contrast-agent 6.2.0 → 6.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (209) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +0 -3
  3. data/.simplecov +1 -0
  4. data/Rakefile +0 -27
  5. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +7 -5
  6. data/ext/cs__assess_kernel/cs__assess_kernel.c +14 -3
  7. data/ext/cs__assess_kernel/cs__assess_kernel.h +2 -0
  8. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +10 -3
  9. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +2 -1
  10. data/ext/cs__assess_regexp/cs__assess_regexp.c +9 -7
  11. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.c → cs__assess_string_interpolation/cs__assess_string_interpolation.c} +14 -3
  12. data/ext/{cs__assess_string_interpolation26/cs__assess_string_interpolation26.h → cs__assess_string_interpolation/cs__assess_string_interpolation.h} +1 -1
  13. data/ext/{cs__assess_string_interpolation26 → cs__assess_string_interpolation}/extconf.rb +0 -0
  14. data/ext/cs__common/cs__common.c +5 -4
  15. data/ext/cs__contrast_patch/cs__contrast_patch.c +17 -11
  16. data/lib/contrast/agent/assess/events/source_event.rb +16 -12
  17. data/lib/contrast/agent/assess/finalizers/hash.rb +1 -0
  18. data/lib/contrast/agent/assess/policy/policy_node.rb +6 -0
  19. data/lib/contrast/agent/assess/policy/propagation_method.rb +8 -42
  20. data/lib/contrast/agent/assess/policy/propagation_node.rb +8 -0
  21. data/lib/contrast/agent/assess/policy/propagator/base.rb +2 -0
  22. data/lib/contrast/agent/assess/policy/propagator/custom.rb +4 -0
  23. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +5 -0
  24. data/lib/contrast/agent/assess/policy/propagator/split.rb +3 -0
  25. data/lib/contrast/agent/assess/policy/source_method.rb +7 -47
  26. data/lib/contrast/agent/assess/policy/source_node.rb +1 -0
  27. data/lib/contrast/agent/assess/policy/trigger_method.rb +9 -3
  28. data/lib/contrast/agent/assess/policy/trigger_node.rb +8 -0
  29. data/lib/contrast/agent/assess/property/evented.rb +4 -18
  30. data/lib/contrast/agent/assess/tag.rb +19 -0
  31. data/lib/contrast/agent/assess/tracker.rb +12 -0
  32. data/lib/contrast/agent/at_exit_hook.rb +8 -8
  33. data/lib/contrast/agent/inventory/database_config.rb +6 -3
  34. data/lib/contrast/agent/inventory/dependency_analysis.rb +5 -4
  35. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +11 -11
  36. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  37. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  38. data/lib/contrast/agent/middleware.rb +4 -0
  39. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +27 -2
  40. data/lib/contrast/agent/patching/policy/method_policy.rb +3 -3
  41. data/lib/contrast/agent/patching/policy/policy.rb +5 -0
  42. data/lib/contrast/agent/patching/policy/policy_node.rb +6 -0
  43. data/lib/contrast/agent/patching/policy/trigger_node.rb +3 -0
  44. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +3 -4
  45. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -0
  46. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  47. data/lib/contrast/agent/protect/rule/base.rb +1 -0
  48. data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -0
  49. data/lib/contrast/agent/reporting/reporter.rb +32 -7
  50. data/lib/contrast/agent/reporting/reporter_heartbeat.rb +22 -18
  51. data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb +17 -21
  52. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb +1 -1
  53. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity.rb +26 -3
  54. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +5 -24
  55. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +8 -1
  56. data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +8 -1
  57. data/lib/contrast/agent/reporting/reporting_events/finding.rb +7 -1
  58. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +10 -1
  59. data/lib/contrast/agent/reporting/reporting_events/finding_event_object.rb +11 -1
  60. data/lib/contrast/agent/reporting/reporting_events/finding_event_parent_object.rb +11 -1
  61. data/lib/contrast/agent/reporting/reporting_events/finding_event_property.rb +12 -1
  62. data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -1
  63. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +11 -1
  64. data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb +11 -1
  65. data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb +11 -1
  66. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +11 -1
  67. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +29 -32
  68. data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +13 -1
  69. data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +11 -8
  70. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +12 -5
  71. data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +8 -1
  72. data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +9 -1
  73. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +10 -1
