contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/logger/format.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ougai'
@@ -43,9 +43,7 @@ module Contrast
       def thread_hash
         hash = LOG_TRACKER.get(:logging_hash)
         unless hash
-          hash = {
-              thread_id: Thread.current.object_id
-          }
+          hash = { thread_id: Thread.current.object_id }
           LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
@@ -53,8 +51,7 @@ module Contrast
 
       NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
       def request_hash
-        @request_tracker_defined ||= defined?(Contrast::Agent) &&
-            defined?(Contrast::Agent::REQUEST_TRACKER)
+        @request_tracker_defined ||= defined?(Contrast::Agent) && defined?(Contrast::Agent::REQUEST_TRACKER)
         return NO_REQUEST_HASH unless @request_tracker_defined
 
         Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH

data/lib/contrast/logger/log.rb

@@ -1,25 +1,41 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'logger'
 require 'ougai'
 require 'singleton'
 
-require 'contrast/components/interface'
 require 'contrast/extension/module'
 require 'contrast/logger/application'
 require 'contrast/logger/format'
 require 'contrast/logger/request'
 require 'contrast/logger/time'
+require 'contrast/components/config'
 
 module Contrast
   module Logger
+    # For development set following env var to raise logged exceptions instead of just logging.
+    if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+      Ougai::Logger.class_eval do
+        alias_method :cs__error, :error
+        alias_method :cs__warn, :warn
+
+        def error msg, exc, **kwargs
+          cs__error(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+
+        def warn msg, exc, **kwargs
+          cs__warn(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+      end
+    end
+
     # This class functions to serve as a wrapper around our logging, as we need
     # to be able to dynamically update level based on updates to TeamServer.
     class Log
       include Singleton
-      include Contrast::Components::Interface
-      access_component :config
 
       DEFAULT_NAME     = 'contrast.log'
       DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
@@ -27,8 +43,7 @@ module Contrast
       STDOUT_STR       = 'STDOUT'
       STDERR_STR       = 'STDERR'
 
-      attr_reader :previous_path,
-                  :previous_level
+      attr_reader :previous_path, :previous_level
 
       def initialize
         update
@@ -108,8 +123,8 @@ module Contrast
       #   TeamServer.
       # @return [String] the path to which to log or STDOUT / STDERR if one of those values provided.
       def find_valid_path log_file
-        config = CONFIG.root.agent.logger
-        config_path = config.path&.length.to_i.positive? ? config.path : nil
+        config = ::Contrast::CONFIG.root.agent.logger
+        config_path = config&.path&.length.to_i.positive? ? config.path : nil
         valid_path(config_path || log_file)
       end
 
@@ -124,7 +139,9 @@ module Contrast
         elsif write_permission?(DEFAULT_NAME)
           # Log once when the path is invalid. We'll change to this path, so no
           # need to log again.
-          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
+          if previous_path != DEFAULT_NAME
+            puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
+          end
           DEFAULT_NAME
         else
           # Log once when the path is invalid. We'll change to this path, so no
@@ -140,7 +157,7 @@ module Contrast
       #   TeamServer.
       # @return [::Ougai::Logging::Severity] the level at which to log
       def find_valid_level log_level
-        config = CONFIG.root.agent.logger
+        config = ::Contrast::CONFIG.root.agent.logger
         config_level = config.level&.length&.positive? ? config.level : nil
         valid_level(config_level || log_level)
       end

data/lib/contrast/logger/request.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/timer'
 
 module Contrast
@@ -9,9 +8,6 @@ module Contrast
     # Our decorator for the Ougai logger allowing for the logging of the
     # request lifecycle, used to provide context during troubleshooting.
     module Request
-      include Contrast::Components::Interface
-      access_component :config
-
       # Utility method to log the start of a request
       def request_start
         debug('Beginning request analysis')
@@ -22,8 +18,7 @@ module Contrast
       def request_end
         context = Contrast::Agent::REQUEST_TRACKER.current
         elapsed_time = context ? (Contrast::Utils::Timer.now_ms - context.timer.start_ms) : -1
-        debug('Ending request analysis',
-              elapsed_time_ms: elapsed_time)
+        debug('Ending request analysis', elapsed_time_ms: elapsed_time)
       end
     end
   end

data/lib/contrast/logger/time.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/security_exception.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,7 +8,7 @@ module Contrast
   # to be handled by our customer's applications.
   class SecurityException < StandardError
     def initialize rule, message = nil
-      super(message || "Rule #{ rule.name } threw a security exception")
+      super(message || "Rule #{ rule.rule_name } threw a security exception")
     end
   end
 end

data/lib/contrast/tasks/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/tasks/service.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/os'
 
 module Contrast
@@ -10,14 +9,10 @@ module Contrast
   # forked from the application
   module Service
     extend Rake::DSL
-    include Contrast::Components::Interface
-
-    access_component :contrast_service
-
     # Start the service if it is not already running
     def self.start_service
       puts 'Starting Contrast Service'
-      service_log = CONTRAST_SERVICE.logger_path
+      service_log = ::Contrast::CONTRAST_SERVICE.logger_path
       if File.writable?(service_log)
         spawn('contrast_service', out: File::NULL, err: service_log)
       else
@@ -74,7 +69,11 @@ module Contrast
               sleep(0.05) while Contrast::Utils::OS.running?
             end
             watcher.join(1)
-            puts Contrast::Utils::OS.running? ? 'Contrast Service did not stop.' : 'Contrast Service stopped successfully.'
+            if Contrast::Utils::OS.running?
+              puts 'Contrast Service did not stop.'
+            else
+              puts 'Contrast Service stopped successfully.'
+            end
           else
             puts 'Contrast Service is not already running. No need to stop.'
           end

