contrast-agent 6.15.3 → 7.1.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.15.3
+  version: 7.1.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-02-23 00:00:00.000000000 Z
+date: 2023-04-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -277,6 +277,9 @@ dependencies:
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6'
     - - "~>"
       - !ruby/object:Gem::Version
         version: '7'
@@ -284,6 +287,9 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6'
     - - "~>"
       - !ruby/object:Gem::Version
         version: '7'
@@ -305,16 +311,16 @@ dependencies:
   name: async
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.30.3
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.30.3
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: execjs
   requirement: !ruby/object:Gem::Requirement
@@ -531,14 +537,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: tzinfo-data
   requirement: !ruby/object:Gem::Requirement
@@ -678,22 +684,22 @@ email:
 executables: []
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
-- ext/cs__scope/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__os_information/extconf.rb
-- ext/cs__assess_string/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_fiber_track/extconf.rb
 - ext/cs__assess_hash/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
 - ext/cs__assess_module/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_string/extconf.rb
 - ext/cs__assess_string_interpolation/extconf.rb
-- ext/cs__tests/extconf.rb
 - ext/cs__assess_test/extconf.rb
-- ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__contrast_patch/extconf.rb
+- ext/cs__os_information/extconf.rb
+- ext/cs__scope/extconf.rb
+- ext/cs__tests/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -1073,6 +1079,7 @@ files:
 - lib/contrast/agent/reporting/masker/masker_utils.rb
 - lib/contrast/agent/reporting/report.rb
 - lib/contrast/agent/reporting/reporter.rb
+- lib/contrast/agent/reporting/reporting_events/agent_effective_config.rb
 - lib/contrast/agent/reporting/reporting_events/agent_startup.rb
 - lib/contrast/agent/reporting/reporting_events/application_activity.rb
 - lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb
@@ -1218,11 +1225,17 @@ files:
 - lib/contrast/config/api_proxy_configuration.rb
 - lib/contrast/config/base_configuration.rb
 - lib/contrast/config/certification_configuration.rb
-- lib/contrast/config/config.rb
-- lib/contrast/config/diagnostics.rb
-- lib/contrast/config/diagnostics_tools.rb
-- lib/contrast/config/effective_config.rb
-- lib/contrast/config/effective_config_value.rb
+- lib/contrast/config/configuration_files.rb
+- lib/contrast/config/diagnostics/command_line.rb
+- lib/contrast/config/diagnostics/config.rb
+- lib/contrast/config/diagnostics/contrast_ui.rb
+- lib/contrast/config/diagnostics/effective_config.rb
+- lib/contrast/config/diagnostics/effective_config_value.rb
+- lib/contrast/config/diagnostics/environment_variables.rb
+- lib/contrast/config/diagnostics/monitor.rb
+- lib/contrast/config/diagnostics/source_config_value.rb
+- lib/contrast/config/diagnostics/tools.rb
+- lib/contrast/config/diagnostics/user_configuration_file.rb
 - lib/contrast/config/env_variables.rb
 - lib/contrast/config/exception_configuration.rb
 - lib/contrast/config/protect_rule_configuration.rb
@@ -1291,12 +1304,14 @@ files:
 - lib/contrast/utils/findings.rb
 - lib/contrast/utils/hash_digest.rb
 - lib/contrast/utils/hash_digest_extend.rb
+- lib/contrast/utils/hash_utils.rb
 - lib/contrast/utils/head_dump_utils_extend.rb
 - lib/contrast/utils/heap_dump_util.rb
 - lib/contrast/utils/input_classification_base.rb
 - lib/contrast/utils/invalid_configuration_util.rb
 - lib/contrast/utils/io_util.rb
 - lib/contrast/utils/job_servers_running.rb
+- lib/contrast/utils/json.rb
 - lib/contrast/utils/log_utils.rb
 - lib/contrast/utils/lru_cache.rb
 - lib/contrast/utils/metrics_hash.rb
@@ -1342,7 +1357,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
   - - "<"
     - !ruby/object:Gem::Version
       version: 3.3.0
@@ -1352,7 +1367,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.2.33
 signing_key: 
 specification_version: 4
 summary: Contrast Security's agent for rack-based applications.

