contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/server_features.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -106,7 +106,9 @@ module Contrast
             event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
             event_dtm.build_parent_ids!(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
+            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret,
+                                                                                contrast_event.policy_node,
+                                                                                contrast_event.args)
             event_dtm
           end
         end

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -52,9 +52,7 @@ module Contrast
             tmp = []
             tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
             tmp << ELLIPSIS
-            tmp << obj_string[
-                obj_string.length - UNTRUNCATED_PORTION_LENGTH,
-                UNTRUNCATED_PORTION_LENGTH]
+            tmp << obj_string[obj_string.length - UNTRUNCATED_PORTION_LENGTH, UNTRUNCATED_PORTION_LENGTH]
             tmp.join
           end
         end

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -97,12 +97,7 @@ module Contrast
           DATABASE_WRITE
         ].cs__freeze
 
-        VALID_SOURCE_TAGS = %w[
-          NO_NEWLINES
-          UNTRUSTED
-          CROSS_SITE
-          LIMITED_CHARS
-        ].cs__freeze
+        VALID_SOURCE_TAGS = %w[NO_NEWLINES UNTRUSTED CROSS_SITE LIMITED_CHARS].cs__freeze
       end
     end
   end

data/lib/contrast/api/decorators/user_input.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/components/agent.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
@@ -36,7 +36,7 @@ module Contrast
         end
 
         def ruleset
-          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_ruleset&.values)
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_protect_ruleset&.values)
         end
 
         def reset_ruleset
@@ -69,8 +69,10 @@ module Contrast
         def exception_control
           @_exception_control ||= {
               enable: true?(CONFIG.root.agent.ruby.exceptions.capture),
-              status: CONFIG.root.agent.ruby.exceptions.override_status || 403,
-              message: CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+              status:
+                CONFIG.root.agent.ruby.exceptions.override_status || 403,
+              message:
+                CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
           }
         end
 
@@ -80,8 +82,9 @@ module Contrast
           loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
         end
 
+        # Insert ourselves into the application, keeping our middleware at the outermost layer of the onion
         def insert_middleware app
-          app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
+          app.middleware.insert_before 0, Contrast::Agent::Middleware
         end
 
         def enable_tracepoint
@@ -94,20 +97,16 @@ module Contrast
         # Ruby exposed the C method for interpolation in version 2.6.0, meaning
         # we can attempt to patch using Funchook for that version and later.
         def interpolation_patch_possible?
-          @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
+          if @_interpolation_patch_possible.nil?
+            @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION
+          end
           @_interpolation_patch_possible
         end
 
-        def retrieve_ruleset
-          return {} unless enabled?
+        def retrieve_protect_ruleset
+          return {} unless enabled? && PROTECT.enabled?
 
-          if ASSESS.enabled? && PROTECT.enabled?
-            ASSESS.rules.merge(PROTECT.rules)
-          elsif ASSESS.enabled?
-            ASSESS.rules
-          else
-            PROTECT.rules
-          end
+          PROTECT.rules
         end
       end
 

data/lib/contrast/components/app_context.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
@@ -37,9 +37,9 @@ module Contrast
           end
         end
 
-        def name
-          @_name ||= begin
-            tmp = CONFIG.root.application.name
+        def app_name
+          @_app_name ||= begin
+            tmp = CONFIG.root.application.name # rubocop:disable Security/Module/Name
             tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
@@ -59,7 +59,7 @@ module Contrast
 
         def server_name
           @_server_name ||= begin
-            tmp = CONFIG.root.server.name
+            tmp = CONFIG.root.server.name # rubocop:disable Security/Module/Name
             tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
@@ -88,7 +88,7 @@ module Contrast
                       server_name: msg.server_name,
                       server_path: msg.server_path,
                       server_type: msg.server_type,
-                      application_name: name,
+                      application_name: app_name,
                       application_path: path,
                       application_language: Contrast::Utils::ObjectShare::RUBY)
 
@@ -108,7 +108,7 @@ module Contrast
         end
 
         def client_id
-          @_client_id ||= [name, pgid].join('-')
+          @_client_id ||= [app_name, pgid].join('-')
         end
 
         def instrument_middleware_stack?

data/lib/contrast/components/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,7 +19,7 @@ module Contrast
           return false if forcibly_disabled?
           return true  if forcibly_enabled?
 
-          SETTINGS.assess_enabled?
+          SETTINGS.assess_state.enabled == true
         end
 
         def tainted_columns
@@ -58,10 +58,9 @@ module Contrast
         # node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
         #
         # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
-        # @param return [Boolean] to capture or not to capture, that is the question.
+        # @return [Boolean] to capture or not to capture, that is the question.
         def capture_stacktrace? policy_node
           return true if capture_stacktrace_value == :ALL
-
           return false if capture_stacktrace_value == :NONE
 
           # Below here capture_stacktrace_value must be :SOME.
@@ -90,8 +89,9 @@ module Contrast
           CONFIG.root.assess&.tags
         end
 
