contrast-agent 4.9.0 → 4.12.0

data/lib/contrast/logger/log.rb

@@ -13,6 +13,75 @@ require 'contrast/logger/time'
 require 'contrast/components/config'
 
 module Contrast
+  # This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
+  # we pay the penalty for that timing block
+  module TraceTiming
+    def methods_to_time
+      @_methods_to_time ||= []
+    end
+
+    # Store info about methods for later patching.
+    METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
+
+    # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
+    # logger set to TRACE.
+    #
+    # @params: clazz [Class] the class of the method to time.
+    # @params: method [Symbol] the method to time.
+    # @params: method [String] optional custom logging message.
+    def add_method_to_trace_timing clazz, method, msg = nil
+      methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
+      enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
+    end
+
+    # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
+    # logger set to TRACE.
+    #
+    # @params: method_spec [METHOD_INFO] specs about the method to be timed.
+    # @params: class_method [Boolean] whether this is or isn't a class/module method.
+    def trace_time_class_method meth_spec, class_method
+      untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
+      send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
+      meth_spec.clazz.class_eval do
+        include Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Logger::InstanceMethods
+
+        send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
+        meth_spec.aliased = true
+
+        log_message = "Elapsed time for #{ meth_spec.method_name }."
+        log_message = meth_spec.custom_message if meth_spec.custom_msg
+
+        send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
+          start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          rv = if kwargs.empty?
+                 send(untimed_func_symbol, *args, &block)
+               else
+                 send(untimed_func_symbol, *args, **kwargs, &block)
+               end
+          delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
+          logger.trace(log_message, elapsed: delta * 1000)
+          rv
+        end
+      end
+    end
+
+    # Enable trace timing of methods specified in @_methods_to_time via aliasing.
+    def enable_trace_timing
+      methods_to_time.each do |meth_spec|
+        next if meth_spec.aliased
+
+        is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
+        trace_time_class_method meth_spec, is_class_method
+      end
+    end
+  end
+end
+
+module Contrast
+  # Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
+  # logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
+  # while still providing safe options for customers.
   module Logger
     # For development set following env var to raise logged exceptions instead of just logging.
     if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
@@ -20,22 +89,22 @@ module Contrast
         alias_method :cs__error, :error
         alias_method :cs__warn, :warn
 
-        def error msg, exc, **kwargs
-          cs__error(msg, exc, **kwargs)
-          raise exc if exc && exc.cs__class < Exception
-        end
-
-        def warn msg, exc, **kwargs
-          cs__warn(msg, exc, **kwargs)
-          raise exc if exc && exc.cs__class < Exception
+        def error *args, **kwargs
+          if kwargs.empty?
+            cs__error(*args)
+          else
+            cs__error(*args, **kwargs)
+          end
+          args.each { |arg| raise arg if arg && arg.cs__class < Exception }
         end
       end
     end
 
-    # This class functions to serve as a wrapper around our logging, as we need
-    # to be able to dynamically update level based on updates to TeamServer.
+    # This class functions to serve as a wrapper around our logging, as we need to be able to dynamically update
+    # level based on updates to TeamServer.
     class Log
       include Singleton
+      include ::Contrast::TraceTiming
 
       DEFAULT_NAME     = 'contrast.log'
       DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
@@ -49,8 +118,8 @@ module Contrast
         update
       end
 
-      # Given new settings from TeamServer, update our logging to use the new
-      # file and level, assuming they weren't set by local configuration.
+      # Given new settings from TeamServer, update our logging to use the new file and level, assuming they weren't
+      # set by local configuration.
       #
       # @param log_file [String] the file to which to log, as provided by TeamServer settings
       # @param log_level [String] the level at which to log, as provided by TeamServer settings
@@ -67,6 +136,8 @@ module Contrast
         @previous_path  = current_path
         @previous_level = current_level_const
 
+        enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
+
         @_logger = build(path: current_path, level_const: current_level_const)
         # If we're logging to a new path, then let's start it w/ our helpful
         # data gathering messages
@@ -76,6 +147,9 @@ module Contrast
           logger.error('Unable to process update to LoggerManager.', e)
         else
           puts 'Unable to process update to LoggerManager.'
+          raise e if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+
+          puts e.message
           puts e.backtrace.join("\n")
         end
       end
@@ -158,7 +232,8 @@ module Contrast
       # @return [::Ougai::Logging::Severity] the level at which to log
       def find_valid_level log_level
         config = ::Contrast::CONFIG.root.agent.logger
-        config_level = config.level&.length&.positive? ? config.level : nil
+        config_level = config&.level&.length&.positive? ? config.level : nil
+
         valid_level(config_level || log_level)
       end
 
