contrast-agent 6.7.0 → 6.9.0

data/lib/contrast/api/communication.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Api
-    # Used to contain all modules that handle communication with speedracer
-    module Communication
-    end
-  end
-end
-
-require 'contrast/api/communication/service_lifecycle'
-require 'contrast/api/communication/connection_status'
-require 'contrast/api/communication/socket'
-require 'contrast/api/communication/tcp_socket'
-require 'contrast/api/communication/unix_socket'
-require 'contrast/api/communication/socket_client'
-require 'contrast/api/communication/messaging_queue'
-require 'contrast/api/communication/response_processor'
-require 'contrast/api/communication/speedracer'

data/lib/contrast/api/decorators/address.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/components/logger'
-require 'contrast/utils/string_utils'
-require 'contrast/utils/timer'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::Address} protobuf model so it
-      # can own some of the data massaging required for Request dtm. Only works
-      # as an extension of that class.
-      module Address
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
-        module ClassMethods
-          include Contrast::Components::Logger::InstanceMethods
-          # receiver is memoized because it is the address/host/port of the server, once we
-          # resolve this for the first time, it shouldn't change
-          #
-          # @return [Contrast::Api::Dtm::Address] the address of this server
-          def build_receiver
-            @_build_receiver ||= begin
-              address = new
-              address.host = 'localhost'
-              address.ip = '127.0.0.1' # rubocop:disable Style/IpAddresses
-              begin
-                Timeout.timeout(1) do
-                  address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-                  address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-                end
-              rescue StandardError => e
-                logger.warn('Unable to resolve host or ip', e, address: address)
-              end
-              address
-            end
-          end
-
-          # Parse out the sender of the Request and return it as an Address
-          #
-          # @return [Contrast::Api::Dtm::Address] the address from which the
-          #   request originated
-          def build_sender request
-            sender = new
-            sender.ip = Contrast::Utils::StringUtils.force_utf8(request.ip)
-            sender
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::Address.include(Contrast::Api::Decorators::Address)

data/lib/contrast/api/decorators/agent_startup.rb

@@ -1,56 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/utils/string_utils'
-require 'contrast/components/base'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the AgentStartup protobuf model to handle reporting Agent process start
-      module AgentStartup
-        include Contrast::Components::ComponentBase
-
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the AgentStartup class on inclusion of the decorator
-        module ClassMethods
-          # Return a new DTM with the values from the configuration and Agent discovery
-          #
-          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
-          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
-          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
-          # @return [Contrast::Api::Dtm::AgentStartup]
-          def build name, path, type
-            msg = new
-            msg.server_version   = Contrast::Agent::VERSION
-            msg.server_name      = Contrast::Utils::StringUtils.protobuf_format(name)
-            msg.server_path      = Contrast::Utils::StringUtils.protobuf_format(path)
-            msg.server_type      = Contrast::Utils::StringUtils.protobuf_format(type)
-            config!(msg)
-            msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::ASSESS.tags)
-            msg
-          end
-
-          private
-
-          # set the configuration driven values for this AgentStartup msg
-          #
-          # @param msg [Contrast::Api::Dtm::AgentStartup]
-          def config! msg
-            msg.version      = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.version)
-            msg.server_tags  = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.tags)
-            msg.library_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.inventory.tags)
-            msg.environment  = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.environment)
-            msg.application_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.tags)
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::AgentStartup.include(Contrast::Api::Decorators::AgentStartup)

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,43 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Settings::ApplicationSettings}
-      # protobuf model to handle setting translation.
-      module ApplicationSettings
-        MODE_ALLOWLIST = [
-          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,
-          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK,
-          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR,
-          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
-        ].cs__freeze
-        # Convert protobuf exlcusions into Agent exclusions
-        def translated_exclusions
-          exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
-        end
-
-        # Convert protobuf protect rule settings into a hash that settings state understands
-        def translated_protection_mode_by_id
-          protection_rules = self.protection_rules.map { |pr, _hash| [pr.id, pr.mode] } # [[RULE_ID, MODE]]
-          protection_rules.select! { |(_id, mode)| MODE_ALLOWLIST.include?(mode) } # [REMOVE IF MODE INVALID]
-          protection_rules.to_h # {RULE_ID => MODE}
-        end
-
-        def application_state_translation
-          {
-              modes_by_id: translated_protection_mode_by_id,
-              exclusion_matchers: translated_exclusions,
-              disabled_assess_rules: disabled_assess_rules,
-              session_id: session_id
-          }
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Settings::ApplicationSettings.include(Contrast::Api::Decorators::ApplicationSettings)

