contrast-agent 4.8.0 → 4.11.0

data/lib/contrast/logger/log.rb

@@ -5,21 +5,106 @@ require 'logger'
 require 'ougai'
 require 'singleton'
 
-require 'contrast/components/interface'
 require 'contrast/extension/module'
 require 'contrast/logger/application'
 require 'contrast/logger/format'
 require 'contrast/logger/request'
 require 'contrast/logger/time'
+require 'contrast/components/config'
 
 module Contrast
+  # This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
+  # we pay the penalty for that timing block
+  module TraceTiming
+    def methods_to_time
+      @_methods_to_time ||= []
+    end
+
+    # Store info about methods for later patching.
+    METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
+
+    # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
+    # logger set to TRACE.
+    #
+    # @params: clazz [Class] the class of the method to time.
+    # @params: method [Symbol] the method to time.
+    # @params: method [String] optional custom logging message.
+    def add_method_to_trace_timing clazz, method, msg = nil
+      methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
+      enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
+    end
+
+    # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
+    # logger set to TRACE.
+    #
+    # @params: method_spec [METHOD_INFO] specs about the method to be timed.
+    # @params: class_method [Boolean] whether this is or isn't a class/module method.
+    def trace_time_class_method meth_spec, class_method
+      untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
+      send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
+      meth_spec.clazz.class_eval do
+        include Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Logger::InstanceMethods
+
+        send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
+        meth_spec.aliased = true
+
+        log_message = "Elapsed time for #{ meth_spec.method_name }."
+        log_message = meth_spec.custom_message if meth_spec.custom_msg
+
+        send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
+          start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          rv = if kwargs.empty?
+                 send(untimed_func_symbol, *args, &block)
+               else
+                 send(untimed_func_symbol, *args, **kwargs, &block)
+               end
+          delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
+          logger.trace(log_message, elapsed: delta * 1000)
+          rv
+        end
+      end
+    end
+
+    # Enable trace timing of methods specified in @_methods_to_time via aliasing.
+    def enable_trace_timing
+      methods_to_time.each do |meth_spec|
+        next if meth_spec.aliased
+
+        is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
+        trace_time_class_method meth_spec, is_class_method
+      end
+    end
+  end
+end
+
+module Contrast
+  # Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
+  # logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
+  # while still providing safe options for customers.
   module Logger
-    # This class functions to serve as a wrapper around our logging, as we need
-    # to be able to dynamically update level based on updates to TeamServer.
+    # For development set following env var to raise logged exceptions instead of just logging.
+    if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+      Ougai::Logger.class_eval do
+        alias_method :cs__error, :error
+        alias_method :cs__warn, :warn
+
+        def error *args, **kwargs
+          if kwargs.empty?
+            cs__error(*args)
+          else
+            cs__error(*args, **kwargs)
+          end
+          args.each { |arg| raise arg if arg && arg.cs__class < Exception }
+        end
+      end
+    end
+
+    # This class functions to serve as a wrapper around our logging, as we need to be able to dynamically update
+    # level based on updates to TeamServer.
     class Log
       include Singleton
-      include Contrast::Components::Interface
-      access_component :config
+      include ::Contrast::TraceTiming
 
       DEFAULT_NAME     = 'contrast.log'
       DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
@@ -33,8 +118,8 @@ module Contrast
         update
       end
 
-      # Given new settings from TeamServer, update our logging to use the new
-      # file and level, assuming they weren't set by local configuration.
+      # Given new settings from TeamServer, update our logging to use the new file and level, assuming they weren't
+      # set by local configuration.
       #
       # @param log_file [String] the file to which to log, as provided by TeamServer settings
       # @param log_level [String] the level at which to log, as provided by TeamServer settings
@@ -51,6 +136,8 @@ module Contrast
         @previous_path  = current_path
         @previous_level = current_level_const
 
