contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/api/decorators/server_features.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -106,7 +106,9 @@ module Contrast
             event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
             event_dtm.build_parent_ids!(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
+            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret,
+                                                                                contrast_event.policy_node,
+                                                                                contrast_event.args)
             event_dtm
           end
         end

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
 require 'contrast/utils/assess/tracking_util'
 require 'base64'
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 
 module Contrast
   module Api
@@ -18,8 +18,7 @@ module Contrast
 
         # Class methods for TraceEventObject
         module ClassMethods
-          include Contrast::Components::Interface
-          access_component :scope
+          include Contrast::Components::Scope::InstanceMethods
           # Build the event object. We were originally going to include taint on
           # each one, but TS doesn't accept / use that, so it is a waste of time.
           #
@@ -52,9 +51,7 @@ module Contrast
             tmp = []
             tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
             tmp << ELLIPSIS
-            tmp << obj_string[
-                obj_string.length - UNTRUNCATED_PORTION_LENGTH,
-                UNTRUNCATED_PORTION_LENGTH]
+            tmp << obj_string[obj_string.length - UNTRUNCATED_PORTION_LENGTH, UNTRUNCATED_PORTION_LENGTH]
             tmp.join
           end
         end

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -97,12 +97,7 @@ module Contrast
           DATABASE_WRITE
         ].cs__freeze
 
-        VALID_SOURCE_TAGS = %w[
-          NO_NEWLINES
-          UNTRUSTED
-          CROSS_SITE
-          LIMITED_CHARS
-        ].cs__freeze
+        VALID_SOURCE_TAGS = %w[NO_NEWLINES UNTRUSTED CROSS_SITE LIMITED_CHARS].cs__freeze
       end
     end
   end

data/lib/contrast/api/decorators/user_input.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/components/agent.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
@@ -12,12 +12,9 @@ module Contrast
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-
-        access_component :analysis, :config, :settings
 
         def enabled?
-          @_enabled = !false?(CONFIG.root.enable) if @_enabled.nil?
+          @_enabled = !false?(::Contrast::CONFIG.root.enable) if @_enabled.nil?
           @_enabled
         end
 
@@ -36,7 +33,7 @@ module Contrast
         end
 
         def ruleset
-          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_ruleset&.values)
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_protect_ruleset&.values)
         end
 
         def reset_ruleset
@@ -52,36 +49,39 @@ module Contrast
         end
 
         def patch_yield?
-          @_patch_yield = !false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield = !false?(::Contrast::CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
           @_patch_yield
         end
 
         def interpolation_enabled?
-          @_interpolation_enabled = !false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled = !false?(::Contrast::CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
           @_interpolation_enabled
         end
 
         def omit_body?
-          @_omit_body = true?(CONFIG.root.agent.omit_body) if @_omit_body.nil?
+          @_omit_body = true?(::Contrast::CONFIG.root.agent.omit_body) if @_omit_body.nil?
           @_omit_body
         end
 
         def exception_control
           @_exception_control ||= {
-              enable: true?(CONFIG.root.agent.ruby.exceptions.capture),
-              status: CONFIG.root.agent.ruby.exceptions.override_status || 403,
-              message: CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+              enable: true?(::Contrast::CONFIG.root.agent.ruby.exceptions.capture),
+              status:
+                ::Contrast::CONFIG.root.agent.ruby.exceptions.override_status || 403,
+              message:
+                ::Contrast::CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
           }
         end
 
         def skip_instrumentation? loaded_module_name
           return true unless loaded_module_name
 
-          loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
+          loaded_module_name.start_with?(*::Contrast::CONFIG.root.agent.ruby.uninstrument_namespace)
         end
 
+        # Insert ourselves into the application, keeping our middleware at the outermost layer of the onion
         def insert_middleware app
-          app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
+          app.middleware.insert_before 0, Contrast::Agent::Middleware
         end
 
         def enable_tracepoint
@@ -94,24 +94,18 @@ module Contrast
         # Ruby exposed the C method for interpolation in version 2.6.0, meaning
         # we can attempt to patch using Funchook for that version and later.
         def interpolation_patch_possible?
-          @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
+          if @_interpolation_patch_possible.nil?
+            @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION
+          end
           @_interpolation_patch_possible
         end
 
-        def retrieve_ruleset
-          return {} unless enabled?
+        def retrieve_protect_ruleset
+          return {} unless enabled? && ::Contrast::PROTECT.enabled?
 
