contrast-agent 5.3.0 → 6.0.0

data/lib/contrast/config/request_audit_configuration.rb

@@ -8,76 +8,34 @@ module Contrast
     class RequestAuditConfiguration < BaseConfiguration
       DEFAULT_PATH = './messages'
 
+      attr_writer :enable, :requests, :responses, :path
+
       def initialize hsh = {}
         @enable = traverse_config(hsh, :enable)
         @requests = traverse_config(hsh, :requests)
         @responses = traverse_config(hsh, :responses)
         @path = traverse_config(hsh, :path)
-        @configuration_map = {}
-        build_configuration_map
       end
 
+      # @return [Boolean, false]
       def enable
         @enable.nil? ? false : @enable
       end
 
+      # @return [Boolean, false]
       def requests
         @requests.nil? ? false : @requests
       end
 
+      # @return [Boolean, false]
       def responses
         @responses.nil? ? false : @responses
       end
 
+      # @return [String, ::DEFAULT_PATH]
       def path
         @path.nil? ? DEFAULT_PATH : @path
       end
-
-      def enable= value
-        self['enable'] = value
-      end
-
-      def requests= value
-        self['requests'] = value
-      end
-
-      def responses= value
-        self['responses'] = value
-      end
-
-      def path= value
-        self['path'] = value
-      end
-
-      # TODO: RUBY-1493 MOVE TO BASE CONFIG
-
-      def []= key, value
-        instance_variable_set("@#{ key }".to_sym, value)
-        @configuration_map[key] = value
-      end
-
-      # Traverse the given entity to build out the configuration graph.
-      #
-      # The values will be either a hash, indicating internal nodes to
-      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
-      # leaf node.
-      #
-      # The spec_key are the Contrast defined keys based on the instance variables of
-      # a given configuration.
-      def traverse_config values, spec_key
-        internal_nodes = values.cs__respond_to?(:has_key?)
-        val = internal_nodes ? value_from_key_config(spec_key, values) : nil
-        val == EMPTY_VALUE ? nil : val
-      end
-
-      def build_configuration_map
-        instance_variables.each do |key|
-          str_key = key.to_s.tr('@', '')
-          next if str_key == 'configuration_map'
-
-          @configuration_map[str_key] = send(str_key.to_sym)
-        end
-      end
     end
   end
 end

data/lib/contrast/config/root_configuration.rb

@@ -5,22 +5,62 @@ module Contrast
   module Config
     # The base of the Common Configuration settings.
     class RootConfiguration < BaseConfiguration
-      KEYS = {
-          api: Contrast::Config::ApiConfiguration,
-          enable: BaseConfiguration::EMPTY_VALUE,
-          agent: Contrast::Config::AgentConfiguration,
-          application: Contrast::Config::ApplicationConfiguration,
-          server: Contrast::Config::ServerConfiguration,
-          assess: Contrast::Config::AssessConfiguration,
-          inventory: Contrast::Config::InventoryConfiguration,
-          protect: Contrast::Config::ProtectConfiguration,
-          service: Contrast::Config::ServiceConfiguration
-      }.cs__freeze
+      attr_writer :api, :agent, :application, :server, :assess, :inventory, :protect, :service
+      # @return [Boolean, nil]
+      attr_accessor :enable
 
       def initialize hsh = {}
         raise ArgumentError, 'Expected a hash' unless hsh.is_a?(Hash)
 
