contrast-agent 6.11.0 → 6.12.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.11.0
+  version: 6.12.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-11-09 00:00:00.000000000 Z
+date: 2023-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -684,22 +684,22 @@ email:
 executables: []
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_module/extconf.rb
+- ext/cs__scope/extconf.rb
+- ext/cs__assess_string_interpolation/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
 - ext/cs__assess_test/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
+- ext/cs__assess_hash/extconf.rb
 - ext/cs__assess_string/extconf.rb
 - ext/cs__tests/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
-- ext/cs__assess_string_interpolation/extconf.rb
+- ext/cs__assess_fiber_track/extconf.rb
 - ext/cs__contrast_patch/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
-- ext/cs__os_information/extconf.rb
-- ext/cs__assess_hash/extconf.rb
-- ext/cs__scope/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__assess_fiber_track/extconf.rb
+- ext/cs__os_information/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -1048,6 +1048,7 @@ files:
 - lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb
 - lib/contrast/agent/reporting/attack_result/response_type.rb
 - lib/contrast/agent/reporting/attack_result/user_input.rb
+- lib/contrast/agent/reporting/connection_status.rb
 - lib/contrast/agent/reporting/details/bot_blocker_details.rb
 - lib/contrast/agent/reporting/details/cmd_injection_details.rb
 - lib/contrast/agent/reporting/details/details.rb
@@ -1110,6 +1111,7 @@ files:
 - lib/contrast/agent/reporting/reporting_events/poll.rb
 - lib/contrast/agent/reporting/reporting_events/preflight.rb
 - lib/contrast/agent/reporting/reporting_events/preflight_message.rb
+- lib/contrast/agent/reporting/reporting_events/reportable_hash.rb
 - lib/contrast/agent/reporting/reporting_events/reporting_event.rb
 - lib/contrast/agent/reporting/reporting_events/route_coverage.rb
 - lib/contrast/agent/reporting/reporting_events/route_discovery.rb
@@ -1138,7 +1140,6 @@ files:
 - lib/contrast/agent/reporting/settings/assess_rule.rb
 - lib/contrast/agent/reporting/settings/assess_server_feature.rb
 - lib/contrast/agent/reporting/settings/bot_blocker.rb
-- lib/contrast/agent/reporting/settings/code_exclusion.rb
 - lib/contrast/agent/reporting/settings/exclusion_base.rb
 - lib/contrast/agent/reporting/settings/exclusions.rb
 - lib/contrast/agent/reporting/settings/helpers.rb
@@ -1170,17 +1171,20 @@ files:
 - lib/contrast/agent/rule_set.rb
 - lib/contrast/agent/scope.rb
 - lib/contrast/agent/static_analysis.rb
+- lib/contrast/agent/telemetry.rb
 - lib/contrast/agent/telemetry/base.rb
-- lib/contrast/agent/telemetry/events/event.rb
-- lib/contrast/agent/telemetry/events/exceptions/obfuscate.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb
-- lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb
-- lib/contrast/agent/telemetry/events/metric_event.rb
-- lib/contrast/agent/telemetry/events/startup_metrics_event.rb
+- lib/contrast/agent/telemetry/client.rb
