contrast-agent 6.2.0 → 6.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (110) hide show
  1. checksums.yaml +4 -4
  2. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +7 -5
  3. data/ext/cs__assess_kernel/cs__assess_kernel.c +14 -3
  4. data/ext/cs__assess_kernel/cs__assess_kernel.h +2 -0
  5. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +10 -3
  6. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +2 -1
  7. data/ext/cs__assess_regexp/cs__assess_regexp.c +9 -7
  8. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.c → cs__assess_string_interpolation/cs__assess_string_interpolation.c} +14 -3
  9. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.h → cs__assess_string_interpolation/cs__assess_string_interpolation.h} +1 -1
  10. data/ext/{cs__assess_string_interpolation26 → cs__assess_string_interpolation}/extconf.rb +0 -0
  11. data/ext/cs__common/cs__common.c +5 -4
  12. data/ext/cs__contrast_patch/cs__contrast_patch.c +3 -10
  13. data/lib/contrast/agent/assess/events/source_event.rb +16 -12
  14. data/lib/contrast/agent/assess/policy/policy_node.rb +6 -0
  15. data/lib/contrast/agent/assess/policy/propagation_method.rb +3 -39
  16. data/lib/contrast/agent/assess/policy/propagation_node.rb +8 -0
  17. data/lib/contrast/agent/assess/policy/propagator/base.rb +2 -0
  18. data/lib/contrast/agent/assess/policy/source_method.rb +2 -47
  19. data/lib/contrast/agent/assess/policy/source_node.rb +1 -0
  20. data/lib/contrast/agent/assess/policy/trigger_node.rb +8 -0
  21. data/lib/contrast/agent/assess/property/evented.rb +4 -18
  22. data/lib/contrast/agent/assess/tag.rb +19 -0
  23. data/lib/contrast/agent/at_exit_hook.rb +8 -8
  24. data/lib/contrast/agent/inventory/database_config.rb +6 -3
  25. data/lib/contrast/agent/inventory/dependency_analysis.rb +3 -2
  26. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +10 -10
  27. data/lib/contrast/agent/middleware.rb +4 -0
  28. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +27 -2
  29. data/lib/contrast/agent/patching/policy/policy.rb +5 -0
  30. data/lib/contrast/agent/patching/policy/policy_node.rb +6 -0
  31. data/lib/contrast/agent/patching/policy/trigger_node.rb +3 -0
  32. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +3 -4
  33. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -0
  34. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  35. data/lib/contrast/agent/protect/rule/base.rb +1 -0
  36. data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -0
  37. data/lib/contrast/agent/reporting/reporter.rb +32 -7
  38. data/lib/contrast/agent/reporting/reporter_heartbeat.rb +21 -15
  39. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +5 -24
  40. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +8 -1
  41. data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +8 -1
  42. data/lib/contrast/agent/reporting/reporting_events/finding.rb +7 -1
  43. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +10 -1
  44. data/lib/contrast/agent/reporting/reporting_events/finding_event_object.rb +11 -1
  45. data/lib/contrast/agent/reporting/reporting_events/finding_event_parent_object.rb +11 -1
  46. data/lib/contrast/agent/reporting/reporting_events/finding_event_property.rb +12 -1
  47. data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -1
  48. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +11 -1
  49. data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb +11 -1
  50. data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb +11 -1
  51. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +11 -1
  52. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +29 -32
  53. data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +13 -1
  54. data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +11 -8
  55. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +12 -5
  56. data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +8 -1
  57. data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +9 -1
  58. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +10 -1
  59. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +11 -4
