contrast-agent 6.6.5 → 6.7.0

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,91 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::RouteCoverage} protobuf model
-      # to handle conversion between framework route classes and the dtm.
-      module RouteCoverage
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Class methods for RouteCoverage
-        module ClassMethods
-          def source_or_string obj
-            if obj.cs__is_a?(Regexp)
-              obj.source
-            elsif obj.cs__respond_to?(:safe_string)
-              obj.safe_string
-            else
-              obj.to_s
-            end
-          end
-
-          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-          #
-          # @param journey_obj [ActionDispatch::Journey::Route] a rails route
-          # @param url [String, nil] use url from string instead of journey object.
-          # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_action_dispatch_journey journey_obj, url = nil
-            msg = new
-            msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
-
-            verb = source_or_string(journey_obj.verb)
-            msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
-
-            url ||= source_or_string(journey_obj.path.spec)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(url)
-            msg
-          end
-
-          # Convert Sinatra route data to dtm message.
-          #
-          # @param controller [::Sinatra::Base] the route's final controller.
-          # @param method [String] GET, PUT, POST, etc...
-          # @param pattern [::Mustermann::Sinatra]  the pattern that was matched in routing.
-          # @param url [String, nil] use url from string instead matched pattern.
-          # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_sinatra_route controller, method, pattern, url = nil
-            safe_pattern = source_or_string(pattern)
-            safe_url = source_or_string(url || pattern)
-
-            msg = new
-            msg.route = "#{ controller }##{ method } #{ safe_pattern }"
-            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
-            msg
-          end
-
-          # Convert Grape route data to dtm message.
-          #
-          # @param controller [::Grape::API] the route's final controller.
-          # @param method [String] GET, PUT, POST, etc...
-          # @param url [String, nil] use url from string instead matched pattern.
-          # @param pattern [String, Grape::Router::Route] the pattern that was matched in routing.
-          # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_grape_controller controller, method, pattern, url = nil
-            if pattern.cs__is_a?(Grape::Router::Route)
-              safe_pattern = pattern.pattern&.path&.to_s
-              safe_url = source_or_string(url || safe_pattern)
-            else
-              safe_pattern = source_or_string(pattern)
-              safe_url = source_or_string(url || pattern)
-            end
-
-            msg = new
-            msg.route = "#{ controller }##{ method } #{ safe_pattern }"
-            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
-            msg
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::RouteCoverage.include(Contrast::Api::Decorators::RouteCoverage)

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,120 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::TraceEvent} protobuf model to
-      # convert our {Contrast::Agent::AssessContrastEvent} to the dtm.
-      module TraceEvent
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # The TeamServer uses the Event's type and action to render it in the Details page. These values control the
-        # left-hand "What happened" column and the data shown in the right-hand data
-        #
-        # @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_display_params! contrast_event
-          self.type = contrast_event.policy_node.node_type
-          self.action = contrast_event.policy_node.build_action
-          self
-        end
-
-        # The TeamServer uses the Event's representation of the data to render the actual data used in the dataflow on
-        # the Details page.
-        #
-        # @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_dataflow! contrast_event
-          # Figure out what the target of this event was. This can't be pulled into the decorator because SourceEvent
-          # has a custom impl :/
-          taint_target = contrast_event.determine_taint_target(self)
-          truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
-          self.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
-          truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
-          self.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
-          build_event_args!(contrast_event, taint_target)
-          build_taint_ranges!(contrast_event)
-          self
-        end
-
-        # Wrapper around build_event_object for the args array. Handles
-        # tainting the correct argument.
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_event_args! contrast_event, taint_target
-          contrast_event.args.each_index do |idx|
-            truncate_arg = taint_target != idx
-            event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
-            args << event_arg
-          end
-          self
-        end
-
-        # TeamServer only supports one object's taint ranges at a time. We keep
-        # those tags on the event directly, so we just need to convert them to
-        # their DTM form in order to report this.
-        #
-        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_taint_ranges! contrast_event
-          # If there's no taint_target, this isn't a dataflow trace, but a
-          # trigger one
-          return self unless contrast_event&.tags
-
-          self.taint_ranges += Contrast::Api::Dtm::TraceTaintRange.build_for_event(contrast_event.tags)
-          self
-        end
-
-        # For each Parent in the ContrastEvent, capture its id and report it to TeamServer.
-        #
-        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_parent_ids! contrast_event
-          contrast_event&.parent_events&.each do |event|
-            next unless event
-
-            parent = Contrast::Api::Dtm::ParentObjectId.new
-            parent.id = event.event_id.to_i
-            parent_object_ids << parent
-          end
-          self
-        end
-
-        # Convert the caller into the Stack DTM TeamServer consumes
-        #
-        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
-        # @return [Contrast::Api::Dtm::TraceEvent]
-        def build_stack! contrast_event
-          # We delayed doing this as long as possible b/c it's expensive
-          stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
-          self.stack += stack_dtms
-          self
-        end
-
-        # Class methods for TraceEvent
-        module ClassMethods
-          def build contrast_event
-            event_dtm = new
-            event_dtm.build_display_params!(contrast_event)
-            event_dtm.build_dataflow!(contrast_event)
-            event_dtm.build_stack!(contrast_event)
-            event_dtm.timestamp_ms = contrast_event.time.to_i
-            event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
-            event_dtm.build_parent_ids!(contrast_event)
-            event_dtm.object_id = contrast_event.event_id.to_i
-            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret,
-                                                                                contrast_event.policy_node,
-                                                                                contrast_event.args)
-            event_dtm
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::TraceEvent.include(Contrast::Api::Decorators::TraceEvent)

