contrast-agent 6.2.0 → 6.3.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (110) hide show
  1. checksums.yaml +4 -4
  2. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +7 -5
  3. data/ext/cs__assess_kernel/cs__assess_kernel.c +14 -3
  4. data/ext/cs__assess_kernel/cs__assess_kernel.h +2 -0
  5. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +10 -3
  6. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +2 -1
  7. data/ext/cs__assess_regexp/cs__assess_regexp.c +9 -7
  8. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.c → cs__assess_string_interpolation/cs__assess_string_interpolation.c} +14 -3
  9. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.h → cs__assess_string_interpolation/cs__assess_string_interpolation.h} +1 -1
  10. data/ext/{cs__assess_string_interpolation26 → cs__assess_string_interpolation}/extconf.rb +0 -0
  11. data/ext/cs__common/cs__common.c +5 -4
  12. data/ext/cs__contrast_patch/cs__contrast_patch.c +3 -10
  13. data/lib/contrast/agent/assess/events/source_event.rb +16 -12
  14. data/lib/contrast/agent/assess/policy/policy_node.rb +6 -0
  15. data/lib/contrast/agent/assess/policy/propagation_method.rb +3 -39
  16. data/lib/contrast/agent/assess/policy/propagation_node.rb +8 -0
  17. data/lib/contrast/agent/assess/policy/propagator/base.rb +2 -0
  18. data/lib/contrast/agent/assess/policy/source_method.rb +2 -47
  19. data/lib/contrast/agent/assess/policy/source_node.rb +1 -0
  20. data/lib/contrast/agent/assess/policy/trigger_node.rb +8 -0
  21. data/lib/contrast/agent/assess/property/evented.rb +4 -18
  22. data/lib/contrast/agent/assess/tag.rb +19 -0
  23. data/lib/contrast/agent/at_exit_hook.rb +8 -8
  24. data/lib/contrast/agent/inventory/database_config.rb +6 -3
  25. data/lib/contrast/agent/inventory/dependency_analysis.rb +3 -2
  26. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +10 -10
  27. data/lib/contrast/agent/middleware.rb +4 -0
  28. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +27 -2
  29. data/lib/contrast/agent/patching/policy/policy.rb +5 -0
  30. data/lib/contrast/agent/patching/policy/policy_node.rb +6 -0
  31. data/lib/contrast/agent/patching/policy/trigger_node.rb +3 -0
  32. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +3 -4
  33. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -0
  34. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  35. data/lib/contrast/agent/protect/rule/base.rb +1 -0
  36. data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -0
  37. data/lib/contrast/agent/reporting/reporter.rb +32 -7
  38. data/lib/contrast/agent/reporting/reporter_heartbeat.rb +21 -15
  39. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +5 -24
  40. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +8 -1
  41. data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +8 -1
  42. data/lib/contrast/agent/reporting/reporting_events/finding.rb +7 -1
  43. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +10 -1
  44. data/lib/contrast/agent/reporting/reporting_events/finding_event_object.rb +11 -1
  45. data/lib/contrast/agent/reporting/reporting_events/finding_event_parent_object.rb +11 -1
  46. data/lib/contrast/agent/reporting/reporting_events/finding_event_property.rb +12 -1
  47. data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -1
  48. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +11 -1
  49. data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb +11 -1
  50. data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb +11 -1
  51. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +11 -1
  52. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +29 -32
  53. data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +13 -1
  54. data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +11 -8
  55. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +12 -5
  56. data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +8 -1
  57. data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +9 -1
  58. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +10 -1
  59. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +11 -4
