contrast-agent 6.5.1 → 6.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 958ef5b303e23294af4b85759012ab4c80cb0000d97088b4c8f495560701b91e
4
- data.tar.gz: 714c35c53e89cc2f6335fda57827c5eba620e2ee42ede41d586f072f074defb8
3
+ metadata.gz: f00aee3e36cdb303ca9b209824fbb92386e0ca0043c0f24377f79168dca8d252
4
+ data.tar.gz: 7fc3d7571246ff92a10da151ce4b723768e3f7214b5a1e57d5bb1d6a66e86e2b
5
5
  SHA512:
6
- metadata.gz: a3e1c9a23238e9c3a6727fcd19e1ddf177ac699fcb2200eb1ae190f6a9022a3c5b8e0ee109c90793634cbeb54245f07e3b043e244664782f4a83d34896270baa
7
- data.tar.gz: 79b54ad82d5df30ff7c95499d0862947703a6f6dadab29d3f946072d6c91cd84e3a4207dad71e2be9584b720471325d8eb8fb7d124c4bf4136c4b01a225560bf
6
+ metadata.gz: 9fc9e69602a2706cb41bf8d13e07693afb61ad85ad03ff43182f3c79c5f9dff1c0b8ed3e0cb690d15cf8e43830920516604e9b497945963897f0ee1b82e11f9b
7
+ data.tar.gz: dfd4e5146f9ac498b83d76b13a9d6ed17a5de0e659ed301acbf6a873e18d5ff75ea8aa8fa7c3789433e100903a9f6bfb4b87c9d283107c5bd04015f862e88644
@@ -38,19 +38,20 @@ module Contrast
38
38
  # @param ret [Object] the Return of the invoked method
39
39
  # @param args [Array<Object>] the Arguments with which the method was invoked
40
40
  def apply_source method_policy, object, ret, args
41
- return unless analyze?(method_policy, object, ret, args)
42
- return if event_limit?(method_policy)
43
- return unless (source_node = method_policy.source_node)
41
+ logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
42
+ return unless analyze?(method_policy, object, ret, args)
43
+ return if event_limit?(method_policy)
44
+ return unless (source_node = method_policy.source_node)
44
45
 
45
- # used to hold the object and ret
46
- source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
46
+ # used to hold the object and ret
47
+ source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
47
48
 
48
- return unless (target = determine_target(source_node, source_data, args))
49
- return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
49
+ return unless (target = determine_target(source_node, source_data, args))
50
+ return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
50
51
 
51
- process_source(source_node, target, source_data, source_node.type, nil, *args)
52
+ process_source(source_node, target, source_data, source_node.type, nil, *args)
53
+ end
52
54
  end
53
- Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
54
55
 
55
56
  private
56
57
 
@@ -66,7 +66,8 @@ module Contrast
66
66
  # TODO: RUBY-99999 - Remove when Rails 6.0 is not supported
67
67
  ActiveRecord::Base.connection_config
68
68
  end
69
- rescue StandardError
69
+ rescue StandardError => e
70
+ logger.error('Unable to detect db config connection', e)
70
71
  nil
71
72
  end
72
73
 
@@ -21,7 +21,7 @@ module Contrast
21
21
  DATA_STORE_MARKER = 'data_store'
22
22
 
23
23
  def report_data_store _method, _exception, properties, object, _args
24
- return unless ::Contrast::INVENTORY.enabled
24
+ return unless ::Contrast::INVENTORY.enable
25
25
 
26
26
  marker = properties[DATA_STORE_MARKER]
27
27
  return unless marker
@@ -61,13 +61,14 @@ module Contrast
61
61
  # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
62
62
  # the Rack framework.
63
63
  def call env
64
- return app.call(env) unless ::Contrast::AGENT.enabled?
64
+ logger.trace_with_time('Elapsed time for Contrast::Agent::Middleware#call') do
65
+ return app.call(env) unless ::Contrast::AGENT.enabled?
65
66
 