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,63 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-require 'contrast/utils/assess/tracking_util'
-require 'base64'
-require 'contrast/components/scope'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::TraceEventObject} protobuf
-      # model.
-      module TraceEventObject
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Class methods for TraceEventObject
-        module ClassMethods
-          include Contrast::Components::Scope::InstanceMethods
-          # Build the event object. We were originally going to include taint on
-          # each one, but TS doesn't accept / use that, so it is a waste of time.
-          #
-          # We'll truncate any object that isn't important to the taint ranges of
-          # this event, so that we don't murder TeamServer by, for instance,
-          # hypothetically sending the entire rendered HTML page >_>  <_<  >_>
-          ELLIPSIS = '...'
-          UNTRUNCATED_PORTION_LENGTH = 25
-          TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
-
-          # Convert the given Object into a Contrast::Api::Dtm::TraceEventObject
-          #
-          # @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
-          #   the thing to convert, if any
-          # @param truncate [Boolean] if the converted object can/should be
-          #   truncated.
-          # @return [Contrast::Api::Dtm::TraceEventObject]
-          def build contrast_object, truncate
-            event_object = new
-            with_contrast_scope do
-              obj_string = Contrast::Utils::StringUtils.force_utf8(contrast_object&.object)
-              obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
-              event_object.value = Base64.encode64(obj_string)
-              event_object.tracked = contrast_object&.tracked?
-            end
-            event_object
-          end
-
-          def truncate obj_string
-            tmp = []
-            tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
-            tmp << ELLIPSIS
-            tmp << obj_string[obj_string.length - UNTRUNCATED_PORTION_LENGTH, UNTRUNCATED_PORTION_LENGTH]
-            tmp.join
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::TraceEventObject.include(Contrast::Api::Decorators::TraceEventObject)

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,69 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-require 'contrast/utils/assess/tracking_util'
-require 'base64'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::TraceEventSignature} protobuf
-      # model.
-      module TraceEventSignature
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Class methods for TraceEventSignature
-        module ClassMethods
-          # Convert the given composites into components that TeamServer can
-          # understand in order to build a representation of the method
-          # invoked.
-          #
-          # @param ret_obj [Contrast::Agent::Assess::ContrastObject, nil] the
-          #   return value of the method call.
-          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
-          #   the policy which pertains to the method invoked.
-          # @param args [Array<Contrast::Agent::Assess::ContrastObject>, nil]
-          # @return [Contrast::Api::Dtm::TraceEventSignature]
-          def build ret_obj, policy_node, args
-            signature = new
-            signature.return_type = Contrast::Utils::StringUtils.force_utf8(type_name(ret_obj))
-            signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
-            signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
-            if args
-              args&.each do |arg|
-                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(type_name(arg))
-              end
-            end
-            signature.constructor = policy_node.method_name == :new
-            # if there's a ret, then this method isn't nil. not 100% full proof since you can
-            # return nil, but this is the best we've got currently.
-            signature.void_method = ret_obj.nil? || ret_obj.object.nil?
-            # 8 is STATIC in Java... we have to placate them for now
-            # it has been requested that flags be removed since it isn't used
-            signature.flags = 8 unless policy_node.instance_method?
-            signature
-          end
-
-          private
-
-          # While Ruby signatures do not require neither a return type and can
-          # return anything depending on inputs, code paths, etc, nor constant
-          # parameter types, TeamServer was designed with strongly typed
-          # languages (Java) in mind, so we need types in our signatures.
-          #
-          # @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
-          #   the object to find the type of
-          # @return [String] the name of the module of the ret_obj, or `nil`
-          def type_name contrast_object
-            contrast_object ? contrast_object.object_type : Contrast::Utils::ObjectShare::NIL_STRING
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::TraceEventSignature.include(Contrast::Api::Decorators::TraceEventSignature)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,52 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::TraceTaintRange} protobuf
-      # model.
-      module TraceTaintRange
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Class methods for TraceEventObject
-        module ClassMethods
-          # Convert the tags from Contrast::Agent::Assess::Property::Tagged to
-          # the form required for their Event's DTM.
-          #
-          # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}]
-          # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
-          def build_for_event tags
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
-
-            ranges = []
-            tags.each_value do |value|
-              next if value.empty?
-
-              value.each { |tag| ranges << build(tag) }
-            end
-            ranges
-          end
-
-          # Convert our Tags to their DTM equivalent
-          #
-          # @param tag [Contrast::Agent::Assess::Tag]
-          # @return [Contrast::Api::Dtm::TraceTaintRange]
-          def build tag
-            range = Contrast::Api::Dtm::TraceTaintRange.new
-            range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(tag.label)
-            range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
-            range
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::TraceTaintRange.include(Contrast::Api::Decorators::TraceTaintRange)

