contrast-agent 6.0.0 → 6.1.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.0.0
+  version: 6.1.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-04-04 00:00:00.000000000 Z
+date: 2022-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -631,20 +631,22 @@ executables:
 - contrast_service
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_hash/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__assess_string_interpolation26/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
-- ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_test/extconf.rb
 - ext/cs__os_information/extconf.rb
 - ext/cs__assess_yield_track/extconf.rb
-- ext/cs__assess_string/extconf.rb
-- ext/cs__assess_hash/extconf.rb
-- ext/cs__scope/extconf.rb
 - ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_module/extconf.rb
+- ext/cs__assess_string_interpolation26/extconf.rb
 - ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_fiber_track/extconf.rb
+- ext/cs__scope/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_string/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
+- ext/cs__tests/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -690,6 +692,9 @@ files:
 - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c
 - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h
 - ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_test/cs__assess_test.h
+- ext/cs__assess_test/cs__assess_tests.c
+- ext/cs__assess_test/extconf.rb
 - ext/cs__assess_yield_track/cs__assess_yield_track.c
 - ext/cs__assess_yield_track/cs__assess_yield_track.h
 - ext/cs__assess_yield_track/extconf.rb
@@ -705,6 +710,9 @@ files:
 - ext/cs__scope/cs__scope.c
 - ext/cs__scope/cs__scope.h
 - ext/cs__scope/extconf.rb
+- ext/cs__tests/cs__tests.c
+- ext/cs__tests/cs__tests.h
+- ext/cs__tests/extconf.rb
 - ext/extconf_common.rb
 - funchook/LICENSE
 - funchook/Makefile.in
@@ -992,8 +1000,17 @@ files:
 - lib/contrast/agent/reporting/masker/masker_utils.rb
 - lib/contrast/agent/reporting/report.rb
 - lib/contrast/agent/reporting/reporter.rb
+- lib/contrast/agent/reporting/reporter_heartbeat.rb
 - lib/contrast/agent/reporting/reporting_events/agent_startup.rb
+- lib/contrast/agent/reporting/reporting_events/application_activity.rb
+- lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb
+- lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb
+- lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb
+- lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity.rb
+- lib/contrast/agent/reporting/reporting_events/application_defend_attacker_activity.rb
 - lib/contrast/agent/reporting/reporting_events/application_inventory.rb
+- lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb
+- lib/contrast/agent/reporting/reporting_events/application_reporting_event.rb
 - lib/contrast/agent/reporting/reporting_events/application_startup.rb
 - lib/contrast/agent/reporting/reporting_events/application_startup_instrumentation.rb
 - lib/contrast/agent/reporting/reporting_events/application_update.rb
@@ -1021,8 +1038,10 @@ files:
 - lib/contrast/agent/reporting/reporting_events/route_discovery.rb
 - lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb
 - lib/contrast/agent/reporting/reporting_events/server_activity.rb
+- lib/contrast/agent/reporting/reporting_events/server_reporting_event.rb
 - lib/contrast/agent/reporting/reporting_events/trace_event_source.rb
 - lib/contrast/agent/reporting/reporting_utilities/audit.rb
+- lib/contrast/agent/reporting/reporting_utilities/build_preflight.rb
 - lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb
 - lib/contrast/agent/reporting/reporting_utilities/endpoints.rb
 - lib/contrast/agent/reporting/reporting_utilities/headers.rb
@@ -1054,15 +1073,17 @@ files:
 - lib/contrast/agent/scope.rb
 - lib/contrast/agent/service_heartbeat.rb
 - lib/contrast/agent/static_analysis.rb
+- lib/contrast/agent/telemetry/base.rb
+- lib/contrast/agent/telemetry/events/event.rb
 - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb
 - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb
 - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb
 - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb
 - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb
-- lib/contrast/agent/telemetry/events/metric_telemetry_event.rb
-- lib/contrast/agent/telemetry/events/startup_metrics_telemetry_event.rb
-- lib/contrast/agent/telemetry/events/telemetry_event.rb
-- lib/contrast/agent/telemetry/telemetry.rb
+- lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb
+- lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb
+- lib/contrast/agent/telemetry/events/metric_event.rb
+- lib/contrast/agent/telemetry/events/startup_metrics_event.rb
 - lib/contrast/agent/thread.rb
 - lib/contrast/agent/thread_watcher.rb
 - lib/contrast/agent/tracepoint_hook.rb
@@ -1081,6 +1102,7 @@ files:
 - lib/contrast/api/communication/tcp_socket.rb
 - lib/contrast/api/communication/unix_socket.rb
 - lib/contrast/api/decorators.rb
+- lib/contrast/api/decorators/activity.rb
 - lib/contrast/api/decorators/address.rb
 - lib/contrast/api/decorators/agent_startup.rb
 - lib/contrast/api/decorators/application_settings.rb
@@ -1182,6 +1204,7 @@ files:
 - lib/contrast/framework/rails/support.rb
 - lib/contrast/framework/sinatra/support.rb
 - lib/contrast/funchook/funchook.rb
+- lib/contrast/logger/aliased_logging.rb
 - lib/contrast/logger/application.rb
 - lib/contrast/logger/cef_log.rb
 - lib/contrast/logger/format.rb
@@ -1202,7 +1225,6 @@ files:
 - lib/contrast/utils/class_util.rb
 - lib/contrast/utils/duck_utils.rb
 - lib/contrast/utils/env_configuration_item.rb
-- lib/contrast/utils/exclude_key.rb
 - lib/contrast/utils/findings.rb
 - lib/contrast/utils/hash_digest.rb
 - lib/contrast/utils/hash_digest_extend.rb
@@ -1231,6 +1253,7 @@ files:
 - lib/contrast/utils/tag_util.rb
 - lib/contrast/utils/telemetry.rb
 - lib/contrast/utils/telemetry_client.rb
+- lib/contrast/utils/telemetry_hash.rb
 - lib/contrast/utils/telemetry_identifier.rb
 - lib/contrast/utils/thread_tracker.rb
 - lib/contrast/utils/timer.rb
@@ -1250,7 +1273,7 @@ homepage: https://www.contrastsecurity.com
 licenses:
 - CONTRAST SECURITY (see license file)
 metadata:
-  changelog_uri: https://docs.contrastsecurity.com/release.html
+  changelog_uri: https://docs.contrastsecurity.com/en/ruby-agent-release-notes-and-archive.html
   support_uri: https://support.contrastsecurity.com
   trouble_shooting_uri: https://support.contrastsecurity.com/hc/en-us/search?utf8=%E2%9C%93&query=Ruby
   wiki_uri: https://docs.contrastsecurity.com/

