contrast-agent 4.6.0 → 4.9.1

data/lib/contrast/agent/at_exit_hook.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
     # This module adds an at_exit hook for us to send messages that may be lost at process exit
     module AtExitHook
-      include Contrast::Components::Interface
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
+
       def self.exit_hook
         @_exit_hook ||= begin
           at_exit do

data/lib/contrast/agent/class_reopener.rb

@@ -1,9 +1,12 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 require 'ripper'
 require 'contrast/extension/module'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/logger/log'
 
 # This method is left purposefully at the top level namespace. Moving it
@@ -18,7 +21,7 @@ require 'contrast/logger/log'
 def unbound_eval _class_name, content
   # Yuck, this is a top-level method that has to break encapsulation
   # in order to access scoping!
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope!
+  ::Contrast::SCOPE.scope_for_current_ec.enter_contrast_scope!
   eval(content) # rubocop:disable Security/Eval
 rescue Exception # rubocop:disable Lint/RescueException
   # We can't use components here, so we have to access the log directly. I hate
@@ -27,7 +30,7 @@ rescue Exception # rubocop:disable Lint/RescueException
   # And we need to return nil here, not the value from the logger.
   nil
 ensure
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope!
+  ::Contrast::SCOPE.scope_for_current_ec.exit_contrast_scope!
 end
 
 module Contrast
@@ -36,8 +39,8 @@ module Contrast
     # @deprecated Changes to this class are discouraged as this approach is
     #   being phased out with support for those language versions.
     class ClassReopener
-      include Contrast::Components::Interface
-      access_component :logging, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       END_NEW_LINE = "end\n"
       PROTECTED_WITH_NEW_LINE = "protected\n"
@@ -48,7 +51,7 @@ module Contrast
                   :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
 
       def initialize module_data
-        @class_module_path = module_data.name
+        @class_module_path = module_data.mod_name
         clazz = module_data.mod
         @is_class = clazz.is_a?(Class)
         @public_instance_methods = []

data/lib/contrast/agent/disable_reaction.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -9,14 +9,11 @@ module Contrast
     # typically because some configuration setting did not satisfy requirements
     # set by the Organization's Administrator
     class DisableReaction
-      include Contrast::Components::Interface
-      access_component :agent, :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       def self.run _reaction, level
-        logger.with_level(
-            level,
-            'Contrast received instructions to disable itself - Disabling now')
-        AGENT.disable!
+        logger.with_level(level, 'Contrast received instructions to disable itself - Disabling now')
+        ::Contrast::AGENT.disable!
       end
     end
   end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -9,8 +9,7 @@ module Contrast
     # the Application. If a request or an event matches one of these, the
     # functions of the Agent are suppressed for that request or event.
     class ExclusionMatcher
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       # Create a matcher around an exclusion sent from TeamServer.
       #
@@ -47,7 +46,7 @@ module Contrast
         return if @wildcard_url
         return unless @exclusion.urls&.any?
 
-        @wildcard_url ||= @exclusion.urls.any? { |test| test == '/.*' }
+        @wildcard_url ||= @exclusion.urls.any?('/.*')
         return if @wildcard_url
 
         @urls = []
@@ -95,8 +94,8 @@ module Contrast
         @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
-      def name
-        @exclusion.name
+      def exc_name
+        @exclusion.name # rubocop:disable Security/Module/Name -- part of the API.
       end
 
       def match_all?
@@ -109,10 +108,7 @@ module Contrast
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def protection_rule? rule
-        protect? &&
-            (@exclusion.protection_rules.empty? ||
-                @exclusion.protection_rules.include?(rule)
-            )
+        protect? && (@exclusion.protection_rules.empty? || @exclusion.protection_rules.include?(rule))
       end
 
       # Determine if the given rule is excluded by this exclusion.
@@ -121,10 +117,7 @@ module Contrast
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def assess_rule? rule
-        assess? &&
-            (@exclusion.assessment_rules.empty? ||
-                @exclusion.assessment_rules.include?(rule)
-            )
+        assess? && (@exclusion.assessment_rules.empty? || @exclusion.assessment_rules.include?(rule))
       end
 
       def match_code? stack_trace

data/lib/contrast/agent/inventory/dependencies.rb

@@ -33,6 +33,7 @@ module Contrast
         # then contrast depends on it. If its array of dependents is 1, then contrast is the
         # only dependency in that list. Since only contrast depends on it, we should ignore it.
         def find_contrast_gems
+          # rubocop:disable Security/Module/Name -- here name is part of Ruby Gems.
           ignore = Set.new([CONTRAST_AGENT])
           contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
             dependency.name == CONTRAST_AGENT
@@ -43,6 +44,7 @@ module Contrast
             ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
           end
           ignore
+          # rubocop:enable Security/Module/Name
         end
       end
     end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/dependencies'
-require 'contrast/components/interface'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -12,17 +11,14 @@ module Contrast
       class DependencyAnalysis
         include Singleton
         include Contrast::Agent::Inventory::Dependencies
-        include Contrast::Components::Interface
-
-        access_component :analysis
 