+- lib/contrast/agent/telemetry/event.rb
+- lib/contrast/agent/telemetry/exception.rb
+- lib/contrast/agent/telemetry/exception/base.rb
+- lib/contrast/agent/telemetry/exception/event.rb
+- lib/contrast/agent/telemetry/exception/message.rb
+- lib/contrast/agent/telemetry/exception/message_exception.rb
+- lib/contrast/agent/telemetry/exception/stack_frame.rb
+- lib/contrast/agent/telemetry/hash.rb
+- lib/contrast/agent/telemetry/identifier.rb
+- lib/contrast/agent/telemetry/metric_event.rb
+- lib/contrast/agent/telemetry/startup_metrics_event.rb
 - lib/contrast/agent/thread.rb
 - lib/contrast/agent/thread_watcher.rb
 - lib/contrast/agent/tracepoint_hook.rb
@@ -1196,7 +1200,6 @@ files:
 - lib/contrast/agent_lib/return_types/eval_result.rb
 - lib/contrast/agent_lib/test.rb
 - lib/contrast/api/.gitkeep
-- lib/contrast/api/communication/connection_status.rb
 - lib/contrast/components/agent.rb
 - lib/contrast/components/api.rb
 - lib/contrast/components/app_context.rb
@@ -1264,6 +1267,7 @@ files:
 - lib/contrast/framework/rails/patch/support.rb
 - lib/contrast/framework/rails/railtie.rb
 - lib/contrast/framework/rails/support.rb
+- lib/contrast/framework/sinatra/patch/encrypted_session_cookie.rb
 - lib/contrast/framework/sinatra/support.rb
 - lib/contrast/funchook/funchook.rb
 - lib/contrast/logger/aliased_logging.rb
@@ -1311,13 +1315,10 @@ files:
 - lib/contrast/utils/response_utils.rb
 - lib/contrast/utils/routes_sent.rb
 - lib/contrast/utils/sha256_builder.rb
+- lib/contrast/utils/silence_maker.rb
 - lib/contrast/utils/stack_trace_utils.rb
 - lib/contrast/utils/string_utils.rb
 - lib/contrast/utils/tag_util.rb
-- lib/contrast/utils/telemetry.rb
-- lib/contrast/utils/telemetry_client.rb
-- lib/contrast/utils/telemetry_hash.rb
-- lib/contrast/utils/telemetry_identifier.rb
 - lib/contrast/utils/thread_tracker.rb
 - lib/contrast/utils/timer.rb
 - resources/assess/policy.json

data/lib/contrast/agent/reporting/settings/code_exclusion.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/agent/reporting/settings/exclusion_base'
-
-module Contrast
-  module Agent
-    module Reporting
-      module Settings
-        # CodeExclusions class
-        class CodeExclusion < ExclusionBase
-          ATTRIBUTES = BASE_ATTRIBUTES.dup << :denylist
-          ATTRIBUTES.cs__freeze
-
-          # @return [Array<String>]
-          attr_accessor :denylist
-
-          def initialize
-            super
-            @denylist = []
-          end
-
-          def to_controlled_hash
-            hash = super
-            hash[:denylist] = denylist
-            hash
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/telemetry/events/exceptions/obfuscate.rb

@@ -1,124 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Telemetry
-      module TelemetryException
-        # Here will be all known gems to obfuscate during the building of TelemetryExceptions
-        module Obfuscate
-          # TODO: RUBY-1984 Re-enable/Remove Telemetry Obfuscation.
-          #
-          # List of known gems to be third parties not containing any
-          # user sensitive data.