  74. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +11 -4
  75. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -8
  76. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +1 -4
  77. data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +0 -22
  78. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +1 -3
  79. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +1 -11
  80. data/lib/contrast/agent/request.rb +5 -7
  81. data/lib/contrast/agent/request_context.rb +16 -17
  82. data/lib/contrast/agent/request_context_extend.rb +8 -9
  83. data/lib/contrast/agent/request_handler.rb +9 -38
  84. data/lib/contrast/agent/rule_set.rb +4 -0
  85. data/lib/contrast/agent/service_heartbeat.rb +3 -4
  86. data/lib/contrast/agent/static_analysis.rb +7 -12
  87. data/lib/contrast/agent/telemetry/base.rb +35 -35
  88. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_base.rb +2 -0
  89. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +2 -0
  90. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message.rb +5 -2
  91. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb +3 -0
  92. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb +3 -0
  93. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb +0 -1
  94. data/lib/contrast/agent/thread_watcher.rb +1 -4
  95. data/lib/contrast/agent/version.rb +1 -1
  96. data/lib/contrast/agent/worker_thread.rb +10 -0
  97. data/lib/contrast/api/communication/socket.rb +1 -0
  98. data/lib/contrast/api/decorators/message.rb +0 -6
  99. data/lib/contrast/api/decorators.rb +0 -2
  100. data/lib/contrast/api/dtm.pb.rb +1 -1
  101. data/lib/contrast/api/settings.pb.rb +1 -1
  102. data/lib/contrast/components/agent.rb +51 -13
  103. data/lib/contrast/components/assess.rb +16 -6
  104. data/lib/contrast/components/config.rb +18 -2
  105. data/lib/contrast/components/contrast_service.rb +1 -1
  106. data/lib/contrast/components/heap_dump.rb +51 -1
  107. data/lib/contrast/components/inventory.rb +19 -13
  108. data/lib/contrast/components/logger.rb +18 -0
  109. data/lib/contrast/config/assess_configuration.rb +28 -0
  110. data/lib/contrast/config/base_configuration.rb +8 -15
  111. data/lib/contrast/config/root_configuration.rb +12 -8
  112. data/lib/contrast/config/ruby_configuration.rb +2 -9
  113. data/lib/contrast/config/service_configuration.rb +4 -4
  114. data/lib/contrast/config.rb +0 -6
  115. data/lib/contrast/configuration.rb +0 -2
  116. data/lib/contrast/extension/assess/eval_trigger.rb +0 -4
  117. data/lib/contrast/extension/assess/hash.rb +3 -2
  118. data/lib/contrast/extension/assess/kernel.rb +22 -0
  119. data/lib/contrast/extension/assess/marshal.rb +16 -0
  120. data/lib/contrast/extension/assess/string.rb +21 -20
  121. data/lib/contrast/extension/object.rb +19 -0
  122. data/lib/contrast/framework/base_support.rb +8 -0
  123. data/lib/contrast/framework/manager.rb +6 -20
  124. data/lib/contrast/framework/manager_extend.rb +0 -1
  125. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +11 -16
  126. data/lib/contrast/framework/rails/support.rb +4 -1
  127. data/lib/contrast/logger/aliased_logging.rb +2 -0
  128. data/lib/contrast/logger/log.rb +2 -1
  129. data/lib/contrast/utils/assess/event_limit_utils.rb +96 -0
  130. data/lib/contrast/utils/assess/propagation_method_utils.rb +27 -7
  131. data/lib/contrast/utils/assess/source_method_utils.rb +0 -9
  132. data/lib/contrast/utils/log_utils.rb +2 -2
  133. data/lib/contrast/utils/lru_cache.rb +3 -0
  134. data/lib/contrast/utils/middleware_utils.rb +2 -0
  135. data/lib/contrast/utils/patching/policy/patch_utils.rb +6 -23
  136. data/lib/contrast/utils/telemetry_client.rb +7 -7
  137. data/lib/contrast.rb +37 -18
  138. data/lib/protobuf/code_generator.rb +129 -0
  139. data/lib/protobuf/decoder.rb +28 -0
  140. data/lib/protobuf/deprecation.rb +117 -0
  141. data/lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb +79 -0
  142. data/lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb +360 -0
  143. data/lib/protobuf/descriptors.rb +3 -0
  144. data/lib/protobuf/encoder.rb +11 -0
  145. data/lib/protobuf/enum.rb +365 -0
  146. data/lib/protobuf/exceptions.rb +9 -0
  147. data/lib/protobuf/field/base_field.rb +380 -0
  148. data/lib/protobuf/field/base_field_object_definitions.rb +504 -0
  149. data/lib/protobuf/field/bool_field.rb +64 -0
  150. data/lib/protobuf/field/bytes_field.rb +67 -0
  151. data/lib/protobuf/field/double_field.rb +25 -0
  152. data/lib/protobuf/field/enum_field.rb +56 -0
  153. data/lib/protobuf/field/field_array.rb +102 -0
  154. data/lib/protobuf/field/field_hash.rb +122 -0
  155. data/lib/protobuf/field/fixed32_field.rb +25 -0
  156. data/lib/protobuf/field/fixed64_field.rb +28 -0
  157. data/lib/protobuf/field/float_field.rb +43 -0
  158. data/lib/protobuf/field/int32_field.rb +21 -0
  159. data/lib/protobuf/field/int64_field.rb +34 -0