         # Report the dependencies of this application
         #
         # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
         #   Gem::Specification that have been loaded for this application.
         def library_pb_list
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.enabled?
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.analyze_libraries?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enabled?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries?
 
           loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
             next unless spec

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/dependencies'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'set'
 
@@ -12,11 +12,9 @@ module Contrast
       # Used to analyze class usage for reporting
       class DependencyUsageAnalysis
         include Singleton
-        include Contrast::Components::Interface
+        include Contrast::Components::Logger::InstanceMethods
         include Contrast::Agent::Inventory::Dependencies
 
-        access_component :analysis, :config, :logging
-
         def initialize
           return unless enabled?
 
@@ -107,7 +105,7 @@ module Contrast
 
         # We only use this if inventory and library analysis are enabled
         def enabled?
-          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled = ::Contrast::INVENTORY.enabled? && ::Contrast::INVENTORY.analyze_libraries? if @_enabled.nil?
           @_enabled
         end
       end

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/inventory_util'
 
 module Contrast
@@ -14,15 +14,14 @@ module Contrast
         # the given invocation is worth reporting or not.
         module DataStores
           class << self
-            include Contrast::Components::Interface
+            extend Contrast::Components::Logger::InstanceMethods
 
-            access_component :analysis, :logging
             # The key used in policy.json to indicate the database type to
             # report.
             DATA_STORE_MARKER = 'data_store'
 
             def report_data_store _method, _exception, properties, object, _args
-              return unless INVENTORY.enabled?
+              return unless ::Contrast::INVENTORY.enabled?
 
               marker = properties[DATA_STORE_MARKER]
               return unless marker

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -19,7 +19,7 @@ module Contrast
           end
 
           def disabled_globally?
-            !INVENTORY.enabled?
+            !::Contrast::INVENTORY.enabled?
           end
 
           def node_type

data/lib/contrast/agent/middleware.rb

@@ -7,7 +7,8 @@ require 'rack'
 
 require 'contrast/security_exception'
 require 'contrast/utils/object_share'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/utils/heap_dump_util'
 require 'contrast/agent/request_handler'
 require 'contrast/agent/static_analysis'
@@ -20,8 +21,8 @@ module Contrast
     # initialize ourselves as a rack middleware inside of #initialize. Afterwards, we process each http request and
     # response as it goes through the middleware stack inside of #call.
     class Middleware
-      include Contrast::Components::Interface
-      access_component :agent, :config, :logging, :scope, :settings
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       attr_reader :app
 
@@ -36,11 +37,10 @@ module Contrast
       def initialize app, _legacy_param = nil
         @app = app  # THIS MUST BE FIRST AND ALWAYS SET!
         setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
-        unless AGENT.enabled?
-          logger.error(
-              'The Agent was unable to initialize before the application middleware was initialized. ' \
-              'Disabling permanently.')
-          AGENT.disable! # ensure the agent is disabled (probably redundant)
+        unless ::Contrast::AGENT.enabled?
+          logger.error('The Agent was unable to initialize before the application middleware was initialized. '\
+                       'Disabling permanently.')
+          ::Contrast::AGENT.disable! # ensure the agent is disabled (probably redundant)
           return
         end
         agent_startup_routine
@@ -54,7 +54,7 @@ module Contrast
       # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
       #   the Rack framework.
       def call env
-        return app.call(env) unless AGENT.enabled?
+        return app.call(env) unless ::Contrast::AGENT.enabled?
 