+        enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
+
         @_logger = build(path: current_path, level_const: current_level_const)
         # If we're logging to a new path, then let's start it w/ our helpful
         # data gathering messages
@@ -60,6 +147,9 @@ module Contrast
           logger.error('Unable to process update to LoggerManager.', e)
         else
           puts 'Unable to process update to LoggerManager.'
+          raise e if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+
+          puts e.message
           puts e.backtrace.join("\n")
         end
       end
@@ -107,8 +197,8 @@ module Contrast
       #   TeamServer.
       # @return [String] the path to which to log or STDOUT / STDERR if one of those values provided.
       def find_valid_path log_file
-        config = CONFIG.root.agent.logger
-        config_path = config.path&.length.to_i.positive? ? config.path : nil
+        config = ::Contrast::CONFIG.root.agent.logger
+        config_path = config&.path&.length.to_i.positive? ? config.path : nil
         valid_path(config_path || log_file)
       end
 
@@ -141,8 +231,9 @@ module Contrast
       #   TeamServer.
       # @return [::Ougai::Logging::Severity] the level at which to log
       def find_valid_level log_level
-        config = CONFIG.root.agent.logger
-        config_level = config.level&.length&.positive? ? config.level : nil
+        config = ::Contrast::CONFIG.root.agent.logger
+        config_level = config&.level&.length&.positive? ? config.level : nil
+
         valid_level(config_level || log_level)
       end
 
@@ -158,8 +249,7 @@ module Contrast
         DEFAULT_LEVEL
       end
 
-      # Log that the Agent log has changed and include some default information
-      # at the start of the log.
+      # Log that the Agent log has changed and include some default information at the start of the log.
       def log_update
         logger.debug('Initialized new contrast agent logger')
         logger.debug_with_time('middleware: log environment') do

data/lib/contrast/logger/request.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/timer'
 
 module Contrast
@@ -9,9 +8,6 @@ module Contrast
     # Our decorator for the Ougai logger allowing for the logging of the
     # request lifecycle, used to provide context during troubleshooting.
     module Request
-      include Contrast::Components::Interface
-      access_component :config
-
       # Utility method to log the start of a request
       def request_start
         debug('Beginning request analysis')

data/lib/contrast/tasks/config.rb

@@ -7,7 +7,6 @@ module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings
   module Config
     extend Rake::DSL
-    include Contrast::Components::Interface
     DEFAULT_CONFIG = {
         'api' => {
             'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',

data/lib/contrast/tasks/service.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/os'
 
 module Contrast
@@ -10,14 +9,10 @@ module Contrast
   # forked from the application
   module Service
     extend Rake::DSL
-    include Contrast::Components::Interface
-
-    access_component :contrast_service
-
     # Start the service if it is not already running
     def self.start_service
       puts 'Starting Contrast Service'
-      service_log = CONTRAST_SERVICE.logger_path
+      service_log = ::Contrast::CONTRAST_SERVICE.logger_path
       if File.writable?(service_log)
         spawn('contrast_service', out: File::NULL, err: service_log)
       else

data/lib/contrast/utils/assess/sampling_util.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/sampling'
 
 module Contrast
   module Utils
@@ -11,8 +11,7 @@ module Contrast
       class SamplingUtil
         include Singleton
 
-        include Contrast::Components::Interface
-        access_component :sampling
+        extend Contrast::Components::Sampling::InstanceMethods
 
         def initialize
           @requests = {}

data/lib/contrast/utils/assess/tracking_util.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/duck_utils'
 
 module Contrast
@@ -10,9 +10,7 @@ module Contrast
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
-        include Contrast::Components::Interface
-
-        access_component :logging
+        extend Contrast::Components::Logger::InstanceMethods
 
         class << self
           # Public interface to our tracking check, isolating the internals

