contrast-agent 4.6.0 → 4.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9748bb3a9e7e6ce4722edc88dbb3bd8d3a59b11dd691f47ac29b3ee9e6a00ba
-  data.tar.gz: d5b5ff651f2914bff6da5cbd2fdcdc28a2dd1a2ea8ad4eced6c416cbab72b632
+  metadata.gz: 27e411d1ab6398ca59e77859552c6956b0590dc94973512d0bd6e8e63ffa7f74
+  data.tar.gz: 79fee8e128ace994b8aa791d6e945edada8bd69ff099494272af60fba437937c
 SHA512:
-  metadata.gz: 6e03ec0934d333e79f957515dfdc851861d395e9c768d09ffdfbf56b6e818d27361cffb2f010985f6da2182b1a4b070ef2291b86ccd9280fb117c4125611ae8f
-  data.tar.gz: bb60224de8c19b547f311aca8d78a2b99593e329696ab6acbaf59336316109be5e9419d02e6e4cd06d0714627c0942fea6d1c0872a6c69faff531838e1dbc359
+  metadata.gz: 6029048d3bc67b6c4f0e5408d37c2b9a8362bd5b8bf5d5e5858f93a26f499e4454896613dc71003e123cd1ca9473d558ec11cc9d7fbebe648b192d9040a44d8e
+  data.tar.gz: e1e697c39c4611f3fadccc82c189e700facd5f399214f96b6bc053bd702ccd05b10aa37a302231e39f82611b13ae40adbf45c2ca0e2ef7fb10eef790310a1836

data/.gitignore

@@ -1,8 +1,8 @@
 /.bundle/
 /.yardoc
 /_yardoc/
-/Gemfile.lock
 /coverage/
+/Gemfile.lock
 /data/*
 /doc/
 /log/
@@ -18,6 +18,11 @@
 /ext/**/*.so
 /ext/**/*.bundle
 
+bin
+ruby-spec
+mspec
+service_executables
+
 # Funchook artifacts
 /ext/**/funchook.h
 /ext/**/libfunchook.dylib

data/.gitmodules

@@ -1,6 +1,6 @@
 [submodule "agent-service-api"]
 	path = agent-service-api
-	url = git@bitbucket.org:contrastsecurity/agent-service-api
+	url = git@github.com:Contrast-Security-Inc/agent-service-api.git
 [submodule "funchook"]
 	path = funchook
 	url = https://github.com/kubo/funchook.git

data/.simplecov

@@ -4,4 +4,5 @@
 SimpleCov.minimum_coverage line: 94.75
 SimpleCov.start do
   add_filter '/spec/'
+  enable_coverage :branch
 end

data/Rakefile

@@ -23,8 +23,7 @@ task :contrast_pb_compile do
   # do some stuff before compile
 
   # Invoke the protobuf compile task with your sensible defaults
-  ::Rake::Task['protobuf:compile'].invoke('lib',
-                                          './agent-service-api/protobuf ./agent-service-api/protobuf/dtm.proto',
+  ::Rake::Task['protobuf:compile'].invoke('lib', './agent-service-api/protobuf ./agent-service-api/protobuf/dtm.proto',
                                           'lib/contrast/api',
                                           nil)
 

data/ext/build_funchook.rb

@@ -10,7 +10,8 @@ unless find_header('funchook.h', ext_path)
   COMMANDS = ['./autogen.sh', './configure', 'make clean', 'make'].freeze
   bundler_install_target_paths = []
 
-  possible_gem_paths = Gem.path # .path and .paths diverge in their return type - .path returns strings, .paths returns PathSupports
+  # .path and .paths diverge in their return type - .path returns strings, .paths returns PathSupports
+  possible_gem_paths = Gem.path
   possible_gem_paths.each do |base_path|
     contrast_gem_dir_search = File.join(base_path, 'extensions', '**', '*', 'contrast-agent-*')
     extension_paths = Dir[contrast_gem_dir_search]
@@ -31,8 +32,7 @@ unless find_header('funchook.h', ext_path)
   end
 
   SOURCE_PATHS = [
-    File.join('include', 'funchook.h'),
-    File.join('src', 'libfunchook.dylib'),
+    File.join('include', 'funchook.h'), File.join('src', 'libfunchook.dylib'),
     File.join('src', 'libfunchook.so')
   ].freeze
 

data/ext/extconf_common.rb

@@ -4,12 +4,8 @@
 require 'mkmf'
 require_relative '../lib/contrast/agent/version'
 