  60. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -8
  61. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +1 -4
  62. data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +0 -22
  63. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +1 -3
  64. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +1 -11
  65. data/lib/contrast/agent/request.rb +5 -7
  66. data/lib/contrast/agent/request_context.rb +8 -17
  67. data/lib/contrast/agent/request_context_extend.rb +8 -9
  68. data/lib/contrast/agent/request_handler.rb +9 -38
  69. data/lib/contrast/agent/rule_set.rb +4 -0
  70. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  71. data/lib/contrast/agent/static_analysis.rb +6 -11
  72. data/lib/contrast/agent/telemetry/base.rb +35 -35
  73. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb +2 -0
  74. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +2 -0
  75. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb +5 -2
  76. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb +3 -0
  77. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb +3 -0
  78. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb +0 -1
  79. data/lib/contrast/agent/thread_watcher.rb +1 -4
  80. data/lib/contrast/agent/version.rb +1 -1
  81. data/lib/contrast/api/communication/socket.rb +1 -0
  82. data/lib/contrast/api/decorators/message.rb +0 -6
  83. data/lib/contrast/api/decorators.rb +0 -2
  84. data/lib/contrast/components/assess.rb +0 -6
  85. data/lib/contrast/components/config.rb +18 -2
  86. data/lib/contrast/config/base_configuration.rb +0 -13
  87. data/lib/contrast/config/root_configuration.rb +1 -0
  88. data/lib/contrast/config/ruby_configuration.rb +2 -9
  89. data/lib/contrast/configuration.rb +0 -2
  90. data/lib/contrast/extension/assess/eval_trigger.rb +0 -4
  91. data/lib/contrast/extension/assess/hash.rb +3 -2
  92. data/lib/contrast/extension/assess/kernel.rb +22 -0
  93. data/lib/contrast/extension/assess/marshal.rb +16 -0
  94. data/lib/contrast/extension/assess/string.rb +21 -20
  95. data/lib/contrast/framework/base_support.rb +8 -0
  96. data/lib/contrast/framework/manager.rb +6 -20
  97. data/lib/contrast/framework/manager_extend.rb +0 -1
  98. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +11 -16
  99. data/lib/contrast/logger/aliased_logging.rb +2 -0
  100. data/lib/contrast/utils/assess/source_method_utils.rb +0 -9
  101. data/lib/contrast/utils/lru_cache.rb +3 -0
  102. data/lib/contrast/utils/middleware_utils.rb +2 -0
  103. data/lib/contrast/utils/telemetry_client.rb +7 -7
  104. data/resources/assess/policy.json +2 -11
  105. data/ruby-agent.gemspec +1 -1
  106. metadata +22 -20
  107. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb +0 -30
  108. data/lib/contrast/api/decorators/application_update.rb +0 -44
  109. data/lib/contrast/api/decorators/library.rb +0 -56
  110. data/lib/contrast/framework/platform_version.rb +0 -22
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.2.0
4
+ version: 6.3.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2022-05-27 00:00:00.000000000 Z
16
+ date: 2022-06-06 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: bundler
@@ -585,16 +585,22 @@ dependencies:
585
585
  name: ougai
586
586
  requirement: !ruby/object:Gem::Requirement
587
587
  requirements:
588
- - - "~>"
588
+ - - ">="
589
589
  - !ruby/object:Gem::Version
590
590
  version: '1.8'
591
+ - - "<"
592
+ - !ruby/object:Gem::Version
593
+ version: 3.0.0
591
594
  type: :runtime
592
595
  prerelease: false
593
596
  version_requirements: !ruby/object:Gem::Requirement
594
597
  requirements:
595
- - - "~>"
598
+ - - ">="
596
599
  - !ruby/object:Gem::Version
597
600
  version: '1.8'
601
+ - - "<"
602
+ - !ruby/object:Gem::Version
603
+ version: 3.0.0
598
604
  - !ruby/object:Gem::Dependency
599
605
  name: protobuf
600
606
  requirement: !ruby/object:Gem::Requirement
@@ -631,22 +637,22 @@ executables:
631
637
  - contrast_service
632
638
  extensions:
633
639
  - ext/cs__common/extconf.rb
634
- - ext/cs__assess_string_interpolation26/extconf.rb
635