@@ -174,8 +249,7 @@ module Contrast
         DEFAULT_LEVEL
       end
 
-      # Log that the Agent log has changed and include some default information
-      # at the start of the log.
+      # Log that the Agent log has changed and include some default information at the start of the log.
       def log_update
         logger.debug('Initialized new contrast agent logger')
         logger.debug_with_time('middleware: log environment') do

data/lib/contrast/tasks/config.rb

@@ -7,7 +7,6 @@ module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings
   module Config
     extend Rake::DSL
-    include Contrast::Components::Interface
     DEFAULT_CONFIG = {
         'api' => {
             'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',

data/lib/contrast/utils/class_util.rb

@@ -3,21 +3,21 @@
 
 require 'contrast/extension/module'
 require 'contrast/utils/object_share'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Utils
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
+      @lru_cache = LRUCache.new(300)
+      @string_cache = LRUCache.new(300)
       class << self
-        # some classes have had things prepended to them, like Marshal in Rails
-        # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
-        # our alias patching approach, as will any other prepend on something
-        # that we touch. Prepend and Alias are inherently incompatible monkey
-        # patching approaches. As such, we need to know if something has been
-        # prepended to.
+        # some classes have had things prepended to them, like Marshal in Rails 5 and higher. Their
+        # ActiveSupport::MarshalWithAutoloading will break our alias patching approach, as will any other prepend on
+        # something that we touch. Prepend and Alias are inherently incompatible monkey patching approaches. As such,
+        # we need to know if something has been prepended to.
         #
-        # @param mod [Module] the Module to check to see if it has had something
-        #   prepended
+        # @param mod [Module] the Module to check to see if it has had something prepended
         # @param ancestors [Array<Module>] the array of ancestors for the mod
         # @return [Boolean] if the mod has been prepended or not
         def prepended? mod, ancestors = nil
@@ -25,8 +25,13 @@ module Contrast
           ancestors[0] != mod
         end
 
-        # return true if the given method is overwritten by one of the ancestors
-        # in the ancestor change that comes before the given module
+        # return true if the given method is overwritten by one of the ancestors in the ancestor change that comes
+        # before the given module
+        #
+        # @param mod [Module] the Module to check to see if it has had something prepended
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that holds the method we
+        #   need to check
+        # @return [Boolean] if this method specifically was prepended
         def prepended_method? mod, method_policy
           target_module = determine_target_class mod, method_policy.instance_method
           ancestors = target_module.ancestors
@@ -41,44 +46,49 @@ module Contrast
           false
         end
 
-        # Return a String representing the object invoking this method in the
-        # form expected by our dataflow events.
+        # Return a String representing the object invoking this method in the form expected by our dataflow events.
+        # After implementing the LRU Cache, we firstly need to check if already had that object cached and if we have
+        # it - we can return it directly; otherwise we'll calculate and store the result before returning.
+        #
+        # TODO: RUBY-1327
+        # Once we move to 2.7+, we can combine the caches using ID b/c the memory location stops being the id
         #
         # @param object [Object, nil] the entity to convert to a String
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          # Only treat object like a string if it actually is a string
-          # some subclasses of String override string methods we depend on
+          # Only treat object like a string if it actually is a string+ some subclasses of String override string
+          # methods we depend on
           if object.cs__class == String
-            cached = to_cached_string(object)
-            return cached if cached
-
-            object.dup
-          elsif object.nil?
-            Contrast::Utils::ObjectShare::NIL_STRING
-          elsif object.cs__is_a?(Symbol)
-            ":#{ object }"
-          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
-            "#{ object.cs__name }@#{ object.__id__ }"
-          elsif object.cs__is_a?(Regexp)
-            object.source
-          elsif use_to_s?(object)
-            object.to_s
+            return @string_cache[object] if @string_cache.key? object
+
+            @string_cache[object] = to_cached_string(object) || object.dup
           else
-            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+            return @lru_cache[object.__id__] if @lru_cache.key? object.__id__
+
+            @lru_cache[object.__id__] = if object.nil?
+                                          Contrast::Utils::ObjectShare::NIL_STRING
+                                        elsif object.cs__is_a?(Symbol)
+                                          ":#{ object }"
+                                        elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+                                          "#{ object.cs__name }@#{ object.__id__ }"
+                                        elsif object.cs__is_a?(Regexp)
+                                          object.source
+                                        elsif use_to_s?(object)
+                                          object.to_s
+                                        else
+                                          "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+                                        end
           end
         end
 