-def name
-  $TO_MAKE
-end
-
 def make!
-  create_makefile "#{ name }/#{ name }"
+  create_makefile "#{ $TO_MAKE }/#{ $TO_MAKE }"
 end
 
 def ext_path

data/lib/contrast.rb

@@ -4,10 +4,6 @@
 # Used to prevent deprecation warnings from flooding stdout
 ENV['PB_IGNORE_DEPRECATIONS'] = 'true'
 
-# Top-level namespace for Contrast Security agent
-module Contrast
-end
-
 # Some developers override various methods on Object, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being
 # able to reliably use affected methods.
@@ -38,22 +34,36 @@ if RUBY_VERSION >= '3.0.0'
   end
 end
 
-# component interface for class creation
-# config gets built as a consequence of this require
-require 'contrast/components/interface'
+require 'contrast/components/agent'
+require 'contrast/components/app_context'
+require 'contrast/components/assess'
+require 'contrast/components/config'
+require 'contrast/components/contrast_service'
+require 'contrast/components/inventory'
+require 'contrast/components/logger'
+require 'contrast/components/protect'
+require 'contrast/components/sampling'
+require 'contrast/components/scope'
+require 'contrast/components/settings'
+
+module Contrast
+  SCOPE = Contrast::Components::Scope::Interface.new
+  CONFIG = Contrast::Components::Config::Interface.new
+  SETTINGS = Contrast::Components::Settings::Interface.new
+  ASSESS = Contrast::Components::Assess::Interface.new
+  PROTECT = Contrast::Components::Protect::Interface.new
+  INVENTORY = Contrast::Components::Inventory::Interface.new
+  LOGGER = Contrast::Components::Logger::Interface.new
+  AGENT = Contrast::Components::Agent::Interface.new
+  CONTRAST_SERVICE = Contrast::Components::ContrastService::Interface.new
+  APP_CONTEXT = Contrast::Components::AppContext::Interface.new
+end
 
 # This needs to be required very early, after component interfaces, and before instrumentation attempts
 require 'contrast/funchook/funchook'
 
-# shared configuration support
-require 'contrast/config'
-require 'contrast/configuration'
-
 require 'contrast/agent/version'
 
-# errors and exceptions
-require 'contrast/security_exception'
-
 # shared utils
 require 'contrast/utils/timer'
 require 'contrast/utils/preflight_util'

data/lib/contrast/agent/assess.rb

@@ -10,7 +10,7 @@ module Contrast
     module Assess
       require 'contrast/agent/assess/tracker'
       require 'contrast/agent/module_data'
-      require 'contrast/agent/rewriter'
+      require 'contrast/agent/rewriter' if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
       require 'contrast/agent/assess/policy/preshift'
 
       # Dynamic Sources

data/lib/contrast/agent/assess/contrast_event.rb

@@ -8,7 +8,6 @@ require 'contrast/utils/object_share'
 require 'contrast/utils/stack_trace_utils'
 require 'contrast/utils/string_utils'
 require 'contrast/utils/timer'
-require 'contrast/components/interface'
 require 'contrast/agent/assess/contrast_object'
 
 module Contrast
@@ -29,8 +28,6 @@ module Contrast
       # @attr_reader args [Array<Contrast::Agent::Assess::ContrastObject>] the safe representation of the Arguments
       #   with which the method was invoked
       class ContrastEvent
-        include Contrast::Components::Interface
-        access_component :analysis
 
         attr_reader :event_id, :policy_node, :stack_trace, :time, :thread, :object, :ret, :args, :tags
 
@@ -164,7 +161,7 @@ module Contrast
         def capture_stacktrace!
           # If we're configured to not capture the stacktrace, usually for performance reasons, then don't and return an
           # empty array instead
-          unless ASSESS.capture_stacktrace?(policy_node)
+          unless ::Contrast::ASSESS.capture_stacktrace?(policy_node)
             @stack_trace = Contrast::Utils::ObjectShare::EMPTY_ARRAY
             return
           end

data/lib/contrast/agent/assess/contrast_object.rb

@@ -34,14 +34,14 @@ module Contrast
         def initialize object
           if object
             @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
-            @object_type = object.cs__class.name
+            @object_type = object.cs__class.cs__name
             # TODO: RUBY-1084 determine if we need to copy these tags to
             #   restore immutability. For instance, if these tags were on a
             #   String that was then #reverse!'d, would our tags be wrong?
             @tags = Contrast::Agent::Assess::Tracker.properties(object)&.tags
           else
             @object = Contrast::Utils::ObjectShare::NIL_STRING
-            @object_type = nil.cs__class.name
+            @object_type = nil.cs__class.cs__name
           end
         end
 

