contrast-agent 4.7.0 → 4.10.0

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -68,7 +68,7 @@ module Contrast
           end
 
           def rule_disabled?
-            ASSESS.rule_disabled?(rule_id)
+            ::Contrast::ASSESS.rule_disabled?(rule_id)
           end
 
           # Indicate if this is a dataflow based trigger, meaning it has a proper

data/lib/contrast/agent/assess/property/evented.rb

@@ -50,7 +50,8 @@ module Contrast
             return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
 
             if current_request.observed_route.sources.any? do |source|
-                 source.type == event.forced_source_type && source.name == event.forced_source_name
+                 source.type == event.forced_source_type &&
+                       source.name == event.forced_source_name # rubocop:disable Security/Module/Name
                end
 
               return

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/extension/module'
 
 module Contrast
@@ -18,11 +18,10 @@ module Contrast
           #    given value set
           # 3) redacted_marker : the value to plug in for the obfuscated value
           module HardcodedValueRule
-            include Contrast::Components::Interface
-            access_component :analysis, :app_context, :logging
+            include Contrast::Components::Logger::InstanceMethods
 
             def disabled?
-              !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
+              !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
             end
 
             # TODO: RUBY-1014 - remove `#analyze`

data/lib/contrast/agent/at_exit_hook.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
     # This module adds an at_exit hook for us to send messages that may be lost at process exit
     module AtExitHook
-      include Contrast::Components::Interface
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
+
       def self.exit_hook
         @_exit_hook ||= begin
           at_exit do

data/lib/contrast/agent/class_reopener.rb

@@ -5,7 +5,8 @@ return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 
 require 'ripper'
 require 'contrast/extension/module'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/logger/log'
 
 # This method is left purposefully at the top level namespace. Moving it
@@ -20,7 +21,7 @@ require 'contrast/logger/log'
 def unbound_eval _class_name, content
   # Yuck, this is a top-level method that has to break encapsulation
   # in order to access scoping!
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope!
+  ::Contrast::SCOPE.scope_for_current_ec.enter_contrast_scope!
   eval(content) # rubocop:disable Security/Eval
 rescue Exception # rubocop:disable Lint/RescueException
   # We can't use components here, so we have to access the log directly. I hate
@@ -29,7 +30,7 @@ rescue Exception # rubocop:disable Lint/RescueException
   # And we need to return nil here, not the value from the logger.
   nil
 ensure
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope!
+  ::Contrast::SCOPE.scope_for_current_ec.exit_contrast_scope!
 end
 
 module Contrast
@@ -38,8 +39,8 @@ module Contrast
     # @deprecated Changes to this class are discouraged as this approach is
     #   being phased out with support for those language versions.
     class ClassReopener
-      include Contrast::Components::Interface
-      access_component :logging, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       END_NEW_LINE = "end\n"
       PROTECTED_WITH_NEW_LINE = "protected\n"

data/lib/contrast/agent/disable_reaction.rb

@@ -1,20 +1,19 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
     # A Reaction from TeamServer which indicates the Agent should be disabled,
     # typically because some configuration setting did not satisfy requirements
     # set by the Organization's Administrator
-    class DisableReaction
-      include Contrast::Components::Interface
-      access_component :agent, :logging
+    module DisableReaction
+      extend Contrast::Components::Logger::InstanceMethods
 
       def self.run _reaction, level
         logger.with_level(level, 'Contrast received instructions to disable itself - Disabling now')
-        AGENT.disable!
+        ::Contrast::AGENT.disable!
       end
     end
   end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -9,8 +9,7 @@ module Contrast
     # the Application. If a request or an event matches one of these, the
     # functions of the Agent are suppressed for that request or event.
     class ExclusionMatcher
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       # Create a matcher around an exclusion sent from TeamServer.
       #
@@ -95,10 +94,6 @@ module Contrast
         @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
-      def exc_name
-        @exclusion.name # rubocop:disable Security/Module/Name -- part of the API.
-      end
-
       def match_all?
         @exclusion.urls.nil? || @exclusion.urls.empty?
       end

