contrast-agent 4.6.0 → 4.9.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (190) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +6 -1
  3. data/.gitmodules +1 -1
  4. data/.simplecov +1 -0
  5. data/Rakefile +1 -2
  6. data/ext/build_funchook.rb +3 -3
  7. data/ext/extconf_common.rb +1 -5
  8. data/lib/contrast.rb +24 -14
  9. data/lib/contrast/agent/assess.rb +1 -1
  10. data/lib/contrast/agent/assess/contrast_event.rb +1 -4
  11. data/lib/contrast/agent/assess/contrast_object.rb +2 -2
  12. data/lib/contrast/agent/assess/events/event_factory.rb +2 -1
  13. data/lib/contrast/agent/assess/finalizers/hash.rb +2 -4
  14. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +6 -3
  15. data/lib/contrast/agent/assess/policy/patcher.rb +16 -21
  16. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  17. data/lib/contrast/agent/assess/policy/policy_node.rb +25 -33
  18. data/lib/contrast/agent/assess/policy/policy_scanner.rb +3 -5
  19. data/lib/contrast/agent/assess/policy/preshift.rb +7 -5
  20. data/lib/contrast/agent/assess/policy/propagation_method.rb +10 -19
  21. data/lib/contrast/agent/assess/policy/propagation_node.rb +19 -8
  22. data/lib/contrast/agent/assess/policy/propagator.rb +1 -0
  23. data/lib/contrast/agent/assess/policy/propagator/center.rb +2 -1
  24. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +3 -6
  25. data/lib/contrast/agent/assess/policy/propagator/insert.rb +3 -1
  26. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +2 -1
  27. data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb +73 -0
  28. data/lib/contrast/agent/assess/policy/propagator/select.rb +2 -12
  29. data/lib/contrast/agent/assess/policy/propagator/split.rb +12 -13
  30. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +3 -10
  31. data/lib/contrast/agent/assess/policy/propagator/trim.rb +3 -15
  32. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +13 -10
  33. data/lib/contrast/agent/assess/policy/source_method.rb +12 -12
  34. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -3
  35. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +5 -1
  36. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +0 -3
  37. data/lib/contrast/agent/assess/policy/trigger_method.rb +8 -18
  38. data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -2
  39. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +4 -3
  40. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -2
  41. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -8
  42. data/lib/contrast/agent/assess/property/evented.rb +8 -5
  43. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +11 -5
  44. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +4 -1
  45. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +7 -9
  46. data/lib/contrast/agent/at_exit_hook.rb +3 -3
  47. data/lib/contrast/agent/class_reopener.rb +9 -6
  48. data/lib/contrast/agent/disable_reaction.rb +4 -7
  49. data/lib/contrast/agent/exclusion_matcher.rb +7 -14
  50. data/lib/contrast/agent/inventory/dependencies.rb +2 -0
  51. data/lib/contrast/agent/inventory/dependency_analysis.rb +2 -6
  52. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +3 -5
  53. data/lib/contrast/agent/inventory/policy/datastores.rb +3 -4
  54. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  55. data/lib/contrast/agent/middleware.rb +17 -18
  56. data/lib/contrast/agent/module_data.rb +3 -3
  57. data/lib/contrast/agent/patching/policy/after_load_patch.rb +3 -3
  58. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +9 -9
  59. data/lib/contrast/agent/patching/policy/method_policy.rb +6 -2
  60. data/lib/contrast/agent/patching/policy/module_policy.rb +14 -7
  61. data/lib/contrast/agent/patching/policy/patch.rb +20 -25
  62. data/lib/contrast/agent/patching/policy/patch_status.rb +6 -7
  63. data/lib/contrast/agent/patching/policy/patcher.rb +21 -18
