contrast-agent 6.0.0 → 6.1.0

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb

@@ -78,9 +78,9 @@ module Contrast
           #                in the standard format per RFC 2616
           # used for in observed routes message.
           return false unless response && (response_code = response&.code)
-          return true if ANALYZE_WHEN.include? response_code
+          return true if ANALYZE_WHEN.include?(response_code)
 
-          handle_error response if ERROR_CODES.value?(response_code)
+          handle_error(response) if ERROR_CODES.value?(response_code)
           # There was error, so analyze the Error and nothing more.
           false
         end
@@ -156,19 +156,14 @@ module Contrast
 
           response.application_settings.reactions.each do |reaction|
             # The enums are all uppercase, we need to downcase them before attempting to log.
-            level = if reaction.level.nil?
-                      :error
-                    else
-                      reaction.level.downcase
-                    end
-
+            level = reaction.level.nil? ? :error : reaction.level.downcase
             logger.with_level(level, reaction.message) if reaction.message
 
             case reaction.operation
-            when Contrast::Agent::Reporting::Settings::Reaction::OPERATIONS.second
+            when Contrast::Agent::Reporting::Settings::Reaction::OPERATIONS[1]
               # DISABLED
-              Contrast::Agent::DisableReaction.run reaction, level
-            when Contrast::Agent::Reporting::Settings::Reaction::OPERATIONS.first
+              Contrast::Agent::DisableReaction.run(reaction, level)
+            when Contrast::Agent::Reporting::Settings::Reaction::OPERATIONS[0]
               # NOOP
             else
               logger.warn('ReactionProcessor received a reaction with an unknown operation',
@@ -177,6 +172,24 @@ module Contrast
           end
         end
 
+        # This can't go in the Settings component because protect and assess depend on settings
+        # I don't think it should go into contrast_service because that only handles connection specific data.
+        #
+        # @param response [Contrast::Agent::Reporting::Response]
+        def update_ruleset response
+          logger.info('Updating features from TeamServer')
+          return unless response&.server_features || response&.application_settings
+          return unless ::Contrast::AGENT.enabled?
+
+          logger.trace_with_time('Rebuilding rule modes from TeamServer') do
+            ::Contrast::SETTINGS.build_protect_rules if ::Contrast::PROTECT.enabled?
+            ::Contrast::AGENT.reset_ruleset
+            logger.info('Current rule settings:')
+            ::Contrast::PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
+            logger.info('Disabled Assess Rules', rules: ::Contrast::ASSESS.disabled_rules)
+          end
+        end
+
         # Converts response from Net to Reporting Response object
         #
         # @param response [Net::HTTP::Response, nil]
@@ -192,12 +205,14 @@ module Contrast
           # check if response contains application settings or Feature settings
           if response_data[:settings]
             # the response contains ApplicationSettings
-            logger.trace('Agent: Received updated application settings')
-            build_application_settings response_data
+            app_settings = build_application_settings(response_data)
+            logger.trace('Agent: Received updated application settings', raw: response_data, processed: app_settings)
+            app_settings
           else
             # the response contains FeatureSettings
-            logger.trace('Agent: Received updated server features')
-            build_feature_settings response_data
+            server_features = build_feature_settings(response_data)
+            logger.trace('Agent: Received updated application settings', raw: response_data, processed: server_features)
+            server_features
           end
         rescue StandardError => e
           logger.error('Unable to convert response', e)
@@ -207,7 +222,7 @@ module Contrast
         # @param response_data [Hash]
         # @return res [Contrast::Agent::Reporting::Response]
         def build_application_settings response_data
-          res = Contrast::Agent::Reporting::Response.new
+          res = Contrast::Agent::Reporting::Response.application_response
           extract_assess response_data, res
           extract_protect response_data, res
           extract_exclusions response_data, res
@@ -219,7 +234,7 @@ module Contrast
         # @param response_data [Hash]
         # @return res [Contrast::Agent::Reporting::Response]
         def build_feature_settings response_data
-          res = Contrast::Agent::Reporting::Response.new
+          res = Contrast::Agent::Reporting::Response.server_response
           extract_assess_server_features response_data, res
           extract_protect_server_features response_data, res
           extract_protect_lists response_data, res