-          if ASSESS.enabled? && PROTECT.enabled?
-            ASSESS.rules.merge(PROTECT.rules)
-          elsif ASSESS.enabled?
-            ASSESS.rules
-          else
-            PROTECT.rules
-          end
+          ::Contrast::PROTECT.rules
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/app_context.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
@@ -16,9 +16,7 @@ module Contrast
       # including the Client, Process, and Server information.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-
-        access_component :agent, :analysis, :config, :logging
+        include Contrast::Components::Logger::InstanceMethods
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
@@ -31,15 +29,15 @@ module Contrast
 
         def server_type
           @_server_type ||= begin
-            tmp = CONFIG.root.server.type
+            tmp = ::Contrast::CONFIG.root.server.type
             tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
             tmp
           end
         end
 
-        def name
-          @_name ||= begin
-            tmp = CONFIG.root.application.name
+        def app_name
+          @_app_name ||= begin
+            tmp = ::Contrast::CONFIG.root.application.name # rubocop:disable Security/Module/Name
             tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
@@ -50,7 +48,7 @@ module Contrast
 
         def path
           @_path ||= begin
-            tmp = CONFIG.root.application.path
+            tmp = ::Contrast::CONFIG.root.application.path
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
           rescue StandardError
             DEFAULT_APP_PATH
@@ -59,7 +57,7 @@ module Contrast
 
         def server_name
           @_server_name ||= begin
-            tmp = CONFIG.root.server.name
+            tmp = ::Contrast::CONFIG.root.server.name # rubocop:disable Security/Module/Name
             tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
@@ -70,7 +68,7 @@ module Contrast
 
         def server_path
           @_server_path ||= begin
-            tmp = CONFIG.root.server.path
+            tmp = ::Contrast::CONFIG.root.server.path
             tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
           rescue StandardError
@@ -88,7 +86,7 @@ module Contrast
                       server_name: msg.server_name,
                       server_path: msg.server_path,
                       server_type: msg.server_type,
-                      application_name: name,
+                      application_name: app_name,
                       application_path: path,
                       application_language: Contrast::Utils::ObjectShare::RUBY)
 
@@ -108,7 +106,7 @@ module Contrast
         end
 
         def client_id
-          @_client_id ||= [name, pgid].join('-')
+          @_client_id ||= [app_name, pgid].join('-')
         end
 
         def instrument_middleware_stack?
@@ -116,7 +114,7 @@ module Contrast
         end
 
         def disabled_agent_rake_tasks
-          CONFIG.root.agent.ruby.disabled_agent_rake_tasks
+          ::Contrast::CONFIG.root.agent.ruby.disabled_agent_rake_tasks
         end
 
         # Determines if the Process we're currently in matches that of the
@@ -137,8 +135,6 @@ module Contrast
           @_original_pid ||= Process.pid
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/assess.rb

@@ -1,6 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+require 'contrast/components/config'
+require 'contrast/components/settings'
+
+
 module Contrast
   module Components
     module Assess
@@ -10,24 +15,21 @@ module Contrast
       # Specifically, this allows for querying the state of the Assess product.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-
-        access_component :config, :settings
 
         def enabled?
           # config overrides if forcibly set
           return false if forcibly_disabled?
           return true  if forcibly_enabled?
 