  64. data/lib/contrast/agent/patching/policy/policy.rb +2 -4
  65. data/lib/contrast/agent/patching/policy/policy_node.rb +16 -7
  66. data/lib/contrast/agent/patching/policy/trigger_node.rb +21 -8
  67. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
  68. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
  69. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
  70. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +2 -3
  71. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
  72. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +5 -9
  73. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  74. data/lib/contrast/agent/protect/policy/rule_applicator.rb +7 -9
  75. data/lib/contrast/agent/protect/rule/base.rb +20 -23
  76. data/lib/contrast/agent/protect/rule/base_service.rb +9 -5
  77. data/lib/contrast/agent/protect/rule/cmd_injection.rb +18 -23
  78. data/lib/contrast/agent/protect/rule/deserialization.rb +6 -13
  79. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +3 -14
  80. data/lib/contrast/agent/protect/rule/no_sqli.rb +6 -2
  81. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -3
  82. data/lib/contrast/agent/protect/rule/path_traversal.rb +6 -10
  83. data/lib/contrast/agent/protect/rule/sqli.rb +1 -1
  84. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  85. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  86. data/lib/contrast/agent/protect/rule/xxe.rb +5 -12
  87. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -2
  88. data/lib/contrast/agent/reaction_processor.rb +13 -13
  89. data/lib/contrast/agent/request.rb +27 -26
  90. data/lib/contrast/agent/request_context.rb +17 -22
  91. data/lib/contrast/agent/request_handler.rb +5 -3
  92. data/lib/contrast/agent/response.rb +2 -3
  93. data/lib/contrast/agent/rewriter.rb +9 -6
  94. data/lib/contrast/agent/rule_set.rb +5 -4
  95. data/lib/contrast/agent/service_heartbeat.rb +4 -6
  96. data/lib/contrast/agent/static_analysis.rb +6 -5
  97. data/lib/contrast/agent/thread.rb +2 -4
  98. data/lib/contrast/agent/thread_watcher.rb +3 -4
  99. data/lib/contrast/agent/tracepoint_hook.rb +5 -5
  100. data/lib/contrast/agent/version.rb +1 -1
  101. data/lib/contrast/api/communication/messaging_queue.rb +4 -5
  102. data/lib/contrast/api/communication/response_processor.rb +11 -13
  103. data/lib/contrast/api/communication/service_lifecycle.rb +9 -6
  104. data/lib/contrast/api/communication/socket_client.rb +22 -31
  105. data/lib/contrast/api/communication/speedracer.rb +8 -13
  106. data/lib/contrast/api/decorators/address.rb +2 -3
  107. data/lib/contrast/api/decorators/agent_startup.rb +7 -9
  108. data/lib/contrast/api/decorators/application_startup.rb +12 -10
  109. data/lib/contrast/api/decorators/application_update.rb +0 -4
  110. data/lib/contrast/api/decorators/http_request.rb +3 -7
  111. data/lib/contrast/api/decorators/instrumentation_mode.rb +3 -5
  112. data/lib/contrast/api/decorators/library.rb +8 -6
  113. data/lib/contrast/api/decorators/message.rb +9 -9
  114. data/lib/contrast/api/decorators/trace_event.rb +3 -1
  115. data/lib/contrast/api/decorators/trace_event_object.rb +3 -6
  116. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -6
  117. data/lib/contrast/components/agent.rb +17 -17
  118. data/lib/contrast/components/app_context.rb +11 -15
  119. data/lib/contrast/components/assess.rb +16 -16
  120. data/lib/contrast/components/base.rb +40 -0
  121. data/lib/contrast/components/config.rb +2 -3
  122. data/lib/contrast/components/contrast_service.rb +12 -18
  123. data/lib/contrast/components/heap_dump.rb +5 -4
  124. data/lib/contrast/components/inventory.rb +2 -7
  125. data/lib/contrast/components/logger.rb +1 -2
  126. data/lib/contrast/components/protect.rb +10 -13
  127. data/lib/contrast/components/sampling.rb +13 -7
  128. data/lib/contrast/components/scope.rb +0 -4