66
- Contrast::Agent.heapdump_util.start_thread!
67
- handle_first_request
68
- call_with_agent(env)
67
+ Contrast::Agent.heapdump_util.start_thread!
68
+ handle_first_request
69
+ call_with_agent(env)
70
+ end
69
71
  end
70
- ::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
71
72
 
72
73
  private
73
74
 
@@ -20,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
20
20
  # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
21
21
  # :STATE_SKIP_NEXT_CHARACTER
22
22
 
23
+ # @param query [String] the query being executed
24
+ # @param index [Integer] the index of the input in the query
25
+ # @param input [String] the input value provided by the user
26
+ # @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
23
27
  def crosses_boundary query, index, input
24
28
  last_boundary = 0
25
- token_boundaries(query).each do |boundary|
29
+ scan_token_boundaries(query).each do |boundary|
26
30
  if boundary > index
27
- return last_boundary, boundary if boundary < index + input.length
31
+ # We should report the previous and overrun boundary if the input crosses one.
32
+ return last_boundary, boundary if boundary < (index + input.length)
28
33
 
29
34
  break
30
35
  end
@@ -33,10 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
33
38
  nil
34
39
  end
35
40
 
36
- def token_boundaries query
37
- @_token_boundaries ||= scan_token_boundaries(query)
38
- end
41
+ private
39
42
 
43
+ # @param query [String] the query being executed
44
+ # @return [Array<Integer>] the boundaries of the query
40
45
  def scan_token_boundaries query
41
46
  boundaries = []
42
47
  return boundaries unless query && !query.empty?
@@ -73,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
73
78
  boundaries
74
79
  end
75
80
 
81
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
82
+ # @param current_state [Symbol] the state of the query
83
+ # @param char [String] the character being evaluated
84
+ # @param index [Integer] the location of the character in the query
85
+ # @param query [String] the query being executed
76
86
  def process_state boundaries, current_state, char, index, query
77
87
  case current_state
78
88
  when :STATE_EXPECTING_TOKEN
@@ -88,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
88
98
  end
89
99
  end
90
100
 
101
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
102
+ # @param char [String] the character being evaluated
103
+ # @param index [Integer] the location of the character in the query
104
+ # @param query [String] the query being executed
91
105
  def process_expecting_token boundaries, char, index, query
92
106
  if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
93
107
  boundaries << index
@@ -112,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
112
126
  end
113
127
  end
114
128
 
129
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
130
+ # @param char [String] the character being evaluated
131
+ # @param index [Integer] the location of the character in the query
132
+ # @param query [String] the query being executed
115
133
  def process_inside_token boundaries, char, index, query
116
134
  if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
117
135
  boundaries << index
@@ -133,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
133
151
  end
134
152
  end
135
153
 
154
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
155
+ # @param char [String] the character being evaluated
156
+ # @param index [Integer] the location of the character in the query
157
+ # @param _query [String] the query being executed
136
158
  def process_number boundaries, char, index, _query
137
159
  if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
138
160
  :STATE_INSIDE_NUMBER
@@ -142,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
142
164
  end
143
165
  end
144
166
 
167
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
168
+ # @param char [String] the character being evaluated
169
+ # @param index [Integer] the location of the character in the query
170
+ # @param query [String] the query being executed
145
171
  def process_double_quote boundaries, char, index, query
146
172
  if escape_char?(char)
147
173
  :STATE_SKIP_NEXT_CHARACTER
@@ -159,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
159
185
  end
160
186
  end
161
187
 
188
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
189
+ # @param char [String] the character being evaluated
190
+ # @param index [Integer] the location of the character in the query
191
+ # @param query [String] the query being executed
162
192
  def process_single_quote boundaries, char, index, query
163
193
  if escape_char?(char)
164
194
  :STATE_SKIP_NEXT_CHARACTER
@@ -176,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
176
206
  end
177
207
  end
178
208
 