data/lib/contrast/agent/reporting/settings/protect.rb

@@ -73,7 +73,7 @@ module Contrast
           #
           # @return rules [Hash<RULE_ID => MODE>, nil] Hash with rule_id as key and mode as value
           def protection_rules_to_settings_hash
-            return if protection_rules.empty?
+            return {} if protection_rules.empty?
 
             modes_by_id = {}
             protection_rules.each do |rule|

data/lib/contrast/agent/reporting/settings/protect_server_feature.rb

@@ -23,7 +23,7 @@ module Contrast
           # @param enabled [Boolean]
           # @return enabled [Boolean]
           def enabled= enabled
-            @_enabled = enabled if !!enabled == enabled
+            @_enabled = enabled
           end
 
           # Indicate if the bot protection feature set is enabled for this server or not.

data/lib/contrast/agent/request.rb

@@ -39,7 +39,7 @@ module Contrast
       attr_accessor :route, :observed_route, :new_observed_route
 
       # Delegate calls to the following methods to the attribute @rack_request
-      def_delegators :@rack_request, :base_url, :content_type, :cookies, :env, :ip, :path, :port, :query_string,
+      def_delegators :@rack_request, :base_url, :cookies, :env, :ip, :media_type, :path, :port, :query_string,
                      :request_method, :scheme, :url, :user_agent
 
       # Initialize new Contrast Request
@@ -86,9 +86,9 @@ module Contrast
       #
       # @return type [Symbol<:XML, :JSON, :NORMAL>]
       def document_type
-        @_document_type ||= if /xml/i.match?(content_type) || body&.start_with?('<?xml')
+        @_document_type ||= if /xml/i.match?(media_type) || body&.start_with?('<?xml')
                               :XML
-                            elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
+                            elsif /json/i.match?(media_type) || body&.match?(/\s*[{\[]/)
                               :JSON
                             else
                               :NORMAL

data/lib/contrast/agent/request_context_extend.rb

@@ -76,7 +76,7 @@ module Contrast
         return false unless ::Contrast::PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
+        service_response = Contrast::Agent&.messaging_queue&.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)

data/lib/contrast/agent/request_handler.rb

@@ -47,8 +47,7 @@ module Contrast
       # This method is used to send our JSON messages directly to TeamServer at the end of each request. As we move
       # more endpoints over, this method will take the messages originally sent by #send_actiivty_messages. At the end,
       # that method should be removed.
-      # TODO: RUBY-1358
-      def report_activity
+      def report_activity # rubocop:disable Metrics/AbcSize
         return unless Contrast::Agent::Reporter.enabled?
 
         reporter = Contrast::Agent.reporter
@@ -61,7 +60,8 @@ module Contrast
         [
           context.new_observed_route,
           Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
-          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages)
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages),
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
         ].each do |event|
           reporter.send_event(event)
         rescue StandardError => e

data/lib/contrast/agent/response.rb

@@ -22,6 +22,8 @@ module Contrast
 
       extend Forwardable
 
+      # @return [Array, Rack::Response] The Rack Response passed by the application & middleware. It can be an Array
+      #   in format [response_code, header_hash, response_body] or an instance of Rack::Response
       attr_reader :rack_response
 
       def initialize rack_response

data/lib/contrast/agent/service_heartbeat.rb

@@ -7,71 +7,29 @@ require 'contrast/agent/reporting/report'
 
 module Contrast
   module Agent
-    # The ServiceHeartbeat functions to keep the Contrast Service alive and
-    # ensure that it maintains this Agent's ApplicationContext.
+    # The ServiceHeartbeat functions to keep the Contrast Service alive and ensure that it maintains this Agent's
+    # ApplicationContext.
     class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Logger::InstanceMethods
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      # check if we can report to TS
-      #
-      # @return[Boolean] true if bypass is enabled, or false if bypass disabled
-      def enabled?
-        @_enabled = Contrast::CONTRAST_SERVICE.use_agent_communication? if @_enabled.nil?
-        @_enabled
-      end
-
-      def client
-        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
-      end
-
-      def connection
-        @_connection ||= client.initialize_connection
-      end
-
       def start_thread!
+        return if ::Contrast::CONTRAST_SERVICE.unnecessary?
         return if running?
 
