contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/agent/thread_watcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -37,7 +37,7 @@ module Contrast
 
             Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
             Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
-            Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module)
+            Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module) if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
             Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)
           end
         end

data/lib/contrast/agent/version.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Agent
-    VERSION = '4.4.0'
+    VERSION = '4.8.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/connection_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/messaging_queue.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/api/communication/response_processor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reaction_processor'
@@ -24,10 +24,8 @@ module Contrast
 
           Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
-          logger.trace(
-              'Agent settings updated in response to Service',
-              protect_on: PROTECT.enabled?,
-              assess_on: ASSESS.enabled?)
+          logger.trace('Agent settings updated in response to Service', protect_on: PROTECT.enabled?,
+                                                                        assess_on: ASSESS.enabled?)
         end
 
         private
@@ -70,12 +68,12 @@ module Contrast
 
           logger.trace_with_time('Rebuilding rule modes') do
             SETTINGS.build_protect_rules if PROTECT.enabled?
-            SETTINGS.build_assess_rules  if ASSESS.enabled?
             AGENT.reset_ruleset
 
             logger.info('Current rule settings:')
+
             PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
-            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+            logger.info('Disabled Assess Rules', rules: ASSESS.disabled_rules)
           end
         end
       end

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -21,12 +21,14 @@ module Contrast
           is_service_started
         end
 
-        # check if there's a zombie service that exists, and wait on it if so.
-        # currently, this only happens when trying to initialize speedracer
+        # check if there's a zombie service that exists, and wait on it if so. currently, this only happens when trying
+        # to initialize speedracer
         def zombie_check
           zombie_pid_list = Contrast::Utils::OS.zombie_pids
           zombie_pid_list.each do |pid|
             Process.wait(pid.to_i)
+          rescue Errno::ECHILD => _e
+            # Sometimes the zombie process dies between us finding it and killing it
           end
         end
 

data/lib/contrast/api/communication/socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket_client.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'socket'
@@ -52,16 +52,13 @@ module Contrast
           end
           # The host & port are set,
           if CONFIG.root.agent.service.host && CONFIG.root.agent.service.port
-            logger.info('Connecting to the Contrast Service using a TCP socket',
-                        host: CONTRAST_SERVICE.host,
-                        port: CONTRAST_SERVICE.port)
+            logger.info('Connecting to the Contrast Service using a TCP socket', host: CONTRAST_SERVICE.host,
+                                                                                 port: CONTRAST_SERVICE.port)
             return
           end
 
           # Or something is not set.
-          logger.warn(log_connection_error_msg,
-                      host: CONTRAST_SERVICE.host,
-                      port: CONTRAST_SERVICE.port)
+          logger.warn(log_connection_error_msg, host: CONTRAST_SERVICE.host, port: CONTRAST_SERVICE.port)
         end
 
         # If our connection isn't built properly, we need to warn the user. This builds out the context specific
@@ -87,26 +84,16 @@ module Contrast
         def send_message msg
           return unless msg
 
-          logger.debug('Sending message.',
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count)
+          logger.debug('Sending message.', msg_id: msg.__id__, p_id: msg.pid, msg_count: msg.message_count)
           to_service = Contrast::Api::Dtm::Message.encode(msg)
           from_service = send_marshaled(to_service)
           response = Contrast::Api::Settings::AgentSettings.decode(from_service)
-          logger.debug('Received response.',
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count,
-                       response_id: response&.__id__)
+          logger.debug('Received response.', msg_id: msg.__id__, p_id: msg.pid, msg_count: msg.message_count,
+                                             response_id: response&.__id__)
           response
         rescue StandardError => e
-          logger.error('Sending failed for message.',
-                       e,
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count,
-                       response_id: response&.__id__)
+          logger.error('Sending failed for message.', e, msg_id: msg.__id__, p_id: msg.pid,
+                                                         msg_count: msg.message_count, response_id: response&.__id__)
           raise e # reraise to let Speedracer manage the connection
         end
 

data/lib/contrast/api/communication/speedracer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -58,22 +58,19 @@ module Contrast
         def send_to_speedracer event
           ensure_startup!
 
-          logger.debug_with_time(event.cs__class.name) do
+          logger.debug_with_time(event.cs__class.cs__name) do
             response = socket_client.send_one event
             status.success!
             yield response
           end
         rescue StandardError => e
           status.failure!
-          logger.error('Unable to send message.', e,
-                       event_id: event.__id__,
-                       event_type: event.cs__class.name)
+          logger.error('Unable to send message.', e, event_id: event.__id__, event_type: event.cs__class.cs__name)
           nil
         end
 
         def send_initialization_messages
           agent_startup_msg = APP_CONTEXT.build_agent_startup_message
-          app_startup_msg = APP_CONTEXT.build_app_startup_message
 
           logger.debug('Preparing to send startup messages')
           # 1 initial attempt, + 3 potential retries.
@@ -82,7 +79,8 @@ module Contrast
             log_send_event(agent_startup_msg)
             next unless (agent_response = socket_client.send_one(agent_startup_msg))
 