-          SETTINGS.assess_enabled?
+          ::Contrast::SETTINGS.assess_state.enabled == true
         end
 
         def tainted_columns
-          SETTINGS.tainted_columns
+          ::Contrast::SETTINGS.tainted_columns
         end
 
         def forcibly_disabled?
-          @_forcibly_disabled = false?(CONFIG.root.assess.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled = false?(::Contrast::CONFIG.root.assess.enable) if @_forcibly_disabled.nil?
           @_forcibly_disabled
         end
 
@@ -39,9 +41,9 @@ module Contrast
         # faster comparisons when we use it. Anything not one of the known values of
         # 'NONE',  'SOME', or 'ALL' is treated as 'ALL'
         #
-        # @return [Symbol] the normalized value of CONFIG.root.assess.stacktraces
+        # @return [Symbol] the normalized value of ::Contrast::CONFIG.root.assess.stacktraces
         def capture_stacktrace_value
-          @_capture_stacktrace_value ||= case CONFIG.root.assess.stacktraces.upcase
+          @_capture_stacktrace_value ||= case ::Contrast::CONFIG.root.assess.stacktraces.upcase
                                          when 'NONE'
                                            :NONE
                                          when 'SOME'
@@ -58,10 +60,9 @@ module Contrast
         # node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
         #
         # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
-        # @param return [Boolean] to capture or not to capture, that is the question.
+        # @return [Boolean] to capture or not to capture, that is the question.
         def capture_stacktrace? policy_node
           return true if capture_stacktrace_value == :ALL
-
           return false if capture_stacktrace_value == :NONE
 
           # Below here capture_stacktrace_value must be :SOME.
@@ -72,42 +73,36 @@ module Contrast
         end
 
         def scan_response?
-          @_scan_response = !false?(CONFIG.root.assess.enable_scan_response) if @_scan_response.nil?
+          @_scan_response = !false?(::Contrast::CONFIG.root.assess.enable_scan_response) if @_scan_response.nil?
           @_scan_response
         end
 
         def track_frozen_sources?
-          @_track_frozen_sources = !false?(CONFIG.root.agent.ruby.track_frozen_sources) if @_track_frozen_sources.nil?
+          @_track_frozen_sources = !false?(::Contrast::CONFIG.root.agent.ruby.track_frozen_sources) if @_track_frozen_sources.nil?
           @_track_frozen_sources
         end
 
         def require_scan?
-          @_require_scan = !false?(CONFIG.root.agent.ruby.require_scan) if @_require_scan.nil?
+          @_require_scan = !false?(::Contrast::CONFIG.root.agent.ruby.require_scan) if @_require_scan.nil?
           @_require_scan
         end
 
         def tags
-          CONFIG.root.assess&.tags
+          ::Contrast::CONFIG.root.assess&.tags
         end
 
-        def rules
-          SETTINGS.assess_rules
+        def disabled_rules
+          # TODO: RUBY-903
+          ::Contrast::CONFIG.root.assess&.rules&.disabled_rules || ::Contrast::SETTINGS.assess_state.disabled_assess_rules || []
         end
 
         private
 
         def forcibly_enabled?
-          @_forcibly_enabled = true?(CONFIG.root.assess.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled = true?(::Contrast::CONFIG.root.assess.enable) if @_forcibly_enabled.nil?
           @_forcibly_enabled
         end
-
-        def disabled_rules
-          # TODO: RUBY-903
-          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.disabled_assess_rules || []
-        end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/base.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    # All components should inherit from this,
+    # whether Interfaces, InstanceMethods or ClassMethods.
+    module ComponentBase
+      # use this to determine if the configuration value is literally boolean
+      # false or some form of the word `false`, regardless of case. It should
+      # be used for those values which default to `true` as they should only
+      # treat a value explicitly set to `false` as such.
+      #
+      # @param config_param [Boolean,String] the value to check
+      # @return [Boolean] should the value be treated as `false`
+      def false? config_param
+        return false if config_param == true
+        return true if config_param == false
+        return false unless config_param.cs__is_a?(String)
+
+        Contrast::Utils::ObjectShare::FALSE.casecmp?(config_param)
+      end
+
+      # use this to determine if the configuration value is literally boolean
+      # true or some form of the word `true`, regardless of case. It should
+      # be used for those values which default to `false` as they should only
+      # treat a value explicitly set to `true` as such.
+      #
+      # @param config_param [Boolean,String] the value to check
+      # @return [Boolean] should the value be treated as `true`
+      def true? config_param
+        return false if config_param == false
+        return true if config_param == true
+        return false unless config_param.cs__is_a?(String)
+
+        Contrast::Utils::ObjectShare::TRUE.casecmp?(config_param)
+      end
+    end
+  end
+end