contrast-agent 6.1.1 → 6.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +7 -5
- data/ext/cs__assess_kernel/cs__assess_kernel.c +14 -3
- data/ext/cs__assess_kernel/cs__assess_kernel.h +2 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +10 -3
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +2 -1
- data/ext/cs__assess_regexp/cs__assess_regexp.c +9 -7
- data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.c → cs__assess_string_interpolation/cs__assess_string_interpolation.c} +14 -3
- data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.h → cs__assess_string_interpolation/cs__assess_string_interpolation.h} +1 -1
- data/ext/{cs__assess_string_interpolation26 → cs__assess_string_interpolation}/extconf.rb +0 -0
- data/ext/cs__common/cs__common.c +5 -4
- data/ext/cs__contrast_patch/cs__contrast_patch.c +3 -10
- data/lib/contrast/agent/assess/events/source_event.rb +16 -12
- data/lib/contrast/agent/assess/policy/policy_node.rb +6 -0
- data/lib/contrast/agent/assess/policy/propagation_method.rb +3 -39
- data/lib/contrast/agent/assess/policy/propagation_node.rb +8 -0
- data/lib/contrast/agent/assess/policy/propagator/base.rb +2 -0
- data/lib/contrast/agent/assess/policy/source_method.rb +2 -47
- data/lib/contrast/agent/assess/policy/source_node.rb +1 -0
- data/lib/contrast/agent/assess/policy/trigger_node.rb +8 -0
- data/lib/contrast/agent/assess/property/evented.rb +4 -18
- data/lib/contrast/agent/assess/tag.rb +19 -0
- data/lib/contrast/agent/at_exit_hook.rb +9 -8
- data/lib/contrast/agent/inventory/database_config.rb +18 -7
- data/lib/contrast/agent/inventory/dependency_analysis.rb +3 -2
- data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +13 -9
- data/lib/contrast/agent/middleware.rb +4 -0
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +27 -2
- data/lib/contrast/agent/patching/policy/policy.rb +5 -0
- data/lib/contrast/agent/patching/policy/policy_node.rb +6 -0
- data/lib/contrast/agent/patching/policy/trigger_node.rb +3 -0
- data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +3 -4
- data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -0
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
- data/lib/contrast/agent/protect/rule/base.rb +1 -0
- data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -0
- data/lib/contrast/agent/protect/rule/xss.rb +4 -0
- data/lib/contrast/agent/reporting/reporter.rb +33 -17
- data/lib/contrast/agent/reporting/reporter_heartbeat.rb +21 -15
- data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb +3 -18
- data/lib/contrast/agent/reporting/reporting_events/application_update.rb +5 -24
- data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +8 -1
- data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +83 -16
- data/lib/contrast/agent/reporting/reporting_events/finding.rb +9 -3
- data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +10 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_object.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_parent_object.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_property.rb +12 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +11 -1
- data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +29 -32
- data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +18 -20
- data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +11 -24
- data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +13 -6
- data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +10 -4
- data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +10 -4
- data/lib/contrast/agent/reporting/reporting_events/route_coverage.rb +9 -0
- data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +10 -1
- data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +11 -4
- data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -8
- data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +2 -6
- data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +0 -32
- data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +1 -4
- data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +1 -11
- data/lib/contrast/agent/reporting/reporting_utilities/response.rb +60 -2
- data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb +32 -10
- data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +58 -26
- data/lib/contrast/agent/reporting/settings/application_settings.rb +8 -23
- data/lib/contrast/agent/reporting/settings/assess_server_feature.rb +27 -33
- data/lib/contrast/agent/reporting/settings/bot_blocker.rb +68 -0
- data/lib/contrast/agent/reporting/settings/code_exclusion.rb +27 -0
- data/lib/contrast/agent/reporting/settings/exclusion_base.rb +33 -0
- data/lib/contrast/agent/reporting/settings/exclusions.rb +39 -57
- data/lib/contrast/agent/reporting/settings/helpers.rb +56 -0
- data/lib/contrast/agent/reporting/settings/input_exclusion.rb +37 -0
- data/lib/contrast/agent/reporting/settings/ip_filter.rb +35 -0
- data/lib/contrast/agent/reporting/settings/keyword.rb +74 -0
- data/lib/contrast/agent/reporting/settings/log_enhancer.rb +65 -0
- data/lib/contrast/agent/reporting/settings/protect.rb +4 -2
