contrast-agent 4.9.0 → 4.12.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rspec +0 -1
- data/.rspec_parallel +6 -0
- data/ext/cs__common/cs__common.c +19 -7
- data/ext/cs__common/cs__common.h +4 -2
- data/ext/cs__contrast_patch/cs__contrast_patch.c +32 -11
- data/ext/cs__contrast_patch/cs__contrast_patch.h +5 -4
- data/lib/contrast/agent/assess/contrast_event.rb +1 -2
- data/lib/contrast/agent/assess/contrast_object.rb +1 -4
- data/lib/contrast/agent/assess/finalizers/hash.rb +0 -1
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +2 -0
- data/lib/contrast/agent/assess/policy/patcher.rb +0 -1
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +0 -2
- data/lib/contrast/agent/assess/policy/preshift.rb +29 -12
- data/lib/contrast/agent/assess/policy/propagation_method.rb +100 -57
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +2 -2
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +31 -11
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +4 -9
- data/lib/contrast/agent/assess/policy/propagator/split.rb +3 -2
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +1 -0
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +0 -1
- data/lib/contrast/agent/assess/policy/source_method.rb +13 -17
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +0 -1
- data/lib/contrast/agent/assess/policy/trigger_method.rb +60 -85
- data/lib/contrast/agent/assess/policy/trigger_node.rb +52 -19
- data/lib/contrast/agent/assess/property/evented.rb +2 -1
- data/lib/contrast/agent/assess/property/tagged.rb +34 -25
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +0 -1
- data/lib/contrast/agent/deadzone/policy/policy.rb +6 -0
- data/lib/contrast/agent/disable_reaction.rb +1 -1
- data/lib/contrast/agent/exclusion_matcher.rb +0 -4
- data/lib/contrast/agent/inventory/database_config.rb +117 -0
- data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +6 -5
- data/lib/contrast/agent/inventory/policy/datastores.rb +2 -2
- data/lib/contrast/agent/middleware.rb +1 -0
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +3 -0
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +17 -12
- data/lib/contrast/agent/patching/policy/method_policy.rb +54 -9
- data/lib/contrast/agent/patching/policy/module_policy.rb +2 -4
- data/lib/contrast/agent/patching/policy/patch.rb +17 -6
- data/lib/contrast/agent/patching/policy/patch_status.rb +3 -7
- data/lib/contrast/agent/patching/policy/patcher.rb +9 -9
- data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
- data/lib/contrast/agent/protect/rule/no_sqli.rb +7 -53
- data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +137 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +7 -70
- data/lib/contrast/agent/reaction_processor.rb +1 -1
- data/lib/contrast/agent/request.rb +9 -4
- data/lib/contrast/agent/request_context.rb +51 -33
- data/lib/contrast/agent/rule_set.rb +2 -4
- data/lib/contrast/agent/scope.rb +32 -20
- data/lib/contrast/agent/static_analysis.rb +1 -1
- data/lib/contrast/agent/tracepoint_hook.rb +16 -3
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/agent.rb +0 -1
- data/lib/contrast/api/communication/messaging_queue.rb +12 -6
- data/lib/contrast/api/communication/service_lifecycle.rb +4 -1
- data/lib/contrast/api/communication/socket_client.rb +4 -4
- data/lib/contrast/api/decorators/agent_startup.rb +4 -4
- data/lib/contrast/api/decorators/application_startup.rb +6 -5
- data/lib/contrast/api/decorators/route_coverage.rb +24 -1
- data/lib/contrast/components/agent.rb +5 -2
- data/lib/contrast/components/assess.rb +13 -3
- data/lib/contrast/components/base.rb +2 -2
- data/lib/contrast/components/config.rb +1 -0
- data/lib/contrast/components/contrast_service.rb +4 -2
- data/lib/contrast/components/logger.rb +13 -8
