contrast-agent 6.5.1 → 6.6.2

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 958ef5b303e23294af4b85759012ab4c80cb0000d97088b4c8f495560701b91e
4
- data.tar.gz: 714c35c53e89cc2f6335fda57827c5eba620e2ee42ede41d586f072f074defb8
3
+ metadata.gz: f00aee3e36cdb303ca9b209824fbb92386e0ca0043c0f24377f79168dca8d252
4
+ data.tar.gz: 7fc3d7571246ff92a10da151ce4b723768e3f7214b5a1e57d5bb1d6a66e86e2b
5
5
  SHA512:
6
- metadata.gz: a3e1c9a23238e9c3a6727fcd19e1ddf177ac699fcb2200eb1ae190f6a9022a3c5b8e0ee109c90793634cbeb54245f07e3b043e244664782f4a83d34896270baa
7
- data.tar.gz: 79b54ad82d5df30ff7c95499d0862947703a6f6dadab29d3f946072d6c91cd84e3a4207dad71e2be9584b720471325d8eb8fb7d124c4bf4136c4b01a225560bf
6
+ metadata.gz: 9fc9e69602a2706cb41bf8d13e07693afb61ad85ad03ff43182f3c79c5f9dff1c0b8ed3e0cb690d15cf8e43830920516604e9b497945963897f0ee1b82e11f9b
7
+ data.tar.gz: dfd4e5146f9ac498b83d76b13a9d6ed17a5de0e659ed301acbf6a873e18d5ff75ea8aa8fa7c3789433e100903a9f6bfb4b87c9d283107c5bd04015f862e88644
@@ -38,19 +38,20 @@ module Contrast
38
38
  # @param ret [Object] the Return of the invoked method
39
39
  # @param args [Array<Object>] the Arguments with which the method was invoked
40
40
  def apply_source method_policy, object, ret, args
41
- return unless analyze?(method_policy, object, ret, args)
42
- return if event_limit?(method_policy)
43
- return unless (source_node = method_policy.source_node)
41
+ logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
42
+ return unless analyze?(method_policy, object, ret, args)
43
+ return if event_limit?(method_policy)
44
+ return unless (source_node = method_policy.source_node)
44
45
 
45
- # used to hold the object and ret
46
- source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
46
+ # used to hold the object and ret
47
+ source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
47
48
 
48
- return unless (target = determine_target(source_node, source_data, args))
49
- return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
49
+ return unless (target = determine_target(source_node, source_data, args))
50
+ return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
50
51
 
51
- process_source(source_node, target, source_data, source_node.type, nil, *args)
52
+ process_source(source_node, target, source_data, source_node.type, nil, *args)
53
+ end
52
54
  end
53
- Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
54
55
 
55
56
  private
56
57
 
@@ -66,7 +66,8 @@ module Contrast
66
66
  # TODO: RUBY-99999 - Remove when Rails 6.0 is not supported
67
67
  ActiveRecord::Base.connection_config
68
68
  end
69
- rescue StandardError
69
+ rescue StandardError => e
70
+ logger.error('Unable to detect db config connection', e)
70
71
  nil
71
72
  end
72
73
 
@@ -21,7 +21,7 @@ module Contrast
21
21
  DATA_STORE_MARKER = 'data_store'
22
22
 
23
23
  def report_data_store _method, _exception, properties, object, _args
24
- return unless ::Contrast::INVENTORY.enabled
24
+ return unless ::Contrast::INVENTORY.enable
25
25
 
26
26
  marker = properties[DATA_STORE_MARKER]
27
27
  return unless marker
@@ -61,13 +61,14 @@ module Contrast
61
61
  # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
62
62
  # the Rack framework.
63
63
  def call env
64
- return app.call(env) unless ::Contrast::AGENT.enabled?
64
+ logger.trace_with_time('Elapsed time for Contrast::Agent::Middleware#call') do
65
+ return app.call(env) unless ::Contrast::AGENT.enabled?
65
66
 