  60. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -8
  61. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +1 -4
  62. data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +0 -22
  63. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +1 -3
  64. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +1 -11
  65. data/lib/contrast/agent/request.rb +5 -7
  66. data/lib/contrast/agent/request_context.rb +8 -17
  67. data/lib/contrast/agent/request_context_extend.rb +8 -9
  68. data/lib/contrast/agent/request_handler.rb +9 -38
  69. data/lib/contrast/agent/rule_set.rb +4 -0
  70. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  71. data/lib/contrast/agent/static_analysis.rb +6 -11
  72. data/lib/contrast/agent/telemetry/base.rb +35 -35
  73. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb +2 -0
  74. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +2 -0
  75. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb +5 -2
  76. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb +3 -0
  77. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb +3 -0
  78. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb +0 -1
  79. data/lib/contrast/agent/thread_watcher.rb +1 -4
  80. data/lib/contrast/agent/version.rb +1 -1
  81. data/lib/contrast/api/communication/socket.rb +1 -0
  82. data/lib/contrast/api/decorators/message.rb +0 -6
  83. data/lib/contrast/api/decorators.rb +0 -2
  84. data/lib/contrast/components/assess.rb +0 -6
  85. data/lib/contrast/components/config.rb +18 -2
  86. data/lib/contrast/config/base_configuration.rb +0 -13
  87. data/lib/contrast/config/root_configuration.rb +1 -0
  88. data/lib/contrast/config/ruby_configuration.rb +2 -9
  89. data/lib/contrast/configuration.rb +0 -2
  90. data/lib/contrast/extension/assess/eval_trigger.rb +0 -4
  91. data/lib/contrast/extension/assess/hash.rb +3 -2
  92. data/lib/contrast/extension/assess/kernel.rb +22 -0
  93. data/lib/contrast/extension/assess/marshal.rb +16 -0
  94. data/lib/contrast/extension/assess/string.rb +21 -20
  95. data/lib/contrast/framework/base_support.rb +8 -0
  96. data/lib/contrast/framework/manager.rb +6 -20
  97. data/lib/contrast/framework/manager_extend.rb +0 -1
  98. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +11 -16
  99. data/lib/contrast/logger/aliased_logging.rb +2 -0
  100. data/lib/contrast/utils/assess/source_method_utils.rb +0 -9
  101. data/lib/contrast/utils/lru_cache.rb +3 -0
  102. data/lib/contrast/utils/middleware_utils.rb +2 -0
  103. data/lib/contrast/utils/telemetry_client.rb +7 -7
  104. data/resources/assess/policy.json +2 -11
  105. data/ruby-agent.gemspec +1 -1
  106. metadata +22 -20
  107. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb +0 -30
  108. data/lib/contrast/api/decorators/application_update.rb +0 -44
  109. data/lib/contrast/api/decorators/library.rb +0 -56
  110. data/lib/contrast/framework/platform_version.rb +0 -22
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.2.0
4
+ version: 6.3.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2022-05-27 00:00:00.000000000 Z
16
+ date: 2022-06-06 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: bundler
@@ -585,16 +585,22 @@ dependencies:
585
585
  name: ougai
586
586
  requirement: !ruby/object:Gem::Requirement
587
587
  requirements:
588
- - - "~>"
588
+ - - ">="
589
589
  - !ruby/object:Gem::Version
590
590
  version: '1.8'
591
+ - - "<"
592
+ - !ruby/object:Gem::Version
593
+ version: 3.0.0
591
594
  type: :runtime
592
595
  prerelease: false
593
596
  version_requirements: !ruby/object:Gem::Requirement
594
597
  requirements:
595
- - - "~>"
598
+ - - ">="
596
599
  - !ruby/object:Gem::Version
597
600
  version: '1.8'
601
+ - - "<"
602
+ - !ruby/object:Gem::Version
603
+ version: 3.0.0
598
604
  - !ruby/object:Gem::Dependency
599
605
  name: protobuf
600
606
  requirement: !ruby/object:Gem::Requirement
@@ -631,22 +637,22 @@ executables:
631
637
  - contrast_service
632
638
  extensions:
633
639
  - ext/cs__common/extconf.rb
634
- - ext/cs__assess_string_interpolation26/extconf.rb
635
