contrast-agent 4.9.1 → 4.13.0

data/lib/contrast/components/config.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/utils/env_configuration_item'
+require 'ougai'
 require 'contrast/configuration'
 
 module Contrast
@@ -23,17 +24,33 @@ module Contrast
     # time than to silently fail to deliver functionality.
     module Config
       CONTRAST_ENV_MARKER = 'CONTRAST__'
+      CONTRAST_LOG = 'contrast_agent.log'
+      CONTRAST_NAME = 'Contrast Agent'
 
       class Interface # :nodoc:
         def initialize
           build
         end
 
-        def build log: true
+        # Basic logger for handling configuration validation logging
+        # the file to log is determined by the default one or set
+        # by the config file, if that configuration is found
+        def proto_logger
+          @_proto_logger ||= begin
+            @_proto_logger = ::Ougai::Logger.new(logger_path || CONTRAST_LOG)
+            @_proto_logger.progname = CONTRAST_NAME
+            @_proto_logger.level = ::Ougai::Logging::Severity::WARN
+            @_proto_logger.formatter = Contrast::Logger::Format.new
+            @_proto_logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
+            @_proto_logger
+          end
+        end
+
+        def build
           @_valid = nil
           @config = Contrast::Configuration.new
           env_overrides
-          validate(log: log)
+          validate
         end
         alias_method :rebuild, :build
 
@@ -43,7 +60,8 @@ module Contrast
         end
 
         def valid?
-          @_valid = validate(log: false) if @_valid.nil?
+          @_valid = validate if @_valid.nil?
+          @_valid
         end
 
         def invalid?
@@ -58,20 +76,28 @@ module Contrast
 
         SESSION_VARIABLES = 'Invalid configuration. '\
                             "Setting both application.session_id and application.session_metadata is not allowed.\n"
-        def validate log: false
+        API_URL = "Invalid configuration. Missing a required connection value 'url' is not set."
+        API_KEY = "Invalid configuration. Missing a required connection value 'api_key' is not set."
+        API_SERVICE_KEY = "Invalid configuration. Missing a required connection value 'service_tag' is not set."
+        API_USERNAME = "Invalid configuration. Missing a required connection value 'user_name' is not set."
+        def validate
           # The config has information about how to construct the logger.
           # If the config is invalid, and you want to know about it, then
           # you have a circular dependency if you try to log it,
-          # hence `log: false`.
+          # so we use basic proto_logger to do this job.
           if !session_id.empty? && !session_metadata.empty?
-            if log
-              cs__class.log_error(SESSION_VARIABLES)
-            else
-              puts SESSION_VARIABLES
-            end
+            proto_logger.error(SESSION_VARIABLES)
             return false
           end
-
+          if bypass
+            msg = []
+            msg << API_URL unless api_url
+            msg << API_KEY unless api_key
+            msg << API_SERVICE_KEY unless api_service_key
+            msg << API_USERNAME unless api_username
+            msg.any? { |m| proto_logger.error(m) }
+            return false unless msg.empty?
+          end
           true
         end
 
@@ -107,6 +133,60 @@ module Contrast
         def session_metadata
           @config.application.session_metadata
         end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_url
+          @config.api.url
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_key
+          @config.api.api_key
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_service_key
+          @config.api.service_key
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_username
+          @config.api.user_name
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def bypass
+          @config.root.agent.service.bypass
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::Logger, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def logger_path
+          @config.root.agent.logger.path
+        end
       end
     end
   end

data/lib/contrast/components/contrast_service.rb

@@ -31,12 +31,20 @@ module Contrast
               (LOCALHOST.match?(host) || !!socket_path)
         end
 