  160. data/lib/protobuf/field/integer_field.rb +23 -0
  161. data/lib/protobuf/field/message_field.rb +51 -0
  162. data/lib/protobuf/field/sfixed32_field.rb +27 -0
  163. data/lib/protobuf/field/sfixed64_field.rb +28 -0
  164. data/lib/protobuf/field/signed_integer_field.rb +29 -0
  165. data/lib/protobuf/field/sint32_field.rb +21 -0
  166. data/lib/protobuf/field/sint64_field.rb +21 -0
  167. data/lib/protobuf/field/string_field.rb +51 -0
  168. data/lib/protobuf/field/uint32_field.rb +21 -0
  169. data/lib/protobuf/field/uint64_field.rb +21 -0
  170. data/lib/protobuf/field/varint_field.rb +77 -0
  171. data/lib/protobuf/field.rb +74 -0
  172. data/lib/protobuf/generators/base.rb +85 -0
  173. data/lib/protobuf/generators/enum_generator.rb +39 -0
  174. data/lib/protobuf/generators/extension_generator.rb +27 -0
  175. data/lib/protobuf/generators/field_generator.rb +193 -0
  176. data/lib/protobuf/generators/file_generator.rb +262 -0
  177. data/lib/protobuf/generators/group_generator.rb +122 -0
  178. data/lib/protobuf/generators/message_generator.rb +104 -0
  179. data/lib/protobuf/generators/option_generator.rb +17 -0
  180. data/lib/protobuf/generators/printable.rb +160 -0
  181. data/lib/protobuf/generators/service_generator.rb +50 -0
  182. data/lib/protobuf/lifecycle.rb +33 -0
  183. data/lib/protobuf/logging.rb +39 -0
  184. data/lib/protobuf/message/fields.rb +233 -0
  185. data/lib/protobuf/message/serialization.rb +85 -0
  186. data/lib/protobuf/message.rb +241 -0
  187. data/lib/protobuf/optionable.rb +72 -0
  188. data/lib/protobuf/tasks/compile.rake +80 -0
  189. data/lib/protobuf/tasks.rb +1 -0
  190. data/lib/protobuf/varint.rb +20 -0
  191. data/lib/protobuf/varint_pure.rb +31 -0
  192. data/lib/protobuf/version.rb +3 -0
  193. data/lib/protobuf/wire_type.rb +10 -0
  194. data/lib/protobuf.rb +91 -0
  195. data/proto/dynamic_discovery.proto +46 -0
  196. data/proto/google/protobuf/compiler/plugin.proto +183 -0
  197. data/proto/google/protobuf/descriptor.proto +911 -0
  198. data/proto/rpc.proto +71 -0
  199. data/resources/assess/policy.json +6 -23
  200. data/ruby-agent.gemspec +4 -2
  201. metadata +122 -33
  202. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb +0 -30
  203. data/lib/contrast/api/decorators/application_update.rb +0 -44
  204. data/lib/contrast/api/decorators/library.rb +0 -56
  205. data/lib/contrast/config/agent_configuration.rb +0 -63
  206. data/lib/contrast/config/heap_dump_configuration.rb +0 -59
  207. data/lib/contrast/config/inventory_configuration.rb +0 -33
  208. data/lib/contrast/config/logger_configuration.rb +0 -26
  209. data/lib/contrast/framework/platform_version.rb +0 -22
data/proto/rpc.proto ADDED
@@ -0,0 +1,71 @@
1
+ // Copyright (c) 2009 Shardul Deo
2
+ //
3
+ // Permission is hereby granted, free of charge, to any person obtaining a copy
4
+ // of this software and associated documentation files (the "Software"), to deal
5
+ // in the Software without restriction, including without limitation the rights
6
+ // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
7
+ // copies of the Software, and to permit persons to whom the Software is
8
+ // furnished to do so, subject to the following conditions:
9
+ //
10
+ // The above copyright notice and this permission notice shall be included in
11
+ // all copies or substantial portions of the Software.
12
+ //
13
+ // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14
+ // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15
+ // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
16
+ // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
17
+ // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
18
+ // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
19
+ // THE SOFTWARE.
20
+
21
+ // Authors: Shardul Deo, BJ Neilsen
22
+ //
23
+ // Protobufs needed for socket rpcs.
24
+
25
+ syntax = "proto2";
26
+
27
+ package protobuf.socketrpc;
28
+
29
+ message Request
30
+ {
31
+ required string service_name = 1; // Fully- qualified Service class name
32
+ required string method_name = 2; // Service method to invoke
33
+ optional bytes request_proto = 3; // Serialized request bytes
34
+ optional string caller = 4; // Calling hostname or address
35
+ repeated Header headers = 5; // General purpose request headers
36
+ }
37
+
38
+ message Response
39
+ {
40
+ optional bytes response_proto = 1; // Serialized response
41
+ optional string error = 2; // Error message, if any
42
+ optional bool callback = 3 [default = false]; // Was callback invoked (not sure what this is for)
43
+ optional ErrorReason error_reason = 4; // Error Reason
44
+ optional string server = 5; // Server hostname or address
45
+ }
46
+
47
+ message Header {
48
+ required string key = 1;
49
+ optional string value = 2;
50
+ }
51
+
52
+ // Possible error reasons
53
+ // The server-side errors are returned in the response from the server.
