contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/agent/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/service_heartbeat.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/agent/worker_thread'
 
 module Contrast
@@ -9,8 +9,7 @@ module Contrast
     # The ServiceHeartbeat functions to keep the Contrast Service alive and
     # ensure that it maintains this Agent's ApplicationContext.
     class ServiceHeartbeat < WorkerThread
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
@@ -21,9 +20,8 @@ module Contrast
         @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
-            begin
-              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
-            end
+            Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+
             sleep REFRESH_INTERVAL_SEC
           end
         end

data/lib/contrast/agent/static_analysis.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-require 'contrast/agent/inventory'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/api/decorators/application_update'
 
 module Contrast
@@ -10,8 +10,9 @@ module Contrast
     # this module handles one time static analysis tasks
     class StaticAnalysis
       include Singleton
-      include Contrast::Components::Interface
-      access_component :logging, :analysis, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
+
       class << self
         # After the first request is complete, we do a one-time manual catchup to review and
         # report the already-loaded gems.
@@ -23,7 +24,7 @@ module Contrast
         end
 
         def send_inventory_message
-          return unless INVENTORY.enabled?
+          return unless ::Contrast::INVENTORY.enabled?
 
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
 

data/lib/contrast/agent/thread.rb

@@ -1,15 +1,13 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 
 module Contrast
   module Agent
     # Threads used by Contrast. Any long running thread should be created and managed by our ThreadWatcher class.
     class Thread < ::Thread
-      include Contrast::Components::Interface
-
-      access_component :scope
+      include Contrast::Components::Scope::InstanceMethods
 
       # Make our internal code run in Contrast scope.
       def initialize *args

data/lib/contrast/agent/thread_watcher.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/agent/service_heartbeat'
 require 'contrast/api/communication/messaging_queue'
 
@@ -13,8 +13,7 @@ module Contrast
     # @attr_reader heartbeat [Contrast::Agent::ServiceHeartbeat]
     # @attr_reader messaging_queue [Contrast::Api::Communication::MessagingQueue]
     class ThreadWatcher
-      include Contrast::Components::Interface
-      access_component :agent, :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       attr_reader :heapdump_util, :heartbeat, :messaging_queue
 
@@ -26,7 +25,7 @@ module Contrast
       end
 
       def startup!
-        return unless AGENT.enabled?
+        return unless ::Contrast::AGENT.enabled?
 
         unless heartbeat.running?
           logger.debug('Attempting to start heartbeat thread')

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,15 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Agent
     # This module is used to apply instrumentation to classes as they are required
     module TracePointHook
-      include Contrast::Components::Interface
-
-      access_component :logging, :scope
+      extend Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::Scope::InstanceMethods
 
       class << self
         def enable!
@@ -37,7 +37,7 @@ module Contrast
 
             Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
             Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
-            Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module)
+            Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module) if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
             Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)
           end
         end

data/lib/contrast/agent/version.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Agent
-    VERSION = '4.4.1'
+    VERSION = '4.9.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/connection_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/messaging_queue.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/agent/worker_thread'
 
 module Contrast
@@ -9,8 +9,7 @@ module Contrast
     module Communication
       # Top level gateway to messaging with speedracer
       class MessagingQueue < Contrast::Agent::WorkerThread
-        include Contrast::Components::Interface
-        access_component :agent, :analysis, :logging, :settings
+        include Contrast::Components::Logger::InstanceMethods
 
         attr_reader :queue, :speedracer
 
@@ -22,7 +21,7 @@ module Contrast
 
         # Use this to bypass the messaging queue and leave response processing to the caller
         def send_event_immediately event
-          if AGENT.disabled?
+          if ::Contrast::AGENT.disabled?
             logger.warn('Attempted to send event immediately with Agent disabled', caller: caller, event: event)
             return
           end
@@ -31,7 +30,7 @@ module Contrast
 
         # Use this to add a message to the queue and process the response internally
         def send_event_eventually event
-          if AGENT.disabled?
+          if ::Contrast::AGENT.disabled?
             logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
             return
           end

data/lib/contrast/api/communication/response_processor.rb

@@ -1,15 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reaction_processor'
+require 'contrast/components/logger'
 
 module Contrast
   module Api
     module Communication
       # Handles processing deferred messages
       class ResponseProcessor
-        include Contrast::Components::Interface
-        access_component :agent, :analysis, :logging, :settings
+        include Contrast::Components::Logger::InstanceMethods
 
