contrast-agent 6.2.0 → 6.3.0

data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb

@@ -16,6 +16,8 @@ module Contrast
       # includes the literal URL and HTTP Verb used to invoke them, as they must have been called at this point to be
       # recorded.
       class DiscoveredRoute < Contrast::Agent::Reporting::ObservedRoute
+        include Contrast::Components::Logger::InstanceMethods
+
         class << self
           # @param obj [Regexp, Object]
           # @return [String]
@@ -104,7 +106,12 @@ module Contrast
         end
 
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('DiscoveredRoute validation failed with: ', e)
+            return
+          end
           { session_id: ::Contrast::ASSESS.session_id, signature: @signature, verb: @verb, url: @url }.compact
         end
 

data/lib/contrast/agent/reporting/reporting_events/finding.rb

@@ -130,7 +130,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('Finding event validation failed with: ', e)
+            return
+          end
+
           hsh = {
               created: created,
               hash: hash_code.to_s,

data/lib/contrast/agent/reporting/reporting_events/finding_event.rb

@@ -8,6 +8,7 @@ require 'contrast/agent/reporting/reporting_events/finding_event_signature'
 require 'contrast/agent/reporting/reporting_events/finding_event_source'
 require 'contrast/agent/reporting/reporting_events/finding_event_stack'
 require 'contrast/agent/reporting/reporting_events/finding_event_taint_range'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -17,6 +18,8 @@ module Contrast
       # construct the vulnerability information for the assess feature. They represent the operation the application
       # underwent that transformed data during the dataflow.
       class FindingEvent
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [Symbol] what the event did; CREATION, A2O, A2P, A2A, A2R, O2A, O2O, O2P, O2R, P2A, P2O, P2P, P2R,
         #   TAG, TRIGGER.
         attr_reader :action
@@ -120,7 +123,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash # rubocop:disable Metrics/AbcSize
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEvent validation failed with: ', e)
+            return
+          end
+
           {
               action: action,
               args: args.map(&:to_controlled_hash),

data/lib/contrast/agent/reporting/reporting_events/finding_event_object.rb

@@ -3,6 +3,7 @@
 
 require 'base64'
 require 'contrast/agent/assess/contrast_object'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -12,6 +13,8 @@ module Contrast
       # TeamServer to construct the vulnerability information for the assess feature. They represent those parts of the
       # objects that were acted on in a Dataflow Finding.
       class FindingEventObject
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [Integer] the id of the Object this represents.
         attr_reader :hash
         # @return [Boolean] if the Object is tracked or not
@@ -52,7 +55,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventObject validation failed with: ', e)
+            return
+          end
+
           {
               hash: hash,
               tracked: tracked,
@@ -60,6 +69,7 @@ module Contrast
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper hash. Unable to continue.") unless hash
           raise(ArgumentError, "#{ self } did not have a proper tracked. Unable to continue.") if tracked.nil?

data/lib/contrast/agent/reporting/reporting_events/finding_event_parent_object.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'base64'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -11,6 +12,8 @@ module Contrast
       # used by TeamServer to relate this event to those that came previously. They represent the events that directly
       # preceding the FindingEvent generated.
       class FindingEventParentObject
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [Integer] the Id of the parent event
         attr_reader :id
 
@@ -24,12 +27,19 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventParentObject validation failed with: ', e)
+            return
+          end
+
           {
               id: id
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper id. Unable to continue.") unless id
         end

data/lib/contrast/agent/reporting/reporting_events/finding_event_property.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Reporting
@@ -8,6 +10,8 @@ module Contrast
       # system to relay this information in the Finding/Trace messages. Events have properties on them which are held
       # as an array of key-value pairs.
       class FindingEventProperty
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the key of the property
         attr_reader :key
         # @return [String] the value of the source
@@ -24,13 +28,20 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventProperty validation failed with: ', e)
+            return
+          end
+
           {
               key: key,
               value: value
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper key. Unable to continue.") unless key && !key.empty?
         end

data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -11,6 +12,8 @@ module Contrast
       # TeamServer to construct the method signature for the assess feature. They represent the method invoked when the
       # FindingEvent was generated.
       class FindingEventSignature
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the types of the arguments in this event; may be different for each invocation of the
         #   method.
         attr_reader :arg_types
@@ -73,7 +76,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventSignature validation failed with: ', e)
+            return
+          end
+
           {
               argTypes: arg_types,
               className: class_name,

data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb

@@ -4,6 +4,7 @@
 require 'base64'
 require 'contrast/agent/assess/contrast_event'
 require 'contrast/agent/assess/events/source_event'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -13,6 +14,8 @@ module Contrast
       # to construct the vulnerability information for the assess feature. They indicate the type of data that the
       # event represents.
       class FindingEventSource
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the name of the source
         attr_reader :name
         # @return [String] the type of the source
@@ -45,13 +48,20 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventSource validation failed with: ', e)
+            return
+          end
+
           {
               sourceName: name, # rubocop:disable Security/Module/Name
               sourceType: type
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper type. Unable to continue.") unless type && !type.empty?
         end