54
+ // The client-side errors are returned by the client-side code when it doesn't
55
+ // have a response from the server.
56
+ enum ErrorReason
57
+ {
58
+ // Server-side errors
59
+ BAD_REQUEST_DATA = 0; // Server received bad request data
60
+ BAD_REQUEST_PROTO = 1; // Server received bad request proto
61
+ SERVICE_NOT_FOUND = 2; // Service not found on server
62
+ METHOD_NOT_FOUND = 3; // Method not found on server
63
+ RPC_ERROR = 4; // Rpc threw exception on server
64
+ RPC_FAILED = 5; // Rpc failed on server
65
+
66
+ // Client-side errors (these are returned by the client-side code)
67
+ INVALID_REQUEST_PROTO = 6; // Rpc was called with invalid request proto
68
+ BAD_RESPONSE_PROTO = 7; // Server returned a bad response proto
69
+ UNKNOWN_HOST = 8; // Could not find supplied host
70
+ IO_ERROR = 9; // I/O error while communicating with server
71
+ }
@@ -692,15 +692,7 @@
692
692
  "action":"CUSTOM",
693
693
  "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
694
694
  "patch_method": "values_at_tagger"
695
- }, {
696
- "class_name":"String",
697
- "instance_method": true,
698
- "method_visibility": "public",
699
- "method_name":"to_sym",
700
- "source":"O",
701
- "target":"R",
702
- "action":"KEEP"
703
- }, {
695
+ },{
704
696
  "class_name": "String",
705
697
  "instance_method": true,
706
698
  "method_visibility": "public",
@@ -1092,17 +1084,8 @@
1092
1084
  "patch_method": "sprintf_tagger",
1093
1085
  "source": "O,P1",
1094
1086
  "target": "R"
1095
- }, {
1096
- "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
1097
- "instance_method": true,
1098
- "method_visibility": "public",
1099
- "method_name":"quote",
1100
- "source": "P0",
1101
- "target": "R",
1102
- "action": "SPLAT",
1103
- "tags":["SQL_ENCODED"],
1104
- "untags":["SQL_DECODED"]
1105
- }, {
1087
+ },
1088
+ {
1106
1089
  "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
1107
1090
  "instance_method": true,
1108
1091
  "method_visibility": "public",
@@ -1869,9 +1852,9 @@
1869
1852
  "source": "P0"
1870
1853
  },{
1871
1854
  "class_name": "Excon",
1872
- "instance_method": true,
1873
- "method_visibility": "private",
1874
- "method_name": "initialize",
1855
+ "instance_method": false,
1856
+ "method_visibility": "public",
1857
+ "method_name": "new",
1875
1858
  "source": "P0"
1876
1859
  },
1877
1860
  {
data/ruby-agent.gemspec CHANGED
@@ -82,6 +82,8 @@ def self.add_specs spec
82
82
  spec.add_development_dependency 'rspec-rails', '5.0'
83
83
  spec.add_development_dependency 'tzinfo-data' # Alpine rspec-rails requirement.
84
84
  spec.add_development_dependency 'warning'
85
+ spec.add_development_dependency 'typhoeus', '~> 1.4'
86
+ spec.add_development_dependency 'excon', '~> 0.92.3'
85
87
  end
86
88
 
87
89
  def self.add_coverage spec
@@ -113,9 +115,9 @@ end
113
115
  # dependencies.csv in this directory to indicate that and create a
114
116
  # corresponding update to the fake gem server data in TeamServer.
115
117
  def self.add_dependencies spec
116
- spec.add_dependency 'ougai', '~> 1.8'
117
- spec.add_dependency 'protobuf', '~> 3.10'
118
+ spec.add_dependency 'ougai', '>= 1.8', '< 3.0.0'
118
119
  spec.add_dependency 'rack', '~> 2.0'
120
+ spec.add_dependency 'activesupport', '>= 3.2' # TODO: RUBY-1438 remove w/ protobuf code
119
121
  end
120
122
 