- data/lib/contrast/agent/reporting/settings/protect_server_feature.rb +62 -115
- data/lib/contrast/agent/reporting/settings/reaction.rb +11 -2
- data/lib/contrast/agent/reporting/settings/rule_definition.rb +63 -0
- data/lib/contrast/agent/reporting/settings/sampling.rb +10 -0
- data/lib/contrast/agent/reporting/settings/sanitizer.rb +38 -0
- data/lib/contrast/agent/reporting/settings/sensitive_data_masking.rb +9 -1
- data/lib/contrast/agent/reporting/settings/sensitive_data_masking_rule.rb +7 -0
- data/lib/contrast/agent/reporting/settings/server_features.rb +8 -0
- data/lib/contrast/agent/reporting/settings/syslog.rb +176 -0
- data/lib/contrast/agent/reporting/settings/url_exclusion.rb +42 -0
- data/lib/contrast/agent/reporting/settings/validator.rb +17 -0
- data/lib/contrast/agent/request.rb +5 -7
- data/lib/contrast/agent/request_context.rb +8 -13
- data/lib/contrast/agent/request_context_extend.rb +8 -9
- data/lib/contrast/agent/request_handler.rb +10 -35
- data/lib/contrast/agent/rule_set.rb +4 -0
- data/lib/contrast/agent/service_heartbeat.rb +1 -1
- data/lib/contrast/agent/static_analysis.rb +6 -15
- data/lib/contrast/agent/telemetry/base.rb +35 -35
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb +2 -0
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +2 -0
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb +5 -2
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb +3 -0
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb +3 -0
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb +0 -1
- data/lib/contrast/agent/thread_watcher.rb +2 -6
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/agent.rb +1 -3
- data/lib/contrast/api/communication/socket.rb +1 -0
- data/lib/contrast/api/decorators/message.rb +0 -6
- data/lib/contrast/api/decorators.rb +0 -3
- data/lib/contrast/components/assess.rb +0 -6
- data/lib/contrast/components/config.rb +18 -2
- data/lib/contrast/config/base_configuration.rb +0 -13
- data/lib/contrast/config/root_configuration.rb +1 -0
- data/lib/contrast/config/ruby_configuration.rb +2 -9
- data/lib/contrast/configuration.rb +0 -2
- data/lib/contrast/extension/assess/eval_trigger.rb +0 -4
- data/lib/contrast/extension/assess/hash.rb +3 -2
- data/lib/contrast/extension/assess/kernel.rb +22 -0
- data/lib/contrast/extension/assess/marshal.rb +16 -0
- data/lib/contrast/extension/assess/string.rb +21 -20
- data/lib/contrast/framework/base_support.rb +13 -4
- data/lib/contrast/framework/grape/support.rb +6 -6
- data/lib/contrast/framework/manager.rb +7 -23
- data/lib/contrast/framework/manager_extend.rb +1 -1
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +11 -15
- data/lib/contrast/framework/rails/support.rb +9 -2
- data/lib/contrast/framework/sinatra/support.rb +3 -2
- data/lib/contrast/logger/aliased_logging.rb +33 -26
- data/lib/contrast/utils/assess/source_method_utils.rb +0 -9
- data/lib/contrast/utils/lru_cache.rb +3 -0
- data/lib/contrast/utils/middleware_utils.rb +2 -0
- data/lib/contrast/utils/response_utils.rb +14 -1
- data/lib/contrast/utils/telemetry.rb +9 -0
- data/lib/contrast/utils/telemetry_client.rb +7 -7
- data/lib/contrast/utils/telemetry_hash.rb +36 -12
- data/lib/contrast/utils/telemetry_identifier.rb +8 -0
- data/lib/contrast/utils/thread_tracker.rb +26 -9
- data/lib/contrast/utils/timer.rb +6 -1
- data/lib/contrast.rb +1 -3
- data/resources/assess/policy.json +2 -11
- data/ruby-agent.gemspec +1 -1
- metadata +36 -22
- data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb +0 -30
- data/lib/contrast/api/decorators/application_update.rb +0 -52
- data/lib/contrast/api/decorators/library.rb +0 -56
- data/lib/contrast/api/decorators/library_usage_update.rb +0 -31
- data/lib/contrast/framework/platform_version.rb +0 -22
@@ -49,7 +49,7 @@ module Contrast
|
|
49
49
|
|
50
50
|
# Find all classes that subclass ::Grape::API, Gather their routes
|
51
51
|
#
|
52
|
-
# @return [Array<Contrast::
|
52
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
53
53
|
def collect_routes
|
54
54
|
return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless grape_defined?
|
55
55
|
|
@@ -60,8 +60,8 @@ module Contrast
|
|
60
60
|
c&.endpoints&.each do |endpoint|
|
61
61
|
endpoint&.routes&.map do |r|
|
62
62
|
pattern = r.pattern.pattern
|
63
|
-
|
64
|
-
|
63
|
+
routes << Contrast::Agent::Reporting::DiscoveredRoute.from_grape_controller(c, r.request_method,
|
64
|
+
pattern, r.path)
|
65
65
|
end
|
66
66
|
end
|
67
67
|
end
|
@@ -140,8 +140,8 @@ module Contrast
|
|
140
140
|
# @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
|
141
141
|
# @param route [String] the relative route passed from Rack.
|
142
142
|
# @param controllers [Array<::Grape::API>] All Grape controllers found
|
143
|
-
# @return [Array[::Grape::API]
|
144
|
-
#
|
143
|
+
# @return [Array[::Grape::API. Grape::Router::Route], nil] Either the controller that will handle the route
|
144
|
+
# along with the route pattern or nil if no match.
|
145
145
|
def _route_recurse method, route, controllers = grape_controllers
|
146
146
|
# return if there aren't any controllers
|
147
147
|
return unless controllers&.any?