  129. data/lib/contrast/components/settings.rb +5 -7
  130. data/lib/contrast/config/assess_rules_configuration.rb +1 -3
  131. data/lib/contrast/config/base_configuration.rb +4 -5
  132. data/lib/contrast/config/exception_configuration.rb +1 -5
  133. data/lib/contrast/config/heap_dump_configuration.rb +12 -6
  134. data/lib/contrast/config/logger_configuration.rb +1 -5
  135. data/lib/contrast/configuration.rb +6 -18
  136. data/lib/contrast/extension/assess/array.rb +3 -10
  137. data/lib/contrast/extension/assess/erb.rb +1 -7
  138. data/lib/contrast/extension/assess/eval_trigger.rb +4 -9
  139. data/lib/contrast/extension/assess/exec_trigger.rb +3 -9
  140. data/lib/contrast/extension/assess/fiber.rb +8 -17
  141. data/lib/contrast/extension/assess/hash.rb +3 -3
  142. data/lib/contrast/extension/assess/kernel.rb +4 -13
  143. data/lib/contrast/extension/assess/marshal.rb +6 -10
  144. data/lib/contrast/extension/assess/regexp.rb +6 -10
  145. data/lib/contrast/extension/assess/string.rb +8 -6
  146. data/lib/contrast/extension/kernel.rb +2 -2
  147. data/lib/contrast/extension/protect/kernel.rb +0 -5
  148. data/lib/contrast/framework/manager.rb +3 -5
  149. data/lib/contrast/framework/rack/patch/session_cookie.rb +11 -24
  150. data/lib/contrast/framework/rack/patch/support.rb +6 -4
  151. data/lib/contrast/framework/rails/patch/assess_configuration.rb +12 -9
  152. data/lib/contrast/framework/rails/patch/support.rb +41 -35
  153. data/lib/contrast/framework/rails/railtie.rb +34 -0
  154. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +4 -1
  155. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +2 -0
  156. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +5 -4
  157. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +2 -0
  158. data/lib/contrast/framework/rails/support.rb +2 -2
  159. data/lib/contrast/framework/sinatra/support.rb +3 -1
  160. data/lib/contrast/funchook/funchook.rb +5 -8
  161. data/lib/contrast/logger/application.rb +13 -15
  162. data/lib/contrast/logger/format.rb +2 -5
  163. data/lib/contrast/logger/log.rb +26 -9
  164. data/lib/contrast/logger/request.rb +1 -6
  165. data/lib/contrast/security_exception.rb +1 -1
  166. data/lib/contrast/tasks/config.rb +0 -1
  167. data/lib/contrast/tasks/service.rb +6 -7
  168. data/lib/contrast/utils/assess/sampling_util.rb +2 -3
  169. data/lib/contrast/utils/assess/tracking_util.rb +3 -6
  170. data/lib/contrast/utils/class_util.rb +0 -8
  171. data/lib/contrast/utils/hash_digest.rb +2 -5
  172. data/lib/contrast/utils/heap_dump_util.rb +5 -3
  173. data/lib/contrast/utils/invalid_configuration_util.rb +4 -3
  174. data/lib/contrast/utils/inventory_util.rb +2 -3
  175. data/lib/contrast/utils/io_util.rb +3 -5
  176. data/lib/contrast/utils/job_servers_running.rb +13 -7
  177. data/lib/contrast/utils/os.rb +4 -4
  178. data/lib/contrast/utils/ruby_ast_rewriter.rb +2 -1
  179. data/lib/contrast/utils/string_utils.rb +2 -3
  180. data/lib/contrast/utils/tag_util.rb +25 -19
  181. data/resources/assess/policy.json +55 -0
  182. data/ruby-agent.gemspec +17 -16
  183. data/service_executables/VERSION +1 -1
  184. data/service_executables/linux/contrast-service +0 -0
  185. data/service_executables/mac/contrast-service +0 -0
  186. data/sonar-project.properties +9 -0
  187. metadata +61 -46
  188. data/lib/contrast/agent/railtie.rb +0 -31
  189. data/lib/contrast/components/interface.rb +0 -195
  190. data/lib/contrast/delegators/input_analysis.rb +0 -12
data/lib/contrast/delegators/input_analysis.rb DELETED
@@ -1,12 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Delegators
6
- # Used to decorate the InputAnalysis protobuf model so it can own the
7
- # Contrast::Agent::Request from which it came.
8
- class InputAnalysis < SimpleDelegator
9
- attr_accessor :request
10
- end
11
- end
12
- end