data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Reporting
@@ -9,6 +11,8 @@ module Contrast
       # to construct the vulnerability information for the assess feature. They represent the callstack at the time
       # that each FindingEvent was generated.
       class FindingEventStack
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] unused
         attr_reader :eval
         # @return [String] the stack frame to show in TeamServer; the value of an entry in #caller
@@ -51,7 +55,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventStack validation failed with: ', e)
+            return
+          end
+
           {
               file: file
             # eval: eval, # This is unused by the Ruby agent

data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tag'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -11,6 +12,8 @@ module Contrast
       # TeamServer to construct the vulnerability information for the assess feature. They represent those parts of the
       # objects that are tracked because of a security relevant operation acting on them.
       class FindingEventTaintRange
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the range (inclusive:exclusive), that this tag covers.
         attr_reader :range
         # @return [String] the type of action this tag represents.
@@ -41,13 +44,20 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingEventTaintRange validation failed with: ', e)
+            return
+          end
+
           {
               range: range,
               tag: tag
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           unless range && !range.empty?
             raise(ArgumentError, "#{ self } did not have a proper range. Unable to continue.")

data/lib/contrast/agent/reporting/reporting_events/finding_request.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Reporting
@@ -9,6 +11,8 @@ module Contrast
       # HTTP information for the assess feature. They represent the literal request made that resulted in the
       # vulnerability being triggered.
       class FindingRequest
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the body of this request
         attr_reader :body
         # @return [Hash<String,Array<String>>] the headers of this request
@@ -68,7 +72,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('FindingRequest validation failed with: ', e)
+            return
+          end
+
           {
               body: body,
               headers: headers,

data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'
+require 'contrast/utils/string_utils'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -16,41 +18,31 @@ module Contrast
       # @attr_reader file [String] the name of the Gem. Required for reporting.
       # @attr_reader hash [String] the Sha256 of the Gem, matching its hash in RubyGems. Required for reporting.
       # @attr_reader internal_date [Integer] the time, in ms, when the Gem was published. Required for reporting.
-      # @attr_reader manifest [String] the YAML form of the Gem's specification.
+      # @attr_accessor manifest [String] the YAML form of the Gem's specification.
       # @attr_reader tags [String] Inventory tags set by the user via configuration.
       # @attr_reader url [String] The homepage of the Gem.
       # @attr_reader version [String] The version of the Gem.
       class LibraryDiscovery
+        include Contrast::Components::Logger::InstanceMethods
+
+        StringUtils = Contrast::Utils::StringUtils
+
         # required attributes
         attr_reader :external_date, :file, :hash, :internal_date
         # optional attributes
-        attr_reader :class_count, :manifest, :tags, :url, :version
-
-        class << self
-          # Convert a DTM for SpeedRacer to an Event for TeamServer.
-          #
-          # @param library_dtm [Contrast::Api::Dtm::Library]
-          # @return [Contrast::Agent::Reporting::LibraryDiscovery]
-          def convert library_dtm
-            report = new
-            report.attach_data(library_dtm)
-            report
-          end
-        end
+        attr_reader :class_count, :tags, :url, :version
+        attr_accessor :manifest
 
-        # Attach the data from the protobuf models to this reporter so that it can be sent to TeamServer directly
-        #
-        # @param library_dtm [Contrast::Api::Dtm::Library]
-        def attach_data library_dtm
-          @class_count = library_dtm.class_count
-          @external_date = library_dtm.external_ms
-          @file = library_dtm.file_path
-          @hash = library_dtm.hash_code
-          @internal_date = library_dtm.internal_ms
-          @manifest = library_dtm.manifest
+        def initialize digest, spec
+          @file = StringUtils.force_utf8(spec.name) # rubocop:disable Security/Module/Name
+          @hash = StringUtils.force_utf8(digest)
+          @version     = StringUtils.force_utf8(spec.version)
+          @manifest    = StringUtils.force_utf8(StringUtils.force_utf8(spec.to_yaml.to_s))
+          @external_date = (spec.date.to_f * 1000.0).to_i
+          @internal_date = @external_date
+          @url         = StringUtils.force_utf8(spec.homepage)
+          @class_count = Contrast::Utils::Sha256Builder.instance.files(spec.full_gem_path.to_s).length
           @tags = Contrast::INVENTORY.tags
-          @url = library_dtm.url
-          @version = library_dtm.version
         end
 
         # Convert the instance variables on the class, and other information, into the identifiers required for
@@ -59,8 +51,14 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
-          msg = {
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('LibraryDiscovery validation failed with: ', e)
+            return
+          end
+
+          {
               classCount: class_count,
               externalDate: external_date,
               file: file,
@@ -68,10 +66,9 @@ module Contrast
               internalDate: internal_date,
               manifest: manifest,
               url: url,
-              version: version
-          }
-          msg[:tags] = tags if tags
-          msg
+              version: version,
+              tags: tags
+          }.compact
         end
 