data/lib/contrast/api/decorators/application_startup.rb

@@ -1,56 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/api/decorators/instrumentation_mode'
-require 'contrast/components/base'
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the ApplicationCreate protobuf model to handle reporting Agent process start
-      module ApplicationStartup
-        include Contrast::Components::ComponentBase
-
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the AgentStartup class on inclusion of the decorator
-        module ClassMethods
-          # Return a new DTM with the values from the configuration
-          #
-          # @return [Contrast::Api::Dtm::ApplicationCreate]
-          def build
-            msg = new
-            msg.code     = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.code)
-            msg.group    = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.group)
-            msg.metadata = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.metadata)
-            msg.mode     = Contrast::Api::Dtm::InstrumentationMode.build
-            msg.app_version =
-                Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.version.to_s) # rubocop:disable Layout/AssignmentIndentation Layout/FirstArgumentIndentation:
-            session!(msg)
-            msg
-          end
-
-          private
-
-          # Set the session metadata for this ApplicationCreate msg
-          #
-          # @param msg [Contrast::Api::Dtm::ApplicationCreate]
-          def session! msg
-            msg.session_id = Contrast::Utils::StringUtils.protobuf_format(
-                ::Contrast::CONFIG.application.session_id,
-                truncate: false)
-            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format(
-                ::Contrast::CONFIG.application.session_metadata,
-                truncate: false)
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::ApplicationCreate.include(Contrast::Api::Decorators::ApplicationStartup)

data/lib/contrast/api/decorators/bot_blocker.rb

@@ -1,37 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/utils/string_utils'
-require 'contrast/components/base'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::BotBlockerDetails} protobuf
-      # model so it can own the request which its data is for.
-      module BotBlockerDetails
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the AgentStartup class on inclusion of the decorator
-        module ClassMethods
-          def build
-            new
-          end
-
-          # @param result [Contrast::Api::Dtm::BotBlockerDetails]
-          def to_controlled_hash result
-            {
-                bot: result.bot,
-                user_agent: result.user_agent
-            }
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::BotBlockerDetails.include(Contrast::Api::Decorators::BotBlockerDetails)

