contrast-agent 4.8.0 → 4.9.0

data/lib/contrast/extension/kernel.rb

@@ -41,15 +41,13 @@ module Kernel # :nodoc:
 
   def catch *args, &block
     # Save current scope level
-    scope_level =
-      Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+    scope_level = ::Contrast::SCOPE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
 
     # Run original catch with block.
     retval = cs__catch(*args, &block)
 
     # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope,
-                                                                                                scope_level)
+    ::Contrast::SCOPE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
 
     retval
   end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-
 module Contrast
   module Extension
     module Protect
@@ -10,9 +8,6 @@ module Contrast
       # allowing us to track activity as it crosses spawned processes.
       module Kernel
         class << self
-          include Contrast::Components::Interface
-          access_component :contrast_service
-
           def build_wrapper
             lambda {
               proc_start

data/lib/contrast/framework/manager.rb

@@ -1,19 +1,18 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
 require 'contrast/framework/platform_version'
 require 'contrast/framework/rack/support'
 require 'contrast/framework/rails/support'
 require 'contrast/framework/sinatra/support'
-require 'contrast/components/interface'
 require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
     # Allows access to framework specific information
     class Manager
-      include Contrast::Components::Interface
-      access_component :analysis, :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       # Order here does matter as the first framework listed will be the first one we pull information from
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Framework
@@ -11,9 +12,8 @@ module Contrast
         # runtime detection of insecure configurations on individual cookies
         # within the application
         class SessionCookie
-          include Contrast::Components::Interface
-
-          access_component :agent, :analysis, :logging, :scope
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
 
           CS__SECURE_RULE_NAME = 'secure-flag-missing'
           CS__HTTPONLY_NAME = 'rails-http-only-disabled'
@@ -36,8 +36,8 @@ module Contrast
             end
 
             def analyze options
-              return unless AGENT.enabled?
-              return if ASSESS.forcibly_disabled?
+              return unless ::Contrast::AGENT.enabled?
+              return if ::Contrast::ASSESS.forcibly_disabled?
 
               apply_session_timeout(options)
               apply_httponly(options)

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
@@ -10,9 +9,8 @@ module Contrast
       module Patch
         # This module is used to analyze rails session storage configuration for assess vulnerabilities
         module AssessConfiguration
-          include Contrast::Components::Interface
+          include Contrast::Components::Logger::InstanceMethods
 
-          access_component :agent, :analysis, :logging
 
           CS__SESSION_TIMEOUT_NAME = 'session-timeout'
           SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
@@ -23,7 +21,7 @@ module Contrast
             include Contrast::Utils::InvalidConfigurationUtil
 
             def analyze_session_store *args
-              return if ASSESS.forcibly_disabled?
+              return if ::Contrast::ASSESS.forcibly_disabled?
 
               apply_httponly_disabled(*args)
               apply_secure_cookie_disabled(*args)
@@ -52,7 +50,7 @@ module Contrast
             end
 
             def apply_session_timeout *args
-              return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
+              return if ::Contrast::ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
               return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args,
                                                 comparison_type: :greater_than, safe_default: false)
 
@@ -67,7 +65,7 @@ module Contrast
             end
 
             def apply_secure_cookie_disabled *args
-              return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
+              return if ::Contrast::ASSESS.rule_disabled? CS__SECURE_RULE_NAME
               return unless vulnerable_setting?(:secure, true, args)
 
               rails_session_settings = args[1]
@@ -81,7 +79,7 @@ module Contrast
             end
 
             def apply_httponly_disabled *args
-              return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
+              return if ::Contrast::ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
               return unless vulnerable_setting?(:httponly, true, args)
 
               rails_session_settings = args[1]

