contrast-agent 5.2.0 → 6.1.0

data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb

@@ -3,6 +3,7 @@
 
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporting_events/application_startup'
 require 'contrast/agent/reporting/reporting_utilities/reporter_client'
 require 'contrast/agent/reporting/reporting_utilities/endpoints'
 
@@ -15,33 +16,34 @@ module Contrast
         include Contrast::Components::Scope::InstanceMethods
         include Contrast::Agent::Reporting::Endpoints
 
-        # @param event [Contrast::Agent::Reporting::Preflight] the preflight we handle here
-        # @param response [Net::HTTP::Response,nil] The response we handle and read from
-        # @param connection [Net::HTTP] open connection
-        def handle_response event, response, connection
-          return unless event && response && connection
-          return unless event.cs__is_a?(Contrast::Agent::Reporting::Preflight)
-
-          preflight_message = event.messages[0]
-          # for handling multiple findings
-          # we'll only extract the indexes without *
-          # findings_to_return = response.body.split(',').delete_if { |el| el.include?('*') }
-          # after that we'll do some magic and return them the same way we do for corresponding_finding
-          corresponding_finding = Contrast::Agent::Reporting::ReportingStorage.delete(preflight_message.hash_code)
-          return unless corresponding_finding
+        # List the events that need to be sent when agent starts up.
+        # The order here matters -- DO NOT CHANGE IT!!! >_< - HM
+        #
+        # If you add more, update the test in reporter_client_spec.rb
+        STARTUP_EVENTS = [
+          Contrast::Agent::Reporting::AgentStartup,
+          Contrast::Agent::Reporting::ApplicationStartup
+        ].cs__freeze
 
-          audit&.audit_event(corresponding_finding, response) if ::Contrast::API.request_audit_enable?
-          send_event(corresponding_finding, connection, true)
-          nil
-        rescue StandardError => e
-          logger.error('Unable to handle response', e)
+        def audit
+          @_audit ||= Contrast::Agent::Reporting::Audit.new
         end
 
         private
 
-        # TODO: RUBY-1466 find better home for this?
-        def audit
-          @_audit ||= Contrast::Agent::Reporting::Audit.new
+        # Send Agent Startup event
+        #
+        # @param connection [Net::HTTP] open connection
+        def send_agent_startup connection
+          logger.debug('Preparing to send startup messages')
+
+          STARTUP_EVENTS.each do |event|
+            startup_event = event.new
+            send_event(startup_event, connection, send_immediately: true)
+          rescue StandardError => e
+            handle_error(startup_event, e)
+          end
+          logger.debug('Startup messages sent')
         end
 
         # This method will build headers of the request required for TS communication
@@ -66,8 +68,8 @@ module Contrast
 
         # log the event sent immediately
         #
-        # @param event [Contrast::Api::Dtm,Contrast::Agent::Reporting::ReportingEvent] One of the DTMs valid for the
-        # event field of Contrast::Api::Dtm::Message|Contrast::Api::Dtm::Activity
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
         def log_send_event event
           logger.debug("#{ Contrast::Agent::Reporting::ReporterClient::SERVICE_NAME } immediately sending event.",
                        event_id: event.__id__, event_type: event.cs__class.cs__name)
@@ -75,7 +77,7 @@ module Contrast
 
         # Handles standard error case, logs and set status for failure
         #
-        # @param event [Contrast::Api::Dtm, Contrast::Agent::Reporting::ReportingEvent]
+        # @param event [Contrast::Agent::Reporting::ReportingEvent]
         # One of the DTMs valid for the event field of Contrast::Api::Dtm::Message|Contrast::Api::Dtm::Activity
         # @param error_msg [StandardError]
         # @return nil [NilClass] to be passed as response
@@ -92,70 +94,56 @@ module Contrast
         # Handles response processing and sets status
         #
         # @param response [Net::HTTP::Response]
-        # @return response [Net::HTTP::Response]
-        def process_response response
+        def process_settings_response response
           response_handler.process(response)
-          logger.debug('Successfully sent startup messages to service.')
+          logger.debug('Successfully sent startup messages to TeamServer.')
           status.success!
-          response
         end
 
