contrast-agent 6.5.1 → 6.6.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/contrast/agent/assess/policy/source_method.rb +10 -9
- data/lib/contrast/agent/inventory/database_config.rb +2 -1
- data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
- data/lib/contrast/agent/middleware.rb +6 -5
- data/lib/contrast/agent/protect/rule/default_scanner.rb +64 -5
- data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +3 -5
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/components/logger.rb +0 -10
- data/lib/contrast/framework/rails/support.rb +3 -2
- data/lib/contrast/logger/application.rb +2 -1
- data/lib/contrast/logger/log.rb +0 -69
- data/lib/contrast/logger/time.rb +19 -12
- data/resources/deadzone/policy.json +7 -0
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +12 -12
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: f00aee3e36cdb303ca9b209824fbb92386e0ca0043c0f24377f79168dca8d252
|
4
|
+
data.tar.gz: 7fc3d7571246ff92a10da151ce4b723768e3f7214b5a1e57d5bb1d6a66e86e2b
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 9fc9e69602a2706cb41bf8d13e07693afb61ad85ad03ff43182f3c79c5f9dff1c0b8ed3e0cb690d15cf8e43830920516604e9b497945963897f0ee1b82e11f9b
|
7
|
+
data.tar.gz: dfd4e5146f9ac498b83d76b13a9d6ed17a5de0e659ed301acbf6a873e18d5ff75ea8aa8fa7c3789433e100903a9f6bfb4b87c9d283107c5bd04015f862e88644
|
@@ -38,19 +38,20 @@ module Contrast
|
|
38
38
|
# @param ret [Object] the Return of the invoked method
|
39
39
|
# @param args [Array<Object>] the Arguments with which the method was invoked
|
40
40
|
def apply_source method_policy, object, ret, args
|
41
|
-
|
42
|
-
|
43
|
-
|
41
|
+
logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
|
42
|
+
return unless analyze?(method_policy, object, ret, args)
|
43
|
+
return if event_limit?(method_policy)
|
44
|
+
return unless (source_node = method_policy.source_node)
|
44
45
|
|
45
|
-
|
46
|
-
|
46
|
+
# used to hold the object and ret
|
47
|
+
source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
|
47
48
|
|
48
|
-
|
49
|
-
|
49
|
+
return unless (target = determine_target(source_node, source_data, args))
|
50
|
+
return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
|
50
51
|
|
51
|
-
|
52
|
+
process_source(source_node, target, source_data, source_node.type, nil, *args)
|
53
|
+
end
|
52
54
|
end
|
53
|
-
Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
|
54
55
|
|
55
56
|
private
|
56
57
|
|
@@ -21,7 +21,7 @@ module Contrast
|
|
21
21
|
DATA_STORE_MARKER = 'data_store'
|
22
22
|
|
23
23
|
def report_data_store _method, _exception, properties, object, _args
|
24
|
-
return unless ::Contrast::INVENTORY.
|
24
|
+
return unless ::Contrast::INVENTORY.enable
|
25
25
|
|
26
26
|
marker = properties[DATA_STORE_MARKER]
|
27
27
|
return unless marker
|
@@ -61,13 +61,14 @@ module Contrast
|
|
61
61
|
# @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
|
62
62
|
# the Rack framework.
|
63
63
|
def call env
|
64
|
-
|
64
|
+
logger.trace_with_time('Elapsed time for Contrast::Agent::Middleware#call') do
|
65
|
+
return app.call(env) unless ::Contrast::AGENT.enabled?
|
65
66
|
|
66
|
-
|
67
|
-
|
68
|
-
|
67
|
+
Contrast::Agent.heapdump_util.start_thread!
|
68
|
+
handle_first_request
|
69
|
+
call_with_agent(env)
