contrast-agent 4.6.0 → 4.9.1

data/lib/contrast/framework/rails/railtie.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/job_servers_running'
+require 'contrast/components/logger'
+
+module Contrast
+  module Framework
+    module Rails
+      # A Railtie to allow for the automatic hooking of the Agent into a Rails application.
+      class Railtie < ::Rails::Railtie
+        include Contrast::Components::Logger::InstanceMethods
+
+        initializer 'Contrast Ruby Agent Initializer' do |app|
+        log_rails = defined?(Rails) && defined?(Rails.logger)
+
+          Rails.logger.debug("In railtie ::#{ app.middleware.inspect }") if log_rails
+
+          if ::Contrast::APP_CONTEXT.instrument_middleware_stack?
+            ::Contrast::AGENT.insert_middleware(app)
+          else
+            Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.') if log_rails
+            logger.debug('Disabling Contrast for process', p_id: Process.pid)
+          end
+        end
+
+        rake_tasks do
+          load 'contrast/tasks/service.rb'
+          load 'contrast/tasks/config.rb'
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails
@@ -19,7 +21,8 @@ module Contrast
                 alias_method :cs__patched_helper_inherited, :inherited
                 def inherited klass # rubocop:disable Lint/MissingSuper
                   klass&.instance_variable_set(:@cs__defining_class, true)
-                  cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                  # This calls the original inherited, which should handle super as needed.
+                  cs__patched_helper_inherited(klass)
                 ensure
                   klass&.instance_variable_set(:@cs__defining_class, false)
                 end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,9 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
+require 'contrast/components/logger'
 
 module Contrast
   module Framework
@@ -15,12 +17,11 @@ module Contrast
         # @deprecated Changes to this class are discouraged as this approach is
         #   being phased out with support for those language versions.
         class ActiveRecordNamed
-          include Contrast::Components::Interface
-          access_component :agent, :logging
+          include Contrast::Components::Logger::InstanceMethods
 
           class << self
             def rewrite mod, method_name, body
-              return body unless AGENT.rewrite_interpolation?
+              return body unless ::Contrast::AGENT.rewrite_interpolation?
               return body unless body.is_a?(Proc)
 
               location = body.source_location

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/support.rb

@@ -27,8 +27,8 @@ module Contrast
 
           def application_name
             app_class = ::Rails.application.cs__class
-            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
-            # and instead we need to use parent_module_name
+            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed
+            # entirely and instead we need to use parent_module_name
             return app_class.parent_module_name if Gem::Version.new(::Rails.version) >= RAILS_MODULE_NAME_VERSION
 
             app_class.parent_name

data/lib/contrast/framework/sinatra/support.rb

@@ -114,7 +114,9 @@ module Contrast
             return controller, route_pattern if route_pattern
 
             # Check routes defined in superclass if present.
-            return _route_recurse(controller.superclass, method, route) if controller.superclass&.instance_variable_get(:@routes)
+            return unless controller.superclass&.instance_variable_get(:@routes)
+
+            _route_recurse(controller.superclass, method, route)
           end
 
           # Get route and do some cleanup matching that of Sinatra::Base#process_route.

data/lib/contrast/funchook/funchook.rb

@@ -1,22 +1,19 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+
 # This module is used to find funchook library and determine availability
 module Funchook
-  include Contrast::Components::Interface
-  access_component :logging
+  extend Contrast::Components::Logger::InstanceMethods
+
   attr_accessor :path
 
   # Possible platform library files
   ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
 
   # Top level agent directories that should have the funchook libraries
-  SEARCH_DIRS = [
-    File.join('ext'),
-    File.join('shared_libraries'),
-    File.join('funchook', 'src')
-  ].cs__freeze
+  SEARCH_DIRS = [File.join('ext'), File.join('shared_libraries'), File.join('funchook', 'src')].cs__freeze
 
   AGENT_ROOT = File.join(__dir__, '..', '..', '..')
 

data/lib/contrast/logger/application.rb

@@ -1,25 +1,18 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-
 module Contrast
   module Logger
     # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
-      include Contrast::Components::Interface
-      access_component :config
-
       ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
       # Utility method to log some current ruby and rails information from environment
       def application_environment
         return unless info?
 
-        info('Process environment information',
-             p_id: Process.pid,
-             pp_id: Process.ppid,
-             agent_version: Contrast::Agent::VERSION)
+        info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
+                                                agent_version: Contrast::Agent::VERSION)
         ENV.each do |env_key, env_value|
           env_key = env_key.to_s
           next unless ENV_KEYS.include?(env_key) ||
@@ -33,9 +26,11 @@ module Contrast
       def application_configuration
         return unless info?
 