data/lib/contrast/agent/telemetry/events/metric_telemetry_event.rb

@@ -1,26 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/metrics_hash'
-require 'contrast/agent/telemetry/events/telemetry_event'
-
-module Contrast
-  module Agent
-    # This class will hold the basic information for a Telemetry Event
-    class MetricTelemetryEvent < Contrast::Agent::TelemetryEvent
-      include Contrast::Utils
-
-      attr_reader :fields
-
-      def initialize
-        super
-        @fields = MetricsHash.new(Numeric)
-        @fields['_filler'] = 0
-      end
-
-      def to_hash **_args
-        super.merge!({ fields: @fields })
-      end
-    end
-  end
-end

data/lib/contrast/agent/telemetry/events/startup_metrics_telemetry_event.rb

@@ -1,121 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/metrics_hash'
-require 'contrast/agent/telemetry/events/metric_telemetry_event'
-require 'contrast/agent/version'
-require 'contrast/utils/os'
-
-module Contrast
-  module Agent
-    # This class will hold the Startup Metrics Telemetry Event
-    # The class will include initialization of the agent version, language version
-    # os type, arch and version
-    # application framework and version and server framework
-    # It will be initialized and send in Middleware#agent_startup_routine
-    class StartupMetricsTelemetryEvent < Contrast::Agent::MetricTelemetryEvent
-      include Contrast::Utils::OS
-
-      APP_AND_SERVER_DATA = ::Contrast::APP_CONTEXT.app_and_server_information.cs__freeze
-      # Multi-tenant Production Environments
-      SAAS_DEFAULT = { addr: 'app.contrastsecurity.com', type: 'SAAS_DEFAULT' }.cs__freeze
-      SAAS_CS = { addr: /cs[[:digit:]]+\.contrastsecurity\.com/, type: 'SAAS_DEFAULT' }.cs__freeze
-      SAAS_JP = { addr: 'app.contrastsecurity.jp', type: 'SAAS_DEFAULT' }.cs__freeze
-      SAAS_CE = { addr: 'ce.contrastsecurity.com', type: 'SAAS_CE' }.cs__freeze
-      # Multi-tenant Demo Environments
-      SAAS_DEMO = { addr: 'apptwo.contrastsecurity.com', type: 'SAAS_DEMO' }.cs__freeze
-      SAAS_POV = { addr: 'eval.contrastsecurity.com', type: 'SAAS_POV' }.cs__freeze
-      # Multi-tenant Testing Environment
-      SAAS_RESEARCH = { addr: 'security-research.contrastsecurity.com', type: 'SAAS_RESEARCH' }.cs__freeze
-      SAAS_ALPHA = { addr: 'alpha.contrastsecurity.com', type: 'SAAS_ALPHA' }.cs__freeze
-      SAAS_STAGING = { addr: 'teamserver-staging.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
-      SAAS_STAGING_TOKYO = { addr: 'teamserver-staging.contsec.jp', type: 'SAAS_TESTING' }.cs__freeze
-      SAAS_TESTING = { addr: 'teamserver-darpa.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
-      SAAS_OPS_TESTING = { addr: 'teamserver-ops.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
-      # Fallback for Single-tenant Production Environments
-      SAAS_CUSTOM = { addr: 'contrastsecurity.com', type: 'SAAS_CUSTOM' }.cs__freeze
-      SAAS_CUSTOM_JP = { addr: 'contrastsecurity.jp', type: 'SAAS_CUSTOM' }.cs__freeze
-
-      SINGLE_MAP_TENANTS = [
-        SAAS_DEFAULT, SAAS_JP, SAAS_CE, SAAS_DEMO, SAAS_POV, SAAS_RESEARCH, SAAS_ALPHA,
-        SAAS_STAGING, SAAS_STAGING_TOKYO, SAAS_TESTING, SAAS_OPS_TESTING
-      ].cs__freeze
-      REGEXP_MAP_TENANTS = [SAAS_CS].cs__freeze
-      FALLBACK_TENANTS = [SAAS_CUSTOM, SAAS_CUSTOM_JP].cs__freeze