|
70
|
+
end
|
69
71
|
end
|
70
|
-
::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
|
71
72
|
|
72
73
|
private
|
73
74
|
|
@@ -20,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
20
20
|
# :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
|
21
21
|
# :STATE_SKIP_NEXT_CHARACTER
|
22
22
|
|
23
|
+
# @param query [String] the query being executed
|
24
|
+
# @param index [Integer] the index of the input in the query
|
25
|
+
# @param input [String] the input value provided by the user
|
26
|
+
# @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
|
23
27
|
def crosses_boundary query, index, input
|
24
28
|
last_boundary = 0
|
25
|
-
|
29
|
+
scan_token_boundaries(query).each do |boundary|
|
26
30
|
if boundary > index
|
27
|
-
|
31
|
+
# We should report the previous and overrun boundary if the input crosses one.
|
32
|
+
return last_boundary, boundary if boundary < (index + input.length)
|
28
33
|
|
29
34
|
break
|
30
35
|
end
|
@@ -33,10 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
33
38
|
nil
|
34
39
|
end
|
35
40
|
|
36
|
-
|
37
|
-
@_token_boundaries ||= scan_token_boundaries(query)
|
38
|
-
end
|
41
|
+
private
|
39
42
|
|
43
|
+
# @param query [String] the query being executed
|
44
|
+
# @return [Array<Integer>] the boundaries of the query
|
40
45
|
def scan_token_boundaries query
|
41
46
|
boundaries = []
|
42
47
|
return boundaries unless query && !query.empty?
|
@@ -73,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
73
78
|
boundaries
|
74
79
|
end
|
75
80
|
|
81
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
82
|
+
# @param current_state [Symbol] the state of the query
|
83
|
+
# @param char [String] the character being evaluated
|
84
|
+
# @param index [Integer] the location of the character in the query
|
85
|
+
# @param query [String] the query being executed
|
76
86
|
def process_state boundaries, current_state, char, index, query
|
77
87
|
case current_state
|
78
88
|
when :STATE_EXPECTING_TOKEN
|
@@ -88,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
88
98
|
end
|
89
99
|
end
|
90
100
|
|
101
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
102
|
+
# @param char [String] the character being evaluated
|
103
|
+
# @param index [Integer] the location of the character in the query
|
104
|
+
# @param query [String] the query being executed
|
91
105
|
def process_expecting_token boundaries, char, index, query
|
92
106
|
if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
93
107
|
boundaries << index
|
@@ -112,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
112
126
|
end
|
113
127
|
end
|
114
128
|
|
129
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
130
|
+
# @param char [String] the character being evaluated
|
131
|
+
# @param index [Integer] the location of the character in the query
|
132
|
+
# @param query [String] the query being executed
|
115
133
|
def process_inside_token boundaries, char, index, query
|
116
134
|
if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
117
135
|
boundaries << index
|
@@ -133,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
133
151
|
end
|
134
152
|
end
|
135
153
|
|
154
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
155
|
+
# @param char [String] the character being evaluated
|
156
|
+
# @param index [Integer] the location of the character in the query
|
157
|
+
# @param _query [String] the query being executed
|
136
158
|
def process_number boundaries, char, index, _query
|
137
159
|
if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
|
138
160
|
:STATE_INSIDE_NUMBER
|
@@ -142,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
142
164
|
end
|
143
165
|
end
|
144
166
|
|
167
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
168
|
+
# @param char [String] the character being evaluated
|
169
|
+
# @param index [Integer] the location of the character in the query
|
170
|
+
# @param query [String] the query being executed
|
145
171
|
def process_double_quote boundaries, char, index, query
|
146
172
|
if escape_char?(char)
|
147
173
|
:STATE_SKIP_NEXT_CHARACTER
|
@@ -159,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
159
185
|
end
|
160
186
|
end
|
161
187
|
|
188
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
189
|
+
# @param char [String] the character being evaluated
|
190
|
+
# @param index [Integer] the location of the character in the query
|
191
|
+
# @param query [String] the query being executed
|
162
192
|
def process_single_quote boundaries, char, index, query
|
163
193
|
if escape_char?(char)
|
164
194
|
:STATE_SKIP_NEXT_CHARACTER
|
@@ -176,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
176
206
|
end
|
177
207
|
end
|
178
208
|
|
209
|
+
# @param query [String] the query being executed
|
210
|
+
# @param index [Integer] the location of the character in the query
|
179
211
|
def double_quote? query, index
|
180
212
|
return false unless index >= 0 && index < query.length
|
181
213
|
|
182
214
|
query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
|
183
215
|
end
|
184
216
|
|
217
|
+
# @param query [String] the query being executed
|
218
|
+
# @param index [Integer] the location of the character in the query
|
185
219
|
def single_quote? query, index
|
186
220
|
return false unless index >= 0 && index < query.length
|
187
221
|
|
188
222
|
query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
189
223
|
end
|
190
224
|
|
225
|
+
# @param query [String] the query being executed
|
226
|
+
# @param index [Integer] the location of the character in the query
|
191
227
|
def find_escape_sequence_boundary query, index
|
192
228
|
idx = index
|
193
229
|
while idx < query.length
|
@@ -199,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
199
235
|
idx
|
200
236
|
end
|
201
237
|
|
238
|
+
# @param query [String] the query being executed
|
239
|
+
# @param index [Integer] the location of the character in the query
|
202
240
|
def find_block_comment_boundary query, index
|
203
241
|
idx = index
|
204
242
|
while idx < query.length
|
@@ -210,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
210
248
|
idx
|
211
249
|
end
|
212
250
|
|
251
|
+
# @param query [String] the query being executed
|
252
|
+
# @param index [Integer] the location of the character in the query
|
213
253
|
def find_new_line_boundary query, index
|
214
254
|
idx = index
|
215
255
|
while idx < query.length
|
@@ -222,12 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
222
262
|
idx
|
223
263
|
end
|
224
264
|
|
265
|
+
# @param char [String] the character being evaluated
|
225
266
|
def operator? char
|
226
267
|
char.match?(OPERATOR_PATTERN)