-        loggable = CONFIG.loggable
+        loggable = ::Contrast::CONFIG.loggable
         info('Current configuration', configuration: loggable)
-        env_keys = ENV.keys.select { |env_key| env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) }
+        env_keys = ENV.keys.select do |env_key|
+          env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER)
+        end
         env_items = env_keys.map { |env_key| Contrast::Utils::EnvConfigurationItem.new(env_key, nil) }
         env_translations = env_items.each_with_object({}) do |conversion, hash|
           hash[conversion.key] = conversion.dot_path_array.join('.')
@@ -52,7 +47,10 @@ module Contrast
       end
 
       FRAMEWORKS = %w[rails sinatra grape].cs__freeze
-      WEB_SERVERS = %w[agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn webrick yarn].cs__freeze
+      WEB_SERVERS = %w[
+        agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn
+        webrick yarn
+      ].cs__freeze
       LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
       def log_specific_libraries
         FRAMEWORKS.each(&cs__method(:log_gem_data))
@@ -67,6 +65,7 @@ module Contrast
 
         Gem.loaded_specs.each_pair do |_name, gem_spec|
           debug('Gem loaded',
+                # rubocop:disable Security/Module/Name -- gems builtin.
                 gem_name: gem_spec.name,
                 gem_version: gem_spec.version.to_s)
         end
@@ -76,9 +75,8 @@ module Contrast
         gem_spec = Gem.loaded_specs[gem_name]
         return unless gem_spec
 
-        info('Gem loaded',
-             gem_name: gem_spec.name,
-             gem_version: gem_spec.version.to_s)
+        info('Gem loaded', gem_name: gem_spec.name, gem_version: gem_spec.version.to_s)
+        # rubocop:enable Security/Module/Name
       end
     end
   end

data/lib/contrast/logger/format.rb

@@ -43,9 +43,7 @@ module Contrast
       def thread_hash
         hash = LOG_TRACKER.get(:logging_hash)
         unless hash
-          hash = {
-              thread_id: Thread.current.object_id
-          }
+          hash = { thread_id: Thread.current.object_id }
           LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
@@ -53,8 +51,7 @@ module Contrast
 
       NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
       def request_hash
-        @request_tracker_defined ||= defined?(Contrast::Agent) &&
-            defined?(Contrast::Agent::REQUEST_TRACKER)
+        @request_tracker_defined ||= defined?(Contrast::Agent) && defined?(Contrast::Agent::REQUEST_TRACKER)
         return NO_REQUEST_HASH unless @request_tracker_defined
 
         Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH

data/lib/contrast/logger/log.rb

@@ -5,21 +5,37 @@ require 'logger'
 require 'ougai'
 require 'singleton'
 
-require 'contrast/components/interface'
 require 'contrast/extension/module'
 require 'contrast/logger/application'
 require 'contrast/logger/format'
 require 'contrast/logger/request'
 require 'contrast/logger/time'
+require 'contrast/components/config'
 
 module Contrast
   module Logger
+    # For development set following env var to raise logged exceptions instead of just logging.
+    if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+      Ougai::Logger.class_eval do
+        alias_method :cs__error, :error
+        alias_method :cs__warn, :warn
+
+        def error msg, exc, **kwargs
+          cs__error(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+
+        def warn msg, exc, **kwargs
+          cs__warn(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+      end
+    end
+
     # This class functions to serve as a wrapper around our logging, as we need
     # to be able to dynamically update level based on updates to TeamServer.
     class Log
       include Singleton
-      include Contrast::Components::Interface
-      access_component :config
 
       DEFAULT_NAME     = 'contrast.log'
       DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
@@ -27,8 +43,7 @@ module Contrast
       STDOUT_STR       = 'STDOUT'
       STDERR_STR       = 'STDERR'
 
-      attr_reader :previous_path,
-                  :previous_level
+      attr_reader :previous_path, :previous_level
 
       def initialize
         update
@@ -108,8 +123,8 @@ module Contrast
       #   TeamServer.
       # @return [String] the path to which to log or STDOUT / STDERR if one of those values provided.
       def find_valid_path log_file
-        config = CONFIG.root.agent.logger
-        config_path = config.path&.length.to_i.positive? ? config.path : nil
+        config = ::Contrast::CONFIG.root.agent.logger
+        config_path = config&.path&.length.to_i.positive? ? config.path : nil
         valid_path(config_path || log_file)
       end
 