-      # Fallback for Custom, most likely self-hosted, Environments
-      EOP = 'EOP'
-      REJECTED_VALUES = [:EMPTY_VALUE, 'NEEDS_TO_BE_SET', Contrast::Utils::ObjectShare::EMPTY_STRING].cs__freeze
-
-      def initialize
-        super
-        @settings = []
-        add_config_keys ::Contrast::CONFIG.root, 'root'
-        @settings << ENV.keys.select { |v| v.starts_with?('CONTRAST') }
-        @settings.flatten
-        add_tags
-      end
-
-      def path
-        '/startup'
-      end
-
-      def add_tags
-        add_system_tags
-        @tags['app_framework_and_version'] = APP_AND_SERVER_DATA[:application_info].to_s
-        @tags['server_framework_and_version'] = APP_AND_SERVER_DATA[:server_info].to_s
-        @tags['ASSESS'] = Contrast::ASSESS.enabled?.to_s
-        @tags['PROTECT'] = Contrast::PROTECT.enabled?.to_s
-        @tags['settings'] = @settings.join(',')
-      end
-
-      def add_config_keys config, nested_key
-        config.to_hash.reject! { |_k, v| REJECTED_VALUES.include?(v) }
-
-        config.to_hash.each do |k, v|
-          unless v.cs__class <= Contrast::Config::BaseConfiguration
-            @settings << "#{ nested_key }.#{ k }"
-            next
-          end
-
-          add_config_keys v, "#{ nested_key }.#{ k }"
-        end
-      end
-
-      def sys_info
-        @sys_info ||= get_system_information if @sys_info.nil?
-        @sys_info
-      end
-
-      private
-
-      # Here we extract the TeamServer url type
-      #
-      # @return [String] the type of TeamServer environment to which we're connecting
-      def teamserver_type
-        @_teamserver_type ||= begin
-          url = Contrast::API.api_url
-          if (single = SINGLE_MAP_TENANTS.find { |tenant| url.include?(tenant[:addr]) })
-            single[:type]
-          elsif (regexp = REGEXP_MAP_TENANTS.find { |tenant| tenant[:addr].match?(url) })
-            regexp[:type]
-          elsif (fallback = FALLBACK_TENANTS.find { |tenant| url.include?(tenant[:addr]) })
-            fallback[:type]
-          else
-            EOP
-          end
-        end
-      end
-
-      # Here we attach the key-value pairs of the system
-      #
-      def add_system_tags
-        @tags['teamserver'] = teamserver_type
-        @tags['agent_version'] = VERSION
-        @tags['ruby_version'] = RUBY_VERSION
-        @tags['os_type'] = sys_info['os_type'] == 'Darwin' ? 'MacOS' : 'Linux'
-        @tags['os_arch'] = sys_info['os_arch']
-        @tags['os_version'] = sys_info['os_version']
-      end
-    end
-  end
-end

data/lib/contrast/agent/telemetry/events/telemetry_event.rb

@@ -1,33 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/metrics_hash'
-
-module Contrast
-  module Agent
-    # This class will hold the basic information for a Telemetry Event
-    class TelemetryEvent
-      include Contrast::Utils
-
-      attr_reader :tags
-
-      def initialize
-        @tags = MetricsHash.new(String)
-        @timestamp = Time.now.iso8601
-      end
-
-      def path
-        ''
-      end
-
-      def to_hash **_args
-        {
-            tags: @tags,
-            timestamp: @timestamp,
-            instance: Contrast::Agent::Telemetry.instance_id,
-            application: Contrast::Agent::Telemetry.application_id
-        }
-      end
-    end
-  end
-end