-          # KNOWN_GEMS = %w[
-          #   activesupport redis-activesupport redis builder dry-types rails rails-html-sanitizer rails-observers
-          #   sinatra
-          #   benchmark-ips bundler climate_control execjs factory_bot debride fake_ftp fasterer flay openssl
-          #   parallel_tests contrast contrast-agent ruby pry-byebug byebug pry resolv ougai protobuf async nokogiri
-          #   benchmark grape-order grape-activerecord newrelic newrelic-grape grape-rails-cache grape-msgpack
-          #   grape-batch rspec rake rubocop grape-jbuilder rack-test rack-protection minitest grape-instrumentation
-          #   minitest-global_expectations rack-proxy rack-attack rack-ssl grape-cancan grape-attack grape-rake-tasks
-          #   grape-route-helpers benchmark-memory grape-rabl grape-kaminari grape-path-helpers grape-swagger-entity
-          #   grape-swagger-rails grape-roar newrelic-rake grapes-wagger-representative grape-forgery_protection
-          #   grape-papertrail grape-app grape-middleware-logger rack-protection rake-compile rhino rspec-benchmark
-          #   rspec_junit_formatter rspec-rails rake-performance rubocop-rails rubocop-rake rubocop-rspec
-          #   ruby-debug-ide simplecov sqlite steep tilt tzinfo-data warning xpath sinatra-activerecord sinatra-param
-          #   sinatra-partial sinatra-flash sinatra-reloader sinatra-sinatra rake_fly rack rack-accept grape
-          #   grape-entity
-          #   sinatra-advanced-routes sinatra-warden grape_logging grape-swagger sinatra-namespace sinatra-resource
-          #   sinatra-hashfix sinatra-instrumentation sinatra-helpers redis-rack sinatra-support sinatra-assetpack
-          #   sinatra-router sinatra-cross_origin sinatra_more sinatra-jsonp faraday-rack zlib mustermann
-          #   mustermann-grape
-          #   rspec-expectations rspec-core rspec-mocks rspec-sidekiq
-          # ].cs__freeze
-          # KNOWN_ERRORS = %w[
-          #   ActiveModel Error Errors Resolv Rspec ActiveRecord nil NilClass NoMemoryError ScriptError
-          #   LoadError NotImplementedError SyntaxError SecurityError SignalException Interrupt
-          #   StandardError ArgumentError UncaughtThrowError FiberError IOError EOFError IndexError KeyError
-          #   StopIteration LocalJumpError NameError NoMethodError RangeError FloatDomainError RegexpError
-          #   RuntimeError FrozenError SystemCallError ThreadError TypeError ZeroDivisionError SystemExit
-          #   SystemStackError fatal Warning buffer OpenSSL SSL SSLError Errno Timeout Exception EOFError
-          #   ECONNRESET ECONNREFUSED ETIMEDOUT EINVAL ESHUTDOWN EHOSTDOWN EHOSTUNREACH EISCONN
-          #   ECONNABORTED ENETRESET ENETUNREACH Net HTTPBadResponse HTTPHeaderSyntaxError ProtocolError
-          #   Faraday BadRequestError UnauthorizedError ForbiddenError ResourceNotFound ProxyAuthError
-          #   ConflictError UnprocessableEntityError ClientError
-          # ].cs__freeze
-          # CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'.cs__freeze
-          # # This will generate different chars for each agent startup but will be constant
-          # # for current run and will make identical obfuscation to be compared if given type
-          # # is the same.
-          # CYPHER = CHARS.chars.shuffle.join
-          #
-          # class << self
-          #   # Returns paths for known gems.
-          #   #
-          #   # @return [Array<Regexp>] known paths
-          #   def known_gem_paths
-          #     @_known_gem_paths ||= KNOWN_GEMS.map do |gem_name|
-          #       to_regexp(File.join(
-          #                     'gems', gem_name.tr('-', ''), 'lib'))
-          #     end
-          #   end
-          #
-          #   # Returns known modules names.
-          #   #
-          #   # @return [Array<Regexp>] known modules
-          #   def known_modules
-          #     @_known_modules ||= KNOWN_ERRORS.map { |module_name| to_regexp(module_name) }
-          #   end
-          #
-          #   # Obfuscate a type and replace it with random characters.
-          #   #
-          #   # @param type [String] the StackFrame type to obfuscate
-          #   # @return [String] obfuscated type
-          #   def obfuscate_type type
-          #     return unless type
-          #
-          #     check = type.tr('[^0-9].-', '')
-          #     type = cypher(type) unless match_known(known_gem_paths, check)
-          #     type
-          #   end
-          #
-          #   # Obfuscate a type and replace it with random characters.