66
- Contrast::Agent.heapdump_util.start_thread!
67
- handle_first_request
68
- call_with_agent(env)
67
+ Contrast::Agent.heapdump_util.start_thread!
68
+ handle_first_request
69
+ call_with_agent(env)
70
+ end
69
71
  end
70
- ::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
71
72
 
72
73
  private
73
74
 
@@ -20,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
20
20
  # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
21
21
  # :STATE_SKIP_NEXT_CHARACTER
22
22
 
23
+ # @param query [String] the query being executed
24
+ # @param index [Integer] the index of the input in the query
25
+ # @param input [String] the input value provided by the user
26
+ # @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
23
27
  def crosses_boundary query, index, input
24
28
  last_boundary = 0
25
- token_boundaries(query).each do |boundary|
29
+ scan_token_boundaries(query).each do |boundary|
26
30
  if boundary > index
27
- return last_boundary, boundary if boundary < index + input.length
31
+ # We should report the previous and overrun boundary if the input crosses one.
32
+ return last_boundary, boundary if boundary < (index + input.length)
28
33
 
29
34
  break
30
35
  end
@@ -33,10 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
33
38
  nil
34
39
  end
35
40
 
36
- def token_boundaries query
37
- @_token_boundaries ||= scan_token_boundaries(query)
38
- end
41
+ private
39
42
 
43
+ # @param query [String] the query being executed
44
+ # @return [Array<Integer>] the boundaries of the query
40
45
  def scan_token_boundaries query
41
46
  boundaries = []
42
47
  return boundaries unless query && !query.empty?
@@ -73,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
73
78
  boundaries
74
79
  end
75
80
 
81
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
82
+ # @param current_state [Symbol] the state of the query
83
+ # @param char [String] the character being evaluated
84
+ # @param index [Integer] the location of the character in the query
85
+ # @param query [String] the query being executed
76
86
  def process_state boundaries, current_state, char, index, query
77
87
  case current_state
78
88
  when :STATE_EXPECTING_TOKEN
@@ -88,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
88
98
  end
89
99
  end
90
100
 
101
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
102
+ # @param char [String] the character being evaluated
103
+ # @param index [Integer] the location of the character in the query
104
+ # @param query [String] the query being executed
91
105
  def process_expecting_token boundaries, char, index, query
92
106
  if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
93
107
  boundaries << index
@@ -112,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
112
126
  end
113
127
  end
114
128
 
129
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
130
+ # @param char [String] the character being evaluated
131
+ # @param index [Integer] the location of the character in the query
132
+ # @param query [String] the query being executed
115
133
  def process_inside_token boundaries, char, index, query
116
134
  if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
117
135
  boundaries << index
@@ -133,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
133
151
  end
134
152
  end
135
153
 
154
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
155
+ # @param char [String] the character being evaluated
156
+ # @param index [Integer] the location of the character in the query
157
+ # @param _query [String] the query being executed
136
158
  def process_number boundaries, char, index, _query
137
159
  if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
138
160
  :STATE_INSIDE_NUMBER
@@ -142,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
142
164
  end
143
165
  end
144
166
 
167
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
168
+ # @param char [String] the character being evaluated
169
+ # @param index [Integer] the location of the character in the query
170
+ # @param query [String] the query being executed
145
171
  def process_double_quote boundaries, char, index, query
146
172
  if escape_char?(char)
147
173
  :STATE_SKIP_NEXT_CHARACTER
@@ -159,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
159
185
  end
160
186
  end
161
187
 
188
+ # @param boundaries [Array<Integer>] the indexes of the state changes in the query
189
+ # @param char [String] the character being evaluated
190
+ # @param index [Integer] the location of the character in the query
191
+ # @param query [String] the query being executed
162
192
  def process_single_quote boundaries, char, index, query
163
193
  if escape_char?(char)
164
194
  :STATE_SKIP_NEXT_CHARACTER
@@ -176,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
176
206
  end
177
207
  end
178
208
 
209
+ # @param query [String] the query being executed
210
+ # @param index [Integer] the location of the character in the query
179
211
  def double_quote? query, index
180
212
  return false unless index >= 0 && index < query.length
181
213
 
182
214
  query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
183
215
  end
184
216
 
217
+ # @param query [String] the query being executed
218
+ # @param index [Integer] the location of the character in the query
185
219
  def single_quote? query, index
186
220
  return false unless index >= 0 && index < query.length
187
221
 
188
222
  query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
189
223
  end
190
224
 
225
+ # @param query [String] the query being executed
226
+ # @param index [Integer] the location of the character in the query
191
227
  def find_escape_sequence_boundary query, index
192
228
  idx = index
193
229
  while idx < query.length
@@ -199,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
199
235
  idx
200
236
  end
201
237
 
238
+ # @param query [String] the query being executed
239
+ # @param index [Integer] the location of the character in the query
202
240
  def find_block_comment_boundary query, index
203
241
  idx = index
204
242
  while idx < query.length
@@ -210,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
210
248
  idx
211
249
  end
212
250
 
251
+ # @param query [String] the query being executed
252
+ # @param index [Integer] the location of the character in the query
213
253
  def find_new_line_boundary query, index
214
254
  idx = index
215
255
  while idx < query.length
@@ -222,12 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
222
262
  idx
223
263
  end
224
264
 
265
+ # @param char [String] the character being evaluated
225
266
  def operator? char
226
267
  char.match?(OPERATOR_PATTERN)
227
268
  end
228
269
 
229
270
  # @note: Any class extending this module should override these methods as needed
230
271
  # Are the current and subsequent characters both '-' ?
272
+ #
273
+ # @param char [String] the character being evaluated
274
+ # @param index [Integer] the location of the character in the query
275
+ # @param query [String] the query being executed
231
276
  def start_line_comment? char, index, query
232
277
  return false unless char == Contrast::Utils::ObjectShare::DASH
233
278
  return false unless (query.length - 2) >= index
@@ -237,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
237
282
 
238
283
  # Is the current character / sequence of characters the start of a block comment
239
284
  # We assume '/*' starts the comment by default
285
+ #
286
+ # @param char [String] the character being evaluated
287
+ # @param index [Integer] the location of the character in the query
288
+ # @param query [String] the query being executed
240
289
  def start_block_comment? char, index, query
241
290
  return false unless char == Contrast::Utils::ObjectShare::SLASH
242
291
  return false unless (query.length - 2) >= index
@@ -246,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
246
295
 
247
296
  # Is the current character / sequence of characters the end of a block comment
248
297
  # We assume '*/' ends the comment by default
298
+ #
299
+ # @param char [String] the character being evaluated
300
+ # @param index [Integer] the location of the character in the query
301
+ # @param query [String] the query being executed
249
302
  def end_block_comment? char, index, query
250
303
  return false unless char == Contrast::Utils::ObjectShare::ASTERISK
251
304
  return false unless (query.length - 2) >= index
@@ -267,18 +320,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
267
320
 
268
321
  # Is the character provided an escape character?
269
322
  # By default, we'll assume
323
+ #
324
+ # @param char [String] the character being evaluated
270
325
  def escape_char? char
271
326
  char == Contrast::Utils::ObjectShare::BACK_SLASH
272
327
  end
273
328
 
274
329
  # Is this the start of a string escape sequence?
275
330
  # Since escape sequences aren't supported, the answer is always false
331
+ #
332
+ # @param _char [String] the character being evaluated
276
333
  def escape_sequence_start? _char
277
334
  false
278
335
  end
279
336
 
280
337
  # Is this the end of a string escape sequence?
281
338
  # Since escape sequences aren't supported, the answer is always false
339
+ #
340
+ # @param _char [String] the character being evaluated
282
341
  def escape_sequence_end? _char
283
342
  false
284
343
  end
@@ -65,8 +65,8 @@ module Contrast
65
65
  # if one exists, in the case of multiple inputs being found to violate the protection criteria
66
66
  # @param result [Contrast::Api::Dtm::AttackResult, nil] previous attack result for this rule, if one exists,
67
67
  # in the case of multiple inputs being found to violate the protection criteria
68
- # @query_string [string] he value of the input which may be an attack
69
- # @kwargs [Hash] key - value pairs of context individual rules need to build out details to send
68
+ # @param query_string [String] the value of the input which may be an attack
69
+ # @param kwargs [Hash] key - value pairs of context individual rules need to build out details to send
70
70
  # to the Service to tell the story of the attack
71
71
  # @return [Contrast::Api::Dtm::AttackResult] the result from this attack
72
72
  def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
@@ -86,14 +86,12 @@ module Contrast
86
86
  ss = StringScanner.new(query_string)
87
87
  length = attack_string.length
88
88
  while ss.scan_until(regexp)
89
- # the pos of StringScanner is at the end of the regexp (input string),
90
- # we need the beginning
89
+ # the pos of StringScanner is at the end of the regexp (input string), we need the beginning
91
90
  idx = ss.pos - attack_string.length
92
91
  last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
93
92
  next unless last_boundary && boundary
94
93
 
95
94
  result ||= build_attack_result(context)
96
-
97
95
  record_match(idx, length, boundary, last_boundary, kwargs)
98
96
  append_match(context, input_analysis_result, result, query_string, **kwargs)
99
97
  end
@@ -3,6 +3,6 @@
3
3
 
4
4
  module Contrast
5
5
  module Agent
6
- VERSION = '6.5.1'
6
+ VERSION = '6.6.2'
7
7
  end
8
8
  end
@@ -16,16 +16,6 @@ module Contrast
16
16
  def cef_logger
17
17
  @_cef_logger ||= Contrast::Logger::CEFLog.instance.tap(&:build_logger)
18
18
  end
19
-
20
- def add_trace_perf_logging_for sym, custom_message = nil
21
- logger.add_trace_perf_logging(self, sym, custom_message)
22
- end
23
- end
24
-
25
- class << self
26
- def add_trace_log_timing_for clazz, method_name, custom_message = nil
27
- Contrast::Logger::Log.instance.add_method_to_trace_timing(clazz, method_name, custom_message)
28
- end
29
19
  end
30
20
 
31
21
  # So This class here follows the update for the configuration
@@ -59,7 +59,7 @@ module Contrast
59
59
  # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
60
60
  match, _params, route, path = get_full_route(request.rack_request)
61
61
  unless route
62
- logger.warn('Unable to determine the current route of this request')
62
+ logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
63
63
  return
64
64
  end
65
65
 
@@ -90,7 +90,7 @@ module Contrast
90
90
  # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
91
91
  match, _params, route, path = get_full_route(request.rack_request)
92
92
  unless route
93
- logger.warn('Unable to determine the current route of this request')
93
+ logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
94
94
  return
95
95
  end
96
96
 
@@ -182,6 +182,7 @@ module Contrast
182
182
  route_list += find_all_routes(route.app.app, [])
183
183
  end
184
184
  end
185
+ logger.debug("Routes Found: #{ route_list }")
185
186
  route_list
186
187
  end
187
188
 
@@ -12,7 +12,8 @@ module Contrast
12
12
  return unless info?
13
13
 
14
14
  info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
15
- agent_version: Contrast::Agent::VERSION)
15
+ agent_version: Contrast::Agent::VERSION,
16
+ ruby_version: RUBY_VERSION)
16
17
  ENV.each do |env_key, env_value|
17
18
  env_key = env_key.to_s
18
19
  next unless ENV_KEYS.include?(env_key) ||
@@ -13,72 +13,6 @@ require 'contrast/logger/time'
13
13
  require 'contrast/components/config'
14
14
  require 'contrast/utils/log_utils'
15
15
 
16
- module Contrast
17
- # This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
18
- # we pay the penalty for that timing block
19
- module TraceTiming
20
- def methods_to_time
21
- @_methods_to_time ||= []
22
- end
23
-
24
- # Store info about methods for later patching.
25
- METHOD_INFO = Struct.new(:clazz, :method_name, :custom_msg, :aliased)
26
-
27
- # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
28
- # logger set to TRACE.
29
- #
30
- # @param: clazz [Class] the class of the method to time.
31
- # @param: method [Symbol] the method to time.
32
- # @param: method [String] optional custom logging message.
33
- def add_method_to_trace_timing clazz, method, msg = nil
34
- methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
35
- enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
36
- end
37
-
38
- # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
39
- # logger set to TRACE.
40
- #
41
- # @param: meth_spec [METHOD_INFO] specs about the method to be timed.
42
- # @param: class_method [Boolean] whether this is or isn't a class/module method.
43
- def trace_time_class_method meth_spec, class_method # rubocop:disable Metrics/AbcSize
44
- untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
45
- send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
46
- meth_spec.clazz.class_eval do
47
- include(Contrast::Components::Logger::InstanceMethods)
48
- extend(Contrast::Components::Logger::InstanceMethods)
49
-
50
- send_to.send(:alias_method, untimed_func_symbol, meth_spec.method_name)
51
- meth_spec.aliased = true
52
-
53
- log_message = "Elapsed time for #{ meth_spec.method_name }."
54
- log_message = meth_spec.custom_message if meth_spec.custom_msg
55
-
56
- send_to.send(:define_method, meth_spec.method_name) do |*args, **kwargs, &block| # rubocop:disable Performance/Kernel/DefineMethod
57
- start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
58
- rv = if kwargs.empty?
59
- send(untimed_func_symbol, *args, &block)
60
- else
61
- send(untimed_func_symbol, *args, **kwargs, &block)
62
- end
63
- delta = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
64
- logger.trace(log_message, elapsed: delta * 1000)
65
- rv
66
- end
67
- end
68
- end
69
-
70
- # Enable trace timing of methods specified in @_methods_to_time via aliasing.
71
- def enable_trace_timing
72
- methods_to_time.each do |meth_spec|
73
- next if meth_spec.aliased
74
-
75
- is_class_method = meth_spec.clazz.singleton_methods(false).include?(meth_spec.method_name)
76
- trace_time_class_method(meth_spec, is_class_method)
77
- end
78
- end
79
- end
80
- end
81
-
82
16
  module Contrast
83
17
  # Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
84
18
  # logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
@@ -105,7 +39,6 @@ module Contrast
105
39
  # level based on updates to TeamServer.
106
40
  class Log
107
41
  include Singleton
108
- include ::Contrast::TraceTiming
109
42
  include Contrast::Utils::LogUtils
110
43
 
111
44
  attr_reader :previous_path, :previous_level
@@ -132,8 +65,6 @@ module Contrast
132
65
  @previous_path = current_path
133
66
  @previous_level = current_level_const
134
67
 
135
- enable_trace_timing if current_level_const == ::Ougai::Logging::TRACE
136
-
137
68
  progname = Contrast::CONFIG.root.agent.logger.progname
138
69
  @_logger = build(path: current_path, level_const: current_level_const, progname: progname)
139
70
  # If we're logging to a new path, then let's start it w/ our helpful
@@ -8,31 +8,38 @@ module Contrast
8
8
  module Time
9
9
  # Log the message at the given level.
10
10
  #
11
- # @param level [String] the name of the method to use. Should be one of
12
- # trace, debug, info, warn, error
11
+ # @param level [String] the name of the method to use. Should be one of trace, debug, info, warn, error
13
12
  # @param message [String] the message to log
14
13
  def with_level level, message
15
14
  send(level.to_sym, message)
16
15
  end
17
16
 
18
- # Log, at the debug level, the action with a message including the time
19
- # it took for the wrapped function to complete.
17
+ # Log, at the debug level, the action with a message including the time it took for the wrapped function to
18
+ # complete. If not logging to debug, simply yield the given block.
20
19
  #
21
- # @param msgs [Array<Object>] the arguments to pass to the logger.
22
- # msgs[0] will be modified to include the elapsed time.
20
+ # @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
21
+ # time.
23
22
  # @param block [Block, Proc] the block to execute
24
23
  def debug_with_time *msgs, &block
25
- log_with_time(:debug, *msgs, &block)
24
+ if debug?
25
+ log_with_time(:debug, *msgs, &block)
26
+ elsif block
27
+ yield
28
+ end
26
29
  end
27
30
 