- - ext/cs__assess_array/extconf.rb
640
+ - ext/cs__assess_regexp/extconf.rb
636
641
  - ext/cs__assess_basic_object/extconf.rb
637
- - ext/cs__assess_fiber_track/extconf.rb
638
642
  - ext/cs__assess_hash/extconf.rb
643
+ - ext/cs__assess_fiber_track/extconf.rb
644
+ - ext/cs__assess_string_interpolation/extconf.rb
645
+ - ext/cs__assess_kernel/extconf.rb
639
646
  - ext/cs__assess_marshal_module/extconf.rb
647
+ - ext/cs__contrast_patch/extconf.rb
648
+ - ext/cs__os_information/extconf.rb
649
+ - ext/cs__assess_array/extconf.rb
650
+ - ext/cs__tests/extconf.rb
651
+ - ext/cs__assess_module/extconf.rb
640
652
  - ext/cs__assess_yield_track/extconf.rb
641
653
  - ext/cs__assess_string/extconf.rb
642
- - ext/cs__assess_regexp/extconf.rb
643
- - ext/cs__os_information/extconf.rb
644
654
  - ext/cs__scope/extconf.rb
645
655
  - ext/cs__assess_test/extconf.rb
646
- - ext/cs__tests/extconf.rb
647
- - ext/cs__assess_kernel/extconf.rb
648
- - ext/cs__assess_module/extconf.rb
649
- - ext/cs__contrast_patch/extconf.rb
650
656
  extra_rdoc_files: []
651
657
  files:
652
658
  - ".clang-format"
@@ -689,9 +695,9 @@ files:
689
695
  - ext/cs__assess_string/cs__assess_string.c
690
696
  - ext/cs__assess_string/cs__assess_string.h
691
697
  - ext/cs__assess_string/extconf.rb
692
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c
693
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h
694
- - ext/cs__assess_string_interpolation26/extconf.rb
698
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.c
699
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.h
700
+ - ext/cs__assess_string_interpolation/extconf.rb
695
701
  - ext/cs__assess_test/cs__assess_test.h
696
702
  - ext/cs__assess_test/cs__assess_tests.c
697
703
  - ext/cs__assess_test/extconf.rb
@@ -1096,7 +1102,6 @@ files:
1096
1102
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb
1097
1103
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb
1098
1104
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb
1099
- - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb
1100
1105
  - lib/contrast/agent/telemetry/events/metric_event.rb
1101
1106
  - lib/contrast/agent/telemetry/events/startup_metrics_event.rb
1102
1107
  - lib/contrast/agent/thread.rb
@@ -1122,7 +1127,6 @@ files:
1122
1127
  - lib/contrast/api/decorators/agent_startup.rb
1123
1128
  - lib/contrast/api/decorators/application_settings.rb
1124
1129
  - lib/contrast/api/decorators/application_startup.rb
1125
- - lib/contrast/api/decorators/application_update.rb
1126
1130
  - lib/contrast/api/decorators/architecture_component.rb
1127
1131
  - lib/contrast/api/decorators/bot_blocker.rb
1128
1132
  - lib/contrast/api/decorators/finding.rb
@@ -1130,7 +1134,6 @@ files:
1130
1134
  - lib/contrast/api/decorators/input_analysis.rb
1131
1135
  - lib/contrast/api/decorators/instrumentation_mode.rb
1132
1136
  - lib/contrast/api/decorators/ip_denylist.rb
1133
- - lib/contrast/api/decorators/library.rb
1134
1137
  - lib/contrast/api/decorators/message.rb
1135
1138
  - lib/contrast/api/decorators/rasp_rule_sample.rb
1136
1139
  - lib/contrast/api/decorators/response_type.rb
@@ -1206,7 +1209,6 @@ files:
1206
1209
  - lib/contrast/framework/grape/support.rb
1207
1210
  - lib/contrast/framework/manager.rb
1208
1211
  - lib/contrast/framework/manager_extend.rb
1209
- - lib/contrast/framework/platform_version.rb
1210
1212
  - lib/contrast/framework/rack/patch/session_cookie.rb
1211
1213
  - lib/contrast/framework/rack/patch/support.rb
1212
1214
  - lib/contrast/framework/rack/support.rb
@@ -1,30 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Telemetry
7
- # This module will handle the reporting of the TelemetryExceptionHash
8
- module TelemetryExceptionReport
9
- # Here we will send any exceptions gathered. The telemetry_hash is split into batches of 256
10
- # and then added to the telemetry queue. Since this method is called before entering the
11
- # until queue loop any updates after clearing the Contrast::TELEMETRY_EXCEPTIONS would have
12
- # to wait for the sending process to be completed, so accumulating new batches.
