contrast-agent 5.2.0 → 6.1.0

data/lib/contrast/agent/request.rb

@@ -39,7 +39,7 @@ module Contrast
       attr_accessor :route, :observed_route, :new_observed_route
 
       # Delegate calls to the following methods to the attribute @rack_request
-      def_delegators :@rack_request, :base_url, :content_type, :cookies, :env, :ip, :path, :port, :query_string,
+      def_delegators :@rack_request, :base_url, :cookies, :env, :ip, :media_type, :path, :port, :query_string,
                      :request_method, :scheme, :url, :user_agent
 
       # Initialize new Contrast Request
@@ -86,9 +86,9 @@ module Contrast
       #
       # @return type [Symbol<:XML, :JSON, :NORMAL>]
       def document_type
-        @_document_type ||= if /xml/i.match?(content_type) || body&.start_with?('<?xml')
+        @_document_type ||= if /xml/i.match?(media_type) || body&.start_with?('<?xml')
                               :XML
-                            elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
+                            elsif /json/i.match?(media_type) || body&.match?(/\s*[{\[]/)
                               :JSON
                             else
                               :NORMAL

data/lib/contrast/agent/request_context.rb

@@ -42,7 +42,7 @@ module Contrast
       attr_reader :activity, :logging_hash, :observed_route, :new_observed_route, :request, :response, :route,
                   :speedracer_input_analysis, :agent_input_analysis, :server_activity, :timer
 
-      def initialize rack_request, app_loaded = true
+      def initialize rack_request, app_loaded: true
         with_contrast_scope do
           # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new

data/lib/contrast/agent/request_context_extend.rb

@@ -76,7 +76,7 @@ module Contrast
         return false unless ::Contrast::PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
+        service_response = Contrast::Agent&.messaging_queue&.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)
@@ -126,6 +126,7 @@ module Contrast
         @response = Contrast::Agent::Response.new(rack_response)
         return unless @sample_res
 
+        #
         # TODO: RUBY-1376 once all rules translated, move this to if/else w/ the enabled
         if Contrast::Agent::Reporter.enabled?
           Contrast::Agent::Assess::Rule::Response::AutoComplete.new.analyze(@response)
@@ -209,7 +210,6 @@ module Contrast
           @agent_input_analysis = ia
         else
           logger.trace('Analysis from Agent was empty.')
-
         end
       end
 

data/lib/contrast/agent/request_handler.rb

@@ -5,6 +5,7 @@ require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/agent/reporting/reporter'
 require 'contrast/agent/reporting/reporting_utilities/dtm_message'
+require 'contrast/agent/reporting/masker/masker'
 
 module Contrast
   module Agent
@@ -46,18 +47,21 @@ module Contrast
       # This method is used to send our JSON messages directly to TeamServer at the end of each request. As we move
       # more endpoints over, this method will take the messages originally sent by #send_actiivty_messages. At the end,
       # that method should be removed.
-      # TODO: RUBY-1358
-      def report_activity
+      def report_activity # rubocop:disable Metrics/AbcSize
         return unless Contrast::Agent::Reporter.enabled?
 
         reporter = Contrast::Agent.reporter
         return unless reporter
 
+        # Mask Sensitive Data
+        Contrast::Agent::Reporting::Masker.mask context.activity
+
         Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage(context.activity)
         [
           context.new_observed_route,
           Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
-          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages)
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages),
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
         ].each do |event|
           reporter.send_event(event)
         rescue StandardError => e

data/lib/contrast/agent/response.rb

@@ -22,6 +22,8 @@ module Contrast
 
       extend Forwardable
 
+      # @return [Array, Rack::Response] The Rack Response passed by the application & middleware. It can be an Array
+      #   in format [response_code, header_hash, response_body] or an instance of Rack::Response
       attr_reader :rack_response
 
       def initialize rack_response

data/lib/contrast/agent/service_heartbeat.rb

@@ -7,71 +7,29 @@ require 'contrast/agent/reporting/report'
 
 module Contrast
   module Agent
-    # The ServiceHeartbeat functions to keep the Contrast Service alive and
-    # ensure that it maintains this Agent's ApplicationContext.
+    # The ServiceHeartbeat functions to keep the Contrast Service alive and ensure that it maintains this Agent's
+    # ApplicationContext.
     class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Logger::InstanceMethods
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      # check if we can report to TS
-      #
-      # @return[Boolean] true if bypass is enabled, or false if bypass disabled
-      def enabled?
-        @_enabled = Contrast::CONTRAST_SERVICE.use_agent_communication? if @_enabled.nil?
-        @_enabled
-      end
-
-      def client
-        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
-      end
-
-      def connection
-        @_connection ||= client.initialize_connection
-      end
-
       def start_thread!
+        return if ::Contrast::CONTRAST_SERVICE.unnecessary?
         return if running?
 