|
@@ -155,7 +155,7 @@ module Contrast
|
|
155
155
|
|
156
156
|
contr_routes = controller.endpoints&.map(&:routes)&.flatten || []
|
157
157
|
route_pattern = contr_routes&.find do |r|
|
158
|
-
r.pattern.to_regexp.match(route) # ::
|
158
|
+
r.pattern.to_regexp.match(route) # Grape::Router::Route match
|
159
159
|
end
|
160
160
|
return controller, route_pattern unless route_pattern.nil?
|
161
161
|
|
@@ -7,7 +7,6 @@ require 'contrast/components/logger'
|
|
7
7
|
require 'contrast/extension/module'
|
8
8
|
require 'contrast/framework/grape/support'
|
9
9
|
require 'contrast/framework/manager_extend'
|
10
|
-
require 'contrast/framework/platform_version'
|
11
10
|
require 'contrast/framework/rack/support'
|
12
11
|
require 'contrast/framework/rails/support'
|
13
12
|
require 'contrast/framework/sinatra/support'
|
@@ -59,20 +58,11 @@ module Contrast
|
|
59
58
|
patches
|
60
59
|
end
|
61
60
|
|
61
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
62
62
|
def find_route_discovery_data
|
63
63
|
routes_for_all_frameworks
|
64
64
|
end
|
65
65
|
|
66
|
-
def platform_version
|
67
|
-
framework_version = first_framework_result(:version, '')
|
68
|
-
|
69
|
-
Contrast::Framework::PlatformVersion.from_string(framework_version)
|
70
|
-
end
|
71
|
-
|
72
|
-
def platform_version_string
|
73
|
-
first_framework_result(:version, '')
|
74
|
-
end
|
75
|
-
|
76
66
|
def server_type
|
77
67
|
first_framework_result(:server_type, 'rack')
|
78
68
|
end
|
@@ -156,19 +146,13 @@ module Contrast
|
|
156
146
|
next unless module_name == framework.detection_class
|
157
147
|
|
158
148
|
@_frameworks << framework
|
159
|
-
|
160
|
-
#
|
161
|
-
|
162
|
-
|
163
|
-
|
164
|
-
Contrast::Agent.reporter.send_event(report)
|
165
|
-
|
166
|
-
# This is being reported separately because we extract the data from the same message
|
167
|
-
inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
|
168
|
-
Contrast::Agent.reporter.send_event(inventory_report)
|
169
|
-
else
|
170
|
-
Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
|
149
|
+
report = Contrast::Agent::Reporting::ApplicationUpdate.new
|
150
|
+
# This convert here is left as it'll be easier to be replaced when the Library is being changed
|
151
|
+
report.libraries = Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list
|
152
|
+
[report, Contrast::Agent::Reporting::ApplicationInventory.new].each do |e|
|
153
|
+
Contrast::Agent.reporter.send_event(e)
|
171
154
|
end
|
155
|
+
|
172
156
|
logger.info('Framework detected after initialization. Enabling support.',
|
173
157
|
framework: framework.detection_class,
|
174
158
|
frameworks: @_frameworks)
|
@@ -3,7 +3,6 @@
|
|
3
3
|
|
4
4
|
require 'contrast/components/logger'
|
5
5
|
require 'contrast/extension/module'
|
6
|
-
require 'contrast/framework/platform_version'
|
7
6
|
require 'contrast/framework/rack/support'
|
8
7
|
require 'contrast/framework/rails/support'
|
9
8
|
require 'contrast/framework/grape/support'
|
@@ -20,6 +19,7 @@ module Contrast
|
|
20
19
|
Contrast::Utils::ClassUtil.truly_defined?(klass)
|
21
20
|
end
|
22
21
|
|
22
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
23
23
|
def routes_for_all_frameworks
|
24
24
|
data_for_all_frameworks(:collect_routes)
|
25
25
|
end
|
@@ -1,6 +1,8 @@
|
|
1
1
|
# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
|
+
require 'contrast/agent/inventory/dependency_usage_analysis'
|
5
|
+
|
4
6
|
module Contrast
|
5
7
|
module Framework
|
6
8
|
module Rails
|
@@ -9,26 +11,20 @@ module Contrast
|
|
9
11
|
# event on streamed responses.
|
10
12
|
module ActionControllerLiveBuffer
|
11
13
|
class << self
|
12
|
-
# TODO: RUBY-1353
|
13
|
-
# TODO: RUBY-1355
|
14
|
-
# TODO: RUBY-1357
|
15
|
-
# TODO: RUBY-1357
|
16
14
|
def send_messages
|
17
15
|
return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
|
18
16
|
|
17
|
+
[
|
18
|
+
context.observed_route
|
19
|
+
].each do |event|
|
20
|
+
Contrast::Agent.reporter&.send_event_immediately(event)
|
21
|
+
end
|
22
|
+
|
19
23
|
if Contrast::Agent::Reporter.enabled?
