contrast-agent 4.9.1 → 4.13.0

data/lib/contrast/agent/exclusion_matcher.rb

@@ -94,10 +94,6 @@ module Contrast
         @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
-      def exc_name
-        @exclusion.name # rubocop:disable Security/Module/Name -- part of the API.
-      end
-
       def match_all?
         @exclusion.urls.nil? || @exclusion.urls.empty?
       end

data/lib/contrast/agent/inventory/database_config.rb

@@ -0,0 +1,117 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/timer'
+require 'contrast/utils/object_share'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Methods used for parsing database connection configurations
+      # for getting inventory information from the application
+      module DatabaseConfig
+        extend Contrast::Components::Logger::InstanceMethods
+
+        # TeamServer only accepts certain values for ArchitectureComponents.
+        # DO NOT CHANGE THIS!
+        AC_TYPE_DB = 'db'
+        # TeamServer only accepts certain values for FlowMap Services.
+        # DO NOT CHANGE THIS
+        ADAPTER = 'adapter'
+        HOST = 'host'
+        PORT = 'port'
+        DATABASE = 'database'
+        DEFAULT = 'default'
+        LOCALHOST = 'localhost'
+
+        def self.active_record_config
+          return @_active_record_config if instance_variable_defined?(:@_active_record_config)
+
+          @_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
+        end
+
+        def self.append_db_config(activity_or_update,
+                                  hash_or_str = Contrast::Agent::Inventory::DatabaseConfig.active_record_config)
+          arr = build_from_db_config(hash_or_str)
+          return unless arr&.any?
+
+          arr.each do |a|
+            next unless a
+
+            if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
+              activity_or_update.architectures << a
+            else
+              activity_or_update.components << a
+            end
+          end
+        rescue StandardError => e
+          logger.error('Unable to append db config', e)
+          nil
+        end
+
+        def self.build_from_db_config hash_or_str
+          return unless hash_or_str
+
+          if hash_or_str.is_a?(Hash)
+            build_from_db_hash(hash_or_str)
+          else
+            build_from_db_string(hash_or_str.to_s)
+          end
+        end
+
+        def self.build_from_db_hash hash
+          ac = Contrast::Api::Dtm::ArchitectureComponent.new
+          ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          ac.remote_host = host_from_hash(hash)
+          ac.remote_port = port_from_hash(hash)
+          ac.type = AC_TYPE_DB
+          ac.url = hash[:database] || hash[DATABASE] || DEFAULT
+          [ac]
+        end
+
+        def self.host_from_hash hash
+          hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        def self.port_from_hash hash
+          p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          p.to_i
+        end
+
+        # Examples:
+        # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
+        # postgresql://scott:tiger@localhost/mydatabase
+        # mysql+mysqlconnector://scott:tiger@localhost/foo
+        def self.build_from_db_string str
+          adapter, hosts, database = split_connection_str(str)
+          acs = []
+          hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
+            host, port = s.split(Contrast::Utils::ObjectShare::COLON)
+
+            ac = Contrast::Api::Dtm::ArchitectureComponent.new
+            ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
+            ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
+            ac.remote_port = port.to_i
+            ac.type = AC_TYPE_DB
+            ac.url = Contrast::Utils::StringUtils.force_utf8(database)
+            acs << ac
+          end
+          acs
+        end
+
+        def self.split_connection_str str
+          adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
+          _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
+          # Not currently used
+          # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
+          hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
+          hosts << LOCALHOST if hosts.empty?
+          database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
+
+          [adapter, hosts, database]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -60,7 +60,7 @@ module Contrast
 
           digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
           unless digest
-            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s) if logger.debug?
             return
           end
           report_path = adjust_path_for_reporting(path, spec)
@@ -71,16 +71,18 @@ module Contrast
 
         # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache.
         #
+        # TODO: RUBY-1355
         # @param activity [Contrast::Api::Dtm::Activity] the message to which to append the usage data
         def generate_library_usage activity
           return unless enabled?
           return unless activity
 