-        super(hsh, KEYS)
+        @api = Contrast::Config::ApiConfiguration.new(traverse_config(hsh, :api))
+        @enable = traverse_config(hsh, :enable)
+        @agent = Contrast::Config::AgentConfiguration.new(traverse_config(hsh, :agent))
+        @application = Contrast::Config::ApplicationConfiguration.new(traverse_config(hsh, :application))
+        @server = Contrast::Config::ServerConfiguration.new(traverse_config(hsh, :server))
+        @assess = Contrast::Config::AssessConfiguration.new(traverse_config(hsh, :assess))
+        @inventory = Contrast::Config::InventoryConfiguration.new(traverse_config(hsh, :inventory))
+        @protect = Contrast::Config::ProtectConfiguration.new(traverse_config(hsh, :protect))
+        @service = Contrast::Config::ServiceConfiguration.new(traverse_config(hsh, :service))
+      end
+
+      # @return [Contrast::Config::ApiConfiguration]
+      def api
+        @api ||= Contrast::Config::ApiConfiguration.new
+      end
+
+      # @return [Contrast::Config::AgentConfiguration]
+      def agent
+        @agent ||= Contrast::Config::AgentConfiguration.new
+      end
+
+      # @return [Contrast::Config::ApplicationConfiguration]
+      def application
+        @application ||= Contrast::Config::ApplicationConfiguration.new
+      end
+
+      # @return [Contrast::Config::ServerConfiguration]
+      def server
+        @server ||= Contrast::Config::ServerConfiguration.new
+      end
+
+      # @return [Contrast::Config::AssessConfiguration]
+      def assess
+        @assess ||= Contrast::Config::AssessConfiguration.new
+      end
+
+      # @return [Contrast::Config::InventoryConfiguration]
+      def inventory
+        @inventory ||= Contrast::Config::InventoryConfiguration.new
+      end
+
+      # @return [Contrast::Config::ProtectConfiguration]
+      def protect
+        @protect ||= Contrast::Config::ProtectConfiguration.new
+      end
+
+      # @return [Contrast::Config::ServiceConfiguration]
+      def service
+        @service ||= Contrast::Config::ServiceConfiguration.new
       end
     end
   end

data/lib/contrast/config/ruby_configuration.rb

@@ -31,8 +31,6 @@ module Contrast
         @track_frozen_sources = traverse_config(hsh, :track_frozen_sources)
         @non_request_tracking = traverse_config(hsh, :non_request_tracking)
         @uninstrument_namespace = traverse_config(hsh, :uninstrument_namespace)
-        @configuration_map = {}
-        build_configuration_map
       end
 
       # These commands being detected will result the agent disabling instrumentation, generally any command
@@ -82,40 +80,6 @@ module Contrast
       def uninstrument_namespace
         @uninstrument_namespace.nil? ? DEFAULT_UNINSTRUMENTED_NAMESPACES : @uninstrument_namespace
       end
-
-      # TODO: RUBY-1493 MOVE TO BASE CONFIG
-
-      def []= key, value
-        instance_variable_set("@#{ key }".to_sym, value)
-        @configuration_map[key] = value
-      end
-
-      def [] key
-        send(key.to_sym)
-      end
-
-      # Traverse the given entity to build out the configuration graph.
-      #
-      # The values will be either a hash, indicating internal nodes to
-      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
-      # leaf node.
-      #
-      # The spec_key are the Contrast defined keys based on the instance variables of
-      # a given configuration.
-      def traverse_config values, spec_key
-        internal_nodes = values.cs__respond_to?(:has_key?)
-        val = internal_nodes ? value_from_key_config(spec_key, values) : nil
-        val == EMPTY_VALUE ? nil : val
-      end
-
-      def build_configuration_map
-        instance_variables.each do |key|
-          str_key = key.to_s.tr('@', '')
-          next if str_key == 'configuration_map'
-
-          @configuration_map[str_key] = send(str_key.to_sym)
-        end
-      end
     end
   end
 end

data/lib/contrast/config/sampling_configuration.rb

@@ -21,67 +21,11 @@ module Contrast
         @request_frequency = traverse_config(hsh, :request_frequency)
         @response_frequency = traverse_config(hsh, :response_frequency)
         @window_ms = traverse_config(hsh, :window_ms)
-        @configuration_map = {}
-        build_configuration_map
       end
 