-        # build the request headers and assign endpoint
+        # Given a response from preflght, when the finding hash is desired, then send the finding to which it pertains.
+        # The method accepts any Contrast::Agent::Reporting::ReportingEvent, but will short circuit if it is not a
+        # Contrast::Agent::Reporting::Preflight.
         #
-        # @param event event [Contrast::Api::Dtm::AgentStartup, Contrast::Agent::Reporting::ReportingEvent]
-        # One of the DTMs valid for the event field of Contrast::Api::Dtm::Message|Contrast::Api::Dtm::Activity
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
+        # @param response [Net::HTTPResponse,nil] The response we handle and read from
+        # @param connection [Net::HTTP] open connection
+        def process_preflight_response event, response, connection
+          return unless event.cs__is_a?(Contrast::Agent::Reporting::Preflight)
+          return unless response && connection
+
+          findings_to_return = response.body.split(',').delete_if { |el| el.include?('*') }
+          findings_to_return.each do |index|
+            preflight_message = event.messages[index.to_i]
+            corresponding_finding = Contrast::Agent::Reporting::ReportingStorage.delete(preflight_message.hash_code)
+            next unless corresponding_finding
+
+            send_event(corresponding_finding, connection)
+          end
+        rescue StandardError => e
+          logger.error('Unable to handle response', e)
+        end
+
+        # Convert the given event into an appropriate Net::HTTPRequest object, setting the request headers and
+        # assigning endpoint the endpoint appropriate for the event and casting its hash to a JSON body.
+        #
+        # @param event event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
         # @return [Net::HTTP::Post,Net::HTTP::Put]
         def build_request event
           with_contrast_scope do
-            request = if event.cs__is_a?(Contrast::Agent::Reporting::ReportingEvent)
-                        case event.event_method
-                        when :PUT
-                          Net::HTTP::Put.new(event.event_endpoint)
-                        when :POST
-                          Net::HTTP::Post.new(event.event_endpoint)
-                        end
-                      else # TODO: RUBY-1438 -- remove
-                        Net::HTTP::Put.new(Contrast::Agent::Reporting::Endpoints::NG_ENDPOINTS[:agent_startup])
+            request = case event.event_method
+                      when :PUT
+                        Net::HTTP::Put.new(event.event_endpoint)
+                      else # :POST
+                        Net::HTTP::Post.new(event.event_endpoint)
                       end
             build_headers(request)
-            if event.cs__is_a?(Contrast::Agent::Reporting::ReportingEvent)
-              event.attach_headers(request)
-              request.body = event.to_controlled_hash.to_json
-            else
-              request.body = event.to_json
-            end
+            event.attach_headers(request)
+            request.body = event.to_controlled_hash.to_json
             request
           end
         end
-
-        # Send Agent Startup event
-        #
-        # @param connection [Net::HTTP] open connection
-        # @return response [Net::HTTP::Response] response from TS
-        def send_agent_startup connection
-          logger.debug('Preparing to send startup messages')
-          startup = Contrast::APP_CONTEXT.build_agent_startup_message
-          request = build_request(startup)
-          response = connection.request(request)
-          process_response(response)
-        rescue StandardError => e
-          handle_error(startup, e)
-        end
-
-        # Sent different events to different endpoints
-        #
-        # @param event [Contrast::Api::Dtm,Contrast::Agent::Reporting::ReportingEvent] Main reporting event, all events
-        # inherit it
-        # @param connection [Net::HTTP] open connection
-        def send_events event, connection
-          request = build_request(event)
-          response = connection.request(request)
-          process_response(response)
-        rescue StandardError => e
-          handle_error(event, e)
-        end
-
-        # Eventually here we'll handle more response types and etc
       end
     end
   end

data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb

@@ -53,7 +53,7 @@ module Contrast
           end
 
           # @param rule_id [String] the rule_id
-          # @return [Hash, nil] return array with key and value of the pair
+          # @return [Array, nil] return array with key and value of the pair
           def find_by_rule_id rule_id
             return unless rule_id
 

data/lib/contrast/agent/reporting/reporting_utilities/response.rb

@@ -13,16 +13,26 @@ module Contrast
         # At least one, but not necessarily all, setting will differ from the agent's current set.
         # Agents are able to replace all application settings with those in this message.
         #
-        # @return application_settings [Contrast::Agent::Reporting::Settings::ApplicationSettings]
-        def application_settings
-          @_application_settings ||= Contrast::Agent::Reporting::Settings::ApplicationSettings.new
-        end
+        # @return [Contrast::Agent::Reporting::Settings::ApplicationSettings, nil]
+        attr_accessor :application_settings
 