@@ -124,7 +139,9 @@ module Contrast
         elsif write_permission?(DEFAULT_NAME)
           # Log once when the path is invalid. We'll change to this path, so no
           # need to log again.
-          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
+          if previous_path != DEFAULT_NAME
+            puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
+          end
           DEFAULT_NAME
         else
           # Log once when the path is invalid. We'll change to this path, so no
@@ -140,7 +157,7 @@ module Contrast
       #   TeamServer.
       # @return [::Ougai::Logging::Severity] the level at which to log
       def find_valid_level log_level
-        config = CONFIG.root.agent.logger
+        config = ::Contrast::CONFIG.root.agent.logger
         config_level = config.level&.length&.positive? ? config.level : nil
         valid_level(config_level || log_level)
       end

data/lib/contrast/logger/request.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/timer'
 
 module Contrast
@@ -9,9 +8,6 @@ module Contrast
     # Our decorator for the Ougai logger allowing for the logging of the
     # request lifecycle, used to provide context during troubleshooting.
     module Request
-      include Contrast::Components::Interface
-      access_component :config
-
       # Utility method to log the start of a request
       def request_start
         debug('Beginning request analysis')
@@ -22,8 +18,7 @@ module Contrast
       def request_end
         context = Contrast::Agent::REQUEST_TRACKER.current
         elapsed_time = context ? (Contrast::Utils::Timer.now_ms - context.timer.start_ms) : -1
-        debug('Ending request analysis',
-              elapsed_time_ms: elapsed_time)
+        debug('Ending request analysis', elapsed_time_ms: elapsed_time)
       end
     end
   end

data/lib/contrast/security_exception.rb

@@ -8,7 +8,7 @@ module Contrast
   # to be handled by our customer's applications.
   class SecurityException < StandardError
     def initialize rule, message = nil
-      super(message || "Rule #{ rule.name } threw a security exception")
+      super(message || "Rule #{ rule.rule_name } threw a security exception")
     end
   end
 end

data/lib/contrast/tasks/config.rb

@@ -7,7 +7,6 @@ module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings
   module Config
     extend Rake::DSL
-    include Contrast::Components::Interface
     DEFAULT_CONFIG = {
         'api' => {
             'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',

data/lib/contrast/tasks/service.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/os'
 
 module Contrast
@@ -10,14 +9,10 @@ module Contrast
   # forked from the application
   module Service
     extend Rake::DSL
-    include Contrast::Components::Interface
-
-    access_component :contrast_service
-
     # Start the service if it is not already running
     def self.start_service
       puts 'Starting Contrast Service'
-      service_log = CONTRAST_SERVICE.logger_path
+      service_log = ::Contrast::CONTRAST_SERVICE.logger_path
       if File.writable?(service_log)
         spawn('contrast_service', out: File::NULL, err: service_log)
       else
@@ -74,7 +69,11 @@ module Contrast
               sleep(0.05) while Contrast::Utils::OS.running?
             end
             watcher.join(1)
-            puts Contrast::Utils::OS.running? ? 'Contrast Service did not stop.' : 'Contrast Service stopped successfully.'
+            if Contrast::Utils::OS.running?
+              puts 'Contrast Service did not stop.'
+            else
+              puts 'Contrast Service stopped successfully.'
+            end
           else
             puts 'Contrast Service is not already running. No need to stop.'
           end

data/lib/contrast/utils/assess/sampling_util.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/sampling'
 
 module Contrast
   module Utils
@@ -11,8 +11,7 @@ module Contrast
       class SamplingUtil
         include Singleton
 
-        include Contrast::Components::Interface
-        access_component :sampling
+        extend Contrast::Components::Sampling::InstanceMethods
 
         def initialize
           @requests = {}

data/lib/contrast/utils/assess/tracking_util.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/duck_utils'
 
 module Contrast
@@ -10,9 +10,7 @@ module Contrast
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
-        include Contrast::Components::Interface
-
-        access_component :logging
+        extend Contrast::Components::Logger::InstanceMethods
 
         class << self
           # Public interface to our tracking check, isolating the internals
@@ -53,8 +51,7 @@ module Contrast
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
               obj.each_pair do |k, v|
-                return true if _tracked?(k, idx)
-                return true if _tracked?(v, idx)
+                return true if _tracked?(k, idx) || _tracked?(v, idx)
               end
               false
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)