13
- # This methods expects queue and error_messages methods from Contrast::Agent::Telemetry::Base
14
- def push_exceptions
15
- return unless Contrast::TELEMETRY_EXCEPTIONS&.any?
16
-
17
- Contrast::TELEMETRY_EXCEPTIONS.each_value { |value| error_messages.push(value) }
18
- # Clear the hash. All exceptions now live in @_error_messages instance variable. and we will
19
- # add them to the queue. Clearing would make the hash available to be populated again while the
20
- # sending is proceeding.
21
- Contrast::TELEMETRY_EXCEPTIONS.clear
22
- # Add batch to queue. We need to shift here, because we want to report from the oldest batch to
23
- # the newest. And even if somehow the array is filled during sending the new messages would stay
24
- # and wait their turn.
25
- queue << error_messages.shift until error_messages.empty?
26
- end
27
- end
28
- end
29
- end
30
- end
@@ -1,44 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
10
- # model so it can own some of the data massaging required for AppUpdate
11
- # dtm.
12
- module ApplicationUpdate
13
- def self.included klass
14
- klass.extend(ClassMethods)
15
- end
16
-
17
- def append_library_update library_dtm_list
18
- library_dtm_list.each do |library_dtm|
19
- libraries[library_dtm.hash_code] = library_dtm
20
- end
21
- end
22
-
23
- def append_platform_version platform_version
24
- self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
25
- platform.major = platform_version.major
26
- platform.minor = platform_version.minor
27
- platform.build = platform_version.patch
28
- end
29
-
30
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
31
- module ClassMethods
32
- def build
33
- msg = new
34
- msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
35
- msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
36
- msg
37
- end
38
- end
39
- end
40
- end
41
- end
42
- end
43
-
44
- Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)
@@ -1,56 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
- require 'contrast/utils/sha256_builder'
6
- require 'yaml'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the Library protobuf model to handle Gem::Specification translation
12
- module Library
13
- StringUtils = Contrast::Utils::StringUtils
14
-
15
- def self.included klass
16
- klass.extend(ClassMethods)
17
- end
18
-
19
- # Used to add class methods to the Library class on inclusion of the decorator
20
- module ClassMethods
21
- def build digest, gem_specification
22
- msg = new
23
- msg.file_path = StringUtils.force_utf8(gem_specification.name) # rubocop:disable Security/Module/Name
24
- msg.hash_code = StringUtils.force_utf8(digest)
25
- msg.version = StringUtils.force_utf8(gem_specification.version)
26
- msg.manifest = StringUtils.force_utf8(build_manifest(gem_specification))
27
- msg.external_ms = date_to_ms(gem_specification.date)
28
- msg.internal_ms = msg.external_ms
29
- msg.url = StringUtils.force_utf8(gem_specification.homepage)
30
- msg.class_count = file_count(gem_specification.full_gem_path.to_s)
31
- msg.used_class_count = 0
32
- msg
33
- end
34
-
35
- # These are all the code files that are located in the Gem directory loaded
36
- # by the current environment; this includes more than Ruby files
37
- def file_count path
38
- Contrast::Utils::Sha256Builder.instance.files(path).length
39
- end
40
-
41
- def build_manifest spec
42
- StringUtils.force_utf8(spec.to_yaml.to_s)
43
- rescue StandardError
44
- nil
45
- end
46
-
47
- def date_to_ms date
48
- (date.to_f * 1000.0).to_i
49
- end
50
- end
51
- end
52
- end
53
- end
54
- end
55
-
56
- Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)
@@ -1,22 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Framework
6
- # Used to map version strings from frameworks to ApplicationUpdate dtm
7
- class PlatformVersion
8
- attr_reader :major, :minor, :patch
9
-
10
- def initialize major, minor, patch
11
- @major = major || ''
12
- @minor = minor || ''
13
- @patch = patch || ''
14
- end
15
-
16
- def self.from_string platform_version_string
17
- version_array = platform_version_string.split(Contrast::Utils::ObjectShare::PERIOD)
18
- new(version_array[0], version_array[1], version_array[2])
19
- end
20
- end
21
- end
22
- end