|
20
|
-
|
21
|
-
|
22
|
-
Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
|
23
|
-
Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages),
|
24
|
-
Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
|
25
|
-
].each do |event|
|
26
|
-
Contrast::Agent.reporter&.send_event_immediately(event)
|
27
|
-
end
|
24
|
+
event = Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
|
25
|
+
Contrast::Agent.reporter&.send_event_immediately(event)
|
28
26
|
else
|
29
|
-
|
30
|
-
Contrast::Agent.messaging_queue&.send_event_immediately(msg)
|
31
|
-
end
|
27
|
+
Contrast::Agent.messaging_queue&.send_event_immediately(context.activity)
|
32
28
|
end
|
33
29
|
end
|
34
30
|
|
@@ -44,6 +44,7 @@ module Contrast
|
|
44
44
|
'rails'
|
45
45
|
end
|
46
46
|
|
47
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
47
48
|
def collect_routes
|
48
49
|
find_all_routes(::Rails.application, [])
|
49
50
|
end
|
@@ -138,7 +139,8 @@ module Contrast
|
|
138
139
|
route.app.is_a?(::ActionDispatch::Routing::Mapper::Constraints) && route.app.app < ::Rails::Engine
|
139
140
|
end
|
140
141
|
|
141
|
-
# Recursively get final route traversing engines as required.
|
142
|
+
# Recursively get final route traversing engines as required. Because this can only be called once, we store
|
143
|
+
# this match for the duration of our request context.
|
142
144
|
#
|
143
145
|
# @param request [::Rack::Request] the rack request as will be handed to rails controller.
|
144
146
|
# @param top_router [::ActionDispatch::Journey::Router] the current router relative to the previous.
|
@@ -162,12 +164,17 @@ module Contrast
|
|
162
164
|
end
|
163
165
|
|
164
166
|
# Rails engine routes need to be detected by inspecting Engine class route set
|
167
|
+
#
|
168
|
+
# @param app [Rails::Application]
|
169
|
+
# @param route_list [Array<Contrast::Agent::Reporting::DiscoveredRoute>] the list of discovered routes to
|
170
|
+
# which to append and return
|
171
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
165
172
|
def find_all_routes app, route_list
|
166
173
|
return route_list unless app.cs__respond_to?(:routes) && app.routes.cs__respond_to?(:routes)
|
167
174
|
|
168
175
|
app.routes.routes.each do |route|
|
169
176
|
if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
|
170
|
-
route_list << Contrast::
|
177
|
+
route_list << Contrast::Agent::Reporting::DiscoveredRoute.from_action_dispatch_journey(route)
|
171
178
|
elsif route.app.app.cs__respond_to?(:routes)
|
172
179
|
route_list += find_all_routes(route.app.app, [])
|
173
180
|
end
|
@@ -47,7 +47,7 @@ module Contrast
|
|
47
47
|
|
48
48
|
# Find all classes that subclass ::Sinatra::Base. Gather their routes.
|
49
49
|
#
|
50
|
-
# @return [Array<Contrast::
|
50
|
+
# @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
|
51
51
|
def collect_routes
|
52
52
|
return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless defined?(::Sinatra) && defined?(::Sinatra::Base)
|
53
53
|
|
@@ -56,7 +56,8 @@ module Contrast
|
|
56
56
|
controller.routes.each_pair do |method, route_triplets|
|
57
57
|
# Sinatra stores its routes as a triplet: [Mustermann::Sinatra, [], Proc]
|
58
58
|
route_triplets.map(&:first).each do |route_pattern|