-          #   #
-          #   # @param exception_type [String] the exception type to obfuscate
-          #   # @return [String] obfuscated exception type
-          #   def obfuscate_exception_type exception_type
-          #     return unless exception_type
-          #
-          #     exceptions = exception_type.split('::').each do |exception|
-          #       cypher(exception) unless match_known(known_modules, exception)
-          #     end
-          #     exceptions.join('::')
-          #   end
-          #
-          #   private
-          #
-          #   # Transforms string to regexp
-          #   #
-          #   # @param string [String]
-          #   def to_regexp string
-          #     /#{ string }/
-          #   end
-          #
-          #   # Add cypher to path to make it obscure, but unique enough for
-          #   # comparisons. Mutates original or duplicate if frozen string.
-          #   #
-          #   # @param string [String] string to be transformed.
-          #   def cypher string
-          #     string = string.dup if string.cs__frozen?
-          #     string.to_s.tr!(CHARS, CYPHER)
-          #   end
-          #
-          #   # @param known [Array<Regexp>] Array of regexp to match against
-          #   # @param type [String] type to check
-          #   def match_known known, type
-          #     known.any? { |regexp| type =~ regexp }
-          #   end
-          # end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb

@@ -1,19 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Telemetry
-      # This is the module that will include every information created and stored for the
-      # Telemetry Exceptions
-      module TelemetryException
-      end
-    end
-  end
-end
-
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_base'
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame'
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception'
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_message'
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_event'

data/lib/contrast/utils/telemetry_client.rb

@@ -1,107 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'net/http'
-require 'contrast/utils/net_http_base'
-require 'contrast/components/logger'
-require 'contrast/utils/object_share'
-require 'contrast/agent/version'
-require 'json'
-
-module Contrast
-  module Utils
-    # This module creates a Net::HTTP client and initiates a connection to the provided result
-    class TelemetryClient < NetHttpBase
-      include Contrast::Components::Logger::InstanceMethods
-      ENDPOINT = 'api/v1/telemetry/metrics' # /TelemetryEvent.path
-      EXCEPTIONS = 'api/v1/telemetry/exceptions' # /TelemetryExceptions::Event.path
-      SERVICE_NAME = 'Telemetry'
-      # This method initializes the Net::HTTP client we'll need. it will validate
-      # the connection and make the first request. If connection is valid and response
-      # is available then the open connection is returned.
-      #
-      # @param url [String]
-      # @return [Net::HTTP, nil] Return open connection or nil
-      def initialize_connection url
-        super(SERVICE_NAME, url, use_proxy: false, use_custom_cert: false)
-      end
-
-      # This method will be responsible for building the request. Because the telemetry collector expects to receive
-      # multiple events in a single request, we must always wrap the event in an array, even if there is only one.
-      #
-      # @param event [Contrast::Agent::Telemetry::Event, Array<Contrast::Agent::Telemetry::TelemetryException::Event>]
-      # @return [Net::HTTP::Post]
-      def build_request event
-        return unless valid_event?(event)
-
-        header = {
-            'User-Agent' => "<#{ Contrast::Utils::ObjectShare::RUBY }>-<#{ Contrast::Agent::VERSION }>",
-            'Content-Type' => 'application/json'
-        }
-        request = Net::HTTP::Post.new(build_path(event), header)
-        request.body = get_event_json(event)
-        request
-      end
-
-      # This method will create the actual request and send it
-      # @param event[Contrast::Agent::Telemetry::Event]
-      # @param connection[Net::HTTP]
-      def send_request event, connection
-        return if connection.nil? || event.nil?
-        return unless valid_event?(event)
-
-        req = build_request(event)
-        connection.request(req)
-      end
-
-      # This method will handle the response from the tenant
-      # @param res [Net::HTTPResponse]
-      # @return sleep_time [Integer, nil]
-      def handle_response res
-        status_code = res.code.to_i
-        ready_after = if res.to_hash.keys.map(&:downcase).include?('ready-after')
-                        res['Ready-After']
-                      else
-                        60
-                      end
-        ready_after if status_code == 429
-      end
-
-      # This method will be responsible for validating the event. Valid if event is of a known
-      # Contrast::Agent::Telemetry type
-      #
-      # @param event [Object]
-      def valid_event? event
-        return true if event.cs__is_a?(Contrast::Agent::Telemetry::Event)
-        return true if event.cs__is_a?(Contrast::Agent::Telemetry::StartupMetricsEvent)
-        return true if event.cs__is_a?(Contrast::Agent::Telemetry::TelemetryException::Event)
-
-        false
-      end
-
-      private
-
-      # The telemetry instance accepts any path to #{ Contrast::Agent::Telemetry::URL }#{ ENDPOINT }, using the
-      # remainder of the path to segregate messages.