- data/lib/contrast/components/scope.rb +9 -28
- data/lib/contrast/config/assess_configuration.rb +1 -0
- data/lib/contrast/config/base_configuration.rb +14 -6
- data/lib/contrast/configuration.rb +19 -15
- data/lib/contrast/extension/assess/array.rb +1 -11
- data/lib/contrast/extension/assess/eval_trigger.rb +0 -20
- data/lib/contrast/extension/assess/fiber.rb +0 -11
- data/lib/contrast/extension/assess/hash.rb +0 -10
- data/lib/contrast/extension/assess/kernel.rb +1 -10
- data/lib/contrast/extension/assess/marshal.rb +3 -11
- data/lib/contrast/extension/assess/regexp.rb +0 -11
- data/lib/contrast/extension/assess/string.rb +1 -26
- data/lib/contrast/extension/extension.rb +61 -0
- data/lib/contrast/framework/grape/support.rb +174 -0
- data/lib/contrast/framework/manager.rb +42 -6
- data/lib/contrast/framework/rack/support.rb +1 -1
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +0 -1
- data/lib/contrast/framework/rails/patch/support.rb +6 -3
- data/lib/contrast/framework/rails/railtie.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_named.rb +1 -0
- data/lib/contrast/framework/rails/support.rb +60 -13
- data/lib/contrast/framework/sinatra/support.rb +1 -1
- data/lib/contrast/logger/log.rb +89 -15
- data/lib/contrast/tasks/config.rb +0 -1
- data/lib/contrast/utils/class_util.rb +58 -44
- data/lib/contrast/utils/io_util.rb +43 -35
- data/lib/contrast/utils/lru_cache.rb +45 -0
- data/lib/contrast/utils/ruby_ast_rewriter.rb +16 -13
- data/lib/contrast/utils/tag_util.rb +2 -1
- data/lib/contrast.rb +1 -1
- data/resources/assess/policy.json +208 -7
- data/resources/deadzone/policy.json +91 -0
- data/ruby-agent.gemspec +10 -2
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +74 -26
- data/ext/cs__protect_kernel/cs__protect_kernel.c +0 -47
- data/ext/cs__protect_kernel/cs__protect_kernel.h +0 -12
- data/ext/cs__protect_kernel/extconf.rb +0 -5
- data/lib/contrast/extension/protect/kernel.rb +0 -39
- data/lib/contrast/utils/inventory_util.rb +0 -113
data/lib/contrast/agent.rb
CHANGED
@@ -20,7 +20,6 @@ require 'contrast/extension/delegator'
|
|
20
20
|
require 'contrast/extension/inventory'
|
21
21
|
require 'contrast/extension/module'
|
22
22
|
require 'contrast/extension/protect'
|
23
|
-
require 'contrast/extension/protect/kernel'
|
24
23
|
|
25
24
|
require 'contrast/utils/object_share'
|
26
25
|
require 'contrast/utils/string_utils'
|
@@ -11,10 +11,9 @@ module Contrast
|
|
11
11
|
class MessagingQueue < Contrast::Agent::WorkerThread
|
12
12
|
include Contrast::Components::Logger::InstanceMethods
|
13
13
|
|
14
|
-
attr_reader :
|
14
|
+
attr_reader :speedracer
|
15
15
|
|
16
16
|
def initialize
|
17
|
-
@queue = Queue.new
|
18
17
|
@speedracer = Contrast::Api::Communication::Speedracer.new
|
19
18
|
super
|
20
19
|
end
|
@@ -28,6 +27,10 @@ module Contrast
|
|
28
27
|
speedracer.return_response(event)
|
29
28
|
end
|
30
29
|
|
30
|
+
def queue
|
31
|
+
@_queue ||= Queue.new
|
32
|
+
end
|
33
|
+
|
31
34
|
# Use this to add a message to the queue and process the response internally
|
32
35
|
def send_event_eventually event
|
33
36
|
if ::Contrast::AGENT.disabled?
|
@@ -42,7 +45,6 @@ module Contrast
|
|
42
45
|
speedracer.ensure_startup!
|
43
46
|
return if running?
|
44
47
|
|
45
|
-
@queue ||= Queue.new
|
46
48
|
@_thread = Contrast::Agent::Thread.new do
|
47
49
|
loop do
|
48
50
|
event = queue.pop
|
@@ -58,13 +60,17 @@ module Contrast
|
|
58
60
|
logger.debug('Started background sending thread.')
|
59
61
|
end
|
60
62
|
|
63
|
+
def delete_queue!
|
64
|
+
@_queue&.clear
|
65
|
+
@_queue&.close
|
66
|
+
@_queue = nil
|
67
|
+
end
|
68
|
+
|
61
69
|
def stop!
|
62
70
|
return unless running?
|
63
71
|
|
64
72
|
super
|
65
|
-
|
66
|
-
@queue&.close
|
67
|
-
@queue = nil
|
73
|
+
delete_queue!