|
59
|
-
routes << Contrast::
|
59
|
+
routes << Contrast::Agent::Reporting::DiscoveredRoute.from_sinatra_route(controller, method,
|
60
|
+
route_pattern)
|
60
61
|
end
|
61
62
|
end
|
62
63
|
end
|
@@ -17,7 +17,7 @@ module Contrast
|
|
17
17
|
# @param data [Object] Any structured data
|
18
18
|
def warn message = nil, exception = nil, data = nil, &block
|
19
19
|
# build Telemetry Exclusion
|
20
|
-
|
20
|
+
build_exception(ALIASED_WARN, message, exception, data)
|
21
21
|
super(message, exception, data, &block)
|
22
22
|
end
|
23
23
|
|
@@ -26,7 +26,7 @@ module Contrast
|
|
26
26
|
# @param data [Object] Any structured data
|
27
27
|
def error message = nil, exception = nil, data = nil, &block
|
28
28
|
# build Telemetry Exclusion
|
29
|
-
|
29
|
+
build_exception(ALIASED_ERROR, message, exception, data)
|
30
30
|
super(message, exception, data, &block)
|
31
31
|
end
|
32
32
|
|
@@ -35,35 +35,35 @@ module Contrast
|
|
35
35
|
# @param data [Object] Any structured data
|
36
36
|
def fatal message = nil, exception = nil, data = nil, &block
|
37
37
|
# build Telemetry Exclusion
|
38
|
-
|
38
|
+
build_exception(ALIASED_FATAL, message, exception, data)
|
39
39
|
super(message, exception, data, &block)
|
40
40
|
end
|
41
41
|
|
42
42
|
private
|
43
43
|
|
44
|
-
def
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
#
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
44
|
+
def build_exception type, message = nil, exception = nil, data = nil
|
45
|
+
stack_trace = get_stack_trace(type)
|
46
|
+
stack_frame_type = Contrast::Agent::Telemetry::TelemetryException::Obfuscate.obfuscate_type(
|
47
|
+
stack_trace[1].path.delete_prefix(Dir.pwd))
|
48
|
+
stack_frame_function = stack_trace[1].label
|
49
|
+
key = "#{ stack_frame_type }|#{ stack_frame_function }|#{ message }"
|
50
|
+
if TELEMETRY_EXCEPTIONS[key]
|
51
|
+
TELEMETRY_EXCEPTIONS.increment(key)
|
52
|
+
return
|
53
|
+
end
|
54
|
+
|
55
|
+
return if TELEMETRY_EXCEPTIONS.exception_limit?
|
56
|
+
|
57
|
+
message_exception_type = Contrast::Agent::Telemetry::TelemetryException::Obfuscate.obfuscate_exception_type(
|
58
|
+
exception ? exception.cs__class.to_s : stack_frame_type.split('/').last)
|
59
|
+
|
60
|
+
event_message = create_message(stack_frame_function,
|
61
|
+
stack_frame_type, message_exception_type,
|
62
|
+
data, exception,
|
63
|
+
message)
|
64
|
+
TELEMETRY_EXCEPTIONS[key] = event_message
|
65
|
+
rescue StandardError => e
|
66
|
+
debug('Unable to report exception to telemetry', e)
|
67
67
|
end
|
68
68
|
|
69
69
|
def create_message stack_frame_function, stack_frame_type, message_exception_type, data, exception, message
|
@@ -88,6 +88,13 @@ module Contrast
|
|
88
88
|
end
|
89
89
|
message = Contrast::Agent::Telemetry::TelemetryException::Message.build(tags, [message_exception])
|
90
90
|
Contrast::Agent::Telemetry::TelemetryException::Event.new(message)
|
91
|
+
rescue ArgumentError => e
|
92
|
+
debug('TelemetryException failed from aliased logging with: ', e)
|
93
|
+
end
|
94
|
+
|
95
|
+
def get_stack_trace type
|
96
|
+
start = caller_locations&.find_index { |stack| stack.to_s.include?(type) }
|
97
|
+
start ? caller_locations(start + 1, 20) : caller_locations(20, 20)