+        def use_agent_communication?
+          return @_use_agent_communication unless @_use_agent_communication.nil?
+
+          @_use_agent_communication = true?(::Contrast::CONFIG.root.agent.service.bypass)
+        end
+
         def host
-          @_host ||= (::Contrast::CONFIG.root.agent.service.host || Contrast::Config::ServiceConfiguration::DEFAULT_HOST).to_s
+          @_host ||=
+            (::Contrast::CONFIG.root.agent.service.host || Contrast::Config::ServiceConfiguration::DEFAULT_HOST).to_s
         end
 
         def port
-          @_port ||= (::Contrast::CONFIG.root.agent.service.port || Contrast::Config::ServiceConfiguration::DEFAULT_PORT).to_i
+          @_port ||=
+            (::Contrast::CONFIG.root.agent.service.port || Contrast::Config::ServiceConfiguration::DEFAULT_PORT).to_i
         end
 
         def socket_path

data/lib/contrast/components/logger.rb

@@ -6,20 +6,25 @@ require 'contrast/components/base'
 
 module Contrast
   module Components
-    module Logger
-      module InstanceMethods #:nodoc:
+    module Logger # :nodoc:
+      module InstanceMethods # :nodoc:
         def logger
           Contrast::Logger::Log.instance.logger
         end
+
+        def add_trace_perf_logging_for sym, custom_message = nil
+          logger.add_trace_perf_logging(self, sym, custom_message)
+        end
+      end
+
+      class << self
+        def add_trace_log_timing_for clazz, method_name, custom_message = nil
+          Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
+        end
       end
-      ClassMethods = InstanceMethods
 
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Agent Logger.
       class Interface
-        include Contrast::Components::ComponentBase
+        include InstanceMethods
       end
     end
   end

data/lib/contrast/components/scope.rb

@@ -7,12 +7,9 @@ require 'contrast/agent/scope'
 
 # This is the Scope component.
 #
-# It tracks /Contrast/ scope.  That is, "are we currently doing assess
-# or protect stuff within a patched method?" -- this is how we avoid doing
-# Contrast stuff on Contrast code.
-#
-# Separately from this component, there is also require scope, which is an
-# optimization on how we implement patching to `require`.
+# It tracks /Contrast/ scope.  That is, "are we currently doing assess or protect stuff within a patched method?" --
+# this is how we avoid doing Contrast stuff on Contrast code or creating infinite loops -- or "are we in some other
+# execution context for which we need to special case?".
 module Contrast
   module Components
     module Scope # :nodoc:
@@ -25,10 +22,8 @@ module Contrast
           EXECUTION_CONTEXT[Fiber.current] = Contrast::Agent::Scope.new
         end
 
-        # This returns the scope governing the current execution context.
-        # Use this sparingly, preferring the instance & class methods to
-        # access and query scope, rather than interacting with the scope
-        # object directly.
+        # This returns the scope governing the current execution context. Use this sparingly, preferring the instance
+        # & class methods to access and query scope, rather than interacting with the scope object directly.
         def scope_for_current_ec
           MONITOR.synchronize do
             return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
@@ -37,9 +32,7 @@ module Contrast
       end
 
       module InstanceMethods # :nodoc:
-        # For each instance method on a scope, define a forwarder
-        # to the scope on the current execution context's scope.
-
+        # For each instance method on a scope, define a forwarder to the scope on the current execution context's scope.
         def scope_for_current_ec
           MONITOR.synchronize do
             return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
@@ -118,24 +111,12 @@ module Contrast
         ensure
           scope_for_current_ec.exit_split_scope!
         end
-
-        # TODO: RUBY-572
-        #
-        # Current behavior is to no-op if we're not "in a request context".
-        # Our C functions were previously checking to see if we had a scope, because
-        # scope was tacked on to a request context -- so "we have a scope, therefore,
-        # we have a request context."  We've decoupled scopes from request contexts,
-        # so now it checks "do we have a request context."
-        # RUBY-290 should remove all of that, including this method.
-        def in_request_context?
-          !!Contrast::Agent::REQUEST_TRACKER.current
-        end
       end
 
       def self.sweep_dead_ecs
-        # TODO: RUBY-571, #sweep_dead_ecs compensates for a lack of weak tables
-        # 'ec' for execution context.  in this case, it's a Fiber.
-        # Threads rely on Fibers, so two birds, one stone.
+        # TODO: RUBY-534, #sweep_dead_ecs compensates for a lack of weak tables. when we can use WeakRef, we should
+        #   investigate removing this call and instead use the WeakRef for the Execution Context's Keys or using our
+        #   Finalizers Hash for Fibers
         MONITOR.synchronize do
           EXECUTION_CONTEXT.delete_if do |ec, _scope|
             !ec.alive?