|
68
74
|
end
|
69
75
|
end
|
70
76
|
end
|
@@ -6,10 +6,13 @@ require 'contrast/components/logger'
|
|
6
6
|
module Contrast
|
7
7
|
module Api
|
8
8
|
module Communication
|
9
|
-
# Handles local service startup
|
9
|
+
# Handles local service startup. As this should only ever be invoked by the Speedracer class, which includes
|
10
|
+
# this, all methods here are private.
|
10
11
|
module ServiceLifecycle
|
11
12
|
include Contrast::Components::Logger::InstanceMethods
|
12
13
|
|
14
|
+
private
|
15
|
+
|
13
16
|
def attempt_local_service_startup
|
14
17
|
zombie_check
|
15
18
|
service_starter_thread.join(5)
|
@@ -37,8 +37,7 @@ module Contrast
|
|
37
37
|
log_connection
|
38
38
|
if ::Contrast::CONTRAST_SERVICE.use_tcp?
|
39
39
|
Contrast::Api::Communication::TcpSocket.new(
|
40
|
-
|
41
|
-
)
|
40
|
+
::Contrast::CONTRAST_SERVICE.host, ::Contrast::CONTRAST_SERVICE.port)
|
42
41
|
else
|
43
42
|
Contrast::Api::Communication::UnixSocket.new(::Contrast::CONTRAST_SERVICE.socket_path)
|
44
43
|
end
|
@@ -61,8 +60,9 @@ module Contrast
|
|
61
60
|
|
62
61
|
# Or something is not set.
|
63
62
|
logger.warn(
|
64
|
-
|
65
|
-
|
63
|
+
log_connection_error_msg,
|
64
|
+
host: ::Contrast::CONTRAST_SERVICE.host,
|
65
|
+
port: ::Contrast::CONTRAST_SERVICE.port)
|
66
66
|
end
|
67
67
|
|
68
68
|
# If our connection isn't built properly, we need to warn the user. This builds out the context specific
|
@@ -41,11 +41,11 @@ module Contrast
|
|
41
41
|
#
|
42
42
|
# @param msg [Contrast::Api::Dtm::AgentStartup]
|
43
43
|
def config! msg
|
44
|
-
msg.version
|
45
|
-
msg.
|
46
|
-
msg.
|
44
|
+
msg.version = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.server.version
|
45
|
+
msg.server_tags = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.server.tags
|
46
|
+
msg.library_tags = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.inventory.tags
|
47
|
+
msg.environment = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.server.environment
|
47
48
|
msg.application_tags = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.application.tags
|
48
|
-
msg.library_tags = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.inventory.tags
|
49
49
|
end
|
50
50
|
end
|
51
51
|
end
|
@@ -24,11 +24,12 @@ module Contrast
|
|
24
24
|
# @return [Contrast::Api::Dtm::ApplicationCreate]
|
25
25
|
def build
|
26
26
|
msg = new
|
27
|
-
msg.
|
28
|
-
msg.
|
29
|
-
msg.
|
30
|
-
msg.
|
31
|
-
msg.
|
27
|
+
msg.code = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.application.code
|
28
|
+
msg.group = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.application.group
|
29
|
+
msg.metadata = Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.application.metadata
|
30
|
+
msg.mode = Contrast::Api::Dtm::InstrumentationMode.build
|
31
|
+
msg.app_version =
|
32
|
+
Contrast::Utils::StringUtils.protobuf_format ::Contrast::CONFIG.root.application.version.to_s # rubocop:disable Layout/AssignmentIndentation Layout/FirstArgumentIndentation:
|
32
33
|
session!(msg)