|
91
98
|
end
|
92
99
|
end
|
93
100
|
end
|
@@ -7,15 +7,6 @@ module Contrast
|
|
7
7
|
# This module will include all methods for some internal validations in the SourceMethod module
|
8
8
|
# and some other module methods from the same place, so we can ease the main module
|
9
9
|
module SourceMethodUtils
|
10
|
-
# Safely duplicate the target, or return nil
|
11
|
-
#
|
12
|
-
# @param target [Object] the thing to check for duplication
|
13
|
-
def safe_dup target
|
14
|
-
target.dup
|
15
|
-
rescue StandardError => _e
|
16
|
-
nil
|
17
|
-
end
|
18
|
-
|
19
10
|
# Find the name of the source
|
20
11
|
#
|
21
12
|
# @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
|
@@ -5,6 +5,9 @@ module Contrast
|
|
5
5
|
module Utils
|
6
6
|
# A LRU(Least Recently Used) Cache store.
|
7
7
|
class LRUCache
|
8
|
+
# Initializes new Least Recently Used Cache Store
|
9
|
+
#
|
10
|
+
# @raise [StandardError] raises error if provided capacity is invalid or less or equal to zero
|
8
11
|
def initialize capacity = 500
|
9
12
|
raise(StandardError('Capacity must be bigger than 0')) if capacity <= 0
|
10
13
|
|
@@ -34,6 +34,7 @@ module Contrast
|
|
34
34
|
SECURITY_EXCEPTION_MARKER = 'Contrast::SecurityException'
|
35
35
|
# We're only going to suppress SecurityExceptions indicating a blocked attack. And, only if the
|
36
36
|
# config.agent.ruby.exceptions.capture? is set
|
37
|
+
# @raise [Contrast::SecurityException] if exceptions.capture? is allowed
|
37
38
|
def handle_exception exception
|
38
39
|
if security_exception?(exception)
|
39
40
|
exception_control = ::Contrast::AGENT.exception_control
|
@@ -74,6 +75,7 @@ module Contrast
|
|
74
75
|
true
|
75
76
|
end
|
76
77
|
|
78
|
+
# @raise [Contrast::SecurityException] raises error to prevent an attack
|
77
79
|
def application_code env
|
78
80
|
logger.trace_with_time('application') do
|
79
81
|
app.call(env)
|
@@ -34,7 +34,7 @@ module Contrast
|
|
34
34
|
# @return [nil, String] the content of the body
|
35
35
|
def extract_body body
|
36
36
|
return unless body
|
37
|
-
return if
|
37
|
+
return if body_is_file?(body)
|
38
38
|
|
39
39
|
return handle_rack_body_proxy(body) if body.is_a?(Rack::BodyProxy)
|
40
40
|
return extract_body(body.body) if sub_extractable?(body)
|
@@ -77,6 +77,19 @@ module Contrast
|
|
77
77
|
obj.to_s
|
78
78
|
end
|
79
79
|
end
|
80
|
+
|
81
|
+
# After Rack 3.1 gets live - line 88 (Rack::File) will be removed.
|
82
|
+
# In 3.1 version, they drop the support for File class and will only support Files class
|
83
|
+
#
|
84
|
+
# @param body [String, Rack::File, Rack::BodyProxy,
|
85
|
+
# ActionDispatch::Response::RackBody, Rack::Response] Something that
|
86
|
+
# holds, wraps, or is the body of the Response
|
87
|
+
def body_is_file? body
|
88
|
+
return true if defined?(Rack::File) && (body.is_a?(Rack::File) || body.is_a?(Rack::File::Iterator))
|
89
|
+
return true if defined?(Rack::Files) && (body.is_a?(Rack::Files) || body.is_a?(Rack::Files::Iterator))
|
90
|
+
|
91
|
+
false
|
92
|
+
end
|
80
93
|
end
|
81
94
|
end
|
82
95
|
end
|
@@ -34,10 +34,16 @@ module Contrast
|
|
34
34
|
write_mark_file(DIR, FILE, CONFIG_DIR)
|
35
35
|
end
|
36
36
|
|
37
|
+
# The telemetry disclaimer message, set if needed.
|
38
|
+
#
|
39
|
+
# @return [String]
|
37
40
|
def self.disclaimer
|
38
41
|
@_disclaimer = MESSAGE[:disclaimer]
|
39
42
|
end
|
40
43
|
|
44
|
+
# Determine if telemetry has been explicitly disabled by opt out or has been left running.
|
45
|
+
#
|
46
|
+
# @return [Boolean]
|
41
47
|
def self.exceptions_enabled?
|
42
48
|
@_exceptions_enabled = telemetry_exceptions_enabled? if @_exceptions_enabled.nil?
|
43
49
|
@_exceptions_enabled
|
@@ -82,6 +88,9 @@ module Contrast
|
|
82
88
|
false
|
83
89
|
end
|
84
90
|
|
91
|
+
# Determine if telemetry has been explicitly disabled by opt out or has been left running.
|
92
|
+
#
|
93
|
+
# @return [Boolean]
|
85
94
|
def telemetry_exceptions_enabled?
|
86
95
|
opts_out_telemetry = return_value(:telemetry_opt_outs).to_s
|
87
96
|
return false if opts_out_telemetry.casecmp?('true') || opts_out_telemetry == '1'
|
@@ -34,8 +34,8 @@ module Contrast
|
|
34
34
|
def build_request event
|
35
35
|
return unless valid_event?(event)
|
36
36
|
|
37
|
-
string_body = if
|
38
|
-
event.