-            # Connection was successful
+            # Connection was successful; send app create with the resolved features.
+            app_startup_msg = APP_CONTEXT.build_app_startup_message
             log_send_event(app_startup_msg)
             app_response = socket_client.send_one(app_startup_msg)
 
@@ -101,9 +99,7 @@ module Contrast
         end
 
         def log_send_event event
-          logger.debug('Immediately sending event.',
-                       event_id: event.__id__,
-                       event_type: event.cs__class.name)
+          logger.debug('Immediately sending event.', event_id: event.__id__, event_type: event.cs__class.cs__name)
         end
       end
     end

data/lib/contrast/api/communication/tcp_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/communication/unix_socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/communication/socket'

data/lib/contrast/api/decorators.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/decorators/address.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/agent_startup.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/application_startup.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/instrumentation_mode'
 require 'contrast/components/interface'
 require 'contrast/utils/string_utils'
 
@@ -25,10 +26,11 @@ module Contrast
           # @return [Contrast::Api::Dtm::ApplicationCreate]
           def build
             msg = new
-            msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
             msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
             msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+            msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
             msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
+            msg.mode             = Contrast::Api::Dtm::InstrumentationMode.build
             session!(msg)
             msg
           end
@@ -39,8 +41,12 @@ module Contrast
           #
           # @param msg [Contrast::Api::Dtm::ApplicationCreate]
           def session! msg
-            msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
-            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+            msg.session_id = Contrast::Utils::StringUtils.protobuf_format(
+                CONFIG.root.application.session_id,
+                truncate: false)
+            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format(
+                CONFIG.root.application.session_metadata,
+                truncate: false)
           end
         end
       end

data/lib/contrast/api/decorators/application_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/api/decorators/http_request.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/instrumentation_mode.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InstrumentationMode protobuf model to handle reporting Agent process start
+      module InstrumentationMode
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::InstrumentationMode]
+          def build
+            msg = new
+            msg.assess =  ASSESS.enabled?
+            msg.protect = PROTECT.enabled?
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::InstrumentationMode.include(Contrast::Api::Decorators::InstrumentationMode)

data/lib/contrast/api/decorators/library.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -10,6 +10,8 @@ module Contrast
     module Decorators
       # Used to decorate the Library protobuf model to handle Gem::Specification translation
       module Library
+        StringUtils = Contrast::Utils::StringUtils
+
         def self.included klass
           klass.extend(ClassMethods)
         end
@@ -18,13 +20,13 @@ module Contrast
         module ClassMethods
           def build digest, gem_specification
             msg = new
-            msg.file_path = Contrast::Utils::StringUtils.force_utf8(gem_specification.name)
-            msg.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
-            msg.version     = Contrast::Utils::StringUtils.force_utf8(gem_specification.version)
-            msg.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(gem_specification))
+            msg.file_path = StringUtils.force_utf8(gem_specification.name) # rubocop:disable Security/Module/Name
+            msg.hash_code   = StringUtils.force_utf8(digest)
+            msg.version     = StringUtils.force_utf8(gem_specification.version)
+            msg.manifest    = StringUtils.force_utf8(build_manifest(gem_specification))
             msg.external_ms = date_to_ms(gem_specification.date)
             msg.internal_ms = msg.external_ms
-            msg.url         = Contrast::Utils::StringUtils.force_utf8(gem_specification.homepage)
+            msg.url         = StringUtils.force_utf8(gem_specification.homepage)
             msg.class_count = file_count(gem_specification.full_gem_path.to_s)
             msg.used_class_count = 0
             msg
@@ -37,7 +39,7 @@ module Contrast
           end
 
           def build_manifest spec
-            Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s)
+            StringUtils.force_utf8(spec.to_yaml.to_s)
           rescue StandardError
             nil
           end

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/message.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'
@@ -38,7 +38,7 @@ module Contrast
           when Contrast::Api::Dtm::ObservedRoute
             self.observed_route = event
           else
-            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
+            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.cs__name)
             return
           end
           logger.debug('Wrapping event in message',
@@ -46,7 +46,7 @@ module Contrast
                        p_id: pid,
                        msg_count: message_count,
                        event_id: event.__id__,
-                       event_type: event.cs__class.name)
+                       event_type: event.cs__class.cs__name)
         end
 
         # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
@@ -58,7 +58,7 @@ module Contrast
 
           def build event
             msg = new
-            msg.app_name      = APP_CONTEXT.name
+            msg.app_name      = APP_CONTEXT.app_name
             msg.app_path      = APP_CONTEXT.path
             msg.app_language  = Contrast::Utils::ObjectShare::RUBY
             msg.client_id     = APP_CONTEXT.client_id