data/lib/contrast/agent/inventory/database_config.rb

@@ -0,0 +1,117 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/timer'
+require 'contrast/utils/object_share'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Methods used for parsing database connection configurations
+      # for getting inventory information from the application
+      module DatabaseConfig
+        extend Contrast::Components::Logger::InstanceMethods
+
+        # TeamServer only accepts certain values for ArchitectureComponents.
+        # DO NOT CHANGE THIS!
+        AC_TYPE_DB = 'db'
+        # TeamServer only accepts certain values for FlowMap Services.
+        # DO NOT CHANGE THIS
+        ADAPTER = 'adapter'
+        HOST = 'host'
+        PORT = 'port'
+        DATABASE = 'database'
+        DEFAULT = 'default'
+        LOCALHOST = 'localhost'
+
+        def self.active_record_config
+          return @_active_record_config if instance_variable_defined?(:@_active_record_config)
+
+          @_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
+        end
+
+        def self.append_db_config(activity_or_update,
+                                  hash_or_str = Contrast::Agent::Inventory::DatabaseConfig.active_record_config)
+          arr = build_from_db_config(hash_or_str)
+          return unless arr&.any?
+
+          arr.each do |a|
+            next unless a
+
+            if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
+              activity_or_update.architectures << a
+            else
+              activity_or_update.components << a
+            end
+          end
+        rescue StandardError => e
+          logger.error('Unable to append db config', e)
+          nil
+        end
+
+        def self.build_from_db_config hash_or_str
+          return unless hash_or_str
+
+          if hash_or_str.is_a?(Hash)
+            build_from_db_hash(hash_or_str)
+          else
+            build_from_db_string(hash_or_str.to_s)
+          end
+        end
+
+        def self.build_from_db_hash hash
+          ac = Contrast::Api::Dtm::ArchitectureComponent.new
+          ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          ac.remote_host = host_from_hash(hash)
+          ac.remote_port = port_from_hash(hash)
+          ac.type = AC_TYPE_DB
+          ac.url = hash[:database] || hash[DATABASE] || DEFAULT
+          [ac]
+        end
+
+        def self.host_from_hash hash
+          hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        def self.port_from_hash hash
+          p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          p.to_i
+        end
+
+        # Examples:
+        # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
+        # postgresql://scott:tiger@localhost/mydatabase
+        # mysql+mysqlconnector://scott:tiger@localhost/foo
+        def self.build_from_db_string str
+          adapter, hosts, database = split_connection_str(str)
+          acs = []
+          hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
+            host, port = s.split(Contrast::Utils::ObjectShare::COLON)
+
+            ac = Contrast::Api::Dtm::ArchitectureComponent.new
+            ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
+            ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
+            ac.remote_port = port.to_i
+            ac.type = AC_TYPE_DB
+            ac.url = Contrast::Utils::StringUtils.force_utf8(database)
+            acs << ac
+          end
+          acs
+        end
+
+        def self.split_connection_str str
+          adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
+          _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
+          # Not currently used
+          # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
+          hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
+          hosts << LOCALHOST if hosts.empty?
+          database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
+
+          [adapter, hosts, database]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/dependencies'
-require 'contrast/components/interface'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -12,17 +11,14 @@ module Contrast
       class DependencyAnalysis
         include Singleton
         include Contrast::Agent::Inventory::Dependencies
-        include Contrast::Components::Interface
-
-        access_component :analysis
 
         # Report the dependencies of this application
         #
         # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
         #   Gem::Specification that have been loaded for this application.
         def library_pb_list
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.enabled?
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.analyze_libraries?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enabled?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries?
 
           loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
             next unless spec

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/dependencies'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'set'
 
@@ -12,11 +12,9 @@ module Contrast
       # Used to analyze class usage for reporting
       class DependencyUsageAnalysis
         include Singleton
-        include Contrast::Components::Interface
+        include Contrast::Components::Logger::InstanceMethods
         include Contrast::Agent::Inventory::Dependencies
 
-        access_component :analysis, :config, :logging
-
         def initialize
           return unless enabled?
 
