contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/components/settings.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/api/settings.pb'
+
 module Contrast
   module Components
     # This component encapsulates the statefulness of settings.
@@ -8,134 +10,61 @@ module Contrast
     # directives (likely provided by TeamServer) about product operation.
     # 'Settings' is not a generic term for 'configurable stuff'.
     module Settings
+      APPLICATION_STATE_BASE = Struct.new(:modes_by_id, :exclusion_matchers).
+          new(Hash.new(Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION), [])
+      PROTECT_STATE_BASE = Struct.new(:enabled, :rules).new(false, {})
+      ASSESS_STATE_BASE = Struct.new(:enabled, :sampling_settings, :disabled_assess_rules).new(false, nil, []) do
+        def sampling_settings= new_val
+          @sampling_settings = new_val
+          Contrast::Utils::Assess::SamplingUtil.instance.update
+        end
+      end
+
       # This is a class.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
         access_component :config
 
-        attr_reader :assess_rules,
-                    :protect_rules
-
-        # Other stateful information that doesn't yet cleanly fit anywhere:
-
         # tainted_columns are database columns that receive unsanitized input.
-        # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
-
-        # These three 'state' variables represent atomic config/setting state,
-        # outside of things like rule defs.
-
-        def assess_state
-          @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,        # Boolean
-              sampling_features: nil # Contrast::Api::Settings::Sampling
-          }
-        end
-
-        def protect_state
-          @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false
-          }
-        end
-
-        def application_state
-          @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              modes_by_id: Hash.new(:NO_ACTION),
-              exclusion_matchers: [],
-              disabled_assess_rules: []
-          }
-        end
-
-        # These are settings that we receive & store.
-        # Rules are settings too, but they're more involved.
-        # So, between this block and rules, that's setting state.
-        PROTECT_STATE_ATTRS       = %i[].cs__freeze
-        ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
-
-        # Meta-define an accessor for each state attribute.
-
-        PROTECT_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            protect_state[attr]
-          end
-        end
-
-        ASSESS_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            assess_state[attr]
-          end
-        end
-
-        APPLICATION_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            application_state[attr]
-          end
-        end
+        attr_reader :assess_state, :protect_state, :application_state
 
         def initialize
           reset_state
         end
 
-        def protect_enabled?
-          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
-          @_protect_enabled
-        end
-
-        def assess_enabled?
-          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
-          @_assess_enabled
-        end
-
         def code_exclusions
-          exclusion_matchers.select(&:code?)
+          @application_state.exclusion_matchers.select(&:code?)
         end
 
         # @param server_features [Contrast::Api::Settings::ServerFeatures]
         def update_from_server_features server_features
-          # protect
-
-          @_protect_enabled = nil
-          protect_state[:enabled] = server_features.protect_enabled?
-
-          # assess
-
-          @_assess_enabled = nil
-          assess_state[:enabled] = server_features.assess_enabled?
-          assess_state[:sampling_settings] = server_features.assess.sampling
-          Contrast::Utils::Assess::SamplingUtil.instance.update
+          @protect_state.enabled = server_features.protect_enabled?
+          @assess_state.enabled = server_features.assess_enabled?
+          @assess_state.sampling_settings = server_features.assess.sampling
         end
 
         # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
         def update_from_application_settings application_settings
-          application_state.merge!(application_settings.application_state_translation)
+          new_vals = application_settings.application_state_translation
+          @application_state.modes_by_id = new_vals[:modes_by_id]
+          @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+          @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
         end
 
         # Wipe state to zero.
         def reset_state
-          @assess_rules = {}
-          @protect_rules = {}
-
+          @protect_state = PROTECT_STATE_BASE.dup
+          @assess_state = ASSESS_STATE_BASE.dup
+          @application_state = APPLICATION_STATE_BASE.dup
           @tainted_columns = {}
-
-          @assess_state = nil
-          @protect_state = nil
-          @application_state = nil
-        end
-
-        def build_assess_rules
-          # TODO: RUBY-1120 actually build assess_rules.
-          @assess_rules = {}
         end
 
         def build_protect_rules
-          @protect_rules = {}
+          @protect_state.rules = {}
 
-          # rules
+          # Rules. They add themselves on initialize.
           Contrast::Agent::Protect::Rule::CmdInjection.new
           Contrast::Agent::Protect::Rule::Deserialization.new
           Contrast::Agent::Protect::Rule::HttpMethodTampering.new

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/agent_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/application_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/default_value'

data/lib/contrast/config/assess_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/assess_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,9 +6,7 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # disabled assess rule functionality of the Agent.
     class AssessRulesConfiguration < BaseConfiguration
-      KEYS = {
-          disabled_rules: EMPTY_VALUE
-      }.cs__freeze
+      KEYS = { disabled_rules: EMPTY_VALUE }.cs__freeze
 
       def initialize hsh
         super(hsh, KEYS)

data/lib/contrast/config/base_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'forwardable'
@@ -17,10 +17,7 @@ module Contrast
       attr_reader :map
 
       alias_method :to_hash, :map
-      def_delegators :@map, :empty?, :key?,
-                     :delete,
-                     :fetch, :[], :[]=,
-                     :each, :each_pair, :each_key, :each_value
+      def_delegators :@map, :empty?, :key?, :delete, :fetch, :[], :[]=, :each, :each_pair, :each_key, :each_value
 