|
33
34
|
msg
|
34
35
|
end
|
@@ -46,7 +46,7 @@ module Contrast
|
|
46
46
|
#
|
47
47
|
# @param controller [::Sinatra::Base] the route's final controller.
|
48
48
|
# @param method [String] GET, PUT, POST, etc...
|
49
|
-
# @param
|
49
|
+
# @param pattern [::Mustermann::Sinatra] the pattern that was matched in routing.
|
50
50
|
# @param url [String, nil] use url from string instead matched pattern.
|
51
51
|
# @return [Contrast::Api::Dtm::RouteCoverage]
|
52
52
|
def from_sinatra_route controller, method, pattern, url = nil
|
@@ -59,6 +59,29 @@ module Contrast
|
|
59
59
|
msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
|
60
60
|
msg
|
61
61
|
end
|
62
|
+
|
63
|
+
# Convert Grape route data to dtm message.
|
64
|
+
#
|
65
|
+
# @param controller [::Grape::API] the route's final controller.
|
66
|
+
# @param method [String] GET, PUT, POST, etc...
|
67
|
+
# @param url [String, nil] use url from string instead matched pattern.
|
68
|
+
# @param pattern [String, Grape::Router::Route] the pattern that was matched in routing.
|
69
|
+
# @return [Contrast::Api::Dtm::RouteCoverage]
|
70
|
+
def from_grape_controller controller, method, pattern, url = nil
|
71
|
+
if pattern.cs__is_a?(Grape::Router::Route)
|
72
|
+
safe_pattern = pattern.pattern&.path&.to_s
|
73
|
+
safe_url = source_or_string(url || safe_pattern)
|
74
|
+
else
|
75
|
+
safe_pattern = source_or_string(pattern)
|
76
|
+
safe_url = source_or_string(url || pattern)
|
77
|
+
end
|
78
|
+
|
79
|
+
msg = new
|
80
|
+
msg.route = "#{ controller }##{ method } #{ safe_pattern }"
|
81
|
+
msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
|
82
|
+
msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
|
83
|
+
msg
|
84
|
+
end
|
62
85
|
end
|
63
86
|
end
|
64
87
|
end
|
@@ -54,7 +54,9 @@ module Contrast
|
|
54
54
|
end
|
55
55
|
|
56
56
|
def interpolation_enabled?
|
57
|
-
|
57
|
+
if @_interpolation_enabled.nil?
|
58
|
+
@_interpolation_enabled = !false?(::Contrast::CONFIG.root.agent.ruby.interpolate)
|
59
|
+
end
|
58
60
|
@_interpolation_enabled
|
59
61
|
end
|
60
62
|
|
@@ -69,7 +71,8 @@ module Contrast
|
|
69
71
|
status:
|
70
72
|
::Contrast::CONFIG.root.agent.ruby.exceptions.override_status || 403,
|
71
73
|
message:
|
72
|
-
::Contrast::CONFIG.root.agent.ruby.exceptions.override_message ||
|
74
|
+
::Contrast::CONFIG.root.agent.ruby.exceptions.override_message ||
|
75
|
+
Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
|
73
76
|
}
|
74
77
|
end
|
75
78
|
|
@@ -5,7 +5,6 @@ require 'contrast/components/base'
|
|
5
5
|
require 'contrast/components/config'
|
6
6
|
require 'contrast/components/settings'
|
7
7
|
|
8
|
-
|
9
8
|
module Contrast
|
10
9
|
module Components
|
11
10
|
module Assess
|
@@ -78,7 +77,9 @@ module Contrast
|
|
78
77
|
end
|
79
78
|
|
80
79
|
def track_frozen_sources?
|
81
|
-
|
80
|
+
if @_track_frozen_sources.nil?
|
81
|
+
@_track_frozen_sources = !false?(::Contrast::CONFIG.root.agent.ruby.track_frozen_sources)
|
82
|
+
end
|
82
83
|
@_track_frozen_sources
|
83
84
|
end
|
84
85
|
|
@@ -87,13 +88,22 @@ module Contrast
|
|
87
88
|
@_require_scan
|
88
89
|
end
|
89
90
|
|
91
|
+
def require_dynamic_sources?
|
92
|
+
if @_require_dynamic_sources.nil?
|
93
|
+
@_require_dynamic_sources = !false?(::Contrast::CONFIG.root.assess.enable_dynamic_sources)
|
94
|
+
end
|
95
|
+
@_require_dynamic_sources
|
96
|
+
end
|
97
|
+
|
90
98
|
def tags
|
91
99
|
::Contrast::CONFIG.root.assess&.tags
|
92
100
|
end
|
93
101
|
|
94
102
|
def disabled_rules
|
95
103
|
# TODO: RUBY-903
|
96
|
-
::Contrast::CONFIG.root.assess&.rules&.disabled_rules ||
|
104
|
+
::Contrast::CONFIG.root.assess&.rules&.disabled_rules ||
|
105
|
+
::Contrast::SETTINGS.assess_state.disabled_assess_rules ||
|
106
|
+
[]
|
97
107
|
end
|
98
108
|
|
99
109
|
private
|
@@ -18,7 +18,7 @@ module Contrast
|
|
18
18
|
return true if config_param == false
|
19
19
|
return false unless config_param.cs__is_a?(String)
|
20
20
|
|
21
|
-
Contrast::Utils::ObjectShare::FALSE
|
21
|
+
config_param.downcase == Contrast::Utils::ObjectShare::FALSE
|
22
22
|
end
|
23
23
|
|