|
227
268
|
end
|
228
269
|
|
229
270
|
# @note: Any class extending this module should override these methods as needed
|
230
271
|
# Are the current and subsequent characters both '-' ?
|
272
|
+
#
|
273
|
+
# @param char [String] the character being evaluated
|
274
|
+
# @param index [Integer] the location of the character in the query
|
275
|
+
# @param query [String] the query being executed
|
231
276
|
def start_line_comment? char, index, query
|
232
277
|
return false unless char == Contrast::Utils::ObjectShare::DASH
|
233
278
|
return false unless (query.length - 2) >= index
|
@@ -237,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
237
282
|
|
238
283
|
# Is the current character / sequence of characters the start of a block comment
|
239
284
|
# We assume '/*' starts the comment by default
|
285
|
+
#
|
286
|
+
# @param char [String] the character being evaluated
|
287
|
+
# @param index [Integer] the location of the character in the query
|
288
|
+
# @param query [String] the query being executed
|
240
289
|
def start_block_comment? char, index, query
|
241
290
|
return false unless char == Contrast::Utils::ObjectShare::SLASH
|
242
291
|
return false unless (query.length - 2) >= index
|
@@ -246,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
246
295
|
|
247
296
|
# Is the current character / sequence of characters the end of a block comment
|
248
297
|
# We assume '*/' ends the comment by default
|
298
|
+
#
|
299
|
+
# @param char [String] the character being evaluated
|
300
|
+
# @param index [Integer] the location of the character in the query
|
301
|
+
# @param query [String] the query being executed
|
249
302
|
def end_block_comment? char, index, query
|
250
303
|
return false unless char == Contrast::Utils::ObjectShare::ASTERISK
|
251
304
|
return false unless (query.length - 2) >= index
|
@@ -267,18 +320,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
267
320
|
|
268
321
|
# Is the character provided an escape character?
|
269
322
|
# By default, we'll assume
|
323
|
+
#
|
324
|
+
# @param char [String] the character being evaluated
|
270
325
|
def escape_char? char
|
271
326
|
char == Contrast::Utils::ObjectShare::BACK_SLASH
|
272
327
|
end
|
273
328
|
|
274
329
|
# Is this the start of a string escape sequence?
|
275
330
|
# Since escape sequences aren't supported, the answer is always false
|
331
|
+
#
|
332
|
+
# @param _char [String] the character being evaluated
|
276
333
|
def escape_sequence_start? _char
|
277
334
|
false
|
278
335
|
end
|
279
336
|
|
280
337
|
# Is this the end of a string escape sequence?
|
281
338
|
# Since escape sequences aren't supported, the answer is always false
|
339
|
+
#
|
340
|
+
# @param _char [String] the character being evaluated
|
282
341
|
def escape_sequence_end? _char
|
283
342
|
false
|
284
343
|
end
|
@@ -65,8 +65,8 @@ module Contrast
|
|
65
65
|
# if one exists, in the case of multiple inputs being found to violate the protection criteria
|
66
66
|
# @param result [Contrast::Api::Dtm::AttackResult, nil] previous attack result for this rule, if one exists,
|
67
67
|
# in the case of multiple inputs being found to violate the protection criteria
|
68
|
-
# @query_string [
|
69
|
-
# @kwargs [Hash] key - value pairs of context individual rules need to build out details to send
|
68
|
+
# @param query_string [String] the value of the input which may be an attack
|
69
|
+