-          # Copy gemdigest_cache and clear it in sync.
+          # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
+          # assignment and the replace
           gem_spec_digest_to_files = @lock.synchronize do
-            copy = @gemdigest_cache.dup
-            @gemdigest_cache.clear
-            copy
+            hold = @gemdigest_cache
+            @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
+            hold
           end
 
           gem_spec_digest_to_files.each_pair do |digest, files|

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
-require 'contrast/utils/inventory_util'
+require 'contrast/agent/inventory/database_config'
 
 module Contrast
   module Agent
@@ -42,7 +42,7 @@ module Contrast
               context.activity.query_count += 1
               return unless context.activity.query_count == 1
 
-              Contrast::Utils::InventoryUtil.append_db_config(context.activity)
+              Contrast::Agent::Inventory::DatabaseConfig.append_db_config(context.activity)
             end
           end
         end

data/lib/contrast/agent/metric_telemetry_event.rb

@@ -0,0 +1,26 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/metrics_hash'
+require 'contrast/agent/telemetry_event'
+
+module Contrast
+  module Agent
+    # This class will hold the basic information for a Telemetry Event
+    class MetricTelemetryEvent < Contrast::Agent::TelemetryEvent
+      include Contrast::Utils
+
+      attr_reader :fields
+
+      def initialize
+        super
+        @fields = MetricsHash.new(Numeric)
+        @fields['_filter'] = 0
+      end
+
+      def to_json **_args
+        super.merge!({ fields: @fields })
+      end
+    end
+  end
+end

data/lib/contrast/agent/middleware.rb

@@ -10,8 +10,10 @@ require 'contrast/utils/object_share'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/utils/heap_dump_util'
+require 'contrast/utils/telemetry'
 require 'contrast/agent/request_handler'
 require 'contrast/agent/static_analysis'
+require 'contrast/agent/startup_metrics_telemetry_event'
 
 require 'contrast/utils/timer'
 
@@ -60,6 +62,7 @@ module Contrast
         handle_first_request
         call_with_agent(env)
       end
+      ::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
 
       private
 
@@ -67,6 +70,7 @@ module Contrast
         ::Contrast::SETTINGS.reset_state
 
         inform_deprecations
+        telemetry_disclaimer
 
         if ::Contrast::CONFIG.invalid?
           ::Contrast::AGENT.disable!
@@ -88,6 +92,13 @@ module Contrast
           Contrast::Agent.thread_watcher.ensure_running?
         end
 
+        if Contrast::Agent::Telemetry.enabled?
+          logger.debug_with_time('middleware: sending startup metrics telemetry event') do
+            event = Contrast::Agent::StartupMetricsTelemetryEvent.new
+            Contrast::Agent.thread_watcher.telemetry_queue.send_event(event)
+          end
+        end
+
         logger.debug_with_time('middleware: instrument shared libraries and patch') do
           Contrast::Agent::Patching::Policy::Patcher.patch
         end
@@ -224,6 +235,18 @@ module Contrast
         Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\
                     'Please contact Customer Support prior if you require continued support.')
       end
+
+      # Displays Telemetry disclaimer if Telemetry is enabled.
+      # if .telemetry file doesn't exist we create one and then show the disclaimer.
+      # if the file already exists we do nothing.
+      def telemetry_disclaimer
+        return unless Contrast::Agent::Telemetry.enabled?
+        return unless Contrast::Utils::Telemetry.create_telemetry_file
+
+        logger.info Contrast::Utils::Telemetry.disclaimer
+        $stdout.print Contrast::Utils::Telemetry.disclaimer
+        true
+      end
     end
   end
 end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -59,7 +59,10 @@ module Contrast
           end
 
           def instrument!
+            return if instrumenting_module == :'Contrast::Framework::Rails::Rewrite' && RAILS_VER >= '2.6.0'
+
             require instrumentation_file_path
+
             if instrumenting_module
               mod = Module.cs__const_get(instrumenting_module)
               with_contrast_scope { mod.instrument } if mod