data/lib/contrast/config/assess_configuration.rb

@@ -1,93 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/components/sampling'
-
-module Contrast
-  module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # assess functionality of the Agent.
-    class AssessConfiguration
-      include Contrast::Config::BaseConfiguration
-
-      # @return [String, nil]
-      attr_accessor :tags
-      # @return [Boolean, nil]
-      attr_accessor :enable
-      attr_writer :enable_scan_response, :enable_dynamic_sources, :sampling, :rules, :stacktraces
-
-      DEFAULT_STACKTRACES = 'ALL'
-      DEFAULT_MAX_SOURCE_EVENTS = 50_000
-      DEFAULT_MAX_PROPAGATION_EVENTS = 50_000
-      DEFAULT_MAX_RULE_REPORTED = 100
-      DEFAULT_MAX_RULE_TIME_THRESHOLD = 300_000
-
-      def initialize hsh = {}
-        return unless hsh
-
-        @enable = hsh[:enable]
-        @tags = hsh[:tags]
-        @enable_scan_response = hsh[:enable_scan_response]
-        @enable_dynamic_sources = hsh[:enable_dynamic_sources]
-        @enable_original_object = hsh[:enable_original_object]
-        @sampling = Contrast::Components::Sampling::Interface.new(hsh[:sampling])
-        @rules = Contrast::Config::AssessRulesConfiguration.new(hsh[:rules])
-        @stacktraces = hsh[:stacktraces]
-        @max_context_source_events = hsh[:max_context_source_events]
-        @max_propagation_events = hsh[:max_propagation_events]
-        @max_rule_reported = hsh[:max_rule_reported]
-        @time_limit_threshold = hsh[:time_limit_threshold]
-      end
-
-      # @return [Boolean, true]
-      def enable_scan_response
-        @enable_scan_response.nil? ? true : @enable_scan_response
-      end
-
-      # @return [Boolean, true]
-      def enable_dynamic_sources
-        @enable_dynamic_sources.nil? ? true : @enable_dynamic_sources
-      end
-
-      # @return [Boolean, true]
-      def enable_original_object
-        @enable_original_object.nil? ? true : @enable_original_object
-      end
-
-      # @return [Contrast::Components::Sampling::Interface]
-      def sampling
-        @sampling ||= Contrast::Components::Sampling::Interface.new
-      end
-
-      # @return [Contrast::Config::AssessRulesConfiguration]
-      def rules
-        @rules ||= Contrast::Config::AssessRulesConfiguration.new
-      end
-
-      # @return [String] stacktrace level
-      def stacktraces
-        @stacktraces ||= DEFAULT_STACKTRACES
-      end
-
-      # @return [int] max number of context source events in single request
-      def max_context_source_events
-        @max_context_source_events ||= DEFAULT_MAX_SOURCE_EVENTS
-      end
-
-      # @return [int] max number of propagation events in single request
-      def max_propagation_events
-        @max_propagation_events ||= DEFAULT_MAX_PROPAGATION_EVENTS
-      end
-
-      # @return [int] max number of rules reported within time_limit_threshold
-      def max_rule_reported
-        @max_rule_reported ||= DEFAULT_MAX_RULE_REPORTED
-      end
-
-      # @return [int] max ms threshold for reporting rules
-      def time_limit_threshold
-        @time_limit_threshold ||= DEFAULT_MAX_RULE_TIME_THRESHOLD
-      end
-    end
-  end
-end