       # @return [Boolean, false]
       def enable
-        @enable.nil? ? false : @enable
-      end
-
-      def enable= value
-        self['enable'] = value
-      end
-
-      def baseline= value
-        self['baseline'] = value
-      end
-
-      def request_frequency= value
-        self['request_frequency'] = value
-      end
-
-      def response_frequency= value
-        self['response_frequency'] = value
-      end
-
-      def window_ms= value
-        self['window_ms'] = value
-      end
-
-      # TODO: RUBY-1493 MOVE TO BASE CONFIG
-
-      def []= key, value
-        instance_variable_set("@#{ key }".to_sym, value)
-        @configuration_map[key] = value
-      end
-
-      def [] key
-        send(key.to_sym)
-      end
-
-      # Traverse the given entity to build out the configuration graph.
-      #
-      # The values will be either a hash, indicating internal nodes to
-      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
-      # leaf node.
-      #
-      # The spec_key are the Contrast defined keys based on the instance variables of
-      # a given configuration.
-      def traverse_config values, spec_key
-        internal_nodes = values.cs__respond_to?(:has_key?)
-        val = internal_nodes ? value_from_key_config(spec_key, values) : nil
-        val == EMPTY_VALUE ? nil : val
-      end
-
-      def build_configuration_map
-        instance_variables.each do |key|
-          str_key = key.to_s.tr('@', '')
-          next if str_key == 'configuration_map'
-
-          @configuration_map[str_key] = send(str_key.to_sym)
-        end
+        !!@enable
       end
     end
   end

data/lib/contrast/config/server_configuration.rb

@@ -26,42 +26,6 @@ module Contrast
         @tags = traverse_config(hsh, :tags)
         @environment = traverse_config(hsh, :environment)
         @version = traverse_config(hsh, :version)
-        @configuration_map = {}
-        build_configuration_map
-      end
-
-      # TODO: RUBY-1493 MOVE TO BASE CONFIG
-
-      def []= key, value
-        instance_variable_set("@#{ key }".to_sym, value)
-        @configuration_map[key] = value
-      end
-
-      def [] key
-        send(key.to_sym)
-      end
-
-      # Traverse the given entity to build out the configuration graph.
-      #
-      # The values will be either a hash, indicating internal nodes to
-      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
-      # leaf node.
-      #
-      # The spec_key are the Contrast defined keys based on the instance variables of
-      # a given configuration.
-      def traverse_config values, spec_key
-        internal_nodes = values.cs__respond_to?(:has_key?)
-        val = internal_nodes ? value_from_key_config(spec_key, values) : nil
-        val == EMPTY_VALUE ? nil : val
-      end
-
-      def build_configuration_map
-        instance_variables.each do |key|
-          str_key = key.to_s.tr('@', '')
-          next if str_key == 'configuration_map'
-
-          @configuration_map[str_key] = send(str_key.to_sym)
-        end
       end
     end
   end

data/lib/contrast/config/service_configuration.rb

@@ -10,16 +10,18 @@ module Contrast
     class ServiceConfiguration < BaseConfiguration
       # We don't set these b/c we've been asked to handle the default values of
       # these settings differently, logging when we have to use them.
-      DEFAULT_HOST       = '127.0.0.1'
+      DEFAULT_HOST       = '127.0.0.1' # rubocop:disable Style/IpAddresses
       DEFAULT_PORT       = '30555'
 
-      attr_writer :enable, :logger, :bypass
+      attr_writer :logger, :bypass
       # @return [String, nil]
       attr_accessor :socket
       # @return [String, nil]
       attr_accessor :port
       # @return [String, nil]
       attr_accessor :host
+      # @return [Boolean, nil]
+      attr_accessor :enable
 
       def initialize hsh = {}
         @enable = traverse_config(hsh, :enable)
@@ -28,13 +30,6 @@ module Contrast
         @socket = traverse_config(hsh, :socket)
         @logger = Contrast::Config::LoggerConfiguration.new(traverse_config(hsh, :logger))
         @bypass = traverse_config(hsh, :bypass)
-        @configuration_map = {}
-        build_configuration_map
-      end
-
-      # @return [Boolean, false]
-      def enable
-        !!@enable
       end
 