121
123
  # Enumerate the files required to build the Agent.
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.2.0
4
+ version: 6.5.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2022-05-27 00:00:00.000000000 Z
16
+ date: 2022-06-29 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: bundler
@@ -567,6 +567,34 @@ dependencies:
567
567
  - - ">="
568
568
  - !ruby/object:Gem::Version
569
569
  version: '0'
570
+ - !ruby/object:Gem::Dependency
571
+ name: typhoeus
572
+ requirement: !ruby/object:Gem::Requirement
573
+ requirements:
574
+ - - "~>"
575
+ - !ruby/object:Gem::Version
576
+ version: '1.4'
577
+ type: :development
578
+ prerelease: false
579
+ version_requirements: !ruby/object:Gem::Requirement
580
+ requirements:
581
+ - - "~>"
582
+ - !ruby/object:Gem::Version
583
+ version: '1.4'
584
+ - !ruby/object:Gem::Dependency
585
+ name: excon
586
+ requirement: !ruby/object:Gem::Requirement
587
+ requirements:
588
+ - - "~>"
589
+ - !ruby/object:Gem::Version
590
+ version: 0.92.3
591
+ type: :development
592
+ prerelease: false
593
+ version_requirements: !ruby/object:Gem::Requirement
594
+ requirements:
595
+ - - "~>"
596
+ - !ruby/object:Gem::Version
597
+ version: 0.92.3
570
598
  - !ruby/object:Gem::Dependency
571
599
  name: zlib
572
600
  requirement: !ruby/object:Gem::Requirement
@@ -585,44 +613,50 @@ dependencies:
585
613
  name: ougai
586
614
  requirement: !ruby/object:Gem::Requirement
587
615
  requirements:
588
- - - "~>"
616
+ - - ">="
589
617
  - !ruby/object:Gem::Version
590
618
  version: '1.8'
619
+ - - "<"
620
+ - !ruby/object:Gem::Version
621
+ version: 3.0.0
591
622
  type: :runtime
592
623
  prerelease: false
593
624
  version_requirements: !ruby/object:Gem::Requirement
594
625
  requirements:
595
- - - "~>"
626
+ - - ">="
596
627
  - !ruby/object:Gem::Version
597
628
  version: '1.8'
629
+ - - "<"
630
+ - !ruby/object:Gem::Version
631
+ version: 3.0.0
598
632
  - !ruby/object:Gem::Dependency
599
- name: protobuf
633
+ name: rack
600
634
  requirement: !ruby/object:Gem::Requirement
601
635
  requirements:
602
636
  - - "~>"
603
637
  - !ruby/object:Gem::Version
604
- version: '3.10'
638
+ version: '2.0'
605
639
  type: :runtime
606
640
  prerelease: false
607
641
  version_requirements: !ruby/object:Gem::Requirement
608
642
  requirements:
609
643
  - - "~>"
610
644
  - !ruby/object:Gem::Version
611
- version: '3.10'
645
+ version: '2.0'
612
646
  - !ruby/object:Gem::Dependency
613
- name: rack
647
+ name: activesupport
614
648
  requirement: !ruby/object:Gem::Requirement
615
649
  requirements:
616
- - - "~>"
650
+ - - ">="
617
651
  - !ruby/object:Gem::Version
618
- version: '2.0'
652
+ version: '3.2'
619
653
  type: :runtime
620
654
  prerelease: false
621
655
  version_requirements: !ruby/object:Gem::Requirement
622
656
  requirements:
623
- - - "~>"
657
+ - - ">="
624
658
  - !ruby/object:Gem::Version
625
- version: '2.0'
659
+ version: '3.2'
626
660
  description: This gem instantiates a Rack middleware for rack-based web applications
627
661
  in order to provide Interactive Application Security Testing and Protection.
628
662
  email:
@@ -631,22 +665,22 @@ executables:
631
665
  - contrast_service
632
666
  extensions:
633
667
  - ext/cs__common/extconf.rb
634
- - ext/cs__assess_string_interpolation26/extconf.rb
668
+ - ext/cs__assess_yield_track/extconf.rb
669
+ - ext/cs__os_information/extconf.rb
670
+ - ext/cs__contrast_patch/extconf.rb
635
671
  - ext/cs__assess_array/extconf.rb
636
- - ext/cs__assess_basic_object/extconf.rb
672
+ - ext/cs__assess_test/extconf.rb
673
+ - ext/cs__assess_string_interpolation/extconf.rb
637
674
  - ext/cs__assess_fiber_track/extconf.rb
638
- - ext/cs__assess_hash/extconf.rb
639
675
  - ext/cs__assess_marshal_module/extconf.rb
640
- - ext/cs__assess_yield_track/extconf.rb
641
- - ext/cs__assess_string/extconf.rb
676
+ - ext/cs__assess_basic_object/extconf.rb
642
677
  - ext/cs__assess_regexp/extconf.rb
643
- - ext/cs__os_information/extconf.rb
644
- - ext/cs__scope/extconf.rb
645
- - ext/cs__assess_test/extconf.rb
678
+ - ext/cs__assess_string/extconf.rb
646
679
  - ext/cs__tests/extconf.rb
647
- - ext/cs__assess_kernel/extconf.rb
648
680
  - ext/cs__assess_module/extconf.rb
649
- - ext/cs__contrast_patch/extconf.rb
681
+ - ext/cs__assess_hash/extconf.rb
682
+ - ext/cs__assess_kernel/extconf.rb