-        # The method const_defined? can cause autoload, which is bad for us.
-        # The method autoload? doesn't traverse namespaces. This method lets us
-        # provide a constant, as a String, and parse it to determine if it has
-        # been truly truly defined, meaning it existed before this method was
-        # invoked, not as a result of it.
+        # The method const_defined? can cause autoload, which is bad for us. The method autoload? doesn't traverse
+        # namespaces. This method lets us provide a constant, as a String, and parse it to determine if it has been
+        # truly truly defined, meaning it existed before this method was invoked, not as a result of it.
         #
-        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop
-        # support for 2.6.X, we should remove this code.
-        # https://bugs.ruby-lang.org/issues/10741
+        # TODO: RUBY-1326
+        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop support for 2.6.X, we should remove
+        # this code. https://bugs.ruby-lang.org/issues/10741
         # @param name [String] the name of the constant to look up
         # @return [Boolean]
         def truly_defined? name
@@ -101,7 +111,8 @@ module Contrast
         private
 
         # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
-        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list approach.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list
+        # approach.
         #
         # @param object [Object] something that may have a safe to_s method
         # @return [Boolean] if we should invoke to_s to represent the object
@@ -112,6 +123,11 @@ module Contrast
           false
         end
 
+        # Find the target class based on the instance, or module, provided. If a module, return it.
+        #
+        # @param mod [Module] the Module, or instance of a Module, that we need to check
+        # @param is_instance [Boolean] is the object provided an instance of a class, requiring lookup by class
+        # @return [Module]
         def determine_target_class mod, is_instance
           return mod if mod.singleton_class?
 
@@ -120,13 +136,11 @@ module Contrast
           mod
         end
 
-        # If the String matches a common String in our ObjectShare, return that
-        # rather that for use as the representation of the String rather than
-        # forcing a duplication of the String.
+        # If the String matches a common String in our ObjectShare, return that rather that for use as the
+        # representation of the String rather than forcing a duplication of the String.
         #
-        # @param string [String] some string of which we want a Contrast
-        #   representation.
-        # @return [String,nil] the ObjectShare version of the String or nil
+        # @param string [String] some string of which we want a Contrast representation.
+        # @return [String, nil] the ObjectShare version of the String or nil
         def to_cached_string string
           return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
           return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH

data/lib/contrast/utils/io_util.rb

@@ -6,43 +6,51 @@ require 'contrast/components/logger'
 module Contrast
   module Utils
     # Util for information about an IO
-    class IOUtil
+    module IOUtil
       extend Contrast::Components::Logger::InstanceMethods
 
-      # We're only going to call rewind on things that we believe are safe to
-      # call it on. This method white lists those cases and returns false in
-      # all others.
-      def self.should_rewind? potential_io
-        return true if potential_io.is_a?(StringIO)
-        return false unless io?(potential_io)
-
-        should_rewind_io?(potential_io)
-      rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
-        false
-      end
-
-      # IO cannot be used with streams such as pipes, ttys, and sockets.
-      def self.should_rewind_io? io
-        return false if io.tty?
-
-        status = io.stat
-        return false unless status
-        return false if status.pipe?
-        return false if status.socket?
-
-        true
-      end
-
-      # A class is IO if it is a decedent or delegate of IO
-      def self.io? object
-        return true if object.is_a?(IO)
-
-        # DelegateClass, which is a Delegator, defines __getobj__ as a way to
-        # get the object that the class wraps around (delegates to)
-        return false unless object.is_a?(Delegator)
-
-        object.__getobj__.is_a?(IO)
+      class << self
+        # We're only going to call rewind on things that we believe are safe to
+        # call it on. This method white lists those cases and returns false in
+        # all others.
+        def should_rewind? potential_io
+          return true if potential_io.is_a?(StringIO)
+          return false unless io?(potential_io)
+
+          should_rewind_io?(potential_io)
+        rescue StandardError => e
+          logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
+          false
+        end
+
+        # A class is IO if it is a decedent or delegate of IO
+        def io? object
+          return true if object.is_a?(IO)
+
+          # DelegateClass, which is a Delegator, defines __getobj__ as a way to
+          # get the object that the class wraps around (delegates to)
+          return false unless object.is_a?(Delegator)
+
+          object.__getobj__.is_a?(IO)
+        end
+
+        private
+
+        # IO rewind cannot be used with streams such as pipes, ttys, and sockets or for ones which have been closed.
+        #
+        # @param io [IO] the input to check for the ability to rewind
+        # @return [Boolean] if the given IO can be rewound
+        def should_rewind_io? io
+          return false if io.closed?
+          return false if io.tty?
+
+          status = io.stat
+          return false unless status
+          return false if status.pipe?
+          return false if status.socket?
+
+          true
+        end
       end
     end
   end