24
24
|
# use this to determine if the configuration value is literally boolean
|
@@ -33,7 +33,7 @@ module Contrast
|
|
33
33
|
return true if config_param == true
|
34
34
|
return false unless config_param.cs__is_a?(String)
|
35
35
|
|
36
|
-
Contrast::Utils::ObjectShare::TRUE
|
36
|
+
config_param.downcase == Contrast::Utils::ObjectShare::TRUE
|
37
37
|
end
|
38
38
|
end
|
39
39
|
end
|
@@ -32,11 +32,13 @@ module Contrast
|
|
32
32
|
end
|
33
33
|
|
34
34
|
def host
|
35
|
-
@_host ||=
|
35
|
+
@_host ||=
|
36
|
+
(::Contrast::CONFIG.root.agent.service.host || Contrast::Config::ServiceConfiguration::DEFAULT_HOST).to_s
|
36
37
|
end
|
37
38
|
|
38
39
|
def port
|
39
|
-
@_port ||=
|
40
|
+
@_port ||=
|
41
|
+
(::Contrast::CONFIG.root.agent.service.port || Contrast::Config::ServiceConfiguration::DEFAULT_PORT).to_i
|
40
42
|
end
|
41
43
|
|
42
44
|
def socket_path
|
@@ -6,20 +6,25 @@ require 'contrast/components/base'
|
|
6
6
|
|
7
7
|
module Contrast
|
8
8
|
module Components
|
9
|
-
module Logger
|
10
|
-
module InstanceMethods
|
9
|
+
module Logger # :nodoc:
|
10
|
+
module InstanceMethods # :nodoc:
|
11
11
|
def logger
|
12
12
|
Contrast::Logger::Log.instance.logger
|
13
13
|
end
|
14
|
+
|
15
|
+
def add_trace_perf_logging_for sym, custom_message = nil
|
16
|
+
logger.add_trace_perf_logging(self, sym, custom_message)
|
17
|
+
end
|
18
|
+
end
|
19
|
+
|
20
|
+
class << self
|
21
|
+
def add_trace_log_timing_for clazz, method_name, custom_message = nil
|
22
|
+
Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
|
23
|
+
end
|
14
24
|
end
|
15
|
-
ClassMethods = InstanceMethods
|
16
25
|
|
17
|
-
# A wrapper build around the Common Agent Configuration project to allow
|
18
|
-
# for access of the values contained in its
|
19
|
-
# parent_configuration_spec.yaml.
|
20
|
-
# Specifically, this allows for querying the state of the Agent Logger.
|
21
26
|
class Interface
|
22
|
-
include
|
27
|
+
include InstanceMethods
|
23
28
|
end
|
24
29
|
end
|
25
30
|
end
|
@@ -7,12 +7,9 @@ require 'contrast/agent/scope'
|
|
7
7
|
|
8
8
|
# This is the Scope component.
|
9
9
|
#
|
10
|
-
# It tracks /Contrast/ scope. That is, "are we currently doing assess
|
11
|
-
#
|
12
|
-
#
|
13
|
-
#
|
14
|
-
# Separately from this component, there is also require scope, which is an
|
15
|
-
# optimization on how we implement patching to `require`.
|
10
|
+
# It tracks /Contrast/ scope. That is, "are we currently doing assess or protect stuff within a patched method?" --
|
11
|
+
# this is how we avoid doing Contrast stuff on Contrast code or creating infinite loops -- or "are we in some other
|
12
|
+
# execution context for which we need to special case?".
|
16
13
|
module Contrast
|
17
14
|
module Components
|
18
15
|
module Scope # :nodoc:
|
@@ -25,10 +22,8 @@ module Contrast
|
|
25
22
|
EXECUTION_CONTEXT[Fiber.current] = Contrast::Agent::Scope.new
|
26
23
|
end
|
27
24
|
|
28
|
-
# This returns the scope governing the current execution context.
|
29
|
-
#
|
30
|
-
# access and query scope, rather than interacting with the scope
|
31
|
-
# object directly.
|
25
|
+
# This returns the scope governing the current execution context. Use this sparingly, preferring the instance
|
26
|
+
# & class methods to access and query scope, rather than interacting with the scope object directly.
|
32
27
|
def scope_for_current_ec
|
33
28
|
MONITOR.synchronize do
|
34
29
|
return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
|
@@ -37,9 +32,7 @@ module Contrast
|
|
37
32
|
end
|
38
33
|
|
39
34
|
module InstanceMethods # :nodoc:
|
40
|
-
# For each instance method on a scope, define a forwarder
|
41
|
-
# to the scope on the current execution context's scope.
|
42
|
-
|
35
|
+
# For each instance method on a scope, define a forwarder to the scope on the current execution context's scope.
|
43
36
|
def scope_for_current_ec
|
44
37
|
MONITOR.synchronize do
|
45
38
|
return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
|
@@ -118,24 +111,12 @@ module Contrast
|
|
118
111
|
ensure
|
119
112
|
scope_for_current_ec.exit_split_scope!