       EMPTY_VALUE = :EMPTY_VALUE
 
@@ -35,7 +32,9 @@ module Contrast
           current_level = current_level.send(segment) if current_level.cs__respond_to?(segment)
         end
         last_entry = dot_path_array[-1]
-        current_level.send("#{ last_entry }=", value) if current_level.nil? == false && current_level.cs__respond_to?(last_entry)
+        if current_level.nil? == false && current_level.cs__respond_to?(last_entry)
+          current_level.send("#{ last_entry }=", value)
+        end
         nil
       end
 

data/lib/contrast/config/default_value.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/exception_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,11 +7,7 @@ module Contrast
     # exception handling in Ruby, allowing for the override of Response Code
     # and Message when Security Exceptions are raised.
     class ExceptionConfiguration < BaseConfiguration
-      KEYS = {
-          capture: EMPTY_VALUE,
-          override_status: EMPTY_VALUE,
-          override_message: EMPTY_VALUE
-      }.cs__freeze
+      KEYS = { capture: EMPTY_VALUE, override_status: EMPTY_VALUE, override_message: EMPTY_VALUE }.cs__freeze
 
       def initialize hsh
         super(hsh, KEYS)

data/lib/contrast/config/heap_dump_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,12 +7,18 @@ module Contrast
     # Heap Dump collection functionality of the Agent.
     class HeapDumpConfiguration < BaseConfiguration
       KEYS = {
-          enable: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE), # should dumps be taken
-          path: Contrast::Config::DefaultValue.new('contrast_heap_dumps'),                 # dir to which dumps should be saved
-          delay_ms: Contrast::Config::DefaultValue.new(10_000),                            # time, in ms, after initialization to delay before taking dump
-          window_ms: Contrast::Config::DefaultValue.new(10_000),                           # ms between each dump
-          count: Contrast::Config::DefaultValue.new(5),                                    # number of dumps to take
-          clean: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE)   # remove temporary objects
+          enable:                                                                   # should dumps be taken
+            Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE),
+          path:                                                                     # dir to which dumps should be
+            Contrast::Config::DefaultValue.new('contrast_heap_dumps'), #   saved
+          delay_ms:                                                                 # time, in ms, after initialization
+            Contrast::Config::DefaultValue.new(10_000), #   to delay before taking dump
+          window_ms:                                                                # ms between each dump
+            Contrast::Config::DefaultValue.new(10_000), #
+          count:                                                                    # number of dumps to take
+            Contrast::Config::DefaultValue.new(5), #
+          clean:                                                                    # remove temporary objects or not
+            Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE)  #
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/inventory_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/logger_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,11 +6,7 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # logging in the Agent.
     class LoggerConfiguration < BaseConfiguration
-      KEYS = {
-          path: EMPTY_VALUE,
-          level: EMPTY_VALUE,
-          progname: EMPTY_VALUE
-      }.cs__freeze
+      KEYS = { path: EMPTY_VALUE, level: EMPTY_VALUE, progname: EMPTY_VALUE }.cs__freeze
 
       def initialize hsh
         super(hsh, KEYS)

data/lib/contrast/config/protect_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -18,6 +18,28 @@ module Contrast
       def initialize hsh
         super(hsh, KEYS)
       end
+
+      # To convert the user input mode from config to a standard format used by TS & SR, we need to convert the given
+      # String to its Contrast::Api::Settings::ProtectionRule::Mode equivalent. If a nonsense value is provided, it'll
+      # be treated the same as disabling the rule.
+      #
+      # @return [Contrast::Api::Settings::ProtectionRule::Mode, nil]
+      def applicable_mode
+        return unless mode
+
+        case mode
+        when 'permit'
+          Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+        when 'block_at_perimeter'
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
+        when 'block'
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
+        when 'monitor'
+          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
+        else
+          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
+        end
+      end
     end
   end
 end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/root_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/ruby_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/sampling_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/server_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/service_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/default_value'

data/lib/contrast/configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'
@@ -25,16 +25,8 @@ module Contrast
 
     DEFAULT_YAML_PATH  = 'contrast_security.yaml'
     MILLISECOND_MARKER = '_ms'
-    CONVERSION = {
-        'agent.service.enable' => 'agent.start_bundled_service'
-    }.cs__freeze
-    CONFIG_BASE_PATHS = [
-      '',
-      'config/',
-      '/etc/contrast/ruby/',
-      '/etc/contrast/',
-      '/etc/'
-    ].cs__freeze
+    CONVERSION = { 'agent.service.enable' => 'agent.start_bundled_service' }.cs__freeze
+    CONFIG_BASE_PATHS = ['', 'config/', '/etc/contrast/ruby/', '/etc/contrast/', '/etc/'].cs__freeze
 
     def initialize cli_options = nil, default_name = DEFAULT_YAML_PATH
       @default_name = default_name
@@ -189,10 +181,7 @@ module Contrast
     # When we fail to parse a configuration because it is misformatted, log an
     # appropriate message based on the Agent Onboarding specification
     def log_yaml_parse_error path, exception
-      hash = {
-          path: path,
-          pwd: Dir.pwd
-      }
+      hash = { path: path, pwd: Dir.pwd }
       if exception.is_a?(Psych::SyntaxError)
         hash[:context] = exception.context
         hash[:column] = exception.column