data/lib/contrast/utils/class_util.rb

@@ -3,11 +3,13 @@
 
 require 'contrast/extension/module'
 require 'contrast/utils/object_share'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Utils
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
+      @lru_cache = LRUCache.new
       class << self
         # some classes have had things prepended to them, like Marshal in Rails
         # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
@@ -47,27 +49,32 @@ module Contrast
         # @param object [Object, nil] the entity to convert to a String
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
+
         def to_contrast_string object
-          # Only treat object like a string if it actually is a string
+          # After implementing the LRU Cache, we firstly need to check if already had that object cached
+          # and if we have it - we can return it directly
+          return @lru_cache[object.__id__] if @lru_cache.key? object.__id__
+
+          # Only treat object like a string if it actually is a string+
           # some subclasses of String override string methods we depend on
-          if object.cs__class == String
-            cached = to_cached_string(object)
-            return cached if cached
-
-            object.dup
-          elsif object.nil?
-            Contrast::Utils::ObjectShare::NIL_STRING
-          elsif object.cs__is_a?(Symbol)
-            ":#{ object }"
-          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
-            "#{ object.cs__name }@#{ object.__id__ }"
-          elsif object.cs__is_a?(Regexp)
-            object.source
-          elsif use_to_s?(object)
-            object.to_s
-          else
-            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
-          end
+          @lru_cache[object.__id__] = if object.cs__class == String
+                                        cached = to_cached_string(object)
+                                        return cached if cached
+
+                                        object.dup
+                                      elsif object.nil?
+                                        Contrast::Utils::ObjectShare::NIL_STRING
+                                      elsif object.cs__is_a?(Symbol)
+                                        ":#{ object }"
+                                      elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+                                        "#{ object.cs__name }@#{ object.__id__ }"
+                                      elsif object.cs__is_a?(Regexp)
+                                        object.source
+                                      elsif use_to_s?(object)
+                                        object.to_s
+                                      else
+                                        "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+                                      end
         end
 
         # The method const_defined? can cause autoload, which is bad for us.

data/lib/contrast/utils/heap_dump_util.rb

@@ -3,14 +3,16 @@
 
 require 'objspace'
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/heap_dump'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil < Contrast::Agent::WorkerThread
-      include Contrast::Components::Interface
-      access_component :heap_dump, :logging
+      extend Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::HeapDump::InstanceMethods
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -2,15 +2,16 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
     # This utility allows us to report invalid configurations detected in
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
-      include Contrast::Components::Interface
-      access_component :analysis, :app_context, :logging, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'

data/lib/contrast/utils/io_util.rb

@@ -1,50 +1,56 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Util for information about an IO
-    class IOUtil
-      include Contrast::Components::Interface
-
-      access_component :logging
-
-      # We're only going to call rewind on things that we believe are safe to
-      # call it on. This method white lists those cases and returns false in
-      # all others.
-      def self.should_rewind? potential_io
-        return true if potential_io.is_a?(StringIO)
-        return false unless io?(potential_io)
-
-        should_rewind_io?(potential_io)
-      rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
-        false
-      end
-
-      # IO cannot be used with streams such as pipes, ttys, and sockets.
-      def self.should_rewind_io? io
-        return false if io.tty?
-
-        status = io.stat
-        return false unless status
-        return false if status.pipe?
-        return false if status.socket?
-
-        true
-      end
-
-      # A class is IO if it is a decedent or delegate of IO
-      def self.io? object
-        return true if object.is_a?(IO)
-
-        # DelegateClass, which is a Delegator, defines __getobj__ as a way to
-        # get the object that the class wraps around (delegates to)
-        return false unless object.is_a?(Delegator)
-
-        object.__getobj__.is_a?(IO)
+    module IOUtil
+      extend Contrast::Components::Logger::InstanceMethods
+
+      class << self
+        # We're only going to call rewind on things that we believe are safe to
+        # call it on. This method white lists those cases and returns false in
+        # all others.
+        def should_rewind? potential_io
+          return true if potential_io.is_a?(StringIO)
+          return false unless io?(potential_io)
+
+          should_rewind_io?(potential_io)
+        rescue StandardError => e
+          logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
+          false
+        end
+
+        # A class is IO if it is a decedent or delegate of IO
+        def io? object
+          return true if object.is_a?(IO)
+
+          # DelegateClass, which is a Delegator, defines __getobj__ as a way to
+          # get the object that the class wraps around (delegates to)
+          return false unless object.is_a?(Delegator)
+
+          object.__getobj__.is_a?(IO)
+        end
+
+        private
+
+        # IO rewind cannot be used with streams such as pipes, ttys, and sockets or for ones which have been closed.
+        #
+        # @param io [IO] the input to check for the ability to rewind
+        # @return [Boolean] if the given IO can be rewound
+        def should_rewind_io? io
+          return false if io.closed?
+          return false if io.tty?
+
+          status = io.stat
+          return false unless status
+          return false if status.pipe?
+          return false if status.socket?
+
+          true
+        end
       end
     end
   end