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -4,6 +4,7 @@
 require 'contrast/agent/patching/policy/after_load_patch'
 require 'contrast/components/logger'
 require 'contrast/framework/manager'
+require 'contrast/extension/extension'
 
 module Contrast
   module Agent
@@ -29,18 +30,22 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
-              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-              Contrast::Extension::Assess::StringPropagator.instrument_string
-              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
-
-              Contrast::Extension::Protect::Kernel.instrument
+              paths = %w[
+                array
+                basic_object
+                module
+                fiber_track
+                hash
+                kernel
+                marshal_module
+                regexp
+                string
+                string_interpolation26
+              ].cs__freeze
+              paths.each do |p|
+                path_part = "cs__assess_#{ p }"
+                Contrast::Extension::Assess::InstrumentHelper.instrument "#{ path_part }/#{ path_part }"
+              end
               true
             end
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -81,15 +81,21 @@ module Contrast
               deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
               method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
                                                   inventory_node, deadzone_node)
-              MethodPolicy.new(method_name: method_name,
-                               method_visibility: method_visibility,
-                               instance_method: instance_method,
-                               source_node: source_node,
-                               propagation_node: propagation_node,
-                               trigger_node: trigger_node,
-                               protect_node: protect_node,
-                               inventory_node: inventory_node,
-                               deadzone_node: deadzone_node)
+              method_policy = MethodPolicy.new(method_name: method_name,
+                                               method_visibility: method_visibility,
+                                               instance_method: instance_method,
+                                               source_node: source_node,
+                                               propagation_node: propagation_node,
+                                               trigger_node: trigger_node,
+                                               protect_node: protect_node,
+                                               inventory_node: inventory_node,
+                                               deadzone_node: deadzone_node)
+
+              return method_policy unless check_method_policy_nodes_empty? source_node, propagation_node, trigger_node,
+                                                                           protect_node, inventory_node, deadzone_node
+
+              create_new_node(module_policy, method_policy) if module_policy.deadzone_nodes&.any?
+              method_policy
             end
 
             def find_method_node nodes, method_name, is_instance_method
@@ -103,6 +109,45 @@ module Contrast
             def find_visibility *nodes
               nodes.find { |node| node }&.method_visibility
             end
+
+            def check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node, protect_node,
+                                                 inventory_node, deadzone_node)
+              return false unless source_node.nil? && propagation_node.nil? && trigger_node.nil? && protect_node.nil? &&
+                  inventory_node.nil? && deadzone_node.nil?
+
+              true
+            end
+
+            private
+
+            def create_new_node module_policy, method_policy
+              return if module_policy.deadzone_nodes.empty?
+
+              module_policy.deadzone_nodes.map do |node|
+                next unless node.method_name.nil?
+
+                klass = Module.cs__const_get(node.class_name)
+                next unless it_defined? klass, method_policy.method_name
+
+                new_node = {}
+                new_node['instance_method'] = method_policy.instance_method
+                new_node['method_visibility'] =
+                  klass.private_method_defined?(method_policy.method_name) ? 'private' : 'public'
+                new_node['method_name'] = method_policy.method_name
+                new_node['class_name'] = node.class_name
+                new_node = Contrast::Agent::Deadzone::Policy::DeadzoneNode.new(new_node)
+                method_policy.instance_variable_set(:@method_visibility, new_node.method_visibility)
+                method_policy.instance_variable_set(:@deadzone_node, new_node)
+                module_policy.deadzone_nodes << new_node
+                break unless method_policy.deadzone_node.nil?
+              end
+            end
+
+            def it_defined? klass, method_name
+              klass.instance_methods(false).include?(method_name) ||
+                  klass.private_instance_methods(false).include?(method_name) ||
+                  klass.singleton_methods(false).include?(method_name)
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -12,11 +12,9 @@ module Contrast
         # rather than new.
         class ModulePolicy
           class << self
-            # Given the name of a module, create a :ModulePolicy for it using
-            # the Policy of each supported feature
+            # Given the name of a module, create a :ModulePolicy for it using the Policy of each supported feature.
             #
-            # @param module_name [String] the name of the module to which the
-            #   policy applies
+            # @param module_name [String] the name of the module to which the policy applies.
             # @return [Contrast::Agent::Patching::Policy::ModulePolicy]
             def create_module_policy module_name
               module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.new