-        report_from_reporter = check_report_provider
-
         @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
-            if report_from_reporter
-              client.send_event(poll_message, connection)
-            else
-              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
-            end
-
-            sleep REFRESH_INTERVAL_SEC
+            Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+            sleep(REFRESH_INTERVAL_SEC)
           end
         end
       end
 
       def poll_message
-        @_poll_message ||= if enabled? && client
-                             Contrast::Agent::Reporting::Poll.new
-                           else
-                             Contrast::Api::Dtm::Poll.new
-                           end
-      end
-
-      def check_report_provider
-        return false unless enabled?
-        return false unless client && connection
-
-        client.startup!(connection)
-        true
-      end
-
-      def send_event provider
-        if provider
-          client.send_event(poll_message, connection)
-          return
-        end
-        Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+        @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
     end
   end

data/lib/contrast/agent/static_analysis.rb

@@ -40,7 +40,7 @@ module Contrast
             inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
             Contrast::Agent.reporter.send_event(inventory_report)
           else
-            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg, force: true)
           end
         end
 

data/lib/contrast/agent/telemetry/base.rb

@@ -0,0 +1,151 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/env_variables'
+require 'contrast/components/logger'
+require 'contrast/utils/telemetry_client'
+require 'contrast/agent/worker_thread'
+require 'contrast/utils/telemetry'
+require 'contrast/agent/telemetry/events/exceptions/telemetry_exceptions'
+
+module Contrast
+  module Agent
+    module Telemetry
+      # This class will initialize and hold everything needed for the telemetry
+      class Base < WorkerThread
+        include Contrast::Components::Logger::InstanceMethods
+        # this is where we will send the data from the agents
+        URL = 'https://telemetry.ruby.contrastsecurity.com/'
+        # Suggested timeout after each send is to be 3 hours (10800 seconds)
+        SUGGESTED_TIMEOUT = 10_800
+
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+          include Contrast::Config::EnvVariables
+
+          def application_id
+            Contrast::Utils::Telemetry::Identifier.application_id
+          end
+
+          def instance_id
+            Contrast::Utils::Telemetry::Identifier.instance_id
+          end
+
+          def enabled?
+            @_enabled = telemetry_enabled? if @_enabled.nil?
+            @_enabled
+          end
+
+          private
+
+          def telemetry_enabled?
+            opt_out_telemetry = return_value(:telemetry_opt_outs).to_s
+            return false if opt_out_telemetry.casecmp?('true') || opt_out_telemetry == '1'
+
+            # In case of connection error, do not create the background thread or queue,
+            # as if the opt-out env var was set
+            @_client = Contrast::Utils::TelemetryClient.new
+            ip_opt_out_telemetry = @_client.initialize_connection(URL)
+            if ip_opt_out_telemetry.nil?
+              logger.warn("Connection was not established properly!!! \n Telemetry reporting will be disabled!")
+              return false
+            end
+
+            true
+          end
+        end
+
+        def client
+          @_client ||= Contrast::Utils::TelemetryClient.new
+        end
+
+        def connection
+          @_connection ||= client.initialize_connection(URL)
+        end
+
+        def error_messages
+          @_error_messages ||= []
+        end
+
+        def attempt_to_start?
+          unless cs__class.enabled?
+            logger.warn('Telemetry service is disabled!')
+            return false
+          end
+
+          logger.debug('Attempting to start telemetry thread') unless running?
+          true
+        end
+
+        def start_thread!
+          return if running?
+
+          # It is recommended that implementations send a single payload of
+          # general metrics every 3 hours, starting from implementation startup.
+          @_thread = Contrast::Agent::Thread.new do
+            logger.debug('Starting background telemetry thread.')
+            loop do
+              next unless client && connection
+
+              Contrast::Agent::Telemetry::TelemetryExceptionReport.push_exceptions
+              until queue.empty?
+                event = queue.pop
+                begin
+                  logger.debug('This is the current processed event', event)
+                  sleep_time = request_with_response event
+                  if sleep_time
+                    sleep(sleep_time)
+                    logger.debug('Retrying to process event', event)
+                    retry_sleep_time = request_with_response event
+                    sleep(retry_sleep_time) unless retry_sleep_time.nil?
+                  end
+                rescue StandardError => e
+                  logger.error('Could not send message to service from telemetry queue.', e)
+                  stop!
+                end
+              end
+              sleep(SUGGESTED_TIMEOUT)
+            end
+          end
+        end
+
+        def send_event event
+          if ::Contrast::AGENT.disabled?
+            logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
+            return
+          end
+
+          return unless cs__class.enabled?
+
+          logger.debug('Enqueued event for sending', event_type: event.cs__class)
+          queue << event if event
+        end
+
+        def delete_queue!
+          @_queue&.clear
+          @_queue&.close
+          @_queue = nil
+        end
+
+        def stop!
+          return unless running?
+
+          @_enabled = false
+          delete_queue!
+          super
+        end
+
+        def request_with_response event
+          res = client.send_request event, connection
+          client.handle_response res
+        end
+
+        private
+
+        def queue
+          @_queue ||= Queue.new
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/event.rb