data/lib/contrast/config/diagnostics_tools.rb

@@ -1,99 +0,0 @@
-# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-require 'contrast/config/effective_config_value'
-
-module Contrast
-  module Agent
-    module DiagnosticsConfig
-      # Diagnostics tools to be included in config components.
-      module DiagnosticsTools
-        CHECK = 'd'
-
-        # Converts current configuration for array of values to effective config values class and appends them to
-        # EffectiveConfig class. Must be used inside Config Components only.
-        #
-        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
-        # @param config_values [Array<String>] array of the names of values.
-        # @param canonical_prefix [String] starting of the path to config => api.proxy...
-        # @param name_prefix [String] the name of the config prefix => contrast.api_key, contrast.url
-        def add_effective_config_values effective_config, config_values, canonical_prefix, name_prefix
-          return if config_values.to_s.empty?
-
-          config_values.each do |config|
-            Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |value|
-              next if (config_val = send(config.to_sym)).to_s.empty?
-
-              config_name = assign_name(config)
-              value.canonical_name = "#{ canonical_prefix }.#{ config_name }"
-              value.name = "#{ name_prefix }.#{ config_name }"
-              value.value = config_val
-              value.source = Contrast::CONFIG.sources.get(value.canonical_name)
-              if value.source == Contrast::Components::Config::Sources::YAML
-                value.filename = Contrast::CONFIG.config_file_path
-              end
-              effective_config.values << value
-            rescue StandardError => e
-              log_error(e)
-              next
-            end
-          end
-        end
-
-        # Converts current configuration for single value to effective config values class and appends them to
-        # EffectiveConfig class. Must be used inside Config Components only.
-        #
-        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
-        # @param config_name [String] name of the config.
-        # @param config_value [String, Boolean] value of the config.
-        # @param canonical_prefix [String] starting of the path to config => api.proxy...
-        # @param name_prefix [String] the name of the config prefix => contrast.api_key, contrast.url
-        def add_single_effective_value effective_config, config_name, config_value, canonical_prefix, name_prefix
-          Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |value|
-            break if config_value.to_s.empty?
-
-            value.value = config_value
-            value.canonical_name = "#{ canonical_prefix }.#{ config_name }"
-            value.name = "#{ name_prefix }.#{ config_name }"
-            value.source = Contrast::CONFIG.sources.get(value.canonical_name)
-            if value.source == Contrast::Components::Config::Sources::YAML
-              value.filename = Contrast::CONFIG.config_file_path
-            end
-            effective_config.values << value
-          rescue StandardError => e
-            log_error(e)
-            next
-          end
-        end
-
-        private
-
-        # Assigns a proper name for the config removing '?' out of method names.
-        #
-        # @param config [String] name of the configuration
-        # @return [String]
-        def assign_name config
-          return Contrast::Utils::ObjectShare::EMPTY_STRING unless config
-
-          name = config.dup
-          if name.end_with?(Contrast::Utils::ObjectShare::QUESTION_MARK)
-            # check and remove '?' : start_bundled_service? => start_bundled_service
-            name.delete!(Contrast::Utils::ObjectShare::QUESTION_MARK)
-            name.chop! if name.end_with?(CHECK)
-            name
-          end
-          name
-        end
-
-        # Logs any caught error.
-        #
-        # @param error [StandardError]
-        def log_error error
-          Contrast::CONFIG.proto_logger.warn('Could not write effective config to file: ',
-                                             error: error, backtrace: error.backtrace)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/config/effective_config.rb

@@ -1,131 +0,0 @@
-# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/config/effective_config_value'
-require 'contrast/config/diagnostics_tools'
-require 'contrast/utils/object_share'
-
-module Contrast
-  module Agent
-    module DiagnosticsConfig
-      # The current effective config received from all authorized configuration channels.