28
- # Log, at the trace level, the action with a message including the time
29
- # it took for the wrapped function to complete.
31
+ # Log, at the trace level, the action with a message including the time it took for the wrapped function to
32
+ # complete. If not logging to debug, simply yield the given block.
30
33
  #
31
- # @param msgs [Array<Object>] the arguments to pass to the logger.
32
- # msgs[0] will be modified to include the elapsed time.
34
+ # @param msgs [Array<Object>] the arguments to pass to the logger. msgs[0] will be modified to include the elapsed
35
+ # time.
33
36
  # @param block [Block, Proc] the block to execute
34
37
  def trace_with_time *msgs, &block
35
- log_with_time(:trace, *msgs, &block)
38
+ if trace?
39
+ log_with_time(:trace, *msgs, &block)
40
+ elsif block
41
+ yield
42
+ end
36
43
  end
37
44
 
38
45
  private
@@ -313,6 +313,13 @@
313
313
  "method_visibility": "public",
314
314
  "method_name":"exists?",
315
315
  "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
316
+ }, {
317
+ "class_name":"OmniAuth::Strategies::OAuth2",
318
+ "instance_method":true,
319
+ "method_visibility": "public",
320
+ "method_name":"request_phase",
321
+ "code": "https://github.com/omniauth/omniauth-oauth2/blob/v1.7.2/lib/omniauth/strategies/oauth2.rb#L58",
322
+ "note": "Prevent XSS False Positive from redirect as Omniauth handles security of URL & params"
316
323
  }
317
324
  ]
318
325
  }
@@ -1 +1 @@
1
- 2.28.20
1
+ 2.28.22
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.5.1
4
+ version: 6.6.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2022-07-01 00:00:00.000000000 Z
16
+ date: 2022-07-15 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: bundler
@@ -665,22 +665,22 @@ executables:
665
665
  - contrast_service
666
666
  extensions:
667
667
  - ext/cs__common/extconf.rb
668
+ - ext/cs__assess_fiber_track/extconf.rb
669
+ - ext/cs__assess_string/extconf.rb
670
+ - ext/cs__assess_module/extconf.rb
671
+ - ext/cs__assess_test/extconf.rb
672
+ - ext/cs__assess_kernel/extconf.rb
668
673
  - ext/cs__assess_yield_track/extconf.rb
674
+ - ext/cs__assess_hash/extconf.rb
669
675
  - ext/cs__os_information/extconf.rb
670
676
  - ext/cs__contrast_patch/extconf.rb
671
- - ext/cs__assess_array/extconf.rb
672
- - ext/cs__assess_test/extconf.rb
673
- - ext/cs__assess_string_interpolation/extconf.rb
674
- - ext/cs__assess_fiber_track/extconf.rb
675
677
  - ext/cs__assess_marshal_module/extconf.rb
676
- - ext/cs__assess_basic_object/extconf.rb
677
678
  - ext/cs__assess_regexp/extconf.rb
678
- - ext/cs__assess_string/extconf.rb
679
- - ext/cs__tests/extconf.rb
680
- - ext/cs__assess_module/extconf.rb
681
- - ext/cs__assess_hash/extconf.rb
682
- - ext/cs__assess_kernel/extconf.rb
679
+ - ext/cs__assess_array/extconf.rb
683
680
  - ext/cs__scope/extconf.rb
681
+ - ext/cs__assess_basic_object/extconf.rb
682
+ - ext/cs__tests/extconf.rb
683
+ - ext/cs__assess_string_interpolation/extconf.rb
684
684
  extra_rdoc_files: []
685
685
  files:
686
686
  - ".clang-format"