@@ -0,0 +1,35 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/metrics_hash'
+
+module Contrast
+  module Agent
+    module Telemetry
+      # This class will hold the basic information for a Telemetry Event
+      class Event
+        include Contrast::Utils
+
+        attr_reader :tags
+
+        def initialize
+          @tags = MetricsHash.new(String)
+          @timestamp = Time.now.iso8601
+        end
+
+        def path
+          ''
+        end
+
+        def to_hash **_args
+          {
+              tags: @tags,
+              timestamp: @timestamp,
+              instance: Contrast::Agent::Telemetry::Base.instance_id,
+              application: Contrast::Agent::Telemetry::Base.application_id
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb

@@ -3,48 +3,56 @@
 
 module Contrast
   module Agent
-    # This class will hold the all the mutual information for the Telemetry Exception
-    class TelemetryExceptionBase
-      def to_controlled_hash; end
+    module Telemetry
+      module TelemetryException
+        # This class will hold the all the mutual information for the Telemetry Exception
+        class Base
+          def to_controlled_hash; end
 
-      protected
+          protected
 
-      # Validate required and option fields
-      #
-      # @param validations [Hash] Validation hash to use
-      # @return [nil]
-      def validate validations
-        validations.each do |k, v|
-          next if v[:required] == false
+          # Validate required and option fields
+          #
+          # @param validations [Hash] Validation hash to use
+          # @return [nil]
+          def validate validations
+            validations.each do |k, v|
+              next if v[:required] == false
 
-          validate_field validations[k], k
-        end
-        nil
-      end
+              validate_field(validations[k], k)
+            end
+            nil
+          end
 