-      class EffectiveConfig
-        NON_COMMON_ENV = %w[CONTRAST_CONFIG_PATH CONTRAST_AGENT_TELEMETRY_OPTOUT].cs__freeze
-
-        # Value of effective agent configurations
-        #
-        # @return [Array]
-        attr_reader :values
-
-        def initialize
-          @values = []
-        end
-
-        def to_controlled_hash
-          {
-              effective_config: { values: @values&.map(&:to_controlled_hash) },
-              user_configuration_file: yaml_config_settings,
-              environment_variable: environment_settings(ENV).map(&:to_controlled_hash),
-              command_line: command_line_settings.map(&:to_controlled_hash),
-              contrast_ui: contrast_ui_settings.map(&:to_controlled_hash)
-          }
-        end
-
-        private
-
-        def yaml_config_settings
-          {
-              path: Contrast::CONFIG.config_file_path,
-              values: value_to_s(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::YAML))
-          }
-        end
-
-        def command_line_settings
-          cli = flatten_settings(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::CLI))
-          flat_settings(cli)
-        end
-
-        def contrast_ui_settings
-          ui = flatten_settings(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::CONTRASTUI))
-          flat_settings(ui)
-        end
-
-        # @param flats [Array] of flatten configs produced by #flatten_settings
-        # @return [Array]
-        def flat_settings flats
-          ui_settings = []
-          flats.each do |entry|
-            entry.each do |key, value|
-              efc_value = Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |effective_value|
-                effective_value.canonical_name = Contrast::Utils::ObjectShare::CONTRAST_DOT + key
-                effective_value.name = key
-                effective_value.value = value_to_s(value)
-              end
-              ui_settings << efc_value if efc_value
-            end
-          end
-          ui_settings
-        end
-
-        def flatten_settings data, path = []
-          data.each_with_object([]) do |(k, v), entries|
-            if v.cs__is_a?(Hash)
-              entries.concat(flatten_settings(v, path.dup.append(k.to_sym)))
-            else
-              entries << { "#{ path.join('.') }.#{ k }" => Contrast::CONFIG.config.loaded_config.dig(*path, k).to_s }
-            end
-          end.flatten # rubocop:disable Style/MethodCalledOnDoEndBlock
-        end
-
-        # This method will fill the canonical name for each env var and will check for any uncommon ones.
-        #
-        # @param env [Hash]
-        # @return [Array] array of all the values needed to be written.
-        def environment_settings env
-          env_hash = env.select do |e|
-            e.to_s.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) || NON_COMMON_ENV.include?(e.to_s)
-          end
-          environment_settings = []
-          env_hash.each do |key, value|
-            efc_value = Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |effective_value|
-              next unless value
-
-              effective_value.canonical_name = if NON_COMMON_ENV.include?(key)
-                                                 key.gsub(Contrast::Utils::ObjectShare::UNDERSCORE,
-                                                          Contrast::Utils::ObjectShare::PERIOD).downcase
-                                               else
-                                                 key.gsub(Contrast::Utils::ObjectShare::DOUBLE_UNDERSCORE,
-                                                          Contrast::Utils::ObjectShare::PERIOD).downcase
-                                               end
-              if effective_value.canonical_name
-                effective_value.name =
-                  effective_value.canonical_name.gsub(Contrast::Utils::ObjectShare::CONTRAST_DOT,
-                                                      Contrast::Utils::ObjectShare::EMPTY_STRING)
-              end
-              effective_value.value = value_to_s(value)
-            end
-            environment_settings << efc_value if efc_value
-          end
-          environment_settings
-        end
-
-        # Recursively converts each value to string.
-        #
-        # @param value [Hash]
-        def value_to_s value
-          return value if value.cs__is_a?(String)
-
-          value.each_with_object({}) do |(k, v), m| # rubocop:disable Style/HashTransformValues
-            m[k] = if v.cs__is_a?(Hash)
-                     value_to_s(v)
-                   elsif v.cs__is_a?(Array)
-                     v.map(&:to_s)
-                   else
-                     v.to_s
-                   end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/config/effective_config_value.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module DiagnosticsConfig
-      # All In effect config values stored in a easy to write representation.
-      class EffectiveConfigValue
-        # @return [String] Name of the config starting form root of yaml config.
-        attr_accessor :canonical_name
-        # @return [String] Name of the config.
-        attr_accessor :name
-        # @return [String] Value set for the config.
-        attr_accessor :value
-        # @return [String] The source for the entry in the config.
-        attr_accessor :source
-        # @return [String,nil] The filename for the source of the config, if the source was "yaml".
-        attr_accessor :filename
-
-        def to_controlled_hash
-          {
-              canonical_name: canonical_name,
-              name: name, # rubocop:disable Security/Module/Name
-              value: value&.cs__is_a?(Array) ? value.map(&:to_s) : value.to_s,
-              source: source,
-              filename: filename
-          }.compact
-        end
-      end
-    end
-  end
-end