209
+ # @param query [String] the query being executed
210
+ # @param index [Integer] the location of the character in the query
179
211
  def double_quote? query, index
180
212
  return false unless index >= 0 && index < query.length
181
213
 
182
214
  query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
183
215
  end
184
216
 
217
+ # @param query [String] the query being executed
218
+ # @param index [Integer] the location of the character in the query
185
219
  def single_quote? query, index
186
220
  return false unless index >= 0 && index < query.length
187
221
 
188
222
  query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
189
223
  end
190
224
 
225
+ # @param query [String] the query being executed
226
+ # @param index [Integer] the location of the character in the query
191
227
  def find_escape_sequence_boundary query, index
192
228
  idx = index
193
229
  while idx < query.length
@@ -199,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
199
235
  idx
200
236
  end
201
237
 
238
+ # @param query [String] the query being executed
239
+ # @param index [Integer] the location of the character in the query
202
240
  def find_block_comment_boundary query, index
203
241
  idx = index
204
242
  while idx < query.length
@@ -210,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
210
248
  idx
211
249
  end
212
250
 
251
+ # @param query [String] the query being executed
252
+ # @param index [Integer] the location of the character in the query
213
253
  def find_new_line_boundary query, index
214
254
  idx = index
215
255
  while idx < query.length
@@ -222,12 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
222
262
  idx
223
263
  end
224
264
 
265
+ # @param char [String] the character being evaluated
225
266
  def operator? char
226
267
  char.match?(OPERATOR_PATTERN)
227
268
  end
228
269
 
229
270
  # @note: Any class extending this module should override these methods as needed
230
271
  # Are the current and subsequent characters both '-' ?
272
+ #
273
+ # @param char [String] the character being evaluated
274
+ # @param index [Integer] the location of the character in the query
275
+ # @param query [String] the query being executed
231
276
  def start_line_comment? char, index, query
232
277
  return false unless char == Contrast::Utils::ObjectShare::DASH
233
278
  return false unless (query.length - 2) >= index
@@ -237,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
237
282
 
238
283
  # Is the current character / sequence of characters the start of a block comment
239
284
  # We assume '/*' starts the comment by default
285
+ #
286
+ # @param char [String] the character being evaluated
287
+ # @param index [Integer] the location of the character in the query
288
+ # @param query [String] the query being executed
240
289
  def start_block_comment? char, index, query
241
290
  return false unless char == Contrast::Utils::ObjectShare::SLASH
242
291
  return false unless (query.length - 2) >= index
@@ -246,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
246
295
 
247
296
  # Is the current character / sequence of characters the end of a block comment
248
297
  # We assume '*/' ends the comment by default
298
+ #
299
+ # @param char [String] the character being evaluated
300
+ # @param index [Integer] the location of the character in the query
301
+ # @param query [String] the query being executed
249
302
  def end_block_comment? char, index, query
250
303
  return false unless char == Contrast::Utils::ObjectShare::ASTERISK
251
304
  return false unless (query.length - 2) >= index
@@ -267,18 +320,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
267
320
 
268
321
  # Is the character provided an escape character?
269
322
  # By default, we'll assume
323
+ #
324
+ # @param char [String] the character being evaluated
270
325
  def escape_char? char
271
326
  char == Contrast::Utils::ObjectShare::BACK_SLASH
272
327
  end
273
328
 
274
329
  # Is this the start of a string escape sequence?
275
330
  # Since escape sequences aren't supported, the answer is always false
331
+ #
332
+ # @param _char [String] the character being evaluated
276
333
  def escape_sequence_start? _char
277
334
  false
278
335
  end
279
336
 