         # @param response [Contrast::Api::Settings::AgentSettings]
         def process response
@@ -24,10 +24,8 @@ module Contrast
 
           Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
-          logger.trace(
-              'Agent settings updated in response to Service',
-              protect_on: PROTECT.enabled?,
-              assess_on: ASSESS.enabled?)
+          logger.trace('Agent settings updated in response to Service', protect_on: ::Contrast::PROTECT.enabled?,
+                                                                        assess_on: ::Contrast::ASSESS.enabled?)
         end
 
         private
@@ -42,7 +40,7 @@ module Contrast
 
           logger.trace('Agent: Received updated server features')
 
-          SETTINGS.update_from_server_features(server_features)
+          ::Contrast::SETTINGS.update_from_server_features(server_features)
 
           server_features
         end
@@ -57,7 +55,7 @@ module Contrast
 
           logger.debug('Agent: Received updated application settings')
 
-          SETTINGS.update_from_application_settings(app_settings)
+          ::Contrast::SETTINGS.update_from_application_settings(app_settings)
 
           app_settings
         end
@@ -66,16 +64,16 @@ module Contrast
         # I don't think it should go into contrast_service because that only handles connection specific data
         def update_features server_features, app_settings
           return unless !!(server_features || app_settings)
-          return unless AGENT.enabled?
+          return unless ::Contrast::AGENT.enabled?
 
           logger.trace_with_time('Rebuilding rule modes') do
-            SETTINGS.build_protect_rules if PROTECT.enabled?
-            SETTINGS.build_assess_rules  if ASSESS.enabled?
-            AGENT.reset_ruleset
+            ::Contrast::SETTINGS.build_protect_rules if ::Contrast::PROTECT.enabled?
+            ::Contrast::AGENT.reset_ruleset
 
             logger.info('Current rule settings:')
-            PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
-            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+
+            ::Contrast::PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
+            logger.info('Disabled Assess Rules', rules: ::Contrast::ASSESS.disabled_rules)
           end
         end
       end

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -1,13 +1,14 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Api
     module Communication
       # Handles local service startup
       module ServiceLifecycle
-        include Contrast::Components::Interface
-        access_component :logging, :contrast_service
+        include Contrast::Components::Logger::InstanceMethods
 
         def attempt_local_service_startup
           zombie_check
@@ -21,18 +22,20 @@ module Contrast
           is_service_started
         end
 
-        # check if there's a zombie service that exists, and wait on it if so.
-        # currently, this only happens when trying to initialize speedracer
+        # check if there's a zombie service that exists, and wait on it if so. currently, this only happens when trying
+        # to initialize speedracer
         def zombie_check
           zombie_pid_list = Contrast::Utils::OS.zombie_pids
           zombie_pid_list.each do |pid|
             Process.wait(pid.to_i)
+          rescue Errno::ECHILD => _e
+            # Sometimes the zombie process dies between us finding it and killing it
           end
         end
 
         def determine_startup_options
-          return { out: :out, err: :out } if CONTRAST_SERVICE.logger_path == 'STDOUT'
-          return { out: :err, err: :err } if CONTRAST_SERVICE.logger_path == 'STDERR'
+          return { out: :out, err: :out } if ::Contrast::CONTRAST_SERVICE.logger_path == 'STDOUT'
+          return { out: :err, err: :err } if ::Contrast::CONTRAST_SERVICE.logger_path == 'STDERR'
 