|
37
|
+
string_body = if event.cs__is_a?(Contrast::Agent::Telemetry::TelemetryException::Event)
|
38
|
+
[event.to_controlled_hash]
|
39
39
|
else
|
40
40
|
[event.to_hash]
|
41
41
|
end
|
@@ -73,14 +73,14 @@ module Contrast
|
|
73
73
|
ready_after if status_code == 429
|
74
74
|
end
|
75
75
|
|
76
|
-
# This method will be responsible for validating the event
|
77
|
-
#
|
78
|
-
#
|
76
|
+
# This method will be responsible for validating the event. Valid if event is of a known
|
77
|
+
# Contrast::Agent::Telemetry type
|
78
|
+
#
|
79
|
+
# @param event [Object]
|
79
80
|
def valid_event? event
|
80
81
|
return true if event.cs__is_a?(Contrast::Agent::Telemetry::Event)
|
81
82
|
return true if event.cs__is_a?(Contrast::Agent::Telemetry::StartupMetricsEvent)
|
82
|
-
|
83
|
-
return true if Array(event).all?(Contrast::Agent::Telemetry::TelemetryException::Event)
|
83
|
+
return true if event.cs__is_a?(Contrast::Agent::Telemetry::TelemetryException::Event)
|
84
84
|
|
85
85
|
false
|
86
86
|
end
|
@@ -2,34 +2,58 @@
|
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/logger'
|
5
|
+
require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_event'
|
5
6
|
|
6
7
|
module Contrast
|
7
8
|
module Utils
|
8
|
-
# This is the TelemetryHash, which will
|
9
|
-
# validating the event before that
|
9
|
+
# This is the TelemetryHash, which will store Contrast::Agent::Telemetry::TelemetryException::Event, so we can push
|
10
|
+
# freely, without worrying about validating the event before that. TelemetryHash has a max size of events,
|
11
|
+
# default is 10 events
|
10
12
|
class TelemetryHash < Hash
|
11
13
|
include Contrast::Components::Logger::InstanceMethods
|
14
|
+
HASH_SIZE_LIMIT = 10
|
12
15
|
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
16
|
+
# Wrapper to set a value in this TelemetryHash only if the provided value is of the data_type for this
|
17
|
+
# TelemetryHash or the hash has not reached its limit of for unique keys
|
18
|
+
#
|
19
|
+
# @param key [Object] the key to which to associate the value
|
20
|
+
# @param value [Object] the value to store
|
21
|
+
# @return [Object, nil] echo back out the value as the Hash#[]= method does, or nil if not of the expected
|
22
|
+
# data_type
|
20
23
|
def []= key, value
|
24
|
+
return if exception_limit?
|
21
25
|
return unless valid_value?(value)
|
22
26
|
|
23
27
|
super(key, value)
|
24
28
|
end
|
25
29
|
|
30
|
+
# Increment the occurrences for the exception object contained in this TelemetryHash
|
31
|
+
#
|
32
|
+
# @param key [Object] the key to check for the exception stored in this TelemetryHash
|
26
33
|
def increment key
|
27
|
-
self[key]
|
28
|
-
|
34
|
+
value = self[key]
|
35
|
+
return unless value&.exceptions&.any?
|
36
|
+
|
37
|
+
value.exceptions[0].increment_occurrences
|
29
38
|
end
|
30
39
|
|
40
|
+
# Determine if hash has reached exception event limit
|
41
|
+
# @return [Boolean]
|
42
|
+
def exception_limit?
|
43
|
+
unless size < HASH_SIZE_LIMIT
|
44
|
+
logger.debug("Number of TelemetryExceptions exceeds limit of #{ HASH_SIZE_LIMIT }")
|
45
|
+
return true
|
46
|
+
end
|
47
|
+
false
|
48
|
+
end
|
49
|
+
|
50
|
+
private
|
51
|
+
|
52
|
+
# Determine if the given value is valid based on the datatype which this TelemetryHash contains
|
53
|
+
# @param value [Object]
|
54
|
+
# @return boolean
|
31
55
|
def valid_value? value
|
32
|
-
unless value.cs__is_a?(
|
56
|
+
unless value.cs__is_a?(Contrast::Agent::Telemetry::TelemetryException::Event)
|
33
57
|
logger.debug('The following key will be omitted', value: value)
|
34
58
|
return false
|
35
59
|
end
|
@@ -38,6 +38,10 @@ module Contrast
|
|
38
38
|
@_mac = find_mac(primary) || find_mac
|
39
39
|
end
|
40
40
|
|
41
|
+
# Set and return a Sha256 hash representing this application, based on the mac identifier of this machine and
|
42
|
+
# the application name or a Secure UUID if one of them cannot be determined.
|
43
|
+
#
|
44
|
+
# @return [String]
|
41
45
|
def self.application_id
|
42
46
|
@_application_id ||= begin
|
43
47
|
id = nil
|
@@ -48,6 +52,10 @@ module Contrast
|
|
48
52
|
end
|
49
53
|
end
|
50
54
|
|
55
|
+
# Set and return a Sha256 hash representing this agent run, based on the mac identifier of this machine or a
|
56
|
+
# Secure UUID if one cannot be determined.
|
57
|
+
#
|
58
|
+
# @return [String]
|
51
59
|
def self.instance_id
|
52
60
|
@_instance_id ||= Digest::SHA2.new(256).hexdigest(Contrast::Utils::Telemetry::Identifier.mac ||
|
53
61
|
"_#{ SecureRandom.uuid }")