280
337
  # Is this the end of a string escape sequence?
281
338
  # Since escape sequences aren't supported, the answer is always false
339
+ #
340
+ # @param _char [String] the character being evaluated
282
341
  def escape_sequence_end? _char
283
342
  false
284
343
  end
@@ -65,8 +65,8 @@ module Contrast
65
65
  # if one exists, in the case of multiple inputs being found to violate the protection criteria
66
66
  # @param result [Contrast::Api::Dtm::AttackResult, nil] previous attack result for this rule, if one exists,
67
67
  # in the case of multiple inputs being found to violate the protection criteria
68
- # @query_string [string] he value of the input which may be an attack
69
- # @kwargs [Hash] key - value pairs of context individual rules need to build out details to send
68
+ # @param query_string [String] the value of the input which may be an attack
69
+ # @param kwargs [Hash] key - value pairs of context individual rules need to build out details to send
70
70
  # to the Service to tell the story of the attack
71
71
  # @return [Contrast::Api::Dtm::AttackResult] the result from this attack
72
72
  def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
@@ -86,14 +86,12 @@ module Contrast
86
86
  ss = StringScanner.new(query_string)
87
87
  length = attack_string.length
88
88
  while ss.scan_until(regexp)
89
- # the pos of StringScanner is at the end of the regexp (input string),
90
- # we need the beginning
89
+ # the pos of StringScanner is at the end of the regexp (input string), we need the beginning
91
90
  idx = ss.pos - attack_string.length
92
91
  last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
93
92
  next unless last_boundary && boundary
94
93
 
95
94
  result ||= build_attack_result(context)
96
-
97
95
  record_match(idx, length, boundary, last_boundary, kwargs)
98
96
  append_match(context, input_analysis_result, result, query_string, **kwargs)
99
97
  end
@@ -3,6 +3,6 @@
3
3
 
4
4
  module Contrast
5
5
  module Agent
6
- VERSION = '6.5.1'
6
+ VERSION = '6.6.2'
7
7
  end
8
8
  end
@@ -16,16 +16,6 @@ module Contrast
16
16
  def cef_logger
17
17
  @_cef_logger ||= Contrast::Logger::CEFLog.instance.tap(&:build_logger)
18
18
  end
19
-
20
- def add_trace_perf_logging_for sym, custom_message = nil
21
- logger.add_trace_perf_logging(self, sym, custom_message)
22
- end
23
- end
24
-
25
- class << self
26
- def add_trace_log_timing_for clazz, method_name, custom_message = nil
27
- Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
28
- end
29
19
  end
30
20
 
31
21
  # So This class here follows the update for the configuration
@@ -59,7 +59,7 @@ module Contrast
59
59
  # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
60
60
  match, _params, route, path = get_full_route(request.rack_request)
61
61
  unless route
62
- logger.warn('Unable to determine the current route of this request')
62
+ logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
63
63
  return
64
64
  end
65
65
 
@@ -90,7 +90,7 @@ module Contrast
90
90
  # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
91
91
  match, _params, route, path = get_full_route(request.rack_request)
92
92
  unless route
93
- logger.warn('Unable to determine the current route of this request')
93
+ logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
94
94
  return
95
95
  end
96
96
 
@@ -182,6 +182,7 @@ module Contrast
182
182
  route_list += find_all_routes(route.app.app, [])
183
183
  end
184
184
  end
185
+ logger.debug("Routes Found: #{ route_list }")
185
186
  route_list
186
187
  end
187
188
 
@@ -12,7 +12,8 @@ module Contrast
12
12
  return unless info?
13
13
 
14
14
  info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
15
- agent_version: Contrast::Agent::VERSION)
15
+ agent_version: Contrast::Agent::VERSION,
16
+ ruby_version: RUBY_VERSION)
16
17
  ENV.each do |env_key, env_value|
17
18
  env_key = env_key.to_s
18
19
  next unless ENV_KEYS.include?(env_key) ||
@@ -13,72 +13,6 @@ require 'contrast/logger/time'
13
13
  require 'contrast/components/config'
14
14
  require 'contrast/utils/log_utils'
15
15
 