data/lib/contrast/utils/lru_cache.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # A LRU(Least Recently Used) Cache store.
+    class LRUCache
+      def initialize capacity = 500
+        raise StandardError 'Capacity must be bigger than 0' if capacity <= 0
+
+        @capacity = capacity
+        @cache = {}
+      end
+
+      def [] key
+        val = @cache.delete(key)
+        @cache[key] = val if val
+        val
+      end
+
+      def []= key, value
+        @cache.delete(key)
+        @cache[key] = value
+        @cache.shift if @cache.size > @capacity
+        value # rubocop:disable Lint/Void
+      end
+
+      def keys
+        @cache.keys
+      end
+
+      def key? key
+        @cache.key?(key)
+      end
+
+      def values
+        @cache.values
+      end
+
+      def clear
+        @cache.clear
+      end
+    end
+  end
+end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -36,36 +36,39 @@ module Contrast
       # the replace within the given node.
       def on_dstr node
         return if node.children.all? { |child_node| child_node.type == :str }
-
         new_content = +'('
-        node.children.each_with_index do |child_node, index|
+        idx = 0
+        while idx < node.children.length
+          #node.children.each_with_index do |child_node, index|
+          child_node = node.children[idx]
           # A begin node looks like #{some_code} in ruby, we do a substring
           # from [2...-1] to get rid of the #{ & trailing }.
           if child_node.type == :begin
             code = child_node.
-                location.
-                expression.
-                source_buffer.
-                source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
+              location.
+              expression.
+              source_buffer.
+              source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
             code = code[2...-1]
             new_content += "((#{ code }).to_s)"
 
-          # For interpolations that use class, instance, or global variables,
-          # those are NOT within a begin block, but instead are a ivar, cvar,
-          # or gvar node, not stripping of interpolation markers required.
+            # For interpolations that use class, instance, or global variables,
+            # those are NOT within a begin block, but instead are a ivar, cvar,
+            # or gvar node, not stripping of interpolation markers required.
           elsif VARIABLES.include?(child_node.type)
             variable = child_node.children.first
             new_content << "((#{ variable }).to_s)"
 
-          # When interpolation includes strings before or after an
-          # interpolation they are simple :str nodes, in order to preserve
-          # escaping we need to do a dump of the string value.
+            # When interpolation includes strings before or after an
+            # interpolation they are simple :str nodes, in order to preserve
+            # escaping we need to do a dump of the string value.
           elsif child_node.type == :str
             literal_value = child_node.children.first
             literal_value = literal_value.dump[1...-1]
             new_content <<  "\"#{ literal_value }\""
           end
-          new_content << ' + ' unless index == node.children.length - 1
+          new_content << ' + ' unless idx == node.children.length - 1
+          idx += 1
         end
         new_content << ')'
         if node.location.cs__respond_to?(:heredoc_body)

data/lib/contrast/utils/tag_util.rb

@@ -8,7 +8,8 @@ module Contrast
       class << self
         # Determine if the given array of tags is covered by the other
         #
-        # @param remaining_ranges [Array<Contrast::Agent::Assess::Tag>] the tags left that haven't been covered by those given
+        # @param remaining_ranges [Array<Contrast::Agent::Assess::Tag>] the tags left that haven't been covered by
+        #   those given
         # @param ranges Array<Contrast::Agent::Assess::Tag> the tags that are covering the first
         def covered? remaining_ranges, ranges
           return true unless remaining_ranges&.any?

data/lib/contrast.rb

@@ -23,7 +23,7 @@ end
 
 if RUBY_VERSION >= '3.0.0'
   # This fixes Ruby 3.0 issues with Module#(some instance method) patching by preventing the prepending of
-  # a JSON helper on protobuf load. String.instance_method(:+) is one of the most noticable.
+  # a JSON helper on protobuf load. String.instance_method(:+) is one of the most noticeable.
   # TODO: RUBY-1132 Remove this once Ruby 3 is fixed.
   # See bug here: https://bugs.ruby-lang.org/issues/17725
   class Class