|
@@ -3,36 +3,53 @@
|
|
3
3
|
|
4
4
|
module Contrast
|
5
5
|
module Utils
|
6
|
-
# ThreadTracker allows tracking of singleton objects across threads
|
6
|
+
# ThreadTracker allows tracking of singleton objects across threads. It acts on Thread#[] as that call is
|
7
|
+
# fiber-local where as Thread#thread_variables is not.
|
7
8
|
class ThreadTracker
|
8
|
-
|
9
|
-
|
10
|
-
#
|
11
|
-
#
|
12
|
-
|
9
|
+
# Get the given key to given value in Thread#[] or return default.
|
10
|
+
#
|
11
|
+
# @param key [Object] key used to reference the value
|
12
|
+
# @param default [Object] value to return if not present in Thread#[]
|
13
|
+
# @return [Object]
|
13
14
|
def get key, default = nil
|
14
15
|
Thread.current[key] || default
|
15
16
|
end
|
16
17
|
|
18
|
+
# Set the given key to given value in Thread#[].
|
19
|
+
#
|
20
|
+
# @param key [Object] key used to reference the value
|
21
|
+
# @param value [Object] value to store
|
17
22
|
def set key, value
|
18
23
|
Thread.current[key] = value
|
19
24
|
end
|
20
25
|
|
26
|
+
# Remove the given key from the current Thread#[] by setting it to nil.
|
27
|
+
#
|
28
|
+
# @param key [Object] key of the value to delete
|
21
29
|
def delete key
|
22
30
|
Thread.current[key] = nil
|
23
31
|
end
|
24
32
|
|
25
|
-
|
26
|
-
|
27
|
-
|
33
|
+
# Wrap the block given with a RequestContext by setting it beforehand and deleting it after.
|
34
|
+
#
|
35
|
+
# @param context [Contrast::Agent::RequestContext]
|
36
|
+
def lifespan context
|
37
|
+
set(:current_context, context)
|
38
|
+
response = yield(context)
|
28
39
|
delete(:current_context)
|
29
40
|
response
|
30
41
|
end
|
31
42
|
|
43
|
+
# Retrieve the Thread#[] RequestContext
|
44
|
+
#
|
45
|
+
# @return [Contrast::Agent::RequestContext]
|
32
46
|
def current
|
33
47
|
get(:current_context)
|
34
48
|
end
|
35
49
|
|
50
|
+
# Set the Thread#[] context to the one provided.
|
51
|
+
#
|
52
|
+
# @param context [Contrast::Agent::RequestContext]
|
36
53
|
def update_current_context context
|
37
54
|
set(:current_context, context)
|
38
55
|
end
|
data/lib/contrast/utils/timer.rb
CHANGED
@@ -6,14 +6,19 @@ module Contrast
|
|
6
6
|
# Timer is class that can track state about when an event starts and how long it takes
|
7
7
|
# Also contains utility methods to get time values in milliseconds
|
8
8
|
class Timer
|
9
|
-
|
9
|
+
# @return [Integer] the ms of the Time that this instance represents
|
10
|
+
attr_reader :start_ms
|
10
11
|
|
12
|
+
# Create a wrapper for the current time
|
13
|
+
#
|
14
|
+
# @param time [Time]
|
11
15
|
def initialize time = Time.now
|
12
16
|
@start_at = time
|
13
17
|
@start_ms = (@start_at.to_f * 1000).to_i
|
14
18
|
@events = {}
|
15
19
|
end
|
16
20
|
|
21
|
+
# @return [Integer] time, in ms
|
17
22
|
def self.now_ms
|
18
23
|
(Time.now.to_f * 1000).to_i
|
19
24
|
end
|
data/lib/contrast.rb
CHANGED
@@ -66,9 +66,7 @@ module Contrast
|
|
66
66
|
end
|
67
67
|
|
68
68
|
module Contrast
|
69
|
-
TELEMETRY_EXCEPTIONS = if Contrast::Utils::Telemetry.exceptions_enabled?
|
70
|
-
Contrast::Utils::TelemetryHash.new(Contrast::Agent::Telemetry::TelemetryException::Event)
|
71
|
-
end
|
69
|
+
TELEMETRY_EXCEPTIONS = (Contrast::Utils::TelemetryHash.new if Contrast::Utils::Telemetry.exceptions_enabled?)
|
72
70
|
end
|
73
71
|
|
74
72
|
# This needs to be required very early, after component interfaces, and before instrumentation attempts
|
@@ -1092,17 +1092,8 @@
|
|
1092
1092
|
"patch_method": "sprintf_tagger",
|
1093
1093
|
"source": "O,P1",
|
1094
1094
|
"target": "R"
|
1095
|
-
},
|
1096
|
-
|
1097
|
-
"instance_method": true,
|
1098
|
-
"method_visibility": "public",
|
1099
|
-
"method_name":"quote",
|
1100
|
-
"source": "P0",
|
1101
|
-
"target": "R",
|
1102
|
-
"action": "SPLAT",
|
1103
|
-
"tags":["SQL_ENCODED"],
|
1104
|
-
"untags":["SQL_DECODED"]
|
1105
|
-
}, {
|
1095
|
+
},
|
1096
|
+
{
|
1106
1097
|
"class_name":"ActiveRecord::ConnectionAdapters::Quoting",
|
1107
1098
|
"instance_method": true,
|
1108
1099
|
"method_visibility": "public",
|