|
120
113
|
end
|
121
|
-
|
122
|
-
# TODO: RUBY-572
|
123
|
-
#
|
124
|
-
# Current behavior is to no-op if we're not "in a request context".
|
125
|
-
# Our C functions were previously checking to see if we had a scope, because
|
126
|
-
# scope was tacked on to a request context -- so "we have a scope, therefore,
|
127
|
-
# we have a request context." We've decoupled scopes from request contexts,
|
128
|
-
# so now it checks "do we have a request context."
|
129
|
-
# RUBY-290 should remove all of that, including this method.
|
130
|
-
def in_request_context?
|
131
|
-
!!Contrast::Agent::REQUEST_TRACKER.current
|
132
|
-
end
|
133
114
|
end
|
134
115
|
|
135
116
|
def self.sweep_dead_ecs
|
136
|
-
# TODO: RUBY-
|
137
|
-
#
|
138
|
-
#
|
117
|
+
# TODO: RUBY-534, #sweep_dead_ecs compensates for a lack of weak tables. when we can use WeakRef, we should
|
118
|
+
# investigate removing this call and instead use the WeakRef for the Execution Context's Keys or using our
|
119
|
+
# Finalizers Hash for Fibers
|
139
120
|
MONITOR.synchronize do
|
140
121
|
EXECUTION_CONTEXT.delete_if do |ec, _scope|
|
141
122
|
!ec.alive?
|
@@ -10,6 +10,7 @@ module Contrast
|
|
10
10
|
tags: EMPTY_VALUE,
|
11
11
|
enable: EMPTY_VALUE,
|
12
12
|
enable_scan_response: Contrast::Config::DefaultValue.new('true'),
|
13
|
+
enable_dynamic_sources: Contrast::Config::DefaultValue.new('true'),
|
13
14
|
sampling: Contrast::Config::SamplingConfiguration,
|
14
15
|
rules: Contrast::Config::AssessRulesConfiguration,
|
15
16
|
stacktraces: Contrast::Config::DefaultValue.new('ALL')
|
@@ -12,7 +12,7 @@ module Contrast
|
|
12
12
|
class BaseConfiguration
|
13
13
|
extend Forwardable
|
14
14
|
|
15
|
-
|
15
|
+
STRING_BOOLEANS = %w[false true].cs__freeze
|
16
16
|
|
17
17
|
attr_reader :map
|
18
18
|
|
@@ -73,8 +73,18 @@ module Contrast
|
|
73
73
|
spec_value.new(user_provided_value)
|
74
74
|
elsif spec_value.is_a?(Contrast::Config::DefaultValue) && user_provided_value == EMPTY_VALUE
|
75
75
|
spec_value.value
|
76
|
-
elsif
|
77
|
-
user_provided_value.
|
76
|
+
elsif user_provided_value.cs__is_a?(String)
|
77
|
+
value = user_provided_value.downcase
|
78
|
+
# converts string values to 'true' => true or 'false' => false
|
79
|
+
case value
|
80
|
+
when STRING_BOOLEANS[1]
|
81
|
+
true
|
82
|
+
when STRING_BOOLEANS[0]