# @param kwargs [Hash] key - value pairs of context individual rules need to build out details to send
|
70
70
|
# to the Service to tell the story of the attack
|
71
71
|
# @return [Contrast::Api::Dtm::AttackResult] the result from this attack
|
72
72
|
def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
|
@@ -86,14 +86,12 @@ module Contrast
|
|
86
86
|
ss = StringScanner.new(query_string)
|
87
87
|
length = attack_string.length
|
88
88
|
while ss.scan_until(regexp)
|
89
|
-
# the pos of StringScanner is at the end of the regexp (input string),
|
90
|
-
# we need the beginning
|
89
|
+
# the pos of StringScanner is at the end of the regexp (input string), we need the beginning
|
91
90
|
idx = ss.pos - attack_string.length
|
92
91
|
last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
|
93
92
|
next unless last_boundary && boundary
|
94
93
|
|
95
94
|
result ||= build_attack_result(context)
|
96
|
-
|
97
95
|
record_match(idx, length, boundary, last_boundary, kwargs)
|
98
96
|
append_match(context, input_analysis_result, result, query_string, **kwargs)
|
99
97
|
end
|
@@ -16,16 +16,6 @@ module Contrast
|
|
16
16
|
def cef_logger
|
17
17
|
@_cef_logger ||= Contrast::Logger::CEFLog.instance.tap(&:build_logger)
|
18
18
|
end
|
19
|
-
|
20
|
-
def add_trace_perf_logging_for sym, custom_message = nil
|
21
|
-
logger.add_trace_perf_logging(self, sym, custom_message)
|
22
|
-
end
|
23
|
-
end
|
24
|
-
|
25
|
-
class << self
|
26
|
-
def add_trace_log_timing_for clazz, method_name, custom_message = nil
|
27
|
-
Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
|
28
|
-
end
|
29
19
|
end
|
30
20
|
|
31
21
|
# So This class here follows the update for the configuration
|
@@ -59,7 +59,7 @@ module Contrast
|
|
59
59
|
# ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
|
60
60
|
match, _params, route, path = get_full_route(request.rack_request)
|
61
61
|
unless route
|
62
|
-
logger.warn(
|
62
|
+
logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
|
63
63
|
return
|
64
64
|
end
|
65
65
|
|
@@ -90,7 +90,7 @@ module Contrast
|
|
90
90
|
# ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
|
91
91
|
match, _params, route, path = get_full_route(request.rack_request)
|
92
92
|
unless route
|
93
|
-
logger.warn(
|
93
|
+
logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
|
94
94
|
return
|
95
95
|
end
|
96
96
|
|
@@ -182,6 +182,7 @@ module Contrast
|
|
182
182
|
route_list += find_all_routes(route.app.app, [])
|
183
183
|
end
|
184
184
|
end
|
185
|
+
logger.debug("Routes Found: #{ route_list }")
|
185
186
|
route_list
|
186
187
|
end
|
187
188
|
|
@@ -12,7 +12,8 @@ module Contrast
|
|
12
12
|
return unless info?
|
13
13
|
|
14
14
|
info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
|
15
|
-
agent_version: Contrast::Agent::VERSION
|
15
|
+
agent_version: Contrast::Agent::VERSION,
|
16
|
+
ruby_version: RUBY_VERSION)
|
16
17
|
ENV.each do |env_key, env_value|
|
17
18
|
env_key = env_key.to_s
|
18
19
|
next unless ENV_KEYS.include?(env_key) ||
|
data/lib/contrast/logger/log.rb
CHANGED
@@ -13,72 +13,6 @@ require 'contrast/logger/time'
|
|
13
13
|
require 'contrast/components/config'
|
14
14
|
require 'contrast/utils/log_utils'
|
15
15
|
|
16
|
-
module Contrast
|
17
|
-
# This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
|
18
|
-
# we pay the penalty for that timing block
|
19
|
-
module TraceTiming
|
20
|
-
def methods_to_time
|
21
|
-
@_methods_to_time ||= []