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -13,7 +13,8 @@ module Contrast
           def self.build policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
             case policy_node
             when Contrast::Agent::Assess::Policy::SourceNode
-              Contrast::Agent::Assess::Events::SourceEvent.new(policy_node, tagged, object, ret, args, source_type, source_name)
+              Contrast::Agent::Assess::Events::SourceEvent.new(policy_node, tagged, object, ret, args, source_type,
+                                                               source_name)
             when Contrast::Agent::Assess::Policy::PolicyNode
               Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args)
             end

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -10,13 +10,11 @@ module Contrast
         # An extension of Hash that doesn't impact GC of the object being stored by storing its ID as a Key to lookup
         # and registering a finalizer on the object to remove its entry from the Hash immediately after it's GC'd.
         class Hash < Hash
-          include Contrast::Components::Interface
-          access_component :agent, :analysis
 
           FROZEN_FINALIZED_IDS = Set.new
 
           def []= key, obj
-            return unless AGENT.enabled? && ASSESS.enabled?
+            return unless ::Contrast::AGENT.enabled? && ::Contrast::ASSESS.enabled?
 
             # We can't finalize frozen things, so only act on those that went through .pre_freeze
             if key.cs__frozen?
@@ -79,7 +77,7 @@ module Contrast
           #
           # @param key [Object] the Object on which we need to pre-define finalizers
           def pre_freeze key
-            return unless AGENT.enabled? && ASSESS.enabled?
+            return unless ::Contrast::AGENT.enabled? && ::Contrast::ASSESS.enabled?
             return if key.cs__frozen?
             return if FROZEN_FINALIZED_IDS.include?(key.__id__)
 

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -37,7 +37,8 @@ module Contrast
                 # Move on if we already know about this Dynamic Source
                 next if Contrast::Agent::Assess::Policy::Policy.instance.find_source_node(class_name, method_name, true)
 
-                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys), current_request)
+                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys),
+                                                         current_request)
                 Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
                 method_policy = build_source_policy(method_name, dynamic_source_node)
                 Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
@@ -130,8 +131,10 @@ module Contrast
             def append_properties! dynamic_source, request, source_node, field
               dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
               dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.properties[WRITE_QUERY_TIME] = Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
-              dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
+              dynamic_source.properties[WRITE_QUERY_TIME] =
+                Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
+              dynamic_source.properties[WRITE_QUERY_URL] =
+                Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
             end
 
             def append_events! dynamic_source, event

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -5,7 +5,8 @@ require 'contrast/agent/assess/policy/policy'
 require 'contrast/agent/patching/policy/patcher'
 require 'contrast/agent/patching/policy/method_policy'
 require 'contrast/agent/patching/policy/module_policy'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Agent
@@ -16,8 +17,9 @@ module Contrast
         # provides a map for which methods our renamed functions need to call
         # and how.
         module Patcher
-          include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :scope
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
+
 
           class << self
             def policy
@@ -34,24 +36,18 @@ module Contrast
             # called. This hook is provided so that patches to those methods can
             # pass us execution flow once a new method has been made available.
             def patch_assess_on_eval mod
-              return unless ASSESS.enabled?
+              return unless ::Contrast::ASSESS.enabled?
               return if in_contrast_scope?
 
               patcher.patch_specific_module(mod)
             rescue StandardError => e
-              logger.warn(
-                  'Unable to patch assess during eval',
-                  e,
-                  module: mod.cs__name)
+              logger.warn('Unable to patch assess during eval', e, module: mod.cs__name)
             end
 
             # Exposed so that methods can be dynamically patched on creation at
             # runtime, like those generated by
             # ActiveRecord::AttributeMethods::Read::ClassMethods#define_method_attribute
-            CLASS_TYPES = [
-              Contrast::Utils::ObjectShare::CLASS,
-              Contrast::Utils::ObjectShare::MODULE
-            ].cs__freeze
+            CLASS_TYPES = [Contrast::Utils::ObjectShare::CLASS, Contrast::Utils::ObjectShare::MODULE].cs__freeze
             def patch_assess_method mod, method_name
               # Module.define_method is called a lot in Class and Module. We
               # currently do not expect these define_methods to result in methods
@@ -62,7 +58,8 @@ module Contrast
               return if CLASS_TYPES.include?(class_name)
               return unless ASSESS.enabled?
 