683
+ - ext/cs__scope/extconf.rb
650
684
  extra_rdoc_files: []
651
685
  files:
652
686
  - ".clang-format"
@@ -689,9 +723,9 @@ files:
689
723
  - ext/cs__assess_string/cs__assess_string.c
690
724
  - ext/cs__assess_string/cs__assess_string.h
691
725
  - ext/cs__assess_string/extconf.rb
692
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c
693
- - ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h
694
- - ext/cs__assess_string_interpolation26/extconf.rb
726
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.c
727
+ - ext/cs__assess_string_interpolation/cs__assess_string_interpolation.h
728
+ - ext/cs__assess_string_interpolation/extconf.rb
695
729
  - ext/cs__assess_test/cs__assess_test.h
696
730
  - ext/cs__assess_test/cs__assess_tests.c
697
731
  - ext/cs__assess_test/extconf.rb
@@ -1096,7 +1130,6 @@ files:
1096
1130
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_message_exception.rb
1097
1131
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_stack_frame.rb
1098
1132
  - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions.rb
1099
- - lib/contrast/agent/telemetry/events/exceptions/telemetry_exceptions_report.rb
1100
1133
  - lib/contrast/agent/telemetry/events/metric_event.rb
1101
1134
  - lib/contrast/agent/telemetry/events/startup_metrics_event.rb
1102
1135
  - lib/contrast/agent/thread.rb
@@ -1122,7 +1155,6 @@ files:
1122
1155
  - lib/contrast/api/decorators/agent_startup.rb
1123
1156
  - lib/contrast/api/decorators/application_settings.rb
1124
1157
  - lib/contrast/api/decorators/application_startup.rb
1125
- - lib/contrast/api/decorators/application_update.rb
1126
1158
  - lib/contrast/api/decorators/architecture_component.rb
1127
1159
  - lib/contrast/api/decorators/bot_blocker.rb
1128
1160
  - lib/contrast/api/decorators/finding.rb
@@ -1130,7 +1162,6 @@ files:
1130
1162
  - lib/contrast/api/decorators/input_analysis.rb
1131
1163
  - lib/contrast/api/decorators/instrumentation_mode.rb
1132
1164
  - lib/contrast/api/decorators/ip_denylist.rb
1133
- - lib/contrast/api/decorators/library.rb
1134
1165
  - lib/contrast/api/decorators/message.rb
1135
1166
  - lib/contrast/api/decorators/rasp_rule_sample.rb
1136
1167
  - lib/contrast/api/decorators/response_type.rb
@@ -1161,7 +1192,6 @@ files:
1161
1192
  - lib/contrast/components/scope.rb
1162
1193
  - lib/contrast/components/settings.rb
1163
1194
  - lib/contrast/config.rb
1164
- - lib/contrast/config/agent_configuration.rb
1165
1195
  - lib/contrast/config/api_configuration.rb
1166
1196
  - lib/contrast/config/api_proxy_configuration.rb
1167
1197
  - lib/contrast/config/application_configuration.rb
@@ -1171,9 +1201,6 @@ files:
1171
1201
  - lib/contrast/config/certification_configuration.rb
1172
1202
  - lib/contrast/config/env_variables.rb
1173
1203
  - lib/contrast/config/exception_configuration.rb
1174
- - lib/contrast/config/heap_dump_configuration.rb
1175
- - lib/contrast/config/inventory_configuration.rb
1176
- - lib/contrast/config/logger_configuration.rb
1177
1204
  - lib/contrast/config/protect_configuration.rb
1178
1205
  - lib/contrast/config/protect_rule_configuration.rb
1179
1206
  - lib/contrast/config/protect_rules_configuration.rb
@@ -1199,6 +1226,7 @@ files:
1199
1226
  - lib/contrast/extension/extension.rb
1200
1227
  - lib/contrast/extension/inventory.rb
1201
1228
  - lib/contrast/extension/module.rb
1229
+ - lib/contrast/extension/object.rb
1202
1230
  - lib/contrast/extension/protect.rb
1203
1231
  - lib/contrast/extension/protect/psych.rb
1204
1232
  - lib/contrast/extension/thread.rb
@@ -1206,7 +1234,6 @@ files:
1206
1234
  - lib/contrast/framework/grape/support.rb
1207
1235
  - lib/contrast/framework/manager.rb
1208
1236
  - lib/contrast/framework/manager_extend.rb
1209
- - lib/contrast/framework/platform_version.rb
1210
1237
  - lib/contrast/framework/rack/patch/session_cookie.rb
1211
1238
  - lib/contrast/framework/rack/patch/support.rb
1212
1239
  - lib/contrast/framework/rack/support.rb
@@ -1228,6 +1255,7 @@ files:
1228
1255
  - lib/contrast/security_exception.rb
1229
1256
  - lib/contrast/tasks/config.rb
1230
1257
  - lib/contrast/tasks/service.rb
1258
+ - lib/contrast/utils/assess/event_limit_utils.rb
1231
1259
  - lib/contrast/utils/assess/object_store.rb
1232
1260
  - lib/contrast/utils/assess/propagation_method_utils.rb
1233
1261