-        def rules
-          SETTINGS.assess_rules
+        def disabled_rules
+          # TODO: RUBY-903
+          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.assess_state.disabled_assess_rules || []
         end
 
         private
@@ -100,11 +100,6 @@ module Contrast
           @_forcibly_enabled = true?(CONFIG.root.assess.enable) if @_forcibly_enabled.nil?
           @_forcibly_enabled
         end
-
-        def disabled_rules
-          # TODO: RUBY-903
-          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.disabled_assess_rules || []
-        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/env_configuration_item'
@@ -56,7 +56,8 @@ module Contrast
 
         private
 
-        SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
+        SESSION_VARIABLES = 'Invalid configuration. '\
+                            "Setting both application.session_id and application.session_metadata is not allowed.\n"
         def validate log: false
           # The config has information about how to construct the logger.
           # If the config is invalid, and you want to know about it, then

data/lib/contrast/components/contrast_service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'
@@ -25,14 +25,13 @@ module Contrast
         def use_bundled_service?
           # Validates the config to decide if it's suitable for starting
           # the bundled service
-          @_use_bundled_service ||= begin
-            # Requirement says "must be true" but that
-            # should be "must not be false" -- oops.
-            !false?(CONFIG.root.agent.start_bundled_service) &&
-                # Either a valid host or a valid socket
-                # Path validity is the service's problem
-                (LOCALHOST.match?(host) || !!socket_path)
-          end
+
+          # Requirement says "must be true" but that
+          # should be "must not be false" -- oops.
+          @_use_bundled_service ||= !false?(CONFIG.root.agent.start_bundled_service) &&
+              # Either a valid host or a valid socket
+              # Path validity is the service's problem
+              (LOCALHOST.match?(host) || !!socket_path)
         end
 
         def host

data/lib/contrast/components/heap_dump.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/interface.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'delegate'
@@ -134,7 +134,7 @@ module Contrast
           if (mods = component_map[sym]) # rubocop:disable Style/GuardClause
             # We may support multiple components via one access request.
             mods.each do |m|
-              name = Contrast::Components.component_const_name(m.name)
+              name = Contrast::Components.component_const_name(m.cs__name)
               cs__const_set(name, m::COMPONENT_INTERFACE) if m.cs__const_defined?(:COMPONENT_INTERFACE)
               include m::InstanceMethods               if m.cs__const_defined?(:InstanceMethods, false)
               extend  m::ClassMethods                  if m.cs__const_defined?(:ClassMethods, false)
@@ -181,7 +181,8 @@ require 'contrast/components/agent'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
 
 require 'contrast/components/contrast_service'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] = [Contrast::Components::ContrastService]
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] =
+  [Contrast::Components::ContrastService]
 
 require 'contrast/components/app_context'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]

data/lib/contrast/components/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/logger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/logger/log'

data/lib/contrast/components/protect.rb

@@ -1,14 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Components
     module Protect
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Protect
-      # product.
+      # A wrapper build around the Common Agent Configuration project to allow for access of the values contained in
+      # its parent_configuration_spec.yaml.  Specifically, this allows for querying the state of the Protect product.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
@@ -20,7 +17,7 @@ module Contrast
           return false if forcibly_disabled?
           return true  if forcibly_enabled?
 
-          SETTINGS.protect_enabled?
+          SETTINGS.protect_state.enabled == true
         end
 
         def rule_config
@@ -28,15 +25,17 @@ module Contrast
         end
 
         def rules
-          SETTINGS.protect_rules
+          SETTINGS.protect_state.rules
         end
 
         def rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+          CONFIG.root.protect.rules[rule_id]&.applicable_mode ||
+              SETTINGS.application_state.modes_by_id[rule_id] ||
+              Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
         end
 
         def rule name
-          SETTINGS.protect_rules[name]
+          SETTINGS.protect_state.rules[name]
         end
 
         def report_any_command_execution?
@@ -56,15 +55,13 @@ module Contrast
         end
 
         def forcibly_disabled?
-          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
-          @_forcibly_disabled
+          @_forcibly_disabled ||= false?(CONFIG.root.protect.enable)
         end
 
         private
 
         def forcibly_enabled?
-          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
-          @_forcibly_enabled
+          @_forcibly_enabled ||= true?(CONFIG.root.protect.enable)
         end
       end
 

data/lib/contrast/components/sampling.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -65,7 +65,10 @@ module Contrast
         # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
         # @return [Integer] the resolution of the config_settings, settings, and default value
         def request_frequency config_settings, settings
-          [config_settings&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?)
+          [
+            config_settings&.request_frequency, settings&.request_frequency,
+            DEFAULT_SAMPLING_REQUEST_FREQUENCY
+          ].map(&:to_i).find(&:positive?)
         end
 
         # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
@@ -73,7 +76,10 @@ module Contrast
         # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
         # @return [Integer] the resolution of the config_settings, settings, and default value
         def response_frequency config_settings, settings
-          [config_settings&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?)
+          [
+            config_settings&.response_frequency, settings&.response_frequency,
+            DEFAULT_SAMPLING_RESPONSE_FREQUENCY
+          ].map(&:to_i).find(&:positive?)
         end
 
         # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by

data/lib/contrast/components/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fiber'
@@ -109,6 +109,7 @@ module Contrast
 
         def with_deserialization_scope
           scope_for_current_ec.enter_deserialization_scope!
+          yield
         ensure
           scope_for_current_ec.exit_deserialization_scope!
         end