16
- module Contrast
17
- # This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
18
- # we pay the penalty for that timing block
19
- module TraceTiming
20
- def methods_to_time
21
- @_methods_to_time ||= []
22
- end
23
-
24
- # Store info about methods for later patching.
25
- METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
26
-
27
- # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
28
- # logger set to TRACE.
29
- #
30
- # @param: clazz [Class] the class of the method to time.
31
- # @param: method [Symbol] the method to time.
32
- # @param: method [String] optional custom logging message.
33
- def add_method_to_trace_timing clazz, method, msg = nil
34
- methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
35
- enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
36
- end
37
-
38
- # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
39
- # logger set to TRACE.
40
- #
41
- # @param: meth_spec [METHOD_INFO] specs about the method to be timed.
42
- # @param: class_method [Boolean] whether this is or isn't a class/module method.
43
- def trace_time_class_method meth_spec, class_method # rubocop:disable Metrics/AbcSize
44
- untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
45
- send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
46
- meth_spec.clazz.class_eval do
47
- include(Contrast::Components::Logger::InstanceMethods)
48
- extend(Contrast::Components::Logger::InstanceMethods)
49
-
50
- send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
51
- meth_spec.aliased = true
52
-
53
- log_message = "Elapsed time for #{ meth_spec.method_name }."
54
- log_message = meth_spec.custom_message if meth_spec.custom_msg
55
-
56
- send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
57
- start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
58
- rv = if kwargs.empty?
59
- send(untimed_func_symbol, *args, &block)
60
- else
61
- send(untimed_func_symbol, *args, **kwargs, &block)
62
- end
63
- delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
64
- logger.trace(log_message, elapsed: delta * 1000)
65
- rv
66
- end
67
- end
68
- end
69
-
70
- # Enable trace timing of methods specified in @_methods_to_time via aliasing.
71
- def enable_trace_timing
72
- methods_to_time.each do |meth_spec|
73
- next if meth_spec.aliased
74
-
75
- is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
76
- trace_time_class_method(meth_spec, is_class_method)
77
- end
78
- end
79
- end
80
- end
81
-
82
16
  module Contrast
83
17
  # Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
84
18
  # logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
@@ -105,7 +39,6 @@ module Contrast
105
39
  # level based on updates to TeamServer.
106
40
  class Log
107
41
  include Singleton
108
- include ::Contrast::TraceTiming
109
42
  include Contrast::Utils::LogUtils
110
43
 
111
44
  attr_reader :previous_path, :previous_level
@@ -132,8 +65,6 @@ module Contrast
132
65
  @previous_path = current_path
133
66
  @previous_level = current_level_const
134
67
 
135
- enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
136
-
137
68
  progname = Contrast::CONFIG.root.agent.logger.progname
138
69
  @_logger = build(path: current_path, level_const: current_level_const, progname: progname)
139
70
  # If we're logging to a new path, then let's start it w/ our helpful
@@ -8,31 +8,38 @@ module Contrast
8
8
  module Time
9
9
  # Log the message at the given level.
10
10
  #
11
- # @param level [String] the name of the method to use. Should be one of
12
- # trace, debug, info, warn, error
11
+ # @param level [String] the name of the method to use. Should be one of trace, debug, info, warn, error
13
12
  # @param message [String] the message to log
14
13
  def with_level level, message
15
14
  send(level.to_sym, message)
16
15
  end
17
16
 
18
- # Log, at the debug level, the action with a message including the time
19
- # it took for the wrapped function to complete.
17
+ # Log, at the debug level, the action with a message including the time it took for the wrapped function to
18
+ # complete. If not logging to debug, simply yield the given block.
20
19
  #
21
- # @param msgs [Array<Object>] the arguments to pass to the logger.
22
- # msgs[0] will be modified to include the elapsed time.
20
+ # @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
21
+ # time.
23
22
  # @param block [Block, Proc] the block to execute
24
23
  def debug_with_time *msgs, &block
25
- log_with_time(:debug, *msgs, &block)
24
+ if debug?
25
+ log_with_time(:debug, *msgs, &block)
26
+ elsif block
27
+ yield
28
+ end
26
29
  end
27
30
 
