 
-          # Iterate over every class that extends Sinatra::Base, pull out its routes
-          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-          # Contrast::Api::Dtm::RouteCoverage
+          # Given an object, determine if it is a Sinatra controller with routes.
+          #
+          # @param app [Object] suspected Sinatra app.
+          # @return [Boolean]
+          def sinatra_controller? app
+            # Sinatra is loaded?
+            return false unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+            # App is a subclass of or actually is ::Sinatra::Base.
+            return false unless (app.cs__respond_to?(:<) && app < ::Sinatra::Base) || app == ::Sinatra::Base
+
+            # App has routes.
+            !app.routes.empty?
+          end
+
+          # Find all classes that subclass ::Sinatra::Base. Gather their routes.
+          #
+          # @return [Array<Contrast::Api::Dtm::RouteCoverage>] the routes found as Dtms.
           def collect_routes
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
             routes = []
-            controllers = sinatra_controllers
-            controllers.each do |clazz|
-              class_routes = sinatra_class_routes(clazz)
-              next unless class_routes
-
-              class_routes.each_pair do |method, list|
-                # item: [ Mustermann::Sinatra, [], Proc]
-                list.each do |item|
-                  routes << Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, item[0])
+            sinatra_controllers.each do |controller|
+              controller.routes.each_pair do |method, route_triplets|
+                # Sinatra stores its routes as a triplet: [Mustermann::Sinatra, [], Proc]
+                route_triplets.map(&:first).each do |route_pattern|
+                  routes << Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(controller, method, route_pattern)
                 end
               end
             end
             routes
           end
 
-          # TODO: RUBY-763
-          def current_route _request
-            nil
+          # Given the current request return a RouteCoverage dtm.
+          #
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Sinatra::Base] optionally use this controller instead of global ::Sinatra::Base.
+          # @return [Contrast::Api::Dtm::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route request, controller = ::Sinatra::Base, full_route = nil
+            return unless sinatra_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find route match--checking superclasses if necessary.
+            final_controller, route_pattern = _route_recurse(controller, method, _cleaned_route(request))
+            return unless !final_controller.nil? && !route_pattern.nil?
+
+            full_route ||= request.path_info
+
+            Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(final_controller, method, route_pattern, full_route)
+          end
+
+          # Search object space for sinatra controllers--any class that subclasses ::Sinatra::Base.
+          #
+          # @return [Array<::Sinatra::Base>] sinatra controlelrs
+          def sinatra_controllers
+            [::Sinatra::Base] + ObjectSpace.each_object(Class).select { |clazz| sinatra_controller?(clazz) }
           end
 
           def retrieve_request env
@@ -67,30 +95,63 @@ module Contrast
 
           private
 
-          def app_class
-            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
-
-            @_app_class ||= begin
-              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
-              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-              result_layer
+          # Given a controller and a route to match against, find the route_pattern and class that will serve the
+          # route. This is recursive as Sinatra's routing is recursive from subclass to super.
+          #
+          # @param controller [Sinatra::Base, #routes] a Sinatra application.
+          # @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
+          # @param method [String] the relative route passed from Rack.
+          # @return [Array[Sinatra::Base, Mustermann::Sinatra], nil] Either the controller that
+          # will handle the route along with the route pattern or nil if no match.
+          def _route_recurse controller, method, route
+            return if controller.nil? || controller.cs__class == NilClass
+
+            route_patterns = controller.routes.fetch(method, []).map(&:first)
+            route_pattern = route_patterns&.find do |matcher|
+              matcher.params(route) # ::Mustermann::Sinatra match.
             end
+
+            return controller, route_pattern if route_pattern
+
+            # Check routes defined in superclass if present.
+            return unless controller.superclass&.instance_variable_get(:@routes)
+
+            _route_recurse(controller.superclass, method, route)
           end
 
-          # Iterate over every class that extends Sinatra::Base, pull out its routes
-          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-          # Contrast::Api::Dtm::RouteCoverage
-          def sinatra_controllers
-            return [] unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+          # Get route and do some cleanup matching that of Sinatra::Base#process_route.
+          #
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @return [String] the extracted and cleaned relative route.
+          def _cleaned_route request
+            settings = ::Sinatra::Base.settings
+            route = request.env[::Rack::PATH_INFO]
+            return '/' if route.empty? && !settings.empty_path_info?
+
+            !settings.strict_paths? && route.end_with?('/') ? route[0..-2] : route
+          end
 