data/lib/contrast/framework/rails/patch/support.rb

@@ -25,42 +25,46 @@ module Contrast
 
           # (See BaseSupport#after_load_patches)
           def after_load_patches
-            Set.new([
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'ActionController::Live::Buffer',
-                          'contrast/framework/rails/patch/action_controller_live_buffer',
-                          instrumenting_module: 'Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer'),
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'Rails::Application::Configuration',
-                          'contrast/framework/rails/patch/rails_application_configuration',
-                          method_to_instrument: :session_store,
-                          instrumenting_module: 'Contrast::Framework::Rails::Patch::RailsApplicationConfiguration'),
-
-                      # TODO: RUBY-714 remove w/ EOL of 2.5
-                      #
-                      # @deprecated  Everything past here is used for Rewriting and can
-                      #   be removed once we no longer support 2.5.
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'ActionController::Railties::Helper::ClassMethods',
-                          'contrast/framework/rails/rewrite/action_controller_railties_helper_inherited',
-                          method_to_instrument: :inherited,
-                          instrumenting_module:
-                            'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'ActiveRecord::AttributeMethods::Read::ClassMethods',
-                          'contrast/framework/rails/rewrite/active_record_attribute_methods_read',
-                          instrumenting_module:
-                            'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'ActiveRecord::Scoping::Named::ClassMethods',
-                          'contrast/framework/rails/rewrite/active_record_named',
-                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordNamed'),
-                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                          'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                          'contrast/framework/rails/rewrite/active_record_time_zone_inherited',
-                          method_to_instrument: :inherited,
-                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordTimeZoneInherited')
-                    ])
+            patches = Set.new([
+                                Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                    'ActionController::Live::Buffer',
+                                    'contrast/framework/rails/patch/action_controller_live_buffer',
+                                    instrumenting_module: 'Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer'),
+                                Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                    'Rails::Application::Configuration',
+                                    'contrast/framework/rails/patch/rails_application_configuration',
+                                    method_to_instrument: :session_store,
+                                    instrumenting_module: 'Contrast::Framework::Rails::Patch::RailsApplicationConfiguration')
+                              ])
+            if RUBY_VERSION < '2.6.0'
+              patches.merge([
+                              # TODO: RUBY-714 remove w/ EOL of 2.5
+                              #
+                              # @deprecated  Everything past here is used for Rewriting and can
+                              #   be removed once we no longer support 2.5.
+                              Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                  'ActionController::Railties::Helper::ClassMethods',
+                                  'contrast/framework/rails/rewrite/action_controller_railties_helper_inherited',
+                                  method_to_instrument: :inherited,
+                                  instrumenting_module:
+                                    'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
+                              Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                  'ActiveRecord::AttributeMethods::Read::ClassMethods',
+                                  'contrast/framework/rails/rewrite/active_record_attribute_methods_read',
+                                  instrumenting_module:
+                                    'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
+                              Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                  'ActiveRecord::Scoping::Named::ClassMethods',
+                                  'contrast/framework/rails/rewrite/active_record_named',
+                                  instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordNamed'),
+                              Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                  'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
+                                  'contrast/framework/rails/rewrite/active_record_time_zone_inherited',
+                                  method_to_instrument: :inherited,
+                                  instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordTimeZoneInherited')
+                            ])
+            end
+            patches
           end
         end
       end

data/lib/contrast/framework/rails/railtie.rb

@@ -2,22 +2,24 @@
 # frozen_string_literal: true
 
 require 'contrast/utils/job_servers_running'
+require 'contrast/components/logger'
 
 module Contrast
   module Framework
     module Rails
       # A Railtie to allow for the automatic hooking of the Agent into a Rails application.
       class Railtie < ::Rails::Railtie
-        include Contrast::Components::Interface
-        access_component :agent, :app_context, :logging
+        include Contrast::Components::Logger::InstanceMethods
 
         initializer 'Contrast Ruby Agent Initializer' do |app|
-          Rails.logger.debug("In railtie ::#{ app.middleware.inspect }") if defined?(Rails) && defined?(Rails.logger)
+        log_rails = defined?(Rails) && defined?(Rails.logger)
 
-          if APP_CONTEXT.instrument_middleware_stack?
-            AGENT.insert_middleware(app)
+          Rails.logger.debug("In railtie ::#{ app.middleware.inspect }") if log_rails
+
+          if ::Contrast::APP_CONTEXT.instrument_middleware_stack?
+            ::Contrast::AGENT.insert_middleware(app)
           else
-            Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.')
+            Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.') if log_rails
             logger.debug('Disabling Contrast for process', p_id: Process.pid)
           end
         end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -3,7 +3,7 @@
 
 return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Framework
@@ -17,12 +17,11 @@ module Contrast
         # @deprecated Changes to this class are discouraged as this approach is
         #   being phased out with support for those language versions.
         class ActiveRecordNamed
-          include Contrast::Components::Interface
-          access_component :agent, :logging
+          include Contrast::Components::Logger::InstanceMethods
 
           class << self
             def rewrite mod, method_name, body
-              return body unless AGENT.rewrite_interpolation?
+              return body unless ::Contrast::AGENT.rewrite_interpolation?
               return body unless body.is_a?(Proc)
 
               location = body.source_location

data/lib/contrast/funchook/funchook.rb

@@ -1,11 +1,12 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+
 # This module is used to find funchook library and determine availability
 module Funchook
-  include Contrast::Components::Interface
-  access_component :logging
+  extend Contrast::Components::Logger::InstanceMethods
+
   attr_accessor :path
 