data/lib/contrast/utils/job_servers_running.rb

@@ -1,13 +1,14 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Utils
     # A module that detects whether any job servers attached to
     # the application are running
     module JobServersRunning
-      include Contrast::Components::Interface
-      access_component :app_context, :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       class << self
         def job_servers_running?
@@ -31,7 +32,7 @@ module Contrast
             return
           end
 
-          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
+          disabled_rake_tasks = ::Contrast::APP_CONTEXT.disabled_agent_rake_tasks
           has_disabled_task = Rake.application.top_level_tasks.any? do |top_level_task|
             disabled_rake_tasks.include?(top_level_task)
           end

data/lib/contrast/utils/lru_cache.rb

@@ -0,0 +1,43 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Utils
+    # A LRU(Least Recently Used) Cache store.
+    class LRUCache
+      def initialize capacity = 500
+        raise StandardError 'Capacity must be bigger than 0' if capacity <= 0
+
+        @capacity = capacity
+        @cache = {}
+      end
+
+      def [] key
+        val = @cache.delete(key)
+        @cache[key] = val if val
+        val
+      end
+
+      def []= key, value
+        @cache.delete(key)
+        @cache[key] = value
+        @cache.shift if @cache.size > @capacity
+        value # rubocop:disable Lint/Void
+      end
+
+      def keys
+        @cache.keys
+      end
+
+      def key? key
+        @cache.key?(key)
+      end
+
+      def values
+        @cache.values
+      end
+    end
+  end
+end

data/lib/contrast/utils/os.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
@@ -9,8 +9,7 @@ module Contrast
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
-      include Contrast::Components::Interface
-      access_component :scope
+      extend Contrast::Components::Scope::InstanceMethods
 
       class << self
         def running?

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -36,36 +36,39 @@ module Contrast
       # the replace within the given node.
       def on_dstr node
         return if node.children.all? { |child_node| child_node.type == :str }
-
         new_content = +'('
-        node.children.each_with_index do |child_node, index|
+        idx = 0
+        while idx < node.children.length
+          #node.children.each_with_index do |child_node, index|
+          child_node = node.children[idx]
           # A begin node looks like #{some_code} in ruby, we do a substring
           # from [2...-1] to get rid of the #{ & trailing }.
           if child_node.type == :begin
             code = child_node.
-                location.
-                expression.
-                source_buffer.
-                source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
+              location.
+              expression.
+              source_buffer.
+              source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
             code = code[2...-1]
             new_content += "((#{ code }).to_s)"
 
-          # For interpolations that use class, instance, or global variables,
-          # those are NOT within a begin block, but instead are a ivar, cvar,
-          # or gvar node, not stripping of interpolation markers required.
+            # For interpolations that use class, instance, or global variables,
+            # those are NOT within a begin block, but instead are a ivar, cvar,
+            # or gvar node, not stripping of interpolation markers required.
           elsif VARIABLES.include?(child_node.type)
             variable = child_node.children.first
             new_content << "((#{ variable }).to_s)"
 
-          # When interpolation includes strings before or after an
-          # interpolation they are simple :str nodes, in order to preserve
-          # escaping we need to do a dump of the string value.
+            # When interpolation includes strings before or after an
+            # interpolation they are simple :str nodes, in order to preserve
+            # escaping we need to do a dump of the string value.
           elsif child_node.type == :str
             literal_value = child_node.children.first
             literal_value = literal_value.dump[1...-1]
             new_content <<  "\"#{ literal_value }\""
           end
-          new_content << ' + ' unless index == node.children.length - 1
+          new_content << ' + ' unless idx == node.children.length - 1
+          idx += 1
         end
         new_content << ')'
         if node.location.cs__respond_to?(:heredoc_body)

data/lib/contrast/utils/string_utils.rb

@@ -1,14 +1,13 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP_'