-            Contrast::Utils::ClassUtil.descendants(::Sinatra::Base)
+          # Almost an alias to app_instance.
+          #
+          # @return [::Sinatra::Base] the current controller class as routed by Rack.
+          def app_class
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            app_instance.cs__class
           end
 
-          def sinatra_class_routes controller
-            controller.instance_variable_get(:@routes) if controller.instance_variable_defined?(:@routes)
-          rescue StandardError
-            logger.trace('Sinatra controller found with no route instances', module: controller)
-            nil
+          # Search the object space for the controller handling this request which will be
+          # the class inheriting from ::Sinatra::Base with @app=nil since it is the final servicer
+          # in the request/middleware chain.
+          #
+          # @return [::Sinatra::Base] the current controller as routed by Rack.
+          def app_instance
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            @_app_instance ||= begin
+              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+              sinatra_layers.find { |layer| layer.app.nil? }
+            end
           end
         end
       end

data/lib/contrast/funchook/funchook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -12,11 +12,7 @@ module Funchook
   ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
 
   # Top level agent directories that should have the funchook libraries
-  SEARCH_DIRS = [
-    File.join('ext'),
-    File.join('shared_libraries'),
-    File.join('funchook', 'src')
-  ].cs__freeze
+  SEARCH_DIRS = [File.join('ext'), File.join('shared_libraries'), File.join('funchook', 'src')].cs__freeze
 
   AGENT_ROOT = File.join(__dir__, '..', '..', '..')
 

data/lib/contrast/logger/application.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -16,10 +16,8 @@ module Contrast
       def application_environment
         return unless info?
 
-        info('Process environment information',
-             p_id: Process.pid,
-             pp_id: Process.ppid,
-             agent_version: Contrast::Agent::VERSION)
+        info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
+                                                agent_version: Contrast::Agent::VERSION)
         ENV.each do |env_key, env_value|
           env_key = env_key.to_s
           next unless ENV_KEYS.include?(env_key) ||
@@ -35,7 +33,9 @@ module Contrast
 
         loggable = CONFIG.loggable
         info('Current configuration', configuration: loggable)
-        env_keys = ENV.keys.select { |env_key| env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) }
+        env_keys = ENV.keys.select do |env_key|
+          env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER)
+        end
         env_items = env_keys.map { |env_key| Contrast::Utils::EnvConfigurationItem.new(env_key, nil) }
         env_translations = env_items.each_with_object({}) do |conversion, hash|
           hash[conversion.key] = conversion.dot_path_array.join('.')
@@ -52,7 +52,10 @@ module Contrast
       end
 
       FRAMEWORKS = %w[rails sinatra grape].cs__freeze
-      WEB_SERVERS = %w[agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn webrick yarn].cs__freeze
+      WEB_SERVERS = %w[
+        agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn
+        webrick yarn
+      ].cs__freeze
       LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
       def log_specific_libraries
         FRAMEWORKS.each(&cs__method(:log_gem_data))
@@ -67,6 +70,7 @@ module Contrast
 
         Gem.loaded_specs.each_pair do |_name, gem_spec|
           debug('Gem loaded',
+                # rubocop:disable Security/Module/Name -- gems builtin.
                 gem_name: gem_spec.name,
                 gem_version: gem_spec.version.to_s)
         end
@@ -76,9 +80,8 @@ module Contrast
         gem_spec = Gem.loaded_specs[gem_name]
         return unless gem_spec
 
-        info('Gem loaded',
-             gem_name: gem_spec.name,
-             gem_version: gem_spec.version.to_s)
+        info('Gem loaded', gem_name: gem_spec.name, gem_version: gem_spec.version.to_s)
+        # rubocop:enable Security/Module/Name
       end
     end
   end

data/lib/contrast/logger/format.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ougai'
@@ -43,9 +43,7 @@ module Contrast
       def thread_hash
         hash = LOG_TRACKER.get(:logging_hash)
         unless hash
-          hash = {
-              thread_id: Thread.current.object_id
-          }
+          hash = { thread_id: Thread.current.object_id }
           LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
@@ -53,8 +51,7 @@ module Contrast
 
       NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
       def request_hash
-        @request_tracker_defined ||= defined?(Contrast::Agent) &&
-            defined?(Contrast::Agent::REQUEST_TRACKER)
+        @request_tracker_defined ||= defined?(Contrast::Agent) && defined?(Contrast::Agent::REQUEST_TRACKER)
         return NO_REQUEST_HASH unless @request_tracker_defined
 
         Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH