contrast-agent 6.5.1 → 6.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/contrast/agent/assess/policy/source_method.rb +10 -9
- data/lib/contrast/agent/inventory/database_config.rb +2 -1
- data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
- data/lib/contrast/agent/middleware.rb +6 -5
- data/lib/contrast/agent/protect/rule/default_scanner.rb +64 -5
- data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +3 -5
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/components/logger.rb +0 -10
- data/lib/contrast/framework/rails/support.rb +3 -2
- data/lib/contrast/logger/application.rb +2 -1
- data/lib/contrast/logger/log.rb +0 -69
- data/lib/contrast/logger/time.rb +19 -12
- data/resources/deadzone/policy.json +7 -0
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +12 -12
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: f00aee3e36cdb303ca9b209824fbb92386e0ca0043c0f24377f79168dca8d252
|
4
|
+
data.tar.gz: 7fc3d7571246ff92a10da151ce4b723768e3f7214b5a1e57d5bb1d6a66e86e2b
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 9fc9e69602a2706cb41bf8d13e07693afb61ad85ad03ff43182f3c79c5f9dff1c0b8ed3e0cb690d15cf8e43830920516604e9b497945963897f0ee1b82e11f9b
|
7
|
+
data.tar.gz: dfd4e5146f9ac498b83d76b13a9d6ed17a5de0e659ed301acbf6a873e18d5ff75ea8aa8fa7c3789433e100903a9f6bfb4b87c9d283107c5bd04015f862e88644
|
@@ -38,19 +38,20 @@ module Contrast
|
|
38
38
|
# @param ret [Object] the Return of the invoked method
|
39
39
|
# @param args [Array<Object>] the Arguments with which the method was invoked
|
40
40
|
def apply_source method_policy, object, ret, args
|
41
|
-
|
42
|
-
|
43
|
-
|
41
|
+
logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
|
42
|
+
return unless analyze?(method_policy, object, ret, args)
|
43
|
+
return if event_limit?(method_policy)
|
44
|
+
return unless (source_node = method_policy.source_node)
|
44
45
|
|
45
|
-
|
46
|
-
|
46
|
+
# used to hold the object and ret
|
47
|
+
source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
|
47
48
|
|
48
|
-
|
49
|
-
|
49
|
+
return unless (target = determine_target(source_node, source_data, args))
|
50
|
+
return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
|
50
51
|
|
51
|
-
|
52
|
+
process_source(source_node, target, source_data, source_node.type, nil, *args)
|
53
|
+
end
|
52
54
|
end
|
53
|
-
Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
|
54
55
|
|
55
56
|
private
|
56
57
|
|
@@ -21,7 +21,7 @@ module Contrast
|
|
21
21
|
DATA_STORE_MARKER = 'data_store'
|
22
22
|
|
23
23
|
def report_data_store _method, _exception, properties, object, _args
|
24
|
-
return unless ::Contrast::INVENTORY.
|
24
|
+
return unless ::Contrast::INVENTORY.enable
|
25
25
|
|
26
26
|
marker = properties[DATA_STORE_MARKER]
|
27
27
|
return unless marker
|
@@ -61,13 +61,14 @@ module Contrast
|
|
61
61
|
# @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
|
62
62
|
# the Rack framework.
|
63
63
|
def call env
|
64
|
-
|
64
|
+
logger.trace_with_time('Elapsed time for Contrast::Agent::Middleware#call') do
|
65
|
+
return app.call(env) unless ::Contrast::AGENT.enabled?
|
65
66
|
|
66
|
-
|
67
|
-
|
68
|
-
|
67
|
+
Contrast::Agent.heapdump_util.start_thread!
|
68
|
+
handle_first_request
|
69
|
+
call_with_agent(env)
|
70
|
+
end
|
69
71
|
end
|
70
|
-
::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
|
71
72
|
|
72
73
|
private
|
73
74
|
|
@@ -20,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
20
20
|
# :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
|
21
21
|
# :STATE_SKIP_NEXT_CHARACTER
|
22
22
|
|
23
|
+
# @param query [String] the query being executed
|
24
|
+
# @param index [Integer] the index of the input in the query
|
25
|
+
# @param input [String] the input value provided by the user
|
26
|
+
# @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
|
23
27
|
def crosses_boundary query, index, input
|
24
28
|
last_boundary = 0
|
25
|
-
|
29
|
+
scan_token_boundaries(query).each do |boundary|
|
26
30
|
if boundary > index
|
27
|
-
|
31
|
+
# We should report the previous and overrun boundary if the input crosses one.
|
32
|
+
return last_boundary, boundary if boundary < (index + input.length)
|
28
33
|
|
29
34
|
break
|
30
35
|
end
|
@@ -33,10 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
33
38
|
nil
|
34
39
|
end
|
35
40
|
|
36
|
-
|
37
|
-
@_token_boundaries ||= scan_token_boundaries(query)
|
38
|
-
end
|
41
|
+
private
|
39
42
|
|
43
|
+
# @param query [String] the query being executed
|
44
|
+
# @return [Array<Integer>] the boundaries of the query
|
40
45
|
def scan_token_boundaries query
|
41
46
|
boundaries = []
|
42
47
|
return boundaries unless query && !query.empty?
|
@@ -73,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
73
78
|
boundaries
|
74
79
|
end
|
75
80
|
|
81
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
82
|
+
# @param current_state [Symbol] the state of the query
|
83
|
+
# @param char [String] the character being evaluated
|
84
|
+
# @param index [Integer] the location of the character in the query
|
85
|
+
# @param query [String] the query being executed
|
76
86
|
def process_state boundaries, current_state, char, index, query
|
77
87
|
case current_state
|
78
88
|
when :STATE_EXPECTING_TOKEN
|
@@ -88,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
88
98
|
end
|
89
99
|
end
|
90
100
|
|
101
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
102
|
+
# @param char [String] the character being evaluated
|
103
|
+
# @param index [Integer] the location of the character in the query
|
104
|
+
# @param query [String] the query being executed
|
91
105
|
def process_expecting_token boundaries, char, index, query
|
92
106
|
if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
93
107
|
boundaries << index
|
@@ -112,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
112
126
|
end
|
113
127
|
end
|
114
128
|
|
129
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
130
|
+
# @param char [String] the character being evaluated
|
131
|
+
# @param index [Integer] the location of the character in the query
|
132
|
+
# @param query [String] the query being executed
|
115
133
|
def process_inside_token boundaries, char, index, query
|
116
134
|
if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
117
135
|
boundaries << index
|
@@ -133,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
133
151
|
end
|
134
152
|
end
|
135
153
|
|
154
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
155
|
+
# @param char [String] the character being evaluated
|
156
|
+
# @param index [Integer] the location of the character in the query
|
157
|
+
# @param _query [String] the query being executed
|
136
158
|
def process_number boundaries, char, index, _query
|
137
159
|
if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
|
138
160
|
:STATE_INSIDE_NUMBER
|
@@ -142,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
142
164
|
end
|
143
165
|
end
|
144
166
|
|
167
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
168
|
+
# @param char [String] the character being evaluated
|
169
|
+
# @param index [Integer] the location of the character in the query
|
170
|
+
# @param query [String] the query being executed
|
145
171
|
def process_double_quote boundaries, char, index, query
|
146
172
|
if escape_char?(char)
|
147
173
|
:STATE_SKIP_NEXT_CHARACTER
|
@@ -159,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
159
185
|
end
|
160
186
|
end
|
161
187
|
|
188
|
+
# @param boundaries [Array<Integer>] the indexes of the state changes in the query
|
189
|
+
# @param char [String] the character being evaluated
|
190
|
+
# @param index [Integer] the location of the character in the query
|
191
|
+
# @param query [String] the query being executed
|
162
192
|
def process_single_quote boundaries, char, index, query
|
163
193
|
if escape_char?(char)
|
164
194
|
:STATE_SKIP_NEXT_CHARACTER
|
@@ -176,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
176
206
|
end
|
177
207
|
end
|
178
208
|
|
209
|
+
# @param query [String] the query being executed
|
210
|
+
# @param index [Integer] the location of the character in the query
|
179
211
|
def double_quote? query, index
|
180
212
|
return false unless index >= 0 && index < query.length
|
181
213
|
|
182
214
|
query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
|
183
215
|
end
|
184
216
|
|
217
|
+
# @param query [String] the query being executed
|
218
|
+
# @param index [Integer] the location of the character in the query
|
185
219
|
def single_quote? query, index
|
186
220
|
return false unless index >= 0 && index < query.length
|
187
221
|
|
188
222
|
query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
|
189
223
|
end
|
190
224
|
|
225
|
+
# @param query [String] the query being executed
|
226
|
+
# @param index [Integer] the location of the character in the query
|
191
227
|
def find_escape_sequence_boundary query, index
|
192
228
|
idx = index
|
193
229
|
while idx < query.length
|
@@ -199,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
199
235
|
idx
|
200
236
|
end
|
201
237
|
|
238
|
+
# @param query [String] the query being executed
|
239
|
+
# @param index [Integer] the location of the character in the query
|
202
240
|
def find_block_comment_boundary query, index
|
203
241
|
idx = index
|
204
242
|
while idx < query.length
|
@@ -210,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
210
248
|
idx
|
211
249
|
end
|
212
250
|
|
251
|
+
# @param query [String] the query being executed
|
252
|
+
# @param index [Integer] the location of the character in the query
|
213
253
|
def find_new_line_boundary query, index
|
214
254
|
idx = index
|
215
255
|
while idx < query.length
|
@@ -222,12 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
222
262
|
idx
|
223
263
|
end
|
224
264
|
|
265
|
+
# @param char [String] the character being evaluated
|
225
266
|
def operator? char
|
226
267
|
char.match?(OPERATOR_PATTERN)
|
227
268
|
end
|
228
269
|
|
229
270
|
# @note: Any class extending this module should override these methods as needed
|
230
271
|
# Are the current and subsequent characters both '-' ?
|
272
|
+
#
|
273
|
+
# @param char [String] the character being evaluated
|
274
|
+
# @param index [Integer] the location of the character in the query
|
275
|
+
# @param query [String] the query being executed
|
231
276
|
def start_line_comment? char, index, query
|
232
277
|
return false unless char == Contrast::Utils::ObjectShare::DASH
|
233
278
|
return false unless (query.length - 2) >= index
|
@@ -237,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
237
282
|
|
238
283
|
# Is the current character / sequence of characters the start of a block comment
|
239
284
|
# We assume '/*' starts the comment by default
|
285
|
+
#
|
286
|
+
# @param char [String] the character being evaluated
|
287
|
+
# @param index [Integer] the location of the character in the query
|
288
|
+
# @param query [String] the query being executed
|
240
289
|
def start_block_comment? char, index, query
|
241
290
|
return false unless char == Contrast::Utils::ObjectShare::SLASH
|
242
291
|
return false unless (query.length - 2) >= index
|
@@ -246,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
246
295
|
|
247
296
|
# Is the current character / sequence of characters the end of a block comment
|
248
297
|
# We assume '*/' ends the comment by default
|
298
|
+
#
|
299
|
+
# @param char [String] the character being evaluated
|
300
|
+
# @param index [Integer] the location of the character in the query
|
301
|
+
# @param query [String] the query being executed
|
249
302
|
def end_block_comment? char, index, query
|
250
303
|
return false unless char == Contrast::Utils::ObjectShare::ASTERISK
|
251
304
|
return false unless (query.length - 2) >= index
|
@@ -267,18 +320,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
|
|
267
320
|
|
268
321
|
# Is the character provided an escape character?
|
269
322
|
# By default, we'll assume
|
323
|
+
#
|
324
|
+
# @param char [String] the character being evaluated
|
270
325
|
def escape_char? char
|
271
326
|
char == Contrast::Utils::ObjectShare::BACK_SLASH
|
272
327
|
end
|
273
328
|
|
274
329
|
# Is this the start of a string escape sequence?
|
275
330
|
# Since escape sequences aren't supported, the answer is always false
|
331
|
+
#
|
332
|
+
# @param _char [String] the character being evaluated
|
276
333
|
def escape_sequence_start? _char
|
277
334
|
false
|
278
335
|
end
|
279
336
|
|
280
337
|
# Is this the end of a string escape sequence?
|
281
338
|
# Since escape sequences aren't supported, the answer is always false
|
339
|
+
#
|
340
|
+
# @param _char [String] the character being evaluated
|
282
341
|
def escape_sequence_end? _char
|
283
342
|
false
|
284
343
|
end
|
@@ -65,8 +65,8 @@ module Contrast
|
|
65
65
|
# if one exists, in the case of multiple inputs being found to violate the protection criteria
|
66
66
|
# @param result [Contrast::Api::Dtm::AttackResult, nil] previous attack result for this rule, if one exists,
|
67
67
|
# in the case of multiple inputs being found to violate the protection criteria
|
68
|
-
# @query_string [
|
69
|
-
# @kwargs [Hash] key - value pairs of context individual rules need to build out details to send
|
68
|
+
# @param query_string [String] the value of the input which may be an attack
|
69
|
+
# @param kwargs [Hash] key - value pairs of context individual rules need to build out details to send
|
70
70
|
# to the Service to tell the story of the attack
|
71
71
|
# @return [Contrast::Api::Dtm::AttackResult] the result from this attack
|
72
72
|
def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
|
@@ -86,14 +86,12 @@ module Contrast
|
|
86
86
|
ss = StringScanner.new(query_string)
|
87
87
|
length = attack_string.length
|
88
88
|
while ss.scan_until(regexp)
|
89
|
-
# the pos of StringScanner is at the end of the regexp (input string),
|
90
|
-
# we need the beginning
|
89
|
+
# the pos of StringScanner is at the end of the regexp (input string), we need the beginning
|
91
90
|
idx = ss.pos - attack_string.length
|
92
91
|
last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
|
93
92
|
next unless last_boundary && boundary
|
94
93
|
|
95
94
|
result ||= build_attack_result(context)
|
96
|
-
|
97
95
|
record_match(idx, length, boundary, last_boundary, kwargs)
|
98
96
|
append_match(context, input_analysis_result, result, query_string, **kwargs)
|
99
97
|
end
|
@@ -16,16 +16,6 @@ module Contrast
|
|
16
16
|
def cef_logger
|
17
17
|
@_cef_logger ||= Contrast::Logger::CEFLog.instance.tap(&:build_logger)
|
18
18
|
end
|
19
|
-
|
20
|
-
def add_trace_perf_logging_for sym, custom_message = nil
|
21
|
-
logger.add_trace_perf_logging(self, sym, custom_message)
|
22
|
-
end
|
23
|
-
end
|
24
|
-
|
25
|
-
class << self
|
26
|
-
def add_trace_log_timing_for clazz, method_name, custom_message = nil
|
27
|
-
Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
|
28
|
-
end
|
29
19
|
end
|
30
20
|
|
31
21
|
# So This class here follows the update for the configuration
|
@@ -59,7 +59,7 @@ module Contrast
|
|
59
59
|
# ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
|
60
60
|
match, _params, route, path = get_full_route(request.rack_request)
|
61
61
|
unless route
|
62
|
-
logger.warn(
|
62
|
+
logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
|
63
63
|
return
|
64
64
|
end
|
65
65
|
|
@@ -90,7 +90,7 @@ module Contrast
|
|
90
90
|
# ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
|
91
91
|
match, _params, route, path = get_full_route(request.rack_request)
|
92
92
|
unless route
|
93
|
-
logger.warn(
|
93
|
+
logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
|
94
94
|
return
|
95
95
|
end
|
96
96
|
|
@@ -182,6 +182,7 @@ module Contrast
|
|
182
182
|
route_list += find_all_routes(route.app.app, [])
|
183
183
|
end
|
184
184
|
end
|
185
|
+
logger.debug("Routes Found: #{ route_list }")
|
185
186
|
route_list
|
186
187
|
end
|
187
188
|
|
@@ -12,7 +12,8 @@ module Contrast
|
|
12
12
|
return unless info?
|
13
13
|
|
14
14
|
info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
|
15
|
-
agent_version: Contrast::Agent::VERSION
|
15
|
+
agent_version: Contrast::Agent::VERSION,
|
16
|
+
ruby_version: RUBY_VERSION)
|
16
17
|
ENV.each do |env_key, env_value|
|
17
18
|
env_key = env_key.to_s
|
18
19
|
next unless ENV_KEYS.include?(env_key) ||
|
data/lib/contrast/logger/log.rb
CHANGED
@@ -13,72 +13,6 @@ require 'contrast/logger/time'
|
|
13
13
|
require 'contrast/components/config'
|
14
14
|
require 'contrast/utils/log_utils'
|
15
15
|
|
16
|
-
module Contrast
|
17
|
-
# This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
|
18
|
-
# we pay the penalty for that timing block
|
19
|
-
module TraceTiming
|
20
|
-
def methods_to_time
|
21
|
-
@_methods_to_time ||= []
|
22
|
-
end
|
23
|
-
|
24
|
-
# Store info about methods for later patching.
|
25
|
-
METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
|
26
|
-
|
27
|
-
# Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
|
28
|
-
# logger set to TRACE.
|
29
|
-
#
|
30
|
-
# @param: clazz [Class] the class of the method to time.
|
31
|
-
# @param: method [Symbol] the method to time.
|
32
|
-
# @param: method [String] optional custom logging message.
|
33
|
-
def add_method_to_trace_timing clazz, method, msg = nil
|
34
|
-
methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
|
35
|
-
enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
|
36
|
-
end
|
37
|
-
|
38
|
-
# Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
|
39
|
-
# logger set to TRACE.
|
40
|
-
#
|
41
|
-
# @param: meth_spec [METHOD_INFO] specs about the method to be timed.
|
42
|
-
# @param: class_method [Boolean] whether this is or isn't a class/module method.
|
43
|
-
def trace_time_class_method meth_spec, class_method # rubocop:disable Metrics/AbcSize
|
44
|
-
untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
|
45
|
-
send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
|
46
|
-
meth_spec.clazz.class_eval do
|
47
|
-
include(Contrast::Components::Logger::InstanceMethods)
|
48
|
-
extend(Contrast::Components::Logger::InstanceMethods)
|
49
|
-
|
50
|
-
send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
|
51
|
-
meth_spec.aliased = true
|
52
|
-
|
53
|
-
log_message = "Elapsed time for #{ meth_spec.method_name }."
|
54
|
-
log_message = meth_spec.custom_message if meth_spec.custom_msg
|
55
|
-
|
56
|
-
send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
|
57
|
-
start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
|
58
|
-
rv = if kwargs.empty?
|
59
|
-
send(untimed_func_symbol, *args, &block)
|
60
|
-
else
|
61
|
-
send(untimed_func_symbol, *args, **kwargs, &block)
|
62
|
-
end
|
63
|
-
delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
|
64
|
-
logger.trace(log_message, elapsed: delta * 1000)
|
65
|
-
rv
|
66
|
-
end
|
67
|
-
end
|
68
|
-
end
|
69
|
-
|
70
|
-
# Enable trace timing of methods specified in @_methods_to_time via aliasing.
|
71
|
-
def enable_trace_timing
|
72
|
-
methods_to_time.each do |meth_spec|
|
73
|
-
next if meth_spec.aliased
|
74
|
-
|
75
|
-
is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
|
76
|
-
trace_time_class_method(meth_spec, is_class_method)
|
77
|
-
end
|
78
|
-
end
|
79
|
-
end
|
80
|
-
end
|
81
|
-
|
82
16
|
module Contrast
|
83
17
|
# Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
|
84
18
|
# logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
|
@@ -105,7 +39,6 @@ module Contrast
|
|
105
39
|
# level based on updates to TeamServer.
|
106
40
|
class Log
|
107
41
|
include Singleton
|
108
|
-
include ::Contrast::TraceTiming
|
109
42
|
include Contrast::Utils::LogUtils
|
110
43
|
|
111
44
|
attr_reader :previous_path, :previous_level
|
@@ -132,8 +65,6 @@ module Contrast
|
|
132
65
|
@previous_path = current_path
|
133
66
|
@previous_level = current_level_const
|
134
67
|
|
135
|
-
enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
|
136
|
-
|
137
68
|
progname = Contrast::CONFIG.root.agent.logger.progname
|
138
69
|
@_logger = build(path: current_path, level_const: current_level_const, progname: progname)
|
139
70
|
# If we're logging to a new path, then let's start it w/ our helpful
|
data/lib/contrast/logger/time.rb
CHANGED
@@ -8,31 +8,38 @@ module Contrast
|
|
8
8
|
module Time
|
9
9
|
# Log the message at the given level.
|
10
10
|
#
|
11
|
-
# @param level [String] the name of the method to use. Should be one of
|
12
|
-
# trace, debug, info, warn, error
|
11
|
+
# @param level [String] the name of the method to use. Should be one of trace, debug, info, warn, error
|
13
12
|
# @param message [String] the message to log
|
14
13
|
def with_level level, message
|
15
14
|
send(level.to_sym, message)
|
16
15
|
end
|
17
16
|
|
18
|
-
# Log, at the debug level, the action with a message including the time
|
19
|
-
#
|
17
|
+
# Log, at the debug level, the action with a message including the time it took for the wrapped function to
|
18
|
+
# complete. If not logging to debug, simply yield the given block.
|
20
19
|
#
|
21
|
-
# @param msgs [Array<Object>] the arguments to pass to the logger.
|
22
|
-
#
|
20
|
+
# @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
|
21
|
+
# time.
|
23
22
|
# @param block [Block, Proc] the block to execute
|
24
23
|
def debug_with_time *msgs, &block
|
25
|
-
|
24
|
+
if debug?