-      #
-      # @param event [Contrast::Agent::Telemetry::Event, Contrast::Agent::Telemetry::TelemetryException::Event]
-      # @return [String] the fully qualified path to send the request
-      def build_path event
-        endpoint = Array(event).all?(Contrast::Agent::Telemetry::TelemetryException::Event) ? EXCEPTIONS : ENDPOINT
-        path = endpoint == EXCEPTIONS ? Contrast::Agent::Telemetry::TelemetryException::Event.path : event.path
-        "#{ Contrast::Agent::Telemetry::Base::URL }#{ endpoint }#{ path }"
-      end
-
-      # Helper Method to get json representation of Telemetry Event data, handles error on to_json
-      #
-      # @param event [Contrast::Agent::Telemetry::Event, Array<Contrast::Agent::Telemetry::TelemetryException::Event>]
-      # @return [String] - JSON
-      def get_event_json event
-        Array(event.to_controlled_hash).to_json
-      rescue Exception => e # rubocop:disable Lint/RescueException
-        logger.error('[Telemetry] Unable to convert TelemetryEvent to JSON string', e, hsh)
-        raise(e)
-      end
-    end
-  end
-end

data/lib/contrast/utils/telemetry_hash.rb

@@ -1,65 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/components/logger'
-require 'contrast/agent/telemetry/events/exceptions/telemetry_exception_event'
-
-module Contrast
-  module Utils
-    # This is the TelemetryHash, which will store Contrast::Agent::Telemetry::TelemetryException::Event, so we can push
-    # freely, without worrying about validating the event before that.  TelemetryHash has a max size of events,
-    # default is 10 events
-    class TelemetryHash < Hash
-      include Contrast::Components::Logger::InstanceMethods
-      HASH_SIZE_LIMIT = 10
-
-      # Wrapper to set a value in this TelemetryHash only if the provided value is of the data_type for this
-      # TelemetryHash or the hash has not reached its limit of for unique keys
-      #
-      # @param key [Object] the key to which to associate the value
-      # @param value [Object] the value to store
-      # @return [Object, nil] echo back out the value as the Hash#[]= method does, or nil if not of the expected
-      #   data_type
-      def []= key, value
-        return if exception_limit?
-        return unless valid_value?(value)
-
-        super(key, value)
-      end
-
-      # Increment the occurrences for the exception object contained in this TelemetryHash
-      #
-      # @param key [Object] the key to check for the exception stored in this TelemetryHash
-      def increment key
-        value = self[key]
-        return unless value&.exceptions&.any?
-
-        value.exceptions[0].increment_occurrences
-      end
-
-      # Determine if hash has reached exception event limit
-      # @return [Boolean]
-      def exception_limit?
-        unless size < HASH_SIZE_LIMIT
-          logger.debug("Number of TelemetryExceptions exceeds limit of #{ HASH_SIZE_LIMIT }")
-          return true
-        end
-        false
-      end
-
-      private
-
-      # Determine if the given value is valid based on the datatype which this TelemetryHash contains
-      # @param value [Object]
-      # @return boolean
-      def valid_value? value
-        unless value.cs__is_a?(Contrast::Agent::Telemetry::TelemetryException::Event)
-          logger.debug('The following key will be omitted', value: value)
-          return false
-        end
-
-        true
-      end
-    end
-  end
-end