         # Ensure the required fields are present.

data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb

@@ -1,11 +1,15 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Reporting
       # The usage, meaning loaded files, of a library seen during this request
       class LibraryUsageObservation
+        include Contrast::Components::Logger::InstanceMethods
+
         # @param [String] Sha256Sum of library as identified by the agent
         attr_accessor :id
         # @param [Array<String>] List of file paths that have been loaded out of or executed by the library
@@ -18,14 +22,22 @@ module Contrast
           @names = class_names
         end
 
+        # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('LibraryUsageObservation validation failed with: ', e)
+            return
+          end
+
           {
               id: @id,
               names: @names
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper id. Unable to continue.") unless id
           raise(ArgumentError, "#{ self } did not have a proper names. Unable to continue.") if names.empty?

data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb

@@ -3,15 +3,16 @@
 
 require 'contrast/agent/reporting/reporting_events/application_reporting_event'
 require 'contrast/agent/reporting/reporting_events/library_usage_observation'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
     module Reporting
       # List of libraries that have been observed to have something loaded or executed.
-      #
       class ObservedLibraryUsage < Contrast::Agent::Reporting::ApplicationReportingEvent
-        # @attr_reader observations - Array[Contrast::Agent::Reporting::LibraryUsageObservation]
-        #                            - Hash of LibraryUsageObservations
+        include Contrast::Components::Logger::InstanceMethods
+
+        # @return Array[Contrast::Agent::Reporting::LibraryUsageObservation]
         attr_reader :observations
 
         def initialize
@@ -25,17 +26,19 @@ module Contrast
         end
 
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('ObservedLibraryUsage validation failed with: ', e)
+            return
+          end
+
           { observations: @observations.map(&:to_controlled_hash) }
         end
 
         def validate
           raise(ArgumentError, "#{ self } did not have observations. Unable to continue.") if observations.empty?
         end
-
-        def clear
-          @observations = []
-        end
       end
     end
   end

data/lib/contrast/agent/reporting/reporting_events/observed_route.rb

@@ -16,6 +16,8 @@ module Contrast
       # includes the literal URL and HTTP Verb used to invoke them, as they must have been called at this point to be
       # recorded.
       class ObservedRoute < Contrast::Agent::Reporting::ApplicationReportingEvent
+        include Contrast::Components::Logger::InstanceMethods
+
         # @param [String] the method signature used to uniquely identify the coverage report.
         attr_accessor :signature
         # @param [String] the normalized URL used to access the method in the route.
@@ -45,18 +47,23 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
-          rc_hash = {
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('ObservedRoute validation failed with: ', e)
+            return
+          end
+
+          {
               session_id: ::Contrast::ASSESS.session_id,
               sources: @sources.map(&:to_controlled_hash),
               signature: @signature,
               verb: @verb,
               url: @url
-          }
-          rc_hash.delete(:verb) unless @verb
-          rc_hash
+          }.compact
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ self } did not have a proper sources. Unable to continue.") if @sources.nil?
           raise(ArgumentError, "#{ self } did not have a proper signature. Unable to continue.") unless signature

data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb

@@ -38,7 +38,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('PreflightMessage validation failed with: ', e)
+            return
+          end
+
           {
               code: CODE,
               app_language: @app_language,
@@ -51,6 +57,7 @@ module Contrast
           }
         end
 
+        # @raise [ArgumentError]
         def validate
           raise(ArgumentError, "#{ cs__class } did not have a proper data. Unable to continue.") unless data
           unless @app_name

data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb

@@ -14,6 +14,8 @@ module Contrast
       #
       # @abstract
       class ReportingEvent
+        include Contrast::Components::Logger::InstanceMethods
+
         # @return [String] the endpoint, with host, to which this event should be sent
         attr_reader :event_endpoint
         # @return event_method [Symbol] the HTTP method to use to send this event
@@ -35,7 +37,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('ReportingEvent validation failed with: ', e)
+            return
+          end
+
           {}
         end
 

data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb

@@ -3,6 +3,7 @@
 
 require 'contrast/agent/reporting/reporting_events/route_discovery_observation'
 require 'contrast/api/dtm.pb'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -17,6 +18,8 @@ module Contrast
       # @attr_reader signature [String] the unique identifier for this route; typically the method signature. Required
       #   for reporting.
       class RouteDiscovery
+        include Contrast::Components::Logger::InstanceMethods
+
         # required attributes
         attr_reader :observations, :signature
 
@@ -47,7 +50,13 @@ module Contrast
         # @return [Hash]
         # @raise [ArgumentError]
         def to_controlled_hash
-          validate
+          begin
+            validate
+          rescue ArgumentError => e
+            logger.error('RouteDiscovery validation failed with: ', e)
+            return
+          end
+
           {
               count: 0, # we have this to make TS happy
               observations: @observations.map(&:to_controlled_hash),