         # All of the feature server_features
         #
-        # @return server_features [Contrast::Agent::Reporting::Settings::FeatureSettings]
-        def server_features
-          @_server_features ||= Contrast::Agent::Reporting::Settings::ServerFeatures.new
+        # @return server_features [Contrast::Agent::Reporting::Settings::FeatureSettings, nil]
+        attr_accessor :server_features
+
+        class << self
+          def application_response
+            res = new
+            res.application_settings = Contrast::Agent::Reporting::Settings::ApplicationSettings.new
+            res
+          end
+
+          def server_response
+            res = new
+            res.server_features = Contrast::Agent::Reporting::Settings::ServerFeatures.new
+            res
+          end
         end
       end
     end

data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb

@@ -0,0 +1,100 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the methods for TS response conversion to settings objects.
+      module ResponseExtractor
+        private
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess response_data, res
+          assessments = response_data[:settings][:assessment]
+          return unless assessments
+
+          res.application_settings.assess.disabled_rules = assessments[:disabledRules]
+          res.application_settings.assess.session_id = assessments[:session_id]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect response_data, res
+          protect = response_data[:settings][:defend]
+          return unless protect
+
+          # TODO: RUBY-1636 should this be `:rules` or `:protectionRules`
+          res.application_settings.protect.protection_rules = protect[:protectionRules]
+          res.application_settings.protect.virtual_patches = protect[:virtualPatches]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_exclusions response_data, res
+          exclusions = response_data[:settings][:exceptions]
+          return unless exclusions
+
+          res.application_settings.exclusions.code_exclusions = exclusions[:codeExceptions]
+          res.application_settings.exclusions.input_exclusions = exclusions[:inputExceptions]
+          res.application_settings.exclusions.url_exclusions = exclusions[:urlExceptions]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_reactions response_data, res
+          res.application_settings.reactions = response_data[:settings][:reactions]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess_server_features response_data, res
+          assess = response_data[:features][:assessment]
+          return unless assess
+
+          res.server_features.assess.enabled = assess[:enabled]
+          res.server_features.assess.sampling = assess[:sampling]
+          res.server_features.assess.sanitizers = assess[:sanitizers]
+          res.server_features.assess.validators = assess[:validators]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_server_features response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.enabled = protect[:enabled]
+          res.server_features.protect.bot_blocker = protect[:'bot-blocker']
+          # TODO: RUBY-1636 should this be `:rules` or `:protectionRules`
+          # process the botBlockers field
+          res.server_features.protect.syslog = protect[:syslog]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_lists response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.ip_allowlist = protect[:ipAllowlist]
+          res.server_features.protect.ip_denylist = protect[:ipDenyList]
+          res.server_features.protect.log_enchancers = protect[:logEnhancers]
+          res.server_features.protect.rule_definition_list = protect[:ruleDefinitionList]
+        end
+
+        # Here we extract the rules and state for the sensitive data masking policy
+        # Received from TS.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_sensitive_data_policy response_data, res
+          sensitive_data = response_data[:settings][:sensitive_data_masking_policy]
+          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
+          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
+          res.application_settings.sensitive_data_masking.build_rules_form_settings sensitive_data[:rules]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb

@@ -5,6 +5,7 @@ require 'contrast/api/communication/response_processor'
 require 'contrast/api/decorators/application_settings'
 require 'contrast/agent/reporting/reporting_utilities/response'
 require 'contrast/agent/reporting/reporting_utilities/response_handler_utils'
+require 'contrast/agent/reporting/reporting_utilities/response_handler_mode'
 require 'contrast/api/decorators/server_features'
 require 'contrast/components/logger'
 require 'json'
@@ -13,44 +14,105 @@ module Contrast
   module Agent
     module Reporting
       # This class will facilitate the Response capture and analysis functionality.
-      class ResponseHandler < Contrast::Api::Communication::ResponseProcessor
+      class ResponseHandler
         include Contrast::Components::Logger::InstanceMethods
         include Contrast::Agent::Reporting::ResponseHandlerUtils
+        # 15 min
+        TIMEOUT = 900.cs__freeze
+
         # Process the response from TS
         #
         # @param response [Net::HTTP::Response, nil]
         # @return response [Net::HTTP::Response, nil]
         def process response
           logger.debug('Reporter Received a response')
-          return unless analyze_response_code? response&.code
-
-          # handle the response body and obtain server_features or app_settings
-          report_response = convert_response response
+          return unless analyze_response?(response)
 
+          # Handle the response body and obtain server_features or app_settings
+          report_response = convert_response(response)
           return unless report_response
 