- - ext/cs__assess_array/extconf.rb
640
+ - ext/cs__assess_regexp/extconf.rb
636
641
  - ext/cs__assess_basic_object/extconf.rb
637
- - ext/cs__assess_fiber_track/extconf.rb
638
642
  - ext/cs__assess_hash/extconf.rb
643
+ - ext/cs__assess_fiber_track/extconf.rb
644
+ - ext/cs__assess_string_interpolation/extconf.rb
645
+ - ext/cs__assess_kernel/extconf.rb
639
646
  - ext/cs__assess_marshal_module/extconf.rb
647
+ - ext/cs__contrast_patch/extconf.rb
648
+ - ext/cs__os_information/extconf.rb
649
+ - ext/cs__assess_array/extconf.rb
650
+ - ext/cs__tests/extconf.rb
651
+ - ext/cs__assess_module/extconf.rb
640
652
  - ext/cs__assess_yield_track/extconf.rb
641
653
  - ext/cs__assess_string/extconf.rb
642
- - ext/cs__assess_regexp/extconf.rb
643
- - ext/cs__os_information/extconf.rb
644
654
  - ext/cs__scope/extconf.rb
645
655
  - ext/cs__assess_test/extconf.rb
646
- - ext/cs__tests/extconf.rb
647
- - ext/cs__assess_kernel/extconf.rb
648
- - ext/cs__assess_module/extconf.rb
649
- - ext/cs__contrast_patch/extconf.rb
650
656
  extra_rdoc_files: []
651
657
  files:
652
658
  - ".clang-format"
@@ -689,9 +695,9 @@ files:
689
695
  - ext/cs__assess_string/cs__assess_string.c
690
696
  - ext/cs__assess_string/cs__assess_string.h
691
697
  - ext/cs__assess_string/extconf.rb
692
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c
693
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h
694
- - ext/cs__assess_string_interpolation26/extconf.rb
698
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.c
699
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.h
700
+ - ext/cs__assess_string_interpolation/extconf.rb
695
701
  - ext/cs__assess_test/cs__assess_test.h
696
702
  - ext/cs__assess_test/cs__assess_tests.c
697
703
  - ext/cs__assess_test/extconf.rb
@@ -1096,7 +1102,6 @@ files:
1096
1102
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb
1097
1103
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb
1098
1104
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb
1099
- - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb
1100
1105
  - lib/contrast/agent/telemetry/events/metric_event.rb
1101
1106
  - lib/contrast/agent/telemetry/events/startup_metrics_event.rb
1102
1107
  - lib/contrast/agent/thread.rb
@@ -1122,7 +1127,6 @@ files:
1122
1127
  - lib/contrast/api/decorators/agent_startup.rb
1123
1128
  - lib/contrast/api/decorators/application_settings.rb
1124
1129
  - lib/contrast/api/decorators/application_startup.rb
1125
- - lib/contrast/api/decorators/application_update.rb
1126
1130
  - lib/contrast/api/decorators/architecture_component.rb
1127
1131
  - lib/contrast/api/decorators/bot_blocker.rb
1128
1132
  - lib/contrast/api/decorators/finding.rb
@@ -1130,7 +1134,6 @@ files:
1130
1134
  - lib/contrast/api/decorators/input_analysis.rb
1131
1135
  - lib/contrast/api/decorators/instrumentation_mode.rb
1132
1136
  - lib/contrast/api/decorators/ip_denylist.rb
1133
- - lib/contrast/api/decorators/library.rb
1134
1137
  - lib/contrast/api/decorators/message.rb
1135
1138
  - lib/contrast/api/decorators/rasp_rule_sample.rb
1136
1139
  - lib/contrast/api/decorators/response_type.rb
@@ -1206,7 +1209,6 @@ files:
1206
1209
  - lib/contrast/framework/grape/support.rb
1207
1210
  - lib/contrast/framework/manager.rb
1208
1211
  - lib/contrast/framework/manager_extend.rb
1209
- - lib/contrast/framework/platform_version.rb
1210
1212
  - lib/contrast/framework/rack/patch/session_cookie.rb
1211
1213
  - lib/contrast/framework/rack/patch/support.rb
1212
1214
  - lib/contrast/framework/rack/support.rb
@@ -1,30 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Telemetry
7
- # This module will handle the reporting of the TelemetryExceptionHash
8
- module TelemetryExceptionReport
9
- # Here we will send any exceptions gathered. The telemetry_hash is split into batches of 256
10
- # and then added to the telemetry queue. Since this method is called before entering the
11
- # until queue loop any updates after clearing the Contrast::TELEMETRY_EXCEPTIONS would have
12
- # to wait for the sending process to be completed, so accumulating new batches.