       # @return [Contrast::Config::LoggerConfiguration]
@@ -44,41 +39,7 @@ module Contrast
 
       # @return [Boolean, false]
       def bypass
-        !!@bypass
-      end
-
-      # TODO: RUBY-1493 MOVE TO BASE CONFIG
-
-      def []= key, value
-        instance_variable_set("@#{ key }".to_sym, value)
-        @configuration_map[key] = value
-      end
-
-      def [] key
-        send(key.to_sym)
-      end
-
-      # Traverse the given entity to build out the configuration graph.
-      #
-      # The values will be either a hash, indicating internal nodes to
-      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
-      # leaf node.
-      #
-      # The spec_key are the Contrast defined keys based on the instance variables of
-      # a given configuration.
-      def traverse_config values, spec_key
-        internal_nodes = values.cs__respond_to?(:has_key?)
-        val = internal_nodes ? value_from_key_config(spec_key, values) : nil
-        val == EMPTY_VALUE ? nil : val
-      end
-
-      def build_configuration_map
-        instance_variables.each do |key|
-          str_key = key.to_s.tr('@', '')
-          next if str_key == 'configuration_map'
-
-          @configuration_map[str_key] = send(str_key.to_sym)
-        end
+        @bypass.nil? ? false : @bypass
       end
     end
   end

data/lib/contrast/configuration.rb

@@ -221,9 +221,8 @@ module Contrast
         convert.to_hash.each_key do |key|
           next if Contrast::Utils::ExcludeKey.excludable?(key.to_s)
 
-          # keys can contain '-' but methods getters cannot
-          # clean_key = key.to_s.tr('-', '_')
-          hash[key] = convert_to_hash(convert.send(key.to_sym), {})
+          # change '-' to '_' for ProtectRulesConfiguration
+          hash[key] = convert_to_hash(convert.send(key.tr('-', '_').to_sym), {})
         end
         hash
       else

data/lib/contrast/extension/assess/string.rb

@@ -13,7 +13,7 @@ module Contrast
       # methods which are too complex to fit into one of the standard
       # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
       # String Class or exposing our methods there.
-      class StringPropagator # rubocop:disable Style/StaticClass
+      class StringPropagator
         extend Contrast::Components::Logger::InstanceMethods
         extend Contrast::Components::Scope::InstanceMethods
 
@@ -43,6 +43,7 @@ module Contrast
               offset = 0
               inputs.each do |input|
                 properties.copy_from(input, result, offset)
+                add_dynamic_sources_info input, result
                 offset += input.length
                 parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
                 parent_events << parent_event if parent_event
@@ -58,6 +59,24 @@ module Contrast
           rescue StandardError => e
             logger.error('Unable to track interpolation', e)
           end
+
+          private
+
+          # When there is a string interpolation on input coming from tainted database,
+          # the Contrast::Agent::Assess::Properties::Updated.copy_from method won't copy
+          # the dynamic source properties needed in the build findings from TS to display
+          # the column and Table information as database source information.
+          #
+          # @param source [Object] the source object with the required properties.
+          # @param target [Object] the result form the interpolation and the object
+          # that needs to keep the source properties, in order to be reporter on
+          # trigger event.
+          # @return updated_properties [Hash<DynamicSourceInfo>, nil]
+          def add_dynamic_sources_info source, target
+            return unless (dynamic_props = Contrast::Agent::Assess::Tracker.properties(source)&.properties)
+
+            Contrast::Agent::Assess::Tracker.properties(target)&.add_properties(dynamic_props)
+          end
         end
       end
     end

data/lib/contrast/extension/module.rb

@@ -13,5 +13,4 @@ class Module
   alias_method :cs__const_defined?, :const_defined?
   alias_method :cs__const_get, :const_get
   alias_method :cs__const_set, :const_set
-  alias_method :cs__autoload?, :autoload?
 end

data/lib/contrast/framework/manager.rb

@@ -125,7 +125,7 @@ module Contrast
       # @return [Contrast::Api::Dtm::RouteCoverage] the current route as a Dtm.
       def get_route_dtm request
         @_frameworks.lazy.map { |framework_support| framework_support.current_route(request) }.
-            reject(&:nil?).first
+            reject(&:nil?).first # rubocop:disable Style/CollectionCompact
       end
 