-          update_agent_settings report_response
-          update_reaction report_response
-          # this one is called from super needs to be placed here after protobuf
-          update_features report_response.server_features, report_response.application_settings
-          logger.trace('Agent settings updated in response to Service', protect_on: ::Contrast::PROTECT.enabled?,
-                                                                        assess_on: ::Contrast::ASSESS.enabled?)
+          # Update Server Features and Application Settings to provide current agent settings
+          update_agent_settings(report_response)
+          # Process any reactions, including message logging and shutting down
+          update_reaction(report_response)
+          update_ruleset(report_response)
+          logger.trace('Agent settings updated in response to TeamServer', protect_on: ::Contrast::PROTECT.enabled?,
+                                                                           assess_on: ::Contrast::ASSESS.enabled?)
           response
         rescue StandardError => e
           logger.error('Unable to process response from TeamServer', e)
           nil
         end
 
-        # if sleep is true puts reporting service to sleep
+        # If sleep is true puts reporting service to sleep.
         def sleep?
           @_sleep = wake_up if @_sleep.nil?
           @_sleep
         end
 
-        # wakes the reporting service
+        # For how long the agent should wait until retry
+        # to send message
+        #
+        # @return timeout [Integer] the time for reporter
+        # to be suspended.
+        def timeout
+          @_timeout ||= TIMEOUT
+        end
+
+        def mode
+          @_mode ||= Contrast::Agent::Reporting::ResponseHandlerMode.new
+        end
+
+        # Wakes the reporting service
         def wake_up
           @_sleep = false
         end
+
+        private
+
+        # Handles the errors code received from TS and takes appropriate action.
+        # If we are here the response.code is an error that needs handling [4XX]
+        #
+        # @param response [Net::HTTP::Response]
+        def handle_error response
+          case response&.code
+          when ERROR_CODES[:message_not_sent]
+            handle_response_errors response, UNSUCCESSFULLY_RECEIVED_MSG, mode.running
+          when ERROR_CODES[:access_forbidden]
+            handle_response_errors response, FORBIDDEN_MSG, mode.running
+          when ERROR_CODES[:access_forbidden_no_action]
+            handle_response_errors response, FORBIDDEN_NO_ACTION_MSG, mode.running
+          when ERROR_CODES[:application_do_not_exist]
+            handle_response_errors response, APP_NON_EXISTENT_MSG, mode.disabled
+          when ERROR_CODES[:unprocessable_entity]
+            handle_response_errors response, UNPROCESSABLE_ENTITY_MSG, mode.disabled
+          when ERROR_CODES[:too_many_requests]
+            handle_response_errors response, RETRY_AFTER_MSG, mode.resending
+          else
+            logger.debug('Response Error code could not be processed')
+          end
+        end
+
+        # Suspend the reporter and try again in time. If not set
+        # the timeout is set to 15 min As default:
+        #
+        # @param message [String] Message to log.
+        # @param timeout [Integer,nil] The timeout to wait and retry after.
+        # @param error_message [String, nil] Error message if any received.
+        def suspend_reporting message, timeout, error_message
+          @_timeout = timeout || Contrast::Agent::Reporting::ResponseHandler::TIMEOUT
+          log_debug_msg message, timeout: @_timeout, error_message: error_message || 'none'
+          @_sleep = true
+        end
+
+        # Log what we've received.
+        #
+        # @param message [String] Message to log
+        # @param info_hash [Hash] information about the context to log.
+        def log_debug_msg message, info_hash
+          logger.debug(message, info_hash)
+        end
       end
     end
   end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_mode.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the mode state in which the reporter will send
+      # event ot TS.
+      class ResponseHandlerMode
+        # Reader for the running mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are running
+        # and responses are being processed.
+        attr_reader :running
+        # Reader for the disabled mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are disabled
+        # due to received Error. The Reporting is disabled for this application.
+        attr_reader :disabled
+        # Reader for the resending/retry mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are suspended
+        # for a TS received amount of time and will try to resend the previous
+        # request after that.
+        attr_reader :resending
+        # Reader for all supported modes.
+        #
+        # @return [Array<Symbol>] Reporter's client and Response Handler all
+        # available modes of operation.
+        attr_reader :modes
+
+        def initialize
+          @running = :running
+          @disabled = :disabled
+          @resending = :resending
+          @modes = [@running, @disabled, @resending].cs__freeze
+        end
+
+        # Current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status
+          @_status ||= running
+        end
+
+        # Set current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status= mode
+          @_status = mode if mode.cs__is_a?(Symbol) && modes.include?(mode)
+        end
+
+        # Reset mode
+        #
+        def reset_mode
+          @_status = running
+        end
+      end
+    end
+  end
+end