data/lib/contrast/config/api_configuration.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/default_value'
+
+module Contrast
+  module Config
+    # Api keys configuration
+    class ApiConfiguration < BaseConfiguration
+      URL = 'https://app.contrastsecurity.com/Contrast'
+      KEYS = {
+          api_key: EMPTY_VALUE,
+          url: Contrast::Config::DefaultValue.new(URL),
+          user_name: EMPTY_VALUE,
+          service_key: EMPTY_VALUE
+      }.cs__freeze
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/assess_configuration.rb

@@ -10,6 +10,7 @@ module Contrast
           tags: EMPTY_VALUE,
           enable: EMPTY_VALUE,
           enable_scan_response: Contrast::Config::DefaultValue.new('true'),
+          enable_dynamic_sources: Contrast::Config::DefaultValue.new('true'),
           sampling: Contrast::Config::SamplingConfiguration,
           rules: Contrast::Config::AssessRulesConfiguration,
           stacktraces: Contrast::Config::DefaultValue.new('ALL')

data/lib/contrast/config/base_configuration.rb

@@ -12,7 +12,7 @@ module Contrast
     class BaseConfiguration
       extend Forwardable
 
-      BOOLEANS = [true, false].cs__freeze
+      STRING_BOOLEANS = %w[false true].cs__freeze
 
       attr_reader :map
 
@@ -73,8 +73,18 @@ module Contrast
                           spec_value.new(user_provided_value)
                         elsif spec_value.is_a?(Contrast::Config::DefaultValue) && user_provided_value == EMPTY_VALUE
                           spec_value.value
-                        elsif BOOLEANS.include?(user_provided_value)
-                          user_provided_value.to_s
+                        elsif user_provided_value.cs__is_a?(String)
+                          value = user_provided_value.downcase
+                          # converts string values to 'true' => true or 'false' => false
+                          case value
+                          when STRING_BOOLEANS[1]
+                            true
+                          when STRING_BOOLEANS[0]
+                            false
+                          else
+                            # returns non boolean string values
+                            user_provided_value
+                          end
                         else
                           user_provided_value
                         end
@@ -95,9 +105,7 @@ module Contrast
 
       def define_setter str_key
         define_singleton_method "#{ str_key }=".to_sym do |new_value|
-          boolean_value = new_value == true
-          boolean_value ||= new_value == false
-          @map[str_key] = boolean_value ? new_value.to_s : new_value
+          @map[str_key] = new_value
         end
       end
     end

data/lib/contrast/config/env_variables.rb

@@ -0,0 +1,25 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # This module is holding all the Env Variables that we could use through the agent lifecycle
+    module EnvVariables
+      ENV_VARIABLES = {
+          telemetry_opt_outs: ENV['CONTRAST_AGENT_TELEMETRY_OPTOUT'].to_s || Contrast::Config::DefaultValue.new('false')
+      }.cs__freeze
+
+      def return_value key
+        return unless ENV_VARIABLES.key?(key.to_sym)
+
+        sym_key = key.downcase.to_sym
+        return_val = ENV_VARIABLES[sym_key]
+        if return_val.is_a?(Contrast::Config::DefaultValue)
+          return_val.value
+        else
+          return_val
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/root_configuration.rb

@@ -6,6 +6,7 @@ module Contrast
     # The base of the Common Configuration settings.
     class RootConfiguration < BaseConfiguration
       KEYS = {
+          api: Contrast::Config::ApiConfiguration,
           enable: BaseConfiguration::EMPTY_VALUE,
           agent: Contrast::Config::AgentConfiguration,
           application: Contrast::Config::ApplicationConfiguration,

data/lib/contrast/config/service_configuration.rb

@@ -19,7 +19,8 @@ module Contrast
           host: EMPTY_VALUE,
           port: EMPTY_VALUE,
           socket: EMPTY_VALUE,
-          logger: Contrast::Config::LoggerConfiguration
+          logger: Contrast::Config::LoggerConfiguration,
+          bypass: Contrast::Config::DefaultValue.new(false)
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config.rb