       # Iterate through current frameworks and return the current request's route. This will be the first non-nil
@@ -135,7 +135,7 @@ module Contrast
       # @return [Contrast::Agent::Reporting::RouteCoverage] the current route as a Dtm.
       def get_route_information request
         @_frameworks.lazy.map { |framework_support| framework_support.current_route_coverage(request) }.
-            reject(&:nil?).first
+            reject(&:nil?).first # rubocop:disable Style/CollectionCompact
       end
 
       # Sometimes the framework we want to instrument is loaded after our agent code. To catch that case, we'll detect

data/lib/contrast/logger/application.rb

@@ -19,7 +19,7 @@ module Contrast
           env_key = env_key.to_s
           next unless ENV_KEYS.include?(env_key) ||
               (env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) &&
-                  !env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER + 'API'))
+                  !env_key.start_with?("#{ Contrast::Components::Config::CONTRAST_ENV_MARKER }API"))
 
           info('Environment settings', key: env_key, value: env_value)
         end

data/lib/contrast/logger/cef_log.rb

@@ -142,7 +142,7 @@ module Contrast
                                    "as suspicious using #{ rule_id } - #{ input_value }"
           log [suspicious_attack_with, rule_id, outcome], ::Logger::WARN
         elsif input_value.present?
-          suspicious_attack_without = 'Suspicious activity indicates a potential attack using ' + rule_id.to_s
+          suspicious_attack_without = "Suspicious activity indicates a potential attack using #{ rule_id }"
           log [suspicious_attack_without, rule_id, outcome], ::Logger::WARN
         end
       end

data/lib/contrast/tasks/config.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 require 'yaml'
+require 'contrast/configuration'
+require 'contrast/agent/reporting/reporter'
 
 module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings
@@ -29,6 +31,8 @@ module Contrast
         }
     }.cs__freeze
 
+    SKIP_LOG = %w[service_key api_key].cs__freeze
+
     namespace :contrast do
       namespace :config do
         desc 'Create a contrast_security.yaml in the applications root directory'
@@ -38,9 +42,7 @@ module Contrast
           if File.exist?(target_path)
             puts 'WARNING: contrast_security.yaml already exists'
           else
-            File.open(target_path, 'w') do |f|
-              f.write(YAML.dump(DEFAULT_CONFIG))
-            end
+            File.write(target_path, YAML.dump(DEFAULT_CONFIG))
 