|
25
|
+
log_with_time(:debug, *msgs, &block)
|
26
|
+
elsif block
|
27
|
+
yield
|
28
|
+
end
|
26
29
|
end
|
27
30
|
|
28
|
-
# Log, at the trace level, the action with a message including the time
|
29
|
-
#
|
31
|
+
# Log, at the trace level, the action with a message including the time it took for the wrapped function to
|
32
|
+
# complete. If not logging to debug, simply yield the given block.
|
30
33
|
#
|
31
|
-
# @param msgs [Array<Object>] the arguments to pass to the logger.
|
32
|
-
#
|
34
|
+
# @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
|
35
|
+
# time.
|
33
36
|
# @param block [Block, Proc] the block to execute
|
34
37
|
def trace_with_time *msgs, &block
|
35
|
-
|
38
|
+
if trace?
|
39
|
+
log_with_time(:trace, *msgs, &block)
|
40
|
+
elsif block
|
41
|
+
yield
|
42
|
+
end
|
36
43
|
end
|
37
44
|
|
38
45
|
private
|
@@ -313,6 +313,13 @@
|
|
313
313
|
"method_visibility": "public",
|
314
314
|
"method_name":"exists?",
|
315
315
|
"code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
|
316
|
+
}, {
|
317
|
+
"class_name":"OmniAuth::Strategies::OAuth2",
|
318
|
+
"instance_method":true,
|
319
|
+
"method_visibility": "public",
|
320
|
+
"method_name":"request_phase",
|
321
|
+
"code": "https://github.com/omniauth/omniauth-oauth2/blob/v1.7.2/lib/omniauth/strategies/oauth2.rb#L58",
|
322
|
+
"note": "Prevent XSS False Positive from redirect as Omniauth handles security of URL & params"
|
316
323
|
}
|
317
324
|
]
|
318
325
|
}
|
data/service_executables/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
2.28.
|
1
|
+
2.28.22
|
Binary file
|
Binary file
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: contrast-agent
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 6.
|
4
|
+
version: 6.6.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- galen.palmer@contrastsecurity.com
|
@@ -13,7 +13,7 @@ authors:
|
|
13
13
|
autorequire:
|
14
14
|
bindir: exe
|
15
15
|
cert_chain: []
|
16
|
-
date: 2022-07-
|
16
|
+
date: 2022-07-15 00:00:00.000000000 Z
|
17
17
|
dependencies:
|
18
18
|
- !ruby/object:Gem::Dependency
|
19
19
|
name: bundler
|
@@ -665,22 +665,22 @@ executables:
|
|
665
665
|
- contrast_service
|
666
666
|
extensions:
|
667
667
|
- ext/cs__common/extconf.rb
|
668
|
+
- ext/cs__assess_fiber_track/extconf.rb
|
669
|
+
- ext/cs__assess_string/extconf.rb
|
670
|
+
- ext/cs__assess_module/extconf.rb
|
671
|
+
- ext/cs__assess_test/extconf.rb
|
672
|
+
- ext/cs__assess_kernel/extconf.rb
|
668
673
|
- ext/cs__assess_yield_track/extconf.rb
|
674
|
+
- ext/cs__assess_hash/extconf.rb
|
669
675
|
- ext/cs__os_information/extconf.rb
|
670
676
|
- ext/cs__contrast_patch/extconf.rb
|
671
|
-
- ext/cs__assess_array/extconf.rb
|
672
|
-
- ext/cs__assess_test/extconf.rb
|
673
|
-
- ext/cs__assess_string_interpolation/extconf.rb
|
674
|
-
- ext/cs__assess_fiber_track/extconf.rb
|
675
677
|
- ext/cs__assess_marshal_module/extconf.rb
|
676
|
-
- ext/cs__assess_basic_object/extconf.rb
|
677
678
|
- ext/cs__assess_regexp/extconf.rb
|
678
|
-
- ext/
|
679
|
-
- ext/cs__tests/extconf.rb
|
680
|
-
- ext/cs__assess_module/extconf.rb
|
681
|
-
- ext/cs__assess_hash/extconf.rb
|
682
|
-
- ext/cs__assess_kernel/extconf.rb
|
679
|
+
- ext/cs__assess_array/extconf.rb
|
683
680
|
- ext/cs__scope/extconf.rb
|
681
|
+
- ext/cs__assess_basic_object/extconf.rb
|
682
|
+
- ext/cs__tests/extconf.rb
|
683
|
+
- ext/cs__assess_string_interpolation/extconf.rb
|
684
684
|
extra_rdoc_files: []
|
685
685
|
files:
|
686
686
|
- ".clang-format"
|