|
22
|
-
end
|
23
|
-
|
24
|
-
# Store info about methods for later patching.
|
25
|
-
METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
|
26
|
-
|
27
|
-
# Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
|
28
|
-
# logger set to TRACE.
|
29
|
-
#
|
30
|
-
# @param: clazz [Class] the class of the method to time.
|
31
|
-
# @param: method [Symbol] the method to time.
|
32
|
-
# @param: method [String] optional custom logging message.
|
33
|
-
def add_method_to_trace_timing clazz, method, msg = nil
|
34
|
-
methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
|
35
|
-
enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
|
36
|
-
end
|
37
|
-
|
38
|
-
# Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
|
39
|
-
# logger set to TRACE.
|
40
|
-
#
|
41
|
-
# @param: meth_spec [METHOD_INFO] specs about the method to be timed.
|
42
|
-
# @param: class_method [Boolean] whether this is or isn't a class/module method.
|
43
|
-
def trace_time_class_method meth_spec, class_method # rubocop:disable Metrics/AbcSize
|
44
|
-
untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
|
45
|
-
send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
|
46
|
-
meth_spec.clazz.class_eval do
|
47
|
-
include(Contrast::Components::Logger::InstanceMethods)
|
48
|
-
extend(Contrast::Components::Logger::InstanceMethods)
|
49
|
-
|
50
|
-
send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
|
51
|
-
meth_spec.aliased = true
|
52
|
-
|
53
|
-
log_message = "Elapsed time for #{ meth_spec.method_name }."
|
54
|
-
log_message = meth_spec.custom_message if meth_spec.custom_msg
|
55
|
-
|
56
|
-
send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
|
57
|
-
start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
|
58
|
-
rv = if kwargs.empty?
|
59
|
-
send(untimed_func_symbol, *args, &block)
|
60
|
-
else
|
61
|
-
send(untimed_func_symbol, *args, **kwargs, &block)
|
62
|
-
end
|
63
|
-
delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
|
64
|
-
logger.trace(log_message, elapsed: delta * 1000)
|
65
|
-
rv
|
66
|
-
end
|
67
|
-
end
|
68
|
-
end
|
69
|
-
|
70
|
-
# Enable trace timing of methods specified in @_methods_to_time via aliasing.
|
71
|
-
def enable_trace_timing
|
72
|
-
methods_to_time.each do |meth_spec|
|
73
|
-
next if meth_spec.aliased
|
74
|
-
|
75
|
-
is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
|
76
|
-
trace_time_class_method(meth_spec, is_class_method)
|
77
|
-
end
|
78
|
-
end
|
79
|
-
end
|
80
|
-
end
|
81
|
-
|
82
16
|
module Contrast
|
83
17
|
# Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
|
84
18
|
# logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
|
@@ -105,7 +39,6 @@ module Contrast
|
|
105
39
|
# level based on updates to TeamServer.
|
106
40
|
class Log
|
107
41
|
include Singleton
|
108
|
-
include ::Contrast::TraceTiming
|
109
42
|
include Contrast::Utils::LogUtils
|
110
43
|
|
111
44
|
attr_reader :previous_path, :previous_level
|
@@ -132,8 +65,6 @@ module Contrast
|
|
132
65
|
@previous_path = current_path
|
133
66
|
@previous_level = current_level_const
|
134
67
|
|
135
|
-
enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
|
136
|
-
|
137
68
|
progname = Contrast::CONFIG.root.agent.logger.progname
|
138
69
|
@_logger = build(path: current_path, level_const: current_level_const, progname: progname)
|
139
70
|
# If we're logging to a new path, then let's start it w/ our helpful
|
data/lib/contrast/logger/time.rb
CHANGED
@@ -8,31 +8,38 @@ module Contrast
|
|
8
8
|
module Time
|
9
9
|
# Log the message at the given level.
|
10
10
|
#
|
11
|
-
# @param level [String] the name of the method to use. Should be one of
|
12
|
-
# trace, debug, info, warn, error
|
11
|
+
# @param level [String] the name of the method to use. Should be one of trace, debug, info, warn, error
|
13
12
|
# @param message [String] the message to log
|
14
13
|
def with_level level, message
|
15
14
|
send(level.to_sym, message)
|
16
15
|
end
|
17
16
|
|
18
|
-
# Log, at the debug level, the action with a message including the time
|
19
|
-
#
|
17
|
+
# Log, at the debug level, the action with a message including the time it took for the wrapped function to
|
18
|
+
# complete. If not logging to debug, simply yield the given block.
|
20
19
|
#
|
21
|
-
# @param msgs [Array<Object>] the arguments to pass to the logger.
|
22
|
-
#
|
20
|
+
# @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
|
21
|
+
# time.
|
23
22
|
# @param block [Block, Proc] the block to execute
|
24
23
|
def debug_with_time *msgs, &block
|
25
|
-
|
24
|
+
if debug?