  - lib/contrast/utils/assess/property/tagged_utils.rb
@@ -1271,6 +1299,67 @@ files:
1271
1299
  - lib/contrast/utils/telemetry_identifier.rb
1272
1300
  - lib/contrast/utils/thread_tracker.rb
1273
1301
  - lib/contrast/utils/timer.rb
1302
+ - lib/protobuf.rb
1303
+ - lib/protobuf/code_generator.rb
1304
+ - lib/protobuf/decoder.rb
1305
+ - lib/protobuf/deprecation.rb
1306
+ - lib/protobuf/descriptors.rb
1307
+ - lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb
1308
+ - lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb
1309
+ - lib/protobuf/encoder.rb
1310
+ - lib/protobuf/enum.rb
1311
+ - lib/protobuf/exceptions.rb
1312
+ - lib/protobuf/field.rb
1313
+ - lib/protobuf/field/base_field.rb
1314
+ - lib/protobuf/field/base_field_object_definitions.rb
1315
+ - lib/protobuf/field/bool_field.rb
1316
+ - lib/protobuf/field/bytes_field.rb
1317
+ - lib/protobuf/field/double_field.rb
1318
+ - lib/protobuf/field/enum_field.rb
1319
+ - lib/protobuf/field/field_array.rb
1320
+ - lib/protobuf/field/field_hash.rb
1321
+ - lib/protobuf/field/fixed32_field.rb
1322
+ - lib/protobuf/field/fixed64_field.rb
1323
+ - lib/protobuf/field/float_field.rb
1324
+ - lib/protobuf/field/int32_field.rb
1325
+ - lib/protobuf/field/int64_field.rb
1326
+ - lib/protobuf/field/integer_field.rb
1327
+ - lib/protobuf/field/message_field.rb
1328
+ - lib/protobuf/field/sfixed32_field.rb
1329
+ - lib/protobuf/field/sfixed64_field.rb
1330
+ - lib/protobuf/field/signed_integer_field.rb
1331
+ - lib/protobuf/field/sint32_field.rb
1332
+ - lib/protobuf/field/sint64_field.rb
1333
+ - lib/protobuf/field/string_field.rb
1334
+ - lib/protobuf/field/uint32_field.rb
1335
+ - lib/protobuf/field/uint64_field.rb
1336
+ - lib/protobuf/field/varint_field.rb
1337
+ - lib/protobuf/generators/base.rb
1338
+ - lib/protobuf/generators/enum_generator.rb
1339
+ - lib/protobuf/generators/extension_generator.rb
1340
+ - lib/protobuf/generators/field_generator.rb
1341
+ - lib/protobuf/generators/file_generator.rb
1342
+ - lib/protobuf/generators/group_generator.rb
1343
+ - lib/protobuf/generators/message_generator.rb
1344
+ - lib/protobuf/generators/option_generator.rb
1345
+ - lib/protobuf/generators/printable.rb
1346
+ - lib/protobuf/generators/service_generator.rb
1347
+ - lib/protobuf/lifecycle.rb
1348
+ - lib/protobuf/logging.rb
1349
+ - lib/protobuf/message.rb
1350
+ - lib/protobuf/message/fields.rb
1351
+ - lib/protobuf/message/serialization.rb
1352
+ - lib/protobuf/optionable.rb
1353
+ - lib/protobuf/tasks.rb
1354
+ - lib/protobuf/tasks/compile.rake
1355
+ - lib/protobuf/varint.rb
1356
+ - lib/protobuf/varint_pure.rb
1357
+ - lib/protobuf/version.rb
1358
+ - lib/protobuf/wire_type.rb
1359
+ - proto/dynamic_discovery.proto
1360
+ - proto/google/protobuf/compiler/plugin.proto
1361
+ - proto/google/protobuf/descriptor.proto
1362
+ - proto/rpc.proto
1274
1363
  - resources/assess/policy.json
1275
1364
  - resources/deadzone/policy.json
1276
1365
  - resources/inventory/policy.json
@@ -1,30 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Telemetry
7
- # This module will handle the reporting of the TelemetryExceptionHash
8
- module TelemetryExceptionReport
9
- # Here we will send any exceptions gathered. The telemetry_hash is split into batches of 256
10
- # and then added to the telemetry queue. Since this method is called before entering the
11
- # until queue loop any updates after clearing the Contrast::TELEMETRY_EXCEPTIONS would have
12
- # to wait for the sending process to be completed, so accumulating new batches.
13
- # This methods expects queue and error_messages methods from Contrast::Agent::Telemetry::Base
14
- def push_exceptions
15
- return unless Contrast::TELEMETRY_EXCEPTIONS&.any?
16
-
17
- Contrast::TELEMETRY_EXCEPTIONS.each_value { |value| error_messages.push(value) }
18
- # Clear the hash. All exceptions now live in @_error_messages instance variable. and we will
19
- # add them to the queue. Clearing would make the hash available to be populated again while the
20
- # sending is proceeding.
21
- Contrast::TELEMETRY_EXCEPTIONS.clear
22
- # Add batch to queue. We need to shift here, because we want to report from the oldest batch to
23
- # the newest. And even if somehow the array is filled during sending the new messages would stay
24
- # and wait their turn.
25
- queue << error_messages.shift until error_messages.empty?