|
83
|
+
false
|
84
|
+
else
|
85
|
+
# returns non boolean string values
|
86
|
+
user_provided_value
|
87
|
+
end
|
78
88
|
else
|
79
89
|
user_provided_value
|
80
90
|
end
|
@@ -95,9 +105,7 @@ module Contrast
|
|
95
105
|
|
96
106
|
def define_setter str_key
|
97
107
|
define_singleton_method "#{ str_key }=".to_sym do |new_value|
|
98
|
-
|
99
|
-
boolean_value ||= new_value == false
|
100
|
-
@map[str_key] = boolean_value ? new_value.to_s : new_value
|
108
|
+
@map[str_key] = new_value
|
101
109
|
end
|
102
110
|
end
|
103
111
|
end
|
@@ -48,9 +48,7 @@ module Contrast
|
|
48
48
|
# in an infinite loop on the to_sym method used later.
|
49
49
|
def method_missing symbol, *args
|
50
50
|
with_contrast_scope do
|
51
|
-
root.public_send(symbol, *args)
|
52
|
-
rescue NoMethodError => _e
|
53
|
-
super
|
51
|
+
root.public_send(symbol, *args) if root.cs__respond_to?(symbol)
|
54
52
|
end
|
55
53
|
end
|
56
54
|
|
@@ -101,8 +99,7 @@ module Contrast
|
|
101
99
|
{}
|
102
100
|
end
|
103
101
|
|
104
|
-
# We're updating properties loaded from the configuration
|
105
|
-
# files to match the new agreed upon standard configuration
|
102
|
+
# We're updating properties loaded from the configuration files to match the new agreed upon standard configuration
|
106
103
|
# names, so that one file works for all agents
|
107
104
|
def update_prop_keys config
|
108
105
|
CONVERSION.each_pair do |old_method, new_method|
|
@@ -120,16 +117,7 @@ module Contrast
|
|
120
117
|
# We changed the seconds values into ms values. Multiply them accordingly
|
121
118
|
old_value = old_value.to_i * 1000 if new_method.end_with?(MILLISECOND_MARKER)
|
122
119
|
new_value = config
|
123
|
-
|
124
|
-
new_keys.each_with_index do |new_key, index|
|
125
|
-
if index == end_idx
|
126
|
-
new_value[new_key] = old_value if new_value[new_key].nil?
|
127
|
-
else
|
128
|
-
new_value = {} if new_value.nil?
|
129
|
-
new_value[new_key] = {} if new_value[new_key].nil?
|
130
|
-
new_value = new_value[new_key]
|
131
|
-
end
|
132
|
-
end
|
120
|
+
replace_props(new_keys, new_value, old_value)
|
133
121
|
end
|
134
122
|
|
135
123
|
config
|
@@ -237,5 +225,21 @@ module Contrast
|
|
237
225
|
convert
|
238
226
|
end
|
239
227
|
end
|
228
|
+
|
229
|
+
def replace_props new_keys, new_value, old_value
|
230
|
+
idx = 0
|
231
|
+
end_idx = new_keys.length - 1
|
232
|
+
while idx < new_keys.length
|
233
|
+
new_key = new_keys[idx]
|
234
|
+
if idx == end_idx
|
235
|
+
new_value[new_key] = old_value if new_value[new_key].nil?
|
236
|
+
else
|
237
|
+
new_value = {} if new_value.nil?
|
238
|
+
new_value[new_key] = {} if new_value[new_key].nil?
|
239
|
+
new_value = new_value[new_key]
|
240
|
+
end
|
241
|
+
idx += 1
|
242
|
+
end
|
243
|
+
end
|
240
244
|
end
|
241
245
|
end
|
@@ -11,7 +11,7 @@ module Contrast
|
|
11
11
|
# This is our patch of the Array class required to handle propagation
|
12
12
|
# Disclaimer: there may be a better way, but we're in a 'get it work' state.
|
13
13
|
# Hopefully, we'll be in a 'get it right' state soon.
|
14
|
-
class ArrayPropagator
|
14
|
+
class ArrayPropagator # rubocop:disable Style/StaticClass
|
15
15
|
extend Contrast::Components::Scope::InstanceMethods
|
16
16
|
|
17
17
|
ARRAY_JOIN_HASH = {
|
@@ -59,16 +59,6 @@ module Contrast
|
|
59
59
|
ret
|
60
60
|
end
|
61
61
|
end
|
62
|
-
|
63
|
-
def instrument_array_track
|
64
|
-
@_instrument_array_track ||= begin
|
65
|
-
require 'cs__assess_array/cs__assess_array'
|
66
|
-
true
|
67
|
-
end
|
68
|
-
rescue StandardError, LoadError => e
|
69
|
-
logger.error('Error loading assess track patch', e)
|
70
|
-
false
|
71
|
-
end
|
72
62
|
end
|
73
63
|
end
|
74
64
|
end
|
@@ -34,26 +34,6 @@ module Contrast
|
|
34
34
|
ret, source)
|
35
35
|
end
|
36
36
|
|
37
|
-
def instrument_basic_object_track
|
38
|
-
@_instrument_basic_object_track ||= begin
|
39
|
-
require 'cs__assess_basic_object/cs__assess_basic_object'