   # Possible platform library files

data/lib/contrast/logger/application.rb

@@ -1,16 +1,11 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-
 module Contrast
   module Logger
     # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
-      include Contrast::Components::Interface
-      access_component :config
-
       ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
       # Utility method to log some current ruby and rails information from environment
       def application_environment
@@ -31,7 +26,7 @@ module Contrast
       def application_configuration
         return unless info?
 
-        loggable = CONFIG.loggable
+        loggable = ::Contrast::CONFIG.loggable
         info('Current configuration', configuration: loggable)
         env_keys = ENV.keys.select do |env_key|
           env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER)

data/lib/contrast/logger/log.rb

@@ -5,21 +5,37 @@ require 'logger'
 require 'ougai'
 require 'singleton'
 
-require 'contrast/components/interface'
 require 'contrast/extension/module'
 require 'contrast/logger/application'
 require 'contrast/logger/format'
 require 'contrast/logger/request'
 require 'contrast/logger/time'
+require 'contrast/components/config'
 
 module Contrast
   module Logger
+    # For development set following env var to raise logged exceptions instead of just logging.
+    if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+      Ougai::Logger.class_eval do
+        alias_method :cs__error, :error
+        alias_method :cs__warn, :warn
+
+        def error msg, exc, **kwargs
+          cs__error(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+
+        def warn msg, exc, **kwargs
+          cs__warn(msg, exc, **kwargs)
+          raise exc if exc && exc.cs__class < Exception
+        end
+      end
+    end
+
     # This class functions to serve as a wrapper around our logging, as we need
     # to be able to dynamically update level based on updates to TeamServer.
     class Log
       include Singleton
-      include Contrast::Components::Interface
-      access_component :config
 
       DEFAULT_NAME     = 'contrast.log'
       DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
@@ -107,8 +123,8 @@ module Contrast
       #   TeamServer.
       # @return [String] the path to which to log or STDOUT / STDERR if one of those values provided.
       def find_valid_path log_file
-        config = CONFIG.root.agent.logger
-        config_path = config.path&.length.to_i.positive? ? config.path : nil
+        config = ::Contrast::CONFIG.root.agent.logger
+        config_path = config&.path&.length.to_i.positive? ? config.path : nil
         valid_path(config_path || log_file)
       end
 
@@ -141,7 +157,7 @@ module Contrast
       #   TeamServer.
       # @return [::Ougai::Logging::Severity] the level at which to log
       def find_valid_level log_level
-        config = CONFIG.root.agent.logger
+        config = ::Contrast::CONFIG.root.agent.logger
         config_level = config.level&.length&.positive? ? config.level : nil
         valid_level(config_level || log_level)
       end

data/lib/contrast/logger/request.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/timer'
 
 module Contrast
@@ -9,9 +8,6 @@ module Contrast
     # Our decorator for the Ougai logger allowing for the logging of the
     # request lifecycle, used to provide context during troubleshooting.
     module Request
-      include Contrast::Components::Interface
-      access_component :config
-
       # Utility method to log the start of a request
       def request_start
         debug('Beginning request analysis')

data/lib/contrast/tasks/service.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/os'
 
 module Contrast
@@ -10,14 +9,10 @@ module Contrast
   # forked from the application
   module Service
     extend Rake::DSL
-    include Contrast::Components::Interface
-
-    access_component :contrast_service
-
     # Start the service if it is not already running
     def self.start_service
       puts 'Starting Contrast Service'
-      service_log = CONTRAST_SERVICE.logger_path
+      service_log = ::Contrast::CONTRAST_SERVICE.logger_path
       if File.writable?(service_log)
         spawn('contrast_service', out: File::NULL, err: service_log)
       else

data/lib/contrast/utils/assess/sampling_util.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/sampling'
 
 module Contrast
   module Utils
@@ -11,8 +11,7 @@ module Contrast
       class SamplingUtil
         include Singleton
 
-        include Contrast::Components::Interface
-        access_component :sampling
+        extend Contrast::Components::Sampling::InstanceMethods
 
         def initialize
           @requests = {}