data/lib/contrast/api/decorators/http_request.rb

@@ -1,137 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/api/decorators/address'
-require 'contrast/components/scope'
-require 'contrast/utils/string_utils'
-require 'contrast/utils/timer'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::HttpRequest} protobuf model
-      # so it can own some of the data massaging required for Request dtm. Only
-      # works as an extension of that class.
-      module HttpRequest
-        OMITTED_BODY = '{{body-omitted-by-contrast}}'
-
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Append the sender and receiver to self.
-        #
-        # @param request [Contrast::Agent::Request]
-        def append_addresses request
-          self.sender = Contrast::Api::Dtm::Address.build_sender(request)
-          self.receiver = Contrast::Api::Dtm::Address.build_receiver
-        end
-
-        # Append the connection to self.
-        #
-        # @param request [Contrast::Agent::Request]
-        def append_connection request
-          self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
-          self.version = Contrast::Utils::StringUtils.force_utf8(request.version)
-          self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
-          self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
-          self.uri = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
-        end
-
-        # Append the parameters to self, using the preferred
-        # normalized_request_params field.
-        #
-        # @param request [Contrast::Agent::Request]
-        def append_params request
-          request.parameters.each do |k, v|
-            append_pair(normalized_request_params, k, v)
-          end
-        end
-
-        # Append the normalized headers to self, using the preferred
-        # request_headers field.
-        #
-        # @param request [Contrast::Agent::Request]
-        def append_headers request
-          request.headers.each do |k, v|
-            next unless k && v
-            next if v.is_a?(Hash)
-
-            key = Contrast::Utils::StringUtils.force_utf8(k)
-            val = Contrast::Utils::StringUtils.force_utf8(v)
-            request_headers[key] = val
-          end
-
-          request.cookies.each do |k, v|
-            append_pair(normalized_cookies, k, v)
-          end
-        end
-
-        # Append the body to self, using the preferred
-        # request_body_binary field.
-        #
-        # @param request [Contrast::Agent::Request]
-        def append_body request
-          self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
-
-          self.request_body_binary = if omit_body?(request)
-                                       OMITTED_BODY
-                                     else
-                                       Contrast::Utils::StringUtils.force_utf8(request.body)
-                                     end
-          return if request.file_names.empty?
-
-          request.file_names.each do |name, filename|
-            pair = Contrast::Api::Dtm::SimplePair.new
-            pair.key = Contrast::Utils::StringUtils.force_utf8(name)
-            pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
-            multipart_headers << pair
-          end
-        end
-
-        def omit_body? request
-          return true if ::Contrast::AGENT.omit_body?
-          return false if request.document_type != :NORMAL
-
-          request.media_type&.include?('multipart/form-data')
-        end
-
-        def append_pair map, key, value
-          return unless key && value
-          return if value.is_a?(Hash)
-
-          safe_key = Contrast::Utils::StringUtils.force_utf8(key)
-          map[safe_key] ||= Contrast::Api::Dtm::Pair.new
-          map[safe_key].key = safe_key
-          map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
-        end
-
-        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
-        module ClassMethods
-          include Contrast::Components::Scope::InstanceMethods
-
-          # Convert our Request into a DTM
-          # @param request [Contrast::Agent::Request]
-          # @return [Contrast::Api::Dtm::HttpRequest]
-          def build request
-            with_contrast_scope do
-              msg = new
-              msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
-              msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
-
-              msg.append_addresses(request)
-              msg.append_connection(request)
-              msg.append_params(request)
-              msg.append_headers(request)
-              msg.append_body(request)
-              msg
-            end
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,18 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Settings::InputAnalysis} protobuf
-      # model so it can own the request which its data is for.
-      module InputAnalysis
-        attr_accessor :request
-      end
-    end
-  end
-end
-
-Contrast::Api::Settings::InputAnalysis.include(Contrast::Api::Decorators::InputAnalysis)

data/lib/contrast/api/decorators/instrumentation_mode.rb

@@ -1,35 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/components/base'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the InstrumentationMode protobuf model to handle reporting Agent process start
-      module InstrumentationMode
-        include Contrast::Components::ComponentBase
-
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the AgentStartup class on inclusion of the decorator
-        module ClassMethods
-          # Return a new DTM with the values from the configuration
-          #
-          # @return [Contrast::Api::Dtm::InstrumentationMode]
-          def build
-            msg = new
-            msg.assess =  ::Contrast::ASSESS.enabled?
-            msg.protect = ::Contrast::PROTECT.enabled?
-            msg
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::InstrumentationMode.include(Contrast::Api::Decorators::InstrumentationMode)

data/lib/contrast/api/decorators/ip_denylist.rb

@@ -1,37 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'contrast/utils/string_utils'
-require 'contrast/components/base'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::IpDenylistDetails} protobuf
-      # model so it can own the request which its data is for.
-      module IpDenylistDetails
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to the AgentStartup class on inclusion of the decorator
-        module ClassMethods
-          def build
-            new
-          end
-
-          # @param result [Contrast::Api::Dtm::IpDenylistDetails]
-          def to_controlled_hash result
-            {
-                ip: result.ip,
-                uuid: result.uuid
-            }
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::IpDenylistDetails.include(Contrast::Api::Decorators::IpDenylistDetails)

data/lib/contrast/api/decorators/message.rb

@@ -1,67 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-require 'contrast/utils/string_utils'
-require 'contrast/components/logger'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::Message} protobuf model so it
-      # can handle instance data massaging.
-      module Message
-        include Contrast::Components::Logger::InstanceMethods
-
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        def append_event event
-          case event
-          when Contrast::Api::Dtm::AgentStartup
-            self.agent_startup = event
-          when Contrast::Api::Dtm::ApplicationCreate
-            self.application_create = event
-          when Contrast::Api::Dtm::HttpRequest
-            self.prefilter = event
-          when Contrast::Api::Dtm::Poll
-            self.poll = event
-          else
-            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.cs__name)
-            return
-          end
-          logger.debug('Wrapping event in message',
-                       msg_id: __id__,
-                       p_id: pid,
-                       msg_count: message_count,
-                       event_id: event.__id__,
-                       event_type: event.cs__class.cs__name)
-        end
-
-        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
-        module ClassMethods
-          @@message_total = 0 # rubocop:disable Style/ClassVars
-          def message_count
-            @@message_total += 1 # rubocop:disable Style/ClassVars
-          end
-
-          def build event
-            msg = new
-            msg.app_name      = ::Contrast::APP_CONTEXT.name # rubocop:disable Security/Module/Name
-            msg.app_path      = ::Contrast::APP_CONTEXT.path
-            msg.app_language  = Contrast::Utils::ObjectShare::RUBY
-            msg.client_id     = ::Contrast::APP_CONTEXT.client_id
-            msg.message_count = message_count
-            msg.pid           = ::Contrast::APP_CONTEXT.pid
-            msg.ppid          = ::Contrast::APP_CONTEXT.ppid
-            msg.append_event(event)
-            msg
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -1,52 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Dtm::RaspRuleSample} protobuf
-      # model.
-      module RaspRuleSample
-        def self.included klass
-          klass.extend(ClassMethods)
-        end
-
-        # Used to add class methods to RaspRuleSample
-        module ClassMethods
-          def build context, ia_result
-            sample = new
-            sample.timestamp_ms = context.timer.start_ms
-            sample.user_input = Contrast::Api::Dtm::UserInput.build_from_ia_result(ia_result)
-            sample.user_input.document_type = Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
-            sample
-          end
-
-          # @param result [Contrast::Api::Dtm::RaspRuleSample]
-          def to_controlled_hash result
-            {
-                timestamp: Time.at(result.timestamp_ms).iso8601,
-                user_input: result.user_input,
-                bot_blocker: result.bot_blocker,
-                cmdi: result.cmdi,
-                untrusted_deserialization: result.untrusted_deserialization,
-                padding_oracle: result.padding_oracle,
-                path_traversal: result.path_traversal,
-                re_dos: result.re_dos,
-                sqli: result.sqli,
-                ssrf: result.ssrf,
-                virtual_patch: result.virtual_patch,
-                xss: result.xss,
-                xxe: result.xxe,
-                no_sqli: result.no_sqli,
-                method_tampering: result.method_tampering,
-                path_traversal_semantic: result.path_traversal_semantic,
-                ip_denylist: result.ip_denylist
-            }
-          end
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Dtm::RaspRuleSample.include(Contrast::Api::Decorators::RaspRuleSample)

data/lib/contrast/api/decorators/response_type.rb

@@ -1,17 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/api/dtm.pb'
-require 'protobuf/message'
-
-module Contrast
-  module Api
-    module Dtm
-      class AttackResult < ::Protobuf::Message
-        class ResponseType < ::Protobuf::Enum
-          define :SUSPICIOUS, 6
-        end
-      end
-    end
-  end
-end

data/lib/contrast/api/decorators/server_features.rb

@@ -1,25 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/string_utils'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the {Contrast::Api::Settings::ServerFeatures} protobuf
-      # model to handle setting translation to boolean values.
-      module ServerFeatures
-        # 'defend' is legacy for 'protect' in the dtm.
-        def protect_enabled?
-          !!defend.enabled
-        end
-
-        def assess_enabled?
-          !!assess.enabled
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Settings::ServerFeatures.include(Contrast::Api::Decorators::ServerFeatures)