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/sampling'
 
 module Contrast
   module Utils
@@ -11,8 +11,7 @@ module Contrast
       class SamplingUtil
         include Singleton
 
-        include Contrast::Components::Interface
-        access_component :sampling
+        extend Contrast::Components::Sampling::InstanceMethods
 
         def initialize
           @requests = {}

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/duck_utils'
 
 module Contrast
@@ -10,9 +10,7 @@ module Contrast
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
-        include Contrast::Components::Interface
-
-        access_component :logging
+        extend Contrast::Components::Logger::InstanceMethods
 
         class << self
           # Public interface to our tracking check, isolating the internals
@@ -53,8 +51,7 @@ module Contrast
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
               obj.each_pair do |k, v|
-                return true if _tracked?(k, idx)
-                return true if _tracked?(v, idx)
+                return true if _tracked?(k, idx) || _tracked?(v, idx)
               end
               false
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'
@@ -9,14 +9,6 @@ module Contrast
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
       class << self
-        # Given a module, return all of its descendants
-        #
-        # @param mod [Module] the module whose descendants you want to find.
-        # @return [Array<Module>] those Modules that inherit from the given.
-        def descendants mod
-          ObjectSpace.each_object(mod).to_a
-        end
-
         # some classes have had things prepended to them, like Marshal in Rails
         # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
         # our alias patching approach, as will any other prepend on something
@@ -67,12 +59,12 @@ module Contrast
             Contrast::Utils::ObjectShare::NIL_STRING
           elsif object.cs__is_a?(Symbol)
             ":#{ object }"
-          elsif object.cs__is_a?(Numeric)
-            object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
           elsif object.cs__is_a?(Regexp)
             object.source
+          elsif use_to_s?(object)
+            object.to_s
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -108,6 +100,18 @@ module Contrast
 
         private
 
+        # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list approach.
+        #
+        # @param object [Object] something that may have a safe to_s method
+        # @return [Boolean] if we should invoke to_s to represent the object
+        def use_to_s? object
+          return true if object.cs__is_a?(Numeric)
+          return true if defined?(Arel::Nodes::SqlLiteral) && object.cs__is_a?(Arel::Nodes::SqlLiteral)
+
+          false
+        end
+
         def determine_target_class mod, is_instance
           return mod if mod.singleton_class?
 

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/hash_digest.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -15,10 +15,7 @@ module Contrast
       include Digest::Instance
 
       CONTENT_LENGTH_HEADER = 'Content-Length'
-      CRYPTO_RULES = %w[
-        crypto-bad-ciphers
-        crypto-bad-mac
-      ].cs__freeze
+      CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
       CONFIG_PATH_KEY = 'path'
       CONFIG_SESSION_ID_KEY = 'sessionId'
       CLASS_SOURCE_KEY = 'source'
@@ -37,13 +34,13 @@ module Contrast
           hash.finish
         end
 
-        def generate_event_hash finding, source
-          return generate_dataflow_hash(finding) if finding.events.length.to_i > 1
+        def generate_event_hash finding, source, request
+          return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
 
           id = finding.rule_id
-          return generate_crypto_hash(finding, source) if CRYPTO_RULES.include?(id)
+          return generate_crypto_hash(finding, source, request) if CRYPTO_RULES.include?(id)
 
-          generate_trigger_hash(finding)
+          generate_trigger_hash(finding, request)
         end
 
         def generate_config_hash finding
@@ -71,40 +68,35 @@ module Contrast
 
         private
 
-        def generate_crypto_hash finding, algorithm
+        def generate_crypto_hash finding, algorithm, request
           hash = new
           hash.update(finding.rule_id)
           hash.update(algorithm)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
 
-        def generate_dataflow_hash finding
+        def generate_dataflow_hash finding, request
           hash = new
           hash.update(finding.rule_id)
           hash.update_on_sources(finding.events)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
 
-        def generate_trigger_hash finding
+        def generate_trigger_hash finding, request
           hash = new
           hash.update(finding.rule_id)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
       end
 
-      def update_on_request
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context
-
-        route = context.route
-        request = context.request
-        if route
+      def update_on_request finding, request
+        if (route = finding.routes[0])
           update(route.route)
           update(route.verb)
-        elsif request
+        elsif request ||= Contrast::Agent::REQUEST_TRACKER.current&.request
           update(request.normalized_uri)
           update(request.request_method)
         end
@@ -116,7 +108,7 @@ module Contrast
         events.each do |event|
           event.event_sources.each do |source|
             update(source.type)
-            update(source.name)
+            update(source.name) # rubocop:disable Security/Module/Name -- API attribute.
           end
         end
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,16 +1,18 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'objspace'
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/heap_dump'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil < Contrast::Agent::WorkerThread
-      include Contrast::Components::Interface
-      access_component :heap_dump, :logging
+      extend Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::HeapDump::InstanceMethods
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'