28
- # Log, at the trace level, the action with a message including the time
29
- # it took for the wrapped function to complete.
31
+ # Log, at the trace level, the action with a message including the time it took for the wrapped function to
32
+ # complete. If not logging to debug, simply yield the given block.
30
33
  #
31
- # @param msgs [Array<Object>] the arguments to pass to the logger.
32
- # msgs[0] will be modified to include the elapsed time.
34
+ # @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
35
+ # time.
33
36
  # @param block [Block, Proc] the block to execute
34
37
  def trace_with_time *msgs, &block
35
- log_with_time(:trace, *msgs, &block)
38
+ if trace?
39
+ log_with_time(:trace, *msgs, &block)
40
+ elsif block
41
+ yield
42
+ end
36
43
  end
37
44
 
38
45
  private
@@ -313,6 +313,13 @@
313
313
  "method_visibility": "public",
314
314
  "method_name":"exists?",
315
315
  "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
316
+ }, {
317
+ "class_name":"OmniAuth::Strategies::OAuth2",
318
+ "instance_method":true,
319
+ "method_visibility": "public",
320
+ "method_name":"request_phase",
321
+ "code": "https://github.com/omniauth/omniauth-oauth2/blob/v1.7.2/lib/omniauth/strategies/oauth2.rb#L58",
322
+ "note": "Prevent XSS False Positive from redirect as Omniauth handles security of URL & params"
316
323
  }
317
324
  ]
318
325
  }
@@ -1 +1 @@
1
- 2.28.20
1
+ 2.28.22
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.5.1
4
+ version: 6.6.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2022-07-01 00:00:00.000000000 Z
16
+ date: 2022-07-15 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: bundler
@@ -665,22 +665,22 @@ executables:
665
665
  - contrast_service
666
666
  extensions:
667
667
  - ext/cs__common/extconf.rb
668
+ - ext/cs__assess_fiber_track/extconf.rb
669
+ - ext/cs__assess_string/extconf.rb
670
+ - ext/cs__assess_module/extconf.rb
671
+ - ext/cs__assess_test/extconf.rb
672
+ - ext/cs__assess_kernel/extconf.rb
668
673
  - ext/cs__assess_yield_track/extconf.rb
674
+ - ext/cs__assess_hash/extconf.rb
669
675
  - ext/cs__os_information/extconf.rb
670
676
  - ext/cs__contrast_patch/extconf.rb
671
- - ext/cs__assess_array/extconf.rb
672
- - ext/cs__assess_test/extconf.rb
673
- - ext/cs__assess_string_interpolation/extconf.rb
674
- - ext/cs__assess_fiber_track/extconf.rb
675
677
  - ext/cs__assess_marshal_module/extconf.rb
676
- - ext/cs__assess_basic_object/extconf.rb
677
678
  - ext/cs__assess_regexp/extconf.rb
678
- - ext/cs__assess_string/extconf.rb
679
- - ext/cs__tests/extconf.rb
680
- - ext/cs__assess_module/extconf.rb
681
- - ext/cs__assess_hash/extconf.rb
682
- - ext/cs__assess_kernel/extconf.rb
679
+ - ext/cs__assess_array/extconf.rb
683
680
  - ext/cs__scope/extconf.rb
681
+ - ext/cs__assess_basic_object/extconf.rb
682
+ - ext/cs__tests/extconf.rb
683
+ - ext/cs__assess_string_interpolation/extconf.rb
684
684
  extra_rdoc_files: []
685
685
  files:
686
686
  - ".clang-format"