         Contrast::Agent.heapdump_util.start_thread!
         handle_first_request
@@ -64,17 +64,17 @@ module Contrast
       private
 
       def setup_agent
-        SETTINGS.reset_state
+        ::Contrast::SETTINGS.reset_state
 
         inform_deprecations
 
-        if CONFIG.invalid?
-          AGENT.disable!
+        if ::Contrast::CONFIG.invalid?
+          ::Contrast::AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif AGENT.disabled?
+        elsif ::Contrast::AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
-          AGENT.enable!
+          ::Contrast::AGENT.enable!
         end
       end
 
@@ -93,7 +93,7 @@ module Contrast
         end
 
         logger.debug_with_time('middleware: enabling tracepoint') do
-          AGENT.enable_tracepoint
+          ::Contrast::AGENT.enable_tracepoint
         end
         Contrast::Agent::AtExitHook.exit_hook
       end
@@ -192,7 +192,7 @@ module Contrast
       # config.agent.ruby.exceptions.capture? is set
       def handle_exception exception
         if security_exception?(exception)
-          exception_control = AGENT.exception_control
+          exception_control = ::Contrast::AGENT.exception_control
           raise exception unless exception_control[:enable]
 
           [exception_control[:status], {}, [exception_control[:message]]]
@@ -207,8 +207,7 @@ module Contrast
       # @param exception [Exception]
       # @return [Boolean]
       def security_exception? exception
-        exception.is_a?(Contrast::SecurityException) ||
-            exception.message&.include?(SECURITY_EXCEPTION_MARKER)
+        exception.is_a?(Contrast::SecurityException) || exception.message&.include?(SECURITY_EXCEPTION_MARKER)
       end
 
       # As we deprecate support to prepare to remove dead code, we need to inform our users still relying on the now

data/lib/contrast/agent/module_data.rb

@@ -6,11 +6,11 @@ module Contrast
     # A simple wrapper around a Module and a call to its name, used to avoid
     # calling the Module#name method and generating extra Strings
     class ModuleData
-      attr_reader :mod, :name
+      attr_reader :mod, :mod_name
 
-      def initialize mod, name = nil
+      def initialize mod, mod_name = nil
         @mod = mod
-        @name = name || mod.cs__name
+        @mod_name = mod_name || mod.cs__name
       end
     end
   end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 require 'contrast/extension/module'
 require 'contrast/utils/class_util'
 
@@ -11,8 +11,8 @@ module Contrast
       module Policy
         # Used to handle tracking patches that need to apply special instrumentation when a module is loaded
         class AfterLoadPatch
-          include Contrast::Components::Interface
-          access_component :scope
+          include Contrast::Components::Scope::InstanceMethods
+
           attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
           def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/after_load_patch'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/framework/manager'
 
 module Contrast
@@ -12,8 +12,7 @@ module Contrast
         # Some modules diverge from our generic instrumentation and require custom instrumentation
         # after they've been loaded
         module AfterLoadPatcher
-          include Contrast::Components::Interface
-          access_component :agent, :logging
+          include Contrast::Components::Logger::InstanceMethods
 
           # After initialization run a catchup check to instrument any already loaded modules we care about
           def catchup_after_load_patches
@@ -49,16 +48,17 @@ module Contrast
           def apply_load_patches!
             after_load_patches.each do |after_load_patch|
               next unless after_load_patch.target_defined?
-              next if AGENT.skip_instrumentation?(after_load_patch.module_name)
+              next if ::Contrast::AGENT.skip_instrumentation?(after_load_patch.module_name)
 
-              logger.trace(
-                  'Catching up on already loaded afterload patch - applying instrumentation',
-                  module: after_load_patch.module_name)
+              logger.trace('Catching up on already loaded afterload patch - applying instrumentation',
+                           module: after_load_patch.module_name)
               after_load_patch.instrument!
             rescue NameError => e
-              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name, method: after_load_patch.method_to_instrument)
+              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name,
+                                                                     method: after_load_patch.method_to_instrument)
             rescue StandardError => e
-              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name, method: after_load_patch.method_to_instrument)
+              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name,
+                                                                 method: after_load_patch.method_to_instrument)
             end
             after_load_patches.delete_if(&:applied?)
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -49,7 +49,10 @@ module Contrast
           private
 
           def nodes
-            @_nodes ||= [source_node, propagation_node, trigger_node, inventory_node, protect_node, deadzone_node].compact
+            @_nodes ||= [
+              source_node, propagation_node, trigger_node, inventory_node, protect_node,
+              deadzone_node
+            ].compact
           end
 
           def method_scopes
@@ -76,7 +79,8 @@ module Contrast
               protect_node =     find_method_node(module_policy.protect_nodes, method_name, instance_method)
               inventory_node =   find_method_node(module_policy.inventory_nodes, method_name, instance_method)
               deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
-              method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node, inventory_node, deadzone_node)
+              method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
+                                                  inventory_node, deadzone_node)
               MethodPolicy.new(method_name: method_name,
                                method_visibility: method_visibility,
                                instance_method: instance_method,