-        report_from_reporter = check_report_provider
-
         @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
-            if report_from_reporter
-              client.send_event(poll_message, connection)
-            else
-              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
-            end
-
-            sleep REFRESH_INTERVAL_SEC
+            Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+            sleep(REFRESH_INTERVAL_SEC)
           end
         end
       end
 
       def poll_message
-        @_poll_message ||= if enabled? && client
-                             Contrast::Agent::Reporting::Poll.new
-                           else
-                             Contrast::Api::Dtm::Poll.new
-                           end
-      end
-
-      def check_report_provider
-        return false unless enabled?
-        return false unless client && connection
-
-        client.startup!(connection)
-        true
-      end
-
-      def send_event provider
-        if provider
-          client.send_event(poll_message, connection)
-          return
-        end
-        Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+        @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
     end
   end

data/lib/contrast/agent/static_analysis.rb

@@ -40,7 +40,7 @@ module Contrast
             inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
             Contrast::Agent.reporter.send_event(inventory_report)
           else
-            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg, force: true)
           end
         end
 

data/lib/contrast/agent/telemetry/base.rb

@@ -0,0 +1,151 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/env_variables'
+require 'contrast/components/logger'
+require 'contrast/utils/telemetry_client'
+require 'contrast/agent/worker_thread'
+require 'contrast/utils/telemetry'
+require 'contrast/agent/telemetry/events/exceptions/telemetry_exceptions'
+
+module Contrast
+  module Agent
+    module Telemetry
+      # This class will initialize and hold everything needed for the telemetry
+      class Base < WorkerThread
+        include Contrast::Components::Logger::InstanceMethods
+        # this is where we will send the data from the agents
+        URL = 'https://telemetry.ruby.contrastsecurity.com/'
+        # Suggested timeout after each send is to be 3 hours (10800 seconds)
+        SUGGESTED_TIMEOUT = 10_800
+
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+          include Contrast::Config::EnvVariables
+
+          def application_id
+            Contrast::Utils::Telemetry::Identifier.application_id
+          end
+
+          def instance_id
+            Contrast::Utils::Telemetry::Identifier.instance_id
+          end
+
+          def enabled?
+            @_enabled = telemetry_enabled? if @_enabled.nil?
+            @_enabled
+          end
+
+          private
+
+          def telemetry_enabled?
+            opt_out_telemetry = return_value(:telemetry_opt_outs).to_s
+            return false if opt_out_telemetry.casecmp?('true') || opt_out_telemetry == '1'
+
+            # In case of connection error, do not create the background thread or queue,
+            # as if the opt-out env var was set
+            @_client = Contrast::Utils::TelemetryClient.new
+            ip_opt_out_telemetry = @_client.initialize_connection(URL)
+            if ip_opt_out_telemetry.nil?
+              logger.warn("Connection was not established properly!!! \n Telemetry reporting will be disabled!")
+              return false
+            end
+
+            true
+          end
+        end
+
+        def client
+          @_client ||= Contrast::Utils::TelemetryClient.new
+        end
+
+        def connection
+          @_connection ||= client.initialize_connection(URL)
+        end
+
+        def error_messages
+          @_error_messages ||= []
+        end
+
+        def attempt_to_start?
+          unless cs__class.enabled?
+            logger.warn('Telemetry service is disabled!')
+            return false
+          end
+
+          logger.debug('Attempting to start telemetry thread') unless running?
+          true
+        end
+
+        def start_thread!
+          return if running?
+
+          # It is recommended that implementations send a single payload of
+          # general metrics every 3 hours, starting from implementation startup.
+          @_thread = Contrast::Agent::Thread.new do
+            logger.debug('Starting background telemetry thread.')
+            loop do
+              next unless client && connection
+
+              Contrast::Agent::Telemetry::TelemetryExceptionReport.push_exceptions
+              until queue.empty?
+                event = queue.pop
+                begin
+                  logger.debug('This is the current processed event', event)
+                  sleep_time = request_with_response event
+                  if sleep_time
+                    sleep(sleep_time)
+                    logger.debug('Retrying to process event', event)
+                    retry_sleep_time = request_with_response event
+                    sleep(retry_sleep_time) unless retry_sleep_time.nil?
+                  end
+                rescue StandardError => e
+                  logger.error('Could not send message to service from telemetry queue.', e)
+                  stop!
+                end
+              end
+              sleep(SUGGESTED_TIMEOUT)
+            end
+          end
+        end
+
+        def send_event event
+          if ::Contrast::AGENT.disabled?
+            logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
+            return
+          end
+
+          return unless cs__class.enabled?
+
+          logger.debug('Enqueued event for sending', event_type: event.cs__class)
+          queue << event if event
+        end
+
+        def delete_queue!
+          @_queue&.clear
+          @_queue&.close
+          @_queue = nil
+        end
+
+        def stop!
+          return unless running?
+
+          @_enabled = false
+          delete_queue!
+          super
+        end
+
+        def request_with_response event
+          res = client.send_request event, connection
+          client.handle_response res
+        end
+
+        private
+
+        def queue
+          @_queue ||= Queue.new
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/event.rb