@@ -78,11 +76,12 @@ module Contrast
           return unless enabled?
           return unless activity
 
-          # Copy gemdigest_cache and clear it in sync.
+          # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
+          # assignment and the replace
           gem_spec_digest_to_files = @lock.synchronize do
-            copy = @gemdigest_cache.dup
-            @gemdigest_cache.clear
-            copy
+            hold = @gemdigest_cache
+            @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
+            hold
           end
 
           gem_spec_digest_to_files.each_pair do |digest, files|
@@ -107,7 +106,7 @@ module Contrast
 
         # We only use this if inventory and library analysis are enabled
         def enabled?
-          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled = ::Contrast::INVENTORY.enabled? && ::Contrast::INVENTORY.analyze_libraries? if @_enabled.nil?
           @_enabled
         end
       end

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-require 'contrast/utils/inventory_util'
+require 'contrast/components/logger'
+require 'contrast/agent/inventory/database_config'
 
 module Contrast
   module Agent
@@ -14,15 +14,14 @@ module Contrast
         # the given invocation is worth reporting or not.
         module DataStores
           class << self
-            include Contrast::Components::Interface
+            extend Contrast::Components::Logger::InstanceMethods
 
-            access_component :analysis, :logging
             # The key used in policy.json to indicate the database type to
             # report.
             DATA_STORE_MARKER = 'data_store'
 
             def report_data_store _method, _exception, properties, object, _args
-              return unless INVENTORY.enabled?
+              return unless ::Contrast::INVENTORY.enabled?
 
               marker = properties[DATA_STORE_MARKER]
               return unless marker
@@ -43,7 +42,7 @@ module Contrast
               context.activity.query_count += 1
               return unless context.activity.query_count == 1
 
-              Contrast::Utils::InventoryUtil.append_db_config(context.activity)
+              Contrast::Agent::Inventory::DatabaseConfig.append_db_config(context.activity)
             end
           end
         end

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -19,7 +19,7 @@ module Contrast
           end
 
           def disabled_globally?
-            !INVENTORY.enabled?
+            !::Contrast::INVENTORY.enabled?
           end
 
           def node_type

data/lib/contrast/agent/middleware.rb

@@ -7,7 +7,8 @@ require 'rack'
 
 require 'contrast/security_exception'
 require 'contrast/utils/object_share'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/utils/heap_dump_util'
 require 'contrast/agent/request_handler'
 require 'contrast/agent/static_analysis'
@@ -20,8 +21,8 @@ module Contrast
     # initialize ourselves as a rack middleware inside of #initialize. Afterwards, we process each http request and
     # response as it goes through the middleware stack inside of #call.
     class Middleware
-      include Contrast::Components::Interface
-      access_component :agent, :config, :logging, :scope, :settings
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       attr_reader :app
 
@@ -36,10 +37,10 @@ module Contrast
       def initialize app, _legacy_param = nil
         @app = app  # THIS MUST BE FIRST AND ALWAYS SET!
         setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
-        unless AGENT.enabled?
+        unless ::Contrast::AGENT.enabled?
           logger.error('The Agent was unable to initialize before the application middleware was initialized. '\
                        'Disabling permanently.')
-          AGENT.disable! # ensure the agent is disabled (probably redundant)
+          ::Contrast::AGENT.disable! # ensure the agent is disabled (probably redundant)
           return
         end
         agent_startup_routine
@@ -53,27 +54,28 @@ module Contrast
       # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
       #   the Rack framework.
       def call env
-        return app.call(env) unless AGENT.enabled?
+        return app.call(env) unless ::Contrast::AGENT.enabled?
 
         Contrast::Agent.heapdump_util.start_thread!
         handle_first_request
         call_with_agent(env)
       end
+      ::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
 
       private
 
       def setup_agent
-        SETTINGS.reset_state
+        ::Contrast::SETTINGS.reset_state
 
         inform_deprecations
 
-        if CONFIG.invalid?
-          AGENT.disable!
+        if ::Contrast::CONFIG.invalid?
+          ::Contrast::AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif AGENT.disabled?
+        elsif ::Contrast::AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
-          AGENT.enable!
+          ::Contrast::AGENT.enable!
         end
       end
 
@@ -92,7 +94,7 @@ module Contrast
         end
 
         logger.debug_with_time('middleware: enabling tracepoint') do
-          AGENT.enable_tracepoint
+          ::Contrast::AGENT.enable_tracepoint
         end
         Contrast::Agent::AtExitHook.exit_hook
       end
@@ -191,7 +193,7 @@ module Contrast
       # config.agent.ruby.exceptions.capture? is set
       def handle_exception exception
         if security_exception?(exception)
-          exception_control = AGENT.exception_control
+          exception_control = ::Contrast::AGENT.exception_control
           raise exception unless exception_control[:enable]
 
           [exception_control[:status], {}, [exception_control[:message]]]