-              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources, class_name)
+              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources,
+                                                                                              class_name)
               return if source_nodes.empty?
 
               method_array = []
@@ -70,17 +67,15 @@ module Contrast
               source_nodes.each do |source_node|
                 next unless source_node.method_name.to_s == method_name
 
-                method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
-                                                                                    method_name: source_node.method_name,
-                                                                                    method_visibility: source_node.method_visibility,
-                                                                                    instance_method: true)
+                method_policy =
+                  Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
+                                                                      method_name: source_node.method_name,
+                                                                      method_visibility: source_node.method_visibility,
+                                                                      instance_method: true)
                 patcher.patch_method(mod, method_array, method_policy)
               end
             rescue StandardError => e
-              logger.warn(
-                  'Unable to patch assess during define_method_attribute',
-                  e,
-                  module: mod.cs__name)
+              logger.warn('Unable to patch assess during define_method_attribute', e, module: mod.cs__name)
             end
           end
         end

data/lib/contrast/agent/assess/policy/policy.rb

@@ -26,7 +26,7 @@ module Contrast
           # Indicates is this feature has been disabled by the configuration,
           # read at startup, and therefore can never be enabled.
           def disabled_globally?
-            ASSESS.forcibly_disabled?
+            ::Contrast::ASSESS.forcibly_disabled?
           end
 
           def node_type

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -35,16 +35,6 @@ module Contrast
             :TYPE_METHOD
           end
 
-          def target
-            @_target ||= begin
-              if targets&.any?
-                targets[0]
-              elsif sources&.any?
-                sources[0]
-              end
-            end
-          end
-
           def target_string= value
             @target_string = value
             @targets = convert_policy_markers(value)
@@ -85,8 +75,7 @@ module Contrast
               next if Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
                   Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
-              raise(ArgumentError,
-                    "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
+              raise(ArgumentError, "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
             end
           end
 
@@ -100,27 +89,26 @@ module Contrast
           # Trigger (trigger nodes) don't have targets (they are the target)
           # Everything else (propagation nodes) are Source2Target
           def build_action
-            @event_action ||= begin
-              case node_class
-              when Contrast::Agent::Assess::Policy::SourceNode::SOURCE
-                :CREATION
-              when Contrast::Agent::Assess::Policy::TriggerNode::TRIGGER
-                :TRIGGER
-              else
-                if source_string.nil?
-                  :CREATION
-                elsif target_string.nil?
-                  :TRIGGER
-                else
-                  # TeamServer can't handle the multi-source or multi-target
-                  # values. Give it some help by changing them to 'A'
-                  source = source_string.include?(Contrast::Utils::ObjectShare::COMMA) ? ALL_TYPE : source_string
-                  target = target_string.include?(Contrast::Utils::ObjectShare::COMMA) ? ALL_TYPE : target_string
-                  str = source[0] + TO_MARKER + target[0]
-                  str.to_sym
-                end
-              end
-            end
+            @event_action ||= case node_class
+                              when Contrast::Agent::Assess::Policy::SourceNode::SOURCE
+                                :CREATION
+                              when Contrast::Agent::Assess::Policy::TriggerNode::TRIGGER
+                                :TRIGGER
+                              else
+                                if source_string.nil?
+                                  :CREATION
+                                elsif target_string.nil?
+                                  :TRIGGER
+                                else
+                                  # TeamServer can't handle the multi-source or multi-target values. Give it some help
+                                  # by changing them to 'A'
+                                  source = all_type?(source_string) ? ALL_TYPE : source_string
+                                  target = all_type?(target_string) ? ALL_TYPE : target_string
+                                  str = source[0] + TO_MARKER + target[0]
+                                  str.to_sym
+                                end
+                              end
+
             @event_action
           end
 
@@ -158,6 +146,10 @@ module Contrast
             end
             converted
           end
+
+          def all_type? marker
+            marker.include?(Contrast::Utils::ObjectShare::COMMA)
+          end
         end
       end
     end