@@ -0,0 +1,35 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/metrics_hash'
+
+module Contrast
+  module Agent
+    module Telemetry
+      # This class will hold the basic information for a Telemetry Event
+      class Event
+        include Contrast::Utils
+
+        attr_reader :tags
+
+        def initialize
+          @tags = MetricsHash.new(String)
+          @timestamp = Time.now.iso8601
+        end
+
+        def path
+          ''
+        end
+
+        def to_hash **_args
+          {
+              tags: @tags,
+              timestamp: @timestamp,
+              instance: Contrast::Agent::Telemetry::Base.instance_id,
+              application: Contrast::Agent::Telemetry::Base.application_id
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Telemetry
+      module TelemetryException
+        # This class will hold the all the mutual information for the Telemetry Exception
+        class Base
+          def to_controlled_hash; end
+
+          protected
+
+          # Validate required and option fields
+          #
+          # @param validations [Hash] Validation hash to use
+          # @return [nil]
+          def validate validations
+            validations.each do |k, v|
+              next if v[:required] == false
+
+              validate_field(validations[k], k)
+            end
+            nil
+          end
+
+          # This method will validate every single field passed from validate
+          #
+          # @param validation_pair [Hash] Validation hash to use
+          # @param key[String] The key to check in VALIDATIONS
+          def validate_field validation_pair, key
+            value_to_validate = send(key.to_sym)
+            validate_class(value_to_validate, validation_pair[:class], key) if validation_pair.key?(:class)
+            value_length = if value_to_validate.cs__is_a?(String) || value_to_validate.cs__is_a?(Array)
+                             value_to_validate.length
+                           else
+                             value_to_validate.entries.length
+                           end
+            unless validation_pair[:range].include?(value_length)
+              raise ArgumentError, "The provided value for #{ key } is invalid: #{ value_to_validate }"
+            end
+
+            nil
+          end
+
+          # With the all nested classes, we still need to double check if everything passed along the way
+          # is right
+          # @param message [Object] The message we want to check the class of
+          # @param klass [Class] The klass we want to check the message with
+          # @param field [Object] The field with the error
+          def validate_class message, klass, field
+            message = message[0] if message.cs__is_a?(Array)
+            raise ArgumentError, "The provided value for #{ field } is of wrong class" unless message.cs__is_a? klass
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require_relative 'telemetry_exception_base'
+require_relative 'telemetry_exception_message'
+
+module Contrast
+  module Agent
+    module Telemetry
+      module TelemetryException
+        # This class will hold the basic information for a Parent Telemetry Exception Event
+        class Event < Contrast::Agent::Telemetry::TelemetryException::Base
+          # Array of Telemetry Exceptions
+          # @return [Array<Contrast::Agent::Telemetry::TelemetryException::Message>]
+          attr_reader :exceptions
+
+          # Initialization of the Parent Event requires us to require the exception
+          # to be created
+          #
+          # @param message [Contrast::Agent::Telemetry::TelemetryException::Message]
+          def initialize message
+            super()
+            validate_class(message, Contrast::Agent::Telemetry::TelemetryException::Message, 'exception_message')
+            @exceptions = Array.new(1, message)
+          end
+
+          # @param message [Contrast::Agent::Telemetry::TelemetryException::Message]
+          def push message
+            validate_class(message, Contrast::Agent::Telemetry::TelemetryException::Message, 'exception_message')
+            @exceptions << message
+          end
+
+          def self.path
+            '/ruby/runtime'
+          end
+
+          def to_controlled_hash
+            exceptions.map(&:to_controlled_hash)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb

@@ -0,0 +1,115 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require_relative 'telemetry_exception_base'
+require_relative 'telemetry_exception_message_exception'
+require 'contrast/utils/telemetry_identifier'
+
+module Contrast
+  module Agent
+    module Telemetry
+      module TelemetryException
+        # This class will hold the all the information for the specific exceptions
+        # and will be passed in the the event to be sent to TS
+        class Message < Contrast::Agent::Telemetry::TelemetryException::Base
+          VALIDATIONS = {
+              instance: { required: true, range: 12..64 },
+              tags: { required: true, range: 0..512 },
+              logger: { required: false, range: 1..128 },
+              message: { required: false, range: 1..512 },
+              exceptions: {
+                  required: true,
+                  range: 1..512,
+                  class: Contrast::Agent::Telemetry::TelemetryException::MessageException
+              }
+          }.cs__freeze
+
+          # Timestamp of creation in ISO8601 format
+          # @return [Integer]
+          attr_reader :timestamp
+
+          # An Instance ID as defined in Unique Identification // Application ID
+          # @return [String]
+          attr_reader :instance
+
+          # Tags are key-value string pairs that annotate either metrics
+          # or errors to help provide context, filtering, grouping, and deduplication.
+          # @return [Hash{String => String}]
+          attr_reader :tags
+
+          # @return [Integer] A number of the occurrences of the exception
+          attr_accessor :occurrences
+
+          # Array of exceptions, but in our case the Array will only include one exception
+          # @return [Array<Contrast::Agent::Telemetry::TelemetryException::MessageException>]
+          attr_reader :exceptions
+
+          # @return [String,nil] A string denoting the origin of this error.
+          attr_reader :logger
+
+          # @return [String | nil] A string message to provide additional context to the errors.
+          attr_reader :message
+
+          def initialize instance, tags, exceptions
+            super()
+            @tags = tags
+            @timestamp = Time.now.iso8601
+            @instance = instance
+            @occurrences = 1
+            @exceptions = exceptions
+            validate(VALIDATIONS)
+          end
+
+          # Optional parameters will be set separately from the required
+          #
+          # @param logger[String]
+          def logger= logger
+            validate_field(VALIDATIONS[:logger], 'logger')
+            @logger = logger
+          end
+
+          # Optional parameters will be set separately from the required
+          #
+          # @param message[String]
+          def message= message
+            validate_field(VALIDATIONS[:message], 'message')
+            @message = message
+          end
+
+          # Optional parameters will be set separately from the required
+          # This method is different and is regarding the way we proceed
+          # with incrementing occurrences
+          # If we keep track of them in different places and we store that value
+          # in separated variable - we may directly re-assign occurrences=
+          # But if we are not doing that - we may on same message generated
+          # to increment occurrences from here
+          def increment_occurrences
+            @occurrences += 1
+          end
+
+          def to_controlled_hash
+            super()
+            {
+                timestamp: timestamp,
+                instance: instance,
+                occurrences: occurrences,
+                tags: tags,
+                exceptions: exceptions.map(&:to_controlled_hash),
+                logger: logger,
+                message: message
+            }.compact
+          end
+
+          class << self
+            def build tags, exceptions, logger = nil, message = nil
+              inst = new(Contrast::Utils::Telemetry::Identifier.instance_id, tags, exceptions)
+              inst.logger = logger unless logger.nil?
+              inst.message = message unless message.nil?
+              inst
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb

@@ -0,0 +1,83 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require_relative 'telemetry_exception_base'
+require_relative 'telemetry_exception_stack_frame'
+
+module Contrast
+  module Agent
+    module Telemetry
+      module TelemetryException
+        # This class will hold the all the information for the specific exception
+        # and will be passed in the Exception message itself
+        class MessageException < Contrast::Agent::Telemetry::TelemetryException::Base
+          VALIDATIONS = {
+              type: { required: true, range: 1..256 },
+              module_name: { required: false, range: 1..256 },
+              value: { required: false, range: 1..256 },
+              stack_frames: {
+                  required: true,
+                  range: 1..128,
+                  class: Contrast::Agent::Telemetry::TelemetryException::StackFrame
+              }
+          }.cs__freeze
+
+          # @return [String] The type of the exception itself
+          attr_reader :type
+
+          # stack frames for the message exception
+          # @return [Array<Contrast::Agent::Telemetry::TelemetryException::StackFrame>]
+          attr_reader :stack_frames
+
+          # @return [String]
+          attr_reader :module_name
+
+          # @return [String]
+          attr_reader :value
+
+          def initialize type, stack_frame
+            super()
+            @type = type
+            @stack_frames = Array.new(1, stack_frame)
+            validate VALIDATIONS
+          end
+
+          # @param stack_frame [Contrast::Agent::Telemetry::TelemetryException::StackFrame]
+          def push stack_frame
+            validate_class(stack_frame, Contrast::Agent::Telemetry::TelemetryException::StackFrame, 'stack_frame')
+            @stack_frames << stack_frame
+          end
+
+          def module_name= module_name
+            @module_name = module_name
+            validate_field(VALIDATIONS[:module_name], 'module_name')
+          end
+
+          def value= value
+            @value = value
+            validate_field(VALIDATIONS[:value], 'value')
+          end
+
+          def to_controlled_hash
+            super
+            {
+                type: type,
+                module: module_name,
+                stackFrames: stack_frames.map(&:to_controlled_hash),
+                value: value
+            }.compact
+          end
+
+          class << self
+            def build type, value, module_name, stackframes
+              inst = new(type, stackframes)
+              inst.module_name = module_name if module_name
+              inst.value = value
+              inst
+            end
+          end
+        end
+      end
+    end
+  end
+end