-      # This method will validate every single field passed from validate
-      #
-      # @param validation_pair [Hash] Validation hash to use
-      # @param key[String] The key to check in VALIDATIONS
-      def validate_field validation_pair, key
-        value_to_validate = send(key.to_sym)
-        validate_class value_to_validate, validation_pair[:class], key if validation_pair.key?(:class)
-        value_length = value_to_validate.cs__is_a?(String) ? value_to_validate.length : value_to_validate.entries.length
-        unless validation_pair[:range].include?(value_length)
-          raise ArgumentError, "The provided value for #{ key } is invalid"
-        end
+          # This method will validate every single field passed from validate
+          #
+          # @param validation_pair [Hash] Validation hash to use
+          # @param key[String] The key to check in VALIDATIONS
+          def validate_field validation_pair, key
+            value_to_validate = send(key.to_sym)
+            validate_class(value_to_validate, validation_pair[:class], key) if validation_pair.key?(:class)
+            value_length = if value_to_validate.cs__is_a?(String) || value_to_validate.cs__is_a?(Array)
+                             value_to_validate.length
+                           else
+                             value_to_validate.entries.length
+                           end
+            unless validation_pair[:range].include?(value_length)
+              raise ArgumentError, "The provided value for #{ key } is invalid: #{ value_to_validate }"
+            end
 
-        nil
-      end
+            nil
+          end
 
-      # With the all nested classes, we still need to double check if everything passed along the way
-      # is right
-      # @param message [Object] The message we want to check the class of
-      # @param klass [Class] The klass we want to check the message with
-      # @param field [Object] The field with the error
-      def validate_class message, klass, field
-        message = message[0] if message.cs__is_a?(Array)
-        raise ArgumentError, "The provided value for #{ field } is invalid" unless message.cs__is_a? klass
+          # With the all nested classes, we still need to double check if everything passed along the way
+          # is right
+          # @param message [Object] The message we want to check the class of
+          # @param klass [Class] The klass we want to check the message with
+          # @param field [Object] The field with the error
+          def validate_class message, klass, field
+            message = message[0] if message.cs__is_a?(Array)
+            raise ArgumentError, "The provided value for #{ field } is of wrong class" unless message.cs__is_a? klass
+          end
+        end
       end
     end
   end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb

@@ -6,30 +6,38 @@ require_relative 'telemetry_exception_message'
 
 module Contrast
   module Agent
-    # This class will hold the basic information for a Parent Telemetry Exception Event
-    class TelemetryExceptionEvent < Contrast::Agent::TelemetryExceptionBase
-      # Array of Telemetry Exclusions
-      # @return [Array<Contrast::Agent::TelemetryExceptionMessage>]
-      attr_reader :exclusions
+    module Telemetry
+      module TelemetryException
+        # This class will hold the basic information for a Parent Telemetry Exception Event
+        class Event < Contrast::Agent::Telemetry::TelemetryException::Base
+          # Array of Telemetry Exceptions
+          # @return [Array<Contrast::Agent::Telemetry::TelemetryException::Message>]
+          attr_reader :exceptions
 
-      # Initialization of the Parent Event requires us to require the exception
-      # to be created
-      #
-      # @param message [Contrast::Agent::TelemetryExceptionMessage]
-      def initialize message
-        super()
-        validate_class message, Contrast::Agent::TelemetryExceptionMessage, 'exception_message'
-        @exclusions = Array.new(1, message)
-      end
+          # Initialization of the Parent Event requires us to require the exception
+          # to be created
+          #
+          # @param message [Contrast::Agent::Telemetry::TelemetryException::Message]
+          def initialize message
+            super()
+            validate_class(message, Contrast::Agent::Telemetry::TelemetryException::Message, 'exception_message')
+            @exceptions = Array.new(1, message)
+          end
 
-      # @param message [Contrast::Agent::TelemetryExceptionMessage]
-      def push message
-        validate_class message, Contrast::Agent::TelemetryExceptionMessage, 'exception_message'
-        @exclusions << message
-      end
+          # @param message [Contrast::Agent::Telemetry::TelemetryException::Message]
+          def push message
+            validate_class(message, Contrast::Agent::Telemetry::TelemetryException::Message, 'exception_message')
+            @exceptions << message
+          end
+
+          def self.path
+            '/ruby/runtime'
+          end
 
-      def to_controlled_hash
-        exclusions.map(&:to_controlled_hash)
+          def to_controlled_hash
+            exceptions.map(&:to_controlled_hash)
+          end
+        end
       end
     end
   end