             puts "Created contrast_security.yaml at #{ target_path }"
             puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
@@ -49,5 +51,90 @@ module Contrast
         end
       end
     end
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Validate the provided Contrast configuration and confirm connectivity'
+        task validate: :environment do
+          puts 'Validating Agent Configuration...'
+          Contrast::Config.validate_config
+          puts '...done!'
+          puts 'Validating Contrast Reporter Headers...'
+          reporter = Contrast::Config.validate_headers
+          puts '...done!'
+          puts 'Testing Client Connection...'
+          Contrast::Config.test_connection(reporter) if reporter
+          puts '...done!'
+        end
+      end
+      def self.validate_config # rubocop:disable Metrics/PerceivedComplexity
+        config = Contrast::Configuration.new
+        abort('Unable to Build Config') unless config
+
+        required = %i[url api_key service_key user_name]
+
+        missing = []
+        config.root.api.each do |key, value|
+          puts "#{ key }::#{ value }" unless value.is_a?(Contrast::Config::BaseConfiguration) || SKIP_LOG.includes?(key)
+          if value.is_a?(Contrast::Config::ApiProxyConfiguration)
+            Contrast::Config.validate_proxy(value)
+          elsif value.is_a?(Contrast::Config::CertificationConfiguration)
+            Contrast::Config.validate_cert(value)
+            next
+          elsif value.is_a?(Contrast::Config::RequestAuditConfiguration)
+            Contrast::Config.validate_audit(value)
+            next
+          elsif value == Contrast::Config::BaseConfiguration::EMPTY_VALUE && required.includes?(key.to_sym)
+            missing << key
+          end
+        end
+        abort("Missing required API configuration values: #{ missing.join(', ') }") unless missing.empty?
+      end
+
+      def self.validate_proxy config
+        puts "Proxy Enabled: #{ config.enable }"
+        return unless config.enable
+
+        puts "Proxy URL: #{ config.url }"
+        abort('Proxy Enabled but no Proxy URL given') unless config.url
+      end
+
+      def self.validate_cert config
+        puts "Certification Enabled: #{ config.enable }"
+        return unless config.enable
+
+        puts "CA File: #{ config.ca_file }"
+        abort('CA file path not provided') unless config.ca_file
+        puts "Cert File: #{ config.cert_file }"
+        abort('Cert file path not provided') unless config.cert_file
+        puts "Key File: #{ config.key_file }"
+        abort('Key file path not provided') unless config.key_file
+      end
+
+      def self.validate_audit config
+        puts "Request Audit Enabled: #{ config.enable }"
+        return unless config.enable
+
+        config.each do |k, v|
+          puts "#{ k }::#{ v }"
+        end
+      end
+
+      def self.validate_headers
+        missing = []
+        reporter = Contrast::Agent::Reporter.new
+        reporter.client.headers.to_hash.each_pair do |key, value|
+          puts "#{ key }::#{ value }"
+          missing << key if value.nil?
+        end
+        abort("Missing required header values: #{ missing.join(', ') }") unless missing.empty?
+        reporter
+      end
+
+      def self.test_connection reporter
+        abort('Failed to Initialize Connection please check error logs for details') unless reporter.connection
+        abort('Failed to Start Client please check error logs for details') unless reporter.client.startup!
+      end
+    end
   end
 end

data/lib/contrast/utils/assess/object_store.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # keep track of object properties and events data
+      class ObjectStore
+        def initialize capacity = 500
+          @capacity = capacity
+          @cache = {}
+        end
+
+        def get
+          @cache
+        end
+
+        def [] key
+          @cache[key]
+        end
+
+        def delete key
+          @cache.delete(key)
+        end
+
+        # We would keep object ids with capacity.
+        # If a reference is kept to an object only by it's id,
+        # It would be CG-ted safely.
+        def []= key, value
+          @cache[key] = value
+          @cache.shift if @cache.length > @capacity
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/propagation_method_utils.rb

@@ -10,6 +10,7 @@ module Contrast
         APPEND_ACTION = 'APPEND'
         CENTER_ACTION = 'CENTER'
         INSERT_ACTION = 'INSERT'
+        BUFFER_ACTION = 'BUFFER'
         KEEP_ACTION = 'KEEP'
         NEXT_ACTION = 'NEXT'
         NOOP_ACTION = 'NOOP'
@@ -30,6 +31,7 @@ module Contrast
             INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
             KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
             NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
+            BUFFER_ACTION => Contrast::Agent::Assess::Policy::Propagator::Buffer,
             NOOP_ACTION => nil,
             PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
             REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
@@ -94,6 +96,10 @@ module Contrast
         def can_propagate? propagation_node, preshift, target
           return false unless appropriate_target?(propagation_node, target)
           return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
+          if propagation_node.use_original_object?
+            # return true since we don't have preshift while using the original object.
+            return true
+          end
           return false unless preshift
 
           propagation_node.sources.each do |source|