13
- # This methods expects queue and error_messages methods from Contrast::Agent::Telemetry::Base
14
- def push_exceptions
15
- return unless Contrast::TELEMETRY_EXCEPTIONS&.any?
16
-
17
- Contrast::TELEMETRY_EXCEPTIONS.each_value { |value| error_messages.push(value) }
18
- # Clear the hash. All exceptions now live in @_error_messages instance variable. and we will
19
- # add them to the queue. Clearing would make the hash available to be populated again while the
20
- # sending is proceeding.
21
- Contrast::TELEMETRY_EXCEPTIONS.clear
22
- # Add batch to queue. We need to shift here, because we want to report from the oldest batch to
23
- # the newest. And even if somehow the array is filled during sending the new messages would stay
24
- # and wait their turn.
25
- queue << error_messages.shift until error_messages.empty?
26
- end
27
- end
28
- end
29
- end
30
- end
@@ -1,44 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
10
- # model so it can own some of the data massaging required for AppUpdate
11
- # dtm.
12
- module ApplicationUpdate
13
- def self.included klass
14
- klass.extend(ClassMethods)
15
- end
16
-
17
- def append_library_update library_dtm_list
18
- library_dtm_list.each do |library_dtm|
19
- libraries[library_dtm.hash_code] = library_dtm
20
- end
21
- end
22
-
23
- def append_platform_version platform_version
24
- self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
25
- platform.major = platform_version.major
26
- platform.minor = platform_version.minor
27
- platform.build = platform_version.patch
28
- end
29
-
30
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
31
- module ClassMethods
32
- def build
33
- msg = new
34
- msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
35
- msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
36
- msg
37
- end
38
- end
39
- end
40
- end
41
- end
42
- end
43
-
44
- Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)
@@ -1,56 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
- require 'contrast/utils/sha256_builder'
6
- require 'yaml'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the Library protobuf model to handle Gem::Specification translation
12
- module Library
13
- StringUtils = Contrast::Utils::StringUtils
14
-
15
- def self.included klass
16
- klass.extend(ClassMethods)
17
- end
18
-
19
- # Used to add class methods to the Library class on inclusion of the decorator
20
- module ClassMethods
21
- def build digest, gem_specification
22
- msg = new
23
- msg.file_path = StringUtils.force_utf8(gem_specification.name) # rubocop:disable Security/Module/Name
24
- msg.hash_code = StringUtils.force_utf8(digest)
25
- msg.version = StringUtils.force_utf8(gem_specification.version)
26
- msg.manifest = StringUtils.force_utf8(build_manifest(gem_specification))
27
- msg.external_ms = date_to_ms(gem_specification.date)
28
- msg.internal_ms = msg.external_ms
29
- msg.url = StringUtils.force_utf8(gem_specification.homepage)
30
- msg.class_count = file_count(gem_specification.full_gem_path.to_s)
31
- msg.used_class_count = 0
32
- msg
33
- end
34
-
35
- # These are all the code files that are located in the Gem directory loaded
36
- # by the current environment; this includes more than Ruby files
37
- def file_count path
38
- Contrast::Utils::Sha256Builder.instance.files(path).length
39
- end
40
-
41
- def build_manifest spec
42
- StringUtils.force_utf8(spec.to_yaml.to_s)
43
- rescue StandardError
44
- nil
45
- end
46
-
47
- def date_to_ms date
48
- (date.to_f * 1000.0).to_i
49
- end
50
- end
51
- end
52
- end
53
- end
54
- end
55
-
56
- Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)
@@ -1,22 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Framework
6
- # Used to map version strings from frameworks to ApplicationUpdate dtm
7
- class PlatformVersion
8
- attr_reader :major, :minor, :patch
9
-
10
- def initialize major, minor, patch
11
- @major = major || ''
12
- @minor = minor || ''
13
- @patch = patch || ''
14
- end
15
-
16
- def self.from_string platform_version_string
17
- version_array = platform_version_string.split(Contrast::Utils::ObjectShare::PERIOD)
18
- new(version_array[0], version_array[1], version_array[2])
19
- end
20
- end
21
- end
22
- end