26
- end
27
- end
28
- end
29
- end
30
- end
@@ -1,44 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
10
- # model so it can own some of the data massaging required for AppUpdate
11
- # dtm.
12
- module ApplicationUpdate
13
- def self.included klass
14
- klass.extend(ClassMethods)
15
- end
16
-
17
- def append_library_update library_dtm_list
18
- library_dtm_list.each do |library_dtm|
19
- libraries[library_dtm.hash_code] = library_dtm
20
- end
21
- end
22
-
23
- def append_platform_version platform_version
24
- self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
25
- platform.major = platform_version.major
26
- platform.minor = platform_version.minor
27
- platform.build = platform_version.patch
28
- end
29
-
30
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
31
- module ClassMethods
32
- def build
33
- msg = new
34
- msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
35
- msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
36
- msg
37
- end
38
- end
39
- end
40
- end
41
- end
42
- end
43
-
44
- Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)
@@ -1,56 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
- require 'contrast/utils/sha256_builder'
6
- require 'yaml'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the Library protobuf model to handle Gem::Specification translation
12
- module Library
13
- StringUtils = Contrast::Utils::StringUtils
14
-
15
- def self.included klass
16
- klass.extend(ClassMethods)
17
- end
18
-
19
- # Used to add class methods to the Library class on inclusion of the decorator
20
- module ClassMethods
21
- def build digest, gem_specification
22
- msg = new
23
- msg.file_path = StringUtils.force_utf8(gem_specification.name) # rubocop:disable Security/Module/Name
24
- msg.hash_code = StringUtils.force_utf8(digest)
25
- msg.version = StringUtils.force_utf8(gem_specification.version)
26
- msg.manifest = StringUtils.force_utf8(build_manifest(gem_specification))
27
- msg.external_ms = date_to_ms(gem_specification.date)
28
- msg.internal_ms = msg.external_ms
29
- msg.url = StringUtils.force_utf8(gem_specification.homepage)
30
- msg.class_count = file_count(gem_specification.full_gem_path.to_s)
31
- msg.used_class_count = 0
32
- msg
33
- end
34
-
35
- # These are all the code files that are located in the Gem directory loaded
36
- # by the current environment; this includes more than Ruby files
37
- def file_count path
38
- Contrast::Utils::Sha256Builder.instance.files(path).length
39
- end
40
-
41
- def build_manifest spec
42
- StringUtils.force_utf8(spec.to_yaml.to_s)
43
- rescue StandardError
44
- nil
45
- end
46
-
47
- def date_to_ms date
48
- (date.to_f * 1000.0).to_i
49
- end
50
- end
51
- end
52
- end
53
- end
54
- end
55
-
56
- Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)
@@ -1,63 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/config/service_configuration'
5
- require 'contrast/config/logger_configuration'
6
- require 'contrast/config/ruby_configuration'
7
- require 'contrast/config/heap_dump_configuration'
8
- require 'contrast/config/api_configuration'
9
-
10
- module Contrast
11
- module Config
12
- # Common Configuration settings. Those in this section pertain to the core functionality of the Agent.
13
- class AgentConfiguration
14
- include Contrast::Config::BaseConfiguration
15
-
16
- # @return [Boolean, nil]
17
- attr_accessor :enable
18
- # @return [Boolean, nil]
19
- attr_accessor :omit_body
20
- # @return [Contrast::Config::RubyConfiguration]
21
- attr_writer :ruby
22
- # @return [Contrast::Config::ServiceConfiguration]
23
- attr_writer :service
24
- # @return [ Contrast::Config::LoggerConfiguration]
25
- attr_writer :logger
26
- # @return [Contrast::Config::HeapDumpConfiguration]
27
- attr_writer :heap_dump
28
-
29
- def initialize hsh = {}
30
- return unless hsh
31
-
32
- @enable = hsh[:enable]
33
- @start_bundled_service = hsh[:start_bundled_service]
34
- @omit_body = hsh[:omit_body]
35
- @service = Contrast::Config::ServiceConfiguration.new(hsh[:service])
36
- @logger = Contrast::Config::LoggerConfiguration.new(hsh[:logger])
37
- @ruby = Contrast::Config::RubyConfiguration.new(hsh[:ruby])
38
- @heap_dump = Contrast::Config::HeapDumpConfiguration.new(hsh[:heap_dump])
39
- end
40
-
41
- # @return [Boolean, true]
42
- def start_bundled_service
43
- @start_bundled_service.nil? ? true : @start_bundled_service
44
- end
45
-
46
- def service
47
- @service ||= Contrast::Config::ServiceConfiguration.new
48
- end
49
-
50
- def logger
51
- @logger ||= Contrast::Config::LoggerConfiguration.new
52
- end
53
-
54
- def ruby
55
- @ruby ||= Contrast::Config::RubyConfiguration.new
56
- end
57
-
58
- def heap_dump
59
- @heap_dump ||= Contrast::Config::HeapDumpConfiguration.new
60
- end
61
- end
62
- end
63
- end