|
25
|
+
log_with_time(:debug, *msgs, &block)
|
26
|
+
elsif block
|
27
|
+
yield
|
28
|
+
end
|
26
29
|
end
|
27
30
|
|
28
|
-
# Log, at the trace level, the action with a message including the time
|
29
|
-
#
|
31
|
+
# Log, at the trace level, the action with a message including the time it took for the wrapped function to
|
32
|
+
# complete. If not logging to debug, simply yield the given block.
|
30
33
|
#
|
31
|
-
# @param msgs [Array<Object>] the arguments to pass to the logger.
|
32
|
-
#
|
34
|
+
# @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
|
35
|
+
# time.
|
33
36
|
# @param block [Block, Proc] the block to execute
|
34
37
|
def trace_with_time *msgs, &block
|
35
|
-
|
38
|
+
if trace?
|
39
|
+
log_with_time(:trace, *msgs, &block)
|
40
|
+
elsif block
|
41
|
+
yield
|
42
|
+
end
|
36
43
|
end
|
37
44
|
|
38
45
|
private
|
@@ -313,6 +313,13 @@
|
|
313
313
|
"method_visibility": "public",
|
314
314
|
"method_name":"exists?",
|
315
315
|
"code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
|
316
|
+
}, {
|
317
|
+
"class_name":"OmniAuth::Strategies::OAuth2",
|
318
|
+
"instance_method":true,
|
319
|
+
"method_visibility": "public",
|
320
|
+
"method_name":"request_phase",
|
321
|
+
"code": "https://github.com/omniauth/omniauth-oauth2/blob/v1.7.2/lib/omniauth/strategies/oauth2.rb#L58",
|
322
|
+
"note": "Prevent XSS False Positive from redirect as Omniauth handles security of URL & params"
|
316
323
|
}
|
317
324
|
]
|
318
325
|
}
|
data/service_executables/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
2.28.
|
1
|
+
2.28.22
|
Binary file
|
Binary file
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: contrast-agent
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 6.
|
4
|
+
version: 6.6.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- galen.palmer@contrastsecurity.com
|
@@ -13,7 +13,7 @@ authors:
|
|
13
13
|
autorequire:
|
14
14
|
bindir: exe
|
15
15
|
cert_chain: []
|
16
|
-
date: 2022-07-
|
16
|
+
date: 2022-07-15 00:00:00.000000000 Z
|
17
17
|
dependencies:
|
18
18
|
- !ruby/object:Gem::Dependency
|
19
19
|
name: bundler
|
@@ -665,22 +665,22 @@ executables:
|
|
665
665
|
- contrast_service
|
666
666
|
extensions:
|
667
667
|
- ext/cs__common/extconf.rb
|
668
|
+
- ext/cs__assess_fiber_track/extconf.rb
|
669
|
+
- ext/cs__assess_string/extconf.rb
|
670
|
+
- ext/cs__assess_module/extconf.rb
|
671
|
+
- ext/cs__assess_test/extconf.rb
|
672
|
+
- ext/cs__assess_kernel/extconf.rb
|
668
673
|
- ext/cs__assess_yield_track/extconf.rb
|
674
|
+
- ext/cs__assess_hash/extconf.rb
|
669
675
|
- ext/cs__os_information/extconf.rb
|
670
676
|
- ext/cs__contrast_patch/extconf.rb
|
671
|
-
- ext/cs__assess_array/extconf.rb
|
672
|
-
- ext/cs__assess_test/extconf.rb
|
673
|
-
- ext/cs__assess_string_interpolation/extconf.rb
|
674
|
-
- ext/cs__assess_fiber_track/extconf.rb
|
675
677
|
- ext/cs__assess_marshal_module/extconf.rb
|
676
|
-
- ext/cs__assess_basic_object/extconf.rb
|
677
678
|
- ext/cs__assess_regexp/extconf.rb
|
678
|
-
- ext/
|
679
|
-
- ext/cs__tests/extconf.rb
|
680
|
-
- ext/cs__assess_module/extconf.rb
|
681
|
-
- ext/cs__assess_hash/extconf.rb
|
682
|
-
- ext/cs__assess_kernel/extconf.rb
|
679
|
+
- ext/cs__assess_array/extconf.rb
|
683
680
|
- ext/cs__scope/extconf.rb
|
681
|
+
- ext/cs__assess_basic_object/extconf.rb
|
682
|
+
- ext/cs__tests/extconf.rb
|
683
|
+
- ext/cs__assess_string_interpolation/extconf.rb
|
684
684
|
extra_rdoc_files: []
|
685
685
|
files:
|
686
686
|
- ".clang-format"
|