           { out: File::NULL, err: File::NULL }
         end

data/lib/contrast/api/communication/socket.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/communication/socket_client.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'socket'
@@ -6,7 +6,7 @@ require 'uri'
 
 require 'contrast/api/communication/tcp_socket'
 require 'contrast/api/communication/unix_socket'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Api
@@ -14,8 +14,7 @@ module Contrast
       # SocketClient acts as a interface between the agent and the service. It instantiates a
       # service proxy and tracks the state of that proxy.
       class SocketClient
-        include Contrast::Components::Interface
-        access_component :config, :contrast_service, :logging
+        include Contrast::Components::Logger::InstanceMethods
 
         def initialize
           @socket = init_connection
@@ -36,32 +35,34 @@ module Contrast
 
         def init_connection
           log_connection
-          if CONTRAST_SERVICE.use_tcp?
-            Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
+          if ::Contrast::CONTRAST_SERVICE.use_tcp?
+            Contrast::Api::Communication::TcpSocket.new(
+              ::Contrast::CONTRAST_SERVICE.host, ::Contrast::CONTRAST_SERVICE.port
+            )
           else
-            Contrast::Api::Communication::UnixSocket.new(CONTRAST_SERVICE.socket_path)
+            Contrast::Api::Communication::UnixSocket.new(::Contrast::CONTRAST_SERVICE.socket_path)
           end
         end
 
         def log_connection
           # The socket is set,
-          if CONFIG.root.agent.service.socket
+          if ::Contrast::CONFIG.root.agent.service.socket
             logger.info('Connecting to the Contrast Service using a UnixSocket socket',
-                        socket: CONTRAST_SERVICE.socket_path)
+                        socket: ::Contrast::CONTRAST_SERVICE.socket_path)
             return
           end
           # The host & port are set,
-          if CONFIG.root.agent.service.host && CONFIG.root.agent.service.port
+          if ::Contrast::CONFIG.root.agent.service.host && ::Contrast::CONFIG.root.agent.service.port
             logger.info('Connecting to the Contrast Service using a TCP socket',
-                        host: CONTRAST_SERVICE.host,
-                        port: CONTRAST_SERVICE.port)
+                        host: ::Contrast::CONTRAST_SERVICE.host,
+                        port: ::Contrast::CONTRAST_SERVICE.port)
             return
           end
 
           # Or something is not set.
-          logger.warn(log_connection_error_msg,
-                      host: CONTRAST_SERVICE.host,
-                      port: CONTRAST_SERVICE.port)
+          logger.warn(
+            log_connection_error_msg, host: ::Contrast::CONTRAST_SERVICE.host, port: ::Contrast::CONTRAST_SERVICE.port
+          )
         end
 
         # If our connection isn't built properly, we need to warn the user. This builds out the context specific
@@ -69,11 +70,11 @@ module Contrast
         #
         # @return [String]
         def log_connection_error_msg
-          if CONFIG.root.agent.service.host
+          if ::Contrast::CONFIG.root.agent.service.host
             'Missing a required connection value to the Contrast Service. ' \
             '`agent.service.port` is not set. ' \
             'Falling back to default TCP socket port.'
-          elsif CONFIG.root.agent.service.port
+          elsif ::Contrast::CONFIG.root.agent.service.port
             'Missing a required connection value to the Contrast Service. ' \
             '`agent.service.host` is not set. ' \
             'Falling back to default TCP socket host.'
@@ -87,26 +88,16 @@ module Contrast
         def send_message msg
           return unless msg
 
-          logger.debug('Sending message.',
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count)
+          logger.debug('Sending message.', msg_id: msg.__id__, p_id: msg.pid, msg_count: msg.message_count)
           to_service = Contrast::Api::Dtm::Message.encode(msg)
           from_service = send_marshaled(to_service)
           response = Contrast::Api::Settings::AgentSettings.decode(from_service)
-          logger.debug('Received response.',
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count,
-                       response_id: response&.__id__)
+          logger.debug('Received response.', msg_id: msg.__id__, p_id: msg.pid, msg_count: msg.message_count,
+                                             response_id: response&.__id__)
           response
         rescue StandardError => e
-          logger.error('Sending failed for message.',
-                       e,
-                       msg_id: msg.__id__,
-                       p_id: msg.pid,
-                       msg_count: msg.message_count,
-                       response_id: response&.__id__)
+          logger.error('Sending failed for message.', e, msg_id: msg.__id__, p_id: msg.pid,
+                                                         msg_count: msg.message_count, response_id: response&.__id__)
           raise e # reraise to let Speedracer manage the connection
         end