data/lib/contrast/agent/telemetry/telemetry.rb

@@ -1,150 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/config/env_variables'
-require 'contrast/components/logger'
-require 'contrast/utils/telemetry_client'
-require 'contrast/agent/worker_thread'
-require 'contrast/utils/telemetry'
-
-module Contrast
-  module Agent
-    # This class will initialize and hold everything needed for the telemetry
-    class Telemetry < WorkerThread
-      include Contrast::Components::Logger::InstanceMethods
-      # this is where we will send the data from the agents
-      URL = 'https://telemetry.ruby.contrastsecurity.com/'
-      # Suggested timeout after each send is to be 3 hours (10800 seconds)
-      SUGGESTED_TIMEOUT = 10_800
-
-      class << self
-        include Contrast::Components::Logger::InstanceMethods
-        include Contrast::Config::EnvVariables
-
-        def application_id
-          @_application_id ||= begin
-            id = nil
-            mac = Contrast::Utils::Telemetry::Identifier.mac
-            app_name = Contrast::Utils::Telemetry::Identifier.app_name
-            id = mac + app_name if mac && app_name
-            Digest::SHA2.new(256).hexdigest(id || "_#{ SecureRandom.uuid }")
-          end
-        end
-
-        def instance_id
-          @_instance_id ||= Digest::SHA2.new(256).hexdigest(Contrast::Utils::Telemetry::Identifier.mac ||
-                                                                  "_#{ SecureRandom.uuid }")
-        end
-
-        def enabled?
-          @_enabled = telemetry_enabled? if @_enabled.nil?
-          @_enabled
-        end
-
-        private
-
-        def telemetry_enabled?
-          opt_out_telemetry = return_value(:telemetry_opt_outs).to_s
-          return false if opt_out_telemetry.casecmp?('true') || opt_out_telemetry == '1'
-
-          # In case of connection error, do not create the background thread or queue,
-          # as if the opt-out env var was set
-          @_client = Contrast::Utils::TelemetryClient.new
-          ip_opt_out_telemetry = @_client.initialize_connection(URL)
-          if ip_opt_out_telemetry.nil?
-            logger.warn("Connection was not established properly!!! \n Telemetry reporting will be disabled!")
-            return false
-          end
-
-          true
-        end
-      end
-
-      def client
-        @_client ||= Contrast::Utils::TelemetryClient.new
-      end
-
-      def connection
-        @_connection ||= client.initialize_connection(URL)
-      end
-
-      def attempt_to_start?
-        unless cs__class.enabled?
-          logger.warn('Telemetry service is disabled!')
-          return false
-        end
-
-        logger.debug('Attempting to start telemetry thread') unless running?
-        true
-      end
-
-      def start_thread!
-        return if running?
-
-        # It is recommended that implementations send a single payload of
-        # general metrics every 3 hours, starting from implementation startup.
-        @_thread = Contrast::Agent::Thread.new do
-          logger.debug('Starting background telemetry thread.')
-          loop do
-            next unless client && connection
-
-            until queue.empty?
-              event = queue.pop
-              begin
-                logger.debug('This is the current processed event', event)
-                sleep_time = request_with_response event
-                if sleep_time
-                  sleep(sleep_time)
-                  logger.debug('Retrying to process event', event)
-                  retry_sleep_time = request_with_response event
-                  sleep(retry_sleep_time) unless retry_sleep_time.nil?
-                end
-              rescue StandardError => e
-                logger.error('Could not send message to service from telemetry queue.', e)
-                stop!
-              end
-            end
-            sleep(SUGGESTED_TIMEOUT)
-          end
-        end
-      end
-
-      def send_event event
-        if ::Contrast::AGENT.disabled?
-          logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
-          return
-        end
-
-        return unless cs__class.enabled?
-
-        logger.debug('Enqueued event for sending', event_type: event.cs__class)
-        queue << event if event
-      end
-
-      def delete_queue!
-        @_queue&.clear
-        @_queue&.close
-        @_queue = nil
-      end
-
-      def stop!
-        return unless running?
-
-        @_enabled = false
-        delete_queue!
-        super
-      end
-
-      def request_with_response event
-        res = client.send_request event, connection
-        client.handle_response res
-      end
-
-      private
-
-      def queue
-        @_queue ||= Queue.new
-      end
-    end
-  end
-end

data/lib/contrast/utils/exclude_key.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Determine if configuration keys is excluded from logging
-    module ExcludeKey
-      EXCLUDE_FROM_LOG = %w[api api_key url service_key user_name].cs__freeze
-      class << self
-        # Check if a config key can be logged or not
-        #
-        # @param key [String] key to check
-        # @return[Boolean] true | false
-        def excludable? key
-          EXCLUDE_FROM_LOG.any? { |exclude_key| key.include? exclude_key }
-        end
-      end
-    end
-  end
-end