@@ -24,6 +24,7 @@ require 'contrast/config/protect_rules_configuration'
 require 'contrast/config/sampling_configuration'
 
 require 'contrast/config/ruby_configuration'
+require 'contrast/config/api_configuration'
 require 'contrast/config/agent_configuration'
 require 'contrast/config/application_configuration'
 require 'contrast/config/server_configuration'

data/lib/contrast/configuration.rb

@@ -7,6 +7,7 @@ require 'fileutils'
 require 'contrast/config'
 require 'contrast/utils/object_share'
 require 'contrast/components/scope'
+require 'contrast/utils/exclude_key'
 
 module Contrast
   # This is how we read in the local settings for the Agent, both ENV/ CMD line
@@ -48,9 +49,7 @@ module Contrast
     # in an infinite loop on the to_sym method used later.
     def method_missing symbol, *args
       with_contrast_scope do
-        root.public_send(symbol, *args)
-      rescue NoMethodError => _e
-        super
+        root.public_send(symbol, *args) if root.cs__respond_to?(symbol)
       end
     end
 
@@ -101,8 +100,7 @@ module Contrast
       {}
     end
 
-    # We're updating properties loaded from the configuration
-    # files to match the new agreed upon standard configuration
+    # We're updating properties loaded from the configuration files to match the new agreed upon standard configuration
     # names, so that one file works for all agents
     def update_prop_keys config
       CONVERSION.each_pair do |old_method, new_method|
@@ -120,16 +118,7 @@ module Contrast
         # We changed the seconds values into ms values. Multiply them accordingly
         old_value = old_value.to_i * 1000 if new_method.end_with?(MILLISECOND_MARKER)
         new_value = config
-        end_idx = new_keys.length - 1
-        new_keys.each_with_index do |new_key, index|
-          if index == end_idx
-            new_value[new_key] = old_value if new_value[new_key].nil?
-          else
-            new_value = {} if new_value.nil?
-            new_value[new_key] = {} if new_value[new_key].nil?
-            new_value = new_value[new_key]
-          end
-        end
+        replace_props(new_keys, new_value, old_value)
       end
 
       config
@@ -230,6 +219,8 @@ module Contrast
       case convert
       when Contrast::Config::BaseConfiguration
         convert.cs__class::KEYS.each_key do |key|
+          next if Contrast::Utils::ExcludeKey.excludable? key.to_s
+
           hash[key] = convert_to_hash(convert.send(key), {})
         end
         hash
@@ -237,5 +228,21 @@ module Contrast
         convert
       end
     end
+
+    def replace_props new_keys, new_value, old_value
+      idx = 0
+      end_idx = new_keys.length - 1
+      while idx < new_keys.length
+        new_key = new_keys[idx]
+        if idx == end_idx
+          new_value[new_key] = old_value if new_value[new_key].nil?
+        else
+          new_value = {} if new_value.nil?
+          new_value[new_key] = {} if new_value[new_key].nil?
+          new_value = new_value[new_key]
+        end
+        idx += 1
+      end
+    end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -11,7 +11,7 @@ module Contrast
       # This is our patch of the Array class required to handle propagation
       # Disclaimer: there may be a better way, but we're in a 'get it work' state.
       # Hopefully, we'll be in a 'get it right' state soon.
-      class ArrayPropagator
+      class ArrayPropagator # rubocop:disable Style/StaticClass
         extend Contrast::Components::Scope::InstanceMethods
 
         ARRAY_JOIN_HASH = {
@@ -59,16 +59,6 @@ module Contrast
               ret
             end
           end
-
-          def instrument_array_track
-            @_instrument_array_track ||= begin
-              require 'cs__assess_array/cs__assess_array'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading assess track patch', e)
-            false
-          end
         end
       end
     end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -34,26 +34,6 @@ module Contrast
                                                                               ret, source)
           end
 