data/lib/contrast/config/assess_rules_configuration.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # disabled assess rule functionality of the Agent.
-    class AssessRulesConfiguration
-      include Contrast::Config::BaseConfiguration
-
-      SPEC_KEY = :disabled_rules.cs__freeze
-      # @return [Array, nil] list of disabled assess rules
-      attr_accessor :disabled_rules
-
-      def initialize hsh = {}
-        return unless hsh
-
-        @disabled_rules = cast_disabled_rules(hsh)
-      end
-
-      private
-
-      def cast_disabled_rules hsh
-        return unless hsh
-        return unless hsh.key?(SPEC_KEY)
-        return hsh[SPEC_KEY] if hsh[SPEC_KEY].cs__is_a?(Array)
-
-        hsh[SPEC_KEY].split(',').map(&:strip) if hsh[SPEC_KEY].cs__is_a?(String)
-      end
-    end
-  end
-end

data/lib/contrast/config/root_configuration.rb

@@ -1,90 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/components/agent'
-require 'contrast/components/inventory'
-require 'contrast/components/protect'
-require 'contrast/components/app_context'
-
-module Contrast
-  module Config
-    # The base of the Common Configuration settings.
-    class RootConfiguration
-      include Contrast::Config::BaseConfiguration
-
-      # @return [Contrast::Components::Api::Interface]
-      attr_writer :api
-      # @return [Contrast::Components::Agent::Interface]
-      attr_writer :agent
-      # @return [Contrast::Components::AppContext::Interface]
-      attr_writer :application
-      # @return [Contrast::Config::ServerConfiguration]
-      attr_writer :server
-      # @return [Contrast::Config::AssessConfiguration]
-      attr_writer :assess
-      # @return [Contrast::Components::Inventory::Interface]
-      attr_writer :inventory
-      # @return [Contrast::Components::Protect::Interface]
-      attr_writer :protect
-      # @return [Contrast::Config::ServiceConfiguration]
-      attr_writer :service
-      # @return [Boolean, nil]
-      attr_accessor :enable
-
-      # @raise[ArgumentError]
-      def initialize hsh = {}
-        raise(ArgumentError, 'Expected a hash') unless hsh.is_a?(Hash)
-
-        @api = Contrast::Components::Api::Interface.new(hsh[:api])
-        @enable = hsh[:enable]
-        @agent = Contrast::Components::Agent::Interface.new(hsh[:agent])
-        @application = Contrast::Components::AppContext::Interface.new(hsh[:application])
-        @server = Contrast::Config::ServerConfiguration.new(hsh[:server])
-        @assess = Contrast::Config::AssessConfiguration.new(hsh[:assess])
-        @inventory = Contrast::Components::Inventory::Interface.new(hsh[:inventory])
-        @protect = Contrast::Components::Protect::Interface.new(hsh[:protect])
-        @service = Contrast::Config::ServiceConfiguration.new(hsh[:service])
-      end
-
-      # @return [Contrast::Components::Api::Interface]
-      def api
-        @api ||= Contrast::Components::Api::Interface.new
-      end
-
-      # @return [Contrast::Components::Agent::Interface]
-      def agent
-        @agent ||= Contrast::Components::Agent::Interface.new
-      end
-
-      # @return [Contrast::Components::AppContext::Interface]
-      def application
-        @application ||= Contrast::Components::AppContext::Interface.new
-      end
-
-      # @return [Contrast::Config::ServerConfiguration]
-      def server
-        @server ||= Contrast::Config::ServerConfiguration.new
-      end
-
-      # @return [Contrast::Config::AssessConfiguration]
-      def assess
-        @assess ||= Contrast::Config::AssessConfiguration.new
-      end
-
-      # @return [Contrast::Components::Inventory::Interface]
-      def inventory
-        @inventory ||= Contrast::Components::Inventory::Interface.new
-      end
-
-      # @return [Contrast::Components::Protect::Interface]
-      def protect
-        @protect ||= Contrast::Components::Protect::Interface.new
-      end
-
-      # @return [Contrast::Config::ServiceConfiguration]
-      def service
-        @service ||= Contrast::Config::ServiceConfiguration.new
-      end
-    end
-  end
-end