|
40
|
-
true
|
41
|
-
end
|
42
|
-
rescue StandardError, LoadError => e
|
43
|
-
logger.error('Error loading basic object track patch', e)
|
44
|
-
false
|
45
|
-
end
|
46
|
-
|
47
|
-
def instrument_module_track
|
48
|
-
@_instrument_module_track ||= begin
|
49
|
-
require 'cs__assess_module/cs__assess_module'
|
50
|
-
true
|
51
|
-
end
|
52
|
-
rescue StandardError, LoadError => e
|
53
|
-
logger.error('Error loading module track patch', e)
|
54
|
-
false
|
55
|
-
end
|
56
|
-
|
57
37
|
private
|
58
38
|
|
59
39
|
def trigger_node clazz, method
|
@@ -20,7 +20,6 @@ module Contrast
|
|
20
20
|
extend Contrast::Components::Logger::InstanceMethods
|
21
21
|
extend Contrast::Components::Scope::InstanceMethods
|
22
22
|
|
23
|
-
|
24
23
|
# we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
|
25
24
|
FIBER_NEW_NODE_HASH = {
|
26
25
|
'class_name' => 'Fiber',
|
@@ -86,16 +85,6 @@ module Contrast
|
|
86
85
|
rescue Exception => e # rubocop:disable Lint/RescueException
|
87
86
|
logger.error('Unable to propagate during Fiber.new', e)
|
88
87
|
end
|
89
|
-
|
90
|
-
def instrument_fiber_track
|
91
|
-
@_instrument_fiber_variables ||= begin
|
92
|
-
require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
|
93
|
-
true
|
94
|
-
end
|
95
|
-
rescue StandardError, LoadError => e
|
96
|
-
logger.error('Error loading fiber track patch', e)
|
97
|
-
false
|
98
|
-
end
|
99
88
|
end
|
100
89
|
end
|
101
90
|
end
|
@@ -25,16 +25,6 @@ module Contrast
|
|
25
25
|
# result in a seg fault
|
26
26
|
object
|
27
27
|
end
|
28
|
-
|
29
|
-
def instrument_hash_track
|
30
|
-
@_instrument_hash_track ||= begin
|
31
|
-
require 'cs__assess_hash/cs__assess_hash'
|
32
|
-
true
|
33
|
-
end
|
34
|
-
rescue StandardError, LoadError => e
|
35
|
-
logger.error('Error loading hash track patch', e)
|
36
|
-
false
|
37
|
-
end
|
38
28
|
end
|
39
29
|
end
|
40
30
|
end
|
@@ -14,6 +14,7 @@ module Contrast
|
|
14
14
|
module KernelPropagator
|
15
15
|
class << self
|
16
16
|
extend Contrast::Components::Logger::InstanceMethods
|
17
|
+
include Contrast::Components::Logger::InstanceMethods
|
17
18
|
include Contrast::Extension::Assess::ExecTrigger
|
18
19
|
|
19
20
|
# We're 'tracking' sprintf now, meaning if anything is tracked on the way
|
@@ -65,16 +66,6 @@ module Contrast
|
|
65
66
|
logger.error('Unable to track dataflow through sprintf', e)
|
66
67
|
end
|
67
68
|
|
68
|
-
def instrument_kernel_track
|
69
|
-
@_instrument_fiber_variables ||= begin
|
70
|
-
require 'cs__assess_kernel/cs__assess_kernel'
|
71
|
-
true
|
72
|
-
end
|
73
|
-
rescue StandardError, LoadError => e
|
74
|
-
logger.error('Error loading kernel track patch', e)
|
75
|
-
false
|
76
|
-
end
|
77
|
-
|
78
69
|
private
|
79
70
|
|
80
71
|
def handle_sprintf_value value, result, parent_events
|
@@ -12,10 +12,12 @@ module Contrast
|
|
12
12
|
# Hopefully, we'll be in a 'get it right' state soon.
|
13
13
|
# This module is used for our Marshal.load patches
|
14
14
|
class MarshalPropagator
|
15
|
-
extend Contrast::Components::Logger::InstanceMethods
|
16
15
|
extend Contrast::Components::Scope::InstanceMethods
|
17
16
|
|
18
17
|
class << self
|
18
|
+
extend Contrast::Components::Logger::InstanceMethods
|
19
|
+
include Contrast::Components::Logger::InstanceMethods
|
20
|
+
|
19
21
|
def cs__load_protect arg
|
20
22
|
return if in_contrast_scope?
|
21
23
|
|
@@ -44,16 +46,6 @@ module Contrast
|
|
44
46
|
end
|
45
47
|
end
|
46
48
|
|
47
|
-
def instrument_marshal_load
|
48
|
-
@_instrument_marshal_load ||= begin
|
49
|
-
require 'cs__assess_marshal_module/cs__assess_marshal_module'
|
50
|
-
true
|
51
|
-
end
|
52
|
-
rescue StandardError, LoadError => e
|
53
|
-
logger.error('Error loading marshal load patch', e)
|
54
|
-
false
|
55
|
-
end
|
56
|
-
|
57
49
|
def trigger_node clazz, method
|
58
50
|
triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
|
59
51
|
return unless triggers
|