-          def instrument_basic_object_track
-            @_instrument_basic_object_track ||= begin
-              require 'cs__assess_basic_object/cs__assess_basic_object'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading basic object track patch', e)
-            false
-          end
-
-          def instrument_module_track
-            @_instrument_module_track ||= begin
-              require 'cs__assess_module/cs__assess_module'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading module track patch', e)
-            false
-          end
-
           private
 
           def trigger_node clazz, method

data/lib/contrast/extension/assess/fiber.rb

@@ -20,7 +20,6 @@ module Contrast
         extend Contrast::Components::Logger::InstanceMethods
         extend Contrast::Components::Scope::InstanceMethods
 
-
         # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
         FIBER_NEW_NODE_HASH = {
             'class_name' => 'Fiber',
@@ -86,16 +85,6 @@ module Contrast
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Fiber.new', e)
           end
-
-          def instrument_fiber_track
-            @_instrument_fiber_variables ||= begin
-              require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading fiber track patch', e)
-            false
-          end
         end
       end
     end

data/lib/contrast/extension/assess/hash.rb

@@ -25,16 +25,6 @@ module Contrast
             # result in a seg fault
             object
           end
-
-          def instrument_hash_track
-            @_instrument_hash_track ||= begin
-              require 'cs__assess_hash/cs__assess_hash'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading hash track patch', e)
-            false
-          end
         end
       end
     end

data/lib/contrast/extension/assess/kernel.rb

@@ -14,6 +14,7 @@ module Contrast
       module KernelPropagator
         class << self
           extend Contrast::Components::Logger::InstanceMethods
+          include Contrast::Components::Logger::InstanceMethods
           include Contrast::Extension::Assess::ExecTrigger
 
           # We're 'tracking' sprintf now, meaning if anything is tracked on the way
@@ -65,16 +66,6 @@ module Contrast
             logger.error('Unable to track dataflow through sprintf', e)
           end
 
-          def instrument_kernel_track
-            @_instrument_fiber_variables ||= begin
-              require 'cs__assess_kernel/cs__assess_kernel'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading kernel track patch', e)
-            false
-          end
-
           private
 
           def handle_sprintf_value value, result, parent_events

data/lib/contrast/extension/assess/marshal.rb

@@ -12,10 +12,12 @@ module Contrast
       # Hopefully, we'll be in a 'get it right' state soon.
       # This module is used for our Marshal.load patches
       class MarshalPropagator
-        extend Contrast::Components::Logger::InstanceMethods
         extend Contrast::Components::Scope::InstanceMethods
 
         class << self
+          extend Contrast::Components::Logger::InstanceMethods
+          include Contrast::Components::Logger::InstanceMethods
+
           def cs__load_protect arg
             return if in_contrast_scope?
 
@@ -44,16 +46,6 @@ module Contrast
             end
           end
 
-          def instrument_marshal_load
-            @_instrument_marshal_load ||= begin
-              require 'cs__assess_marshal_module/cs__assess_marshal_module'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading marshal load patch', e)
-            false
-          end
-
           def trigger_node clazz, method
             triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
             return unless triggers

data/lib/contrast/extension/assess/regexp.rb

@@ -16,7 +16,6 @@ module Contrast
         extend Contrast::Components::Logger::InstanceMethods
         extend Contrast::Components::Scope::InstanceMethods
 
-
         REGEXP_EQUAL_SQUIGGLE_HASH = {
             'id' => 'regexp_100',
             'class_name' => 'Regexp',
@@ -59,16 +58,6 @@ module Contrast
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Regexp#=~', e)
           end
-
-          def instrument_regexp_track
-            @_instrument_regexp_track ||= begin
-              require 'cs__assess_regexp/cs__assess_regexp'
-              true
-            end
-          rescue StandardError, LoadError => e
-            logger.error('Error loading regexp track patch', e)
-            false
-          end
         end
       end
     end