sqreen 1.18.6-java → 1.20.0-java

data/lib/sqreen/rules/record_request_context.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/regexp_rule_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/rule_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -59,7 +61,9 @@ module Sqreen
           :infos => infos,
           :rulespack_id => rulespack_id,
           :rule_name => rule_name,
+          :attack_type => @rule['attack_type'], # for signal
           :test => test,
+          :block => @rule['block'], # for signal
           :time => at,
         }
         if payload_tpl.include?('context')

data/lib/sqreen/rules/run_req_start_actions.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -62,7 +64,7 @@ module Sqreen
 
       # @return [Sqreen::Actions::Repository]
       def actions_repo
-        Sqreen::Actions::Repository.instance
+        Sqreen::Actions::Repository.current
       end
     end
   end

data/lib/sqreen/rules/run_user_actions.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -28,7 +30,7 @@ module Sqreen
 
       # @return [Sqreen::Actions::Repository]
       def actions_repo
-        Sqreen::Actions::Repository.instance
+        Sqreen::Actions::Repository.current
       end
     end
   end

data/lib/sqreen/rules/shell_env_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/signup_track_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/update_request_context.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/url_matches_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/user_agent_matches_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/rules/waf_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -9,11 +11,15 @@ require 'sqreen/safe_json'
 require 'sqreen/exception'
 require 'sqreen/util/capper'
 require 'sqreen/dependency/libsqreen'
+require 'sqreen/encoding_sanitizer'
 
 module Sqreen
   module Rules
     class WAFCB < RuleCB
-      BUDGET_MAX = 5
+      # 2^30 -1 or 2^62 -1
+      MAX_FIXNUM = 1.size == 4 ? 1_073_741_823 : 4_611_686_018_427_387_903
+      # will be converted to a long, so better not to overflow
+      INFINITE_BUDGET_US = MAX_FIXNUM
 
       def self.libsqreen?
         Sqreen::Dependency::LibSqreen.required?
@@ -23,7 +29,7 @@ module Sqreen
         Sqreen::Dependency.const_exist?('LibSqreen::WAF')
       end
 
-      attr_reader :binding_accessors, :budget, :waf_rule_name
+      attr_reader :binding_accessors, :max_run_budget_us, :waf_rule_name
 
       def initialize(*args)
         super(*args)
@@ -52,8 +58,12 @@ module Sqreen
         @binding_accessors = @data['values'].fetch('binding_accessors', []).each_with_object({}) do |e, h|
           h[e] = BindingAccessor.new(e)
         end
-        @budget = (@data['values'].fetch('budget_in_ms', nil) || BUDGET_MAX) * 1000
-        Sqreen.log.debug("WAF budget for #{@waf_rule_name} set to #{@budget}us")
+
+        # 0 for using defaults (PW_RUN_TIMEOUT)
+        @max_run_budget_us = (@data['values'].fetch('budget_in_ms', 0) * 1000).to_i
+        @max_run_budget_us = INFINITE_BUDGET_US if @max_run_budget_us >= INFINITE_BUDGET_US
+
+        Sqreen.log.debug { "Max WAF run budget for #{@waf_rule_name} set to #{@max_run_budget_us} us" }
 
         ObjectSpace.define_finalizer(self, WAFCB.finalizer(@waf_rule_name.dup))
       end
@@ -66,20 +76,32 @@ module Sqreen
 
         env = [binding, framework, instance, args]
 
+        start = Sqreen.time if budget
+
         capper = Sqreen::Util::Capper.new(string_size_cap: 4096, size_cap: 150, depth_cap: 10)
         waf_args = binding_accessors.each_with_object({}) do |(e, b), h|
           h[e] = capper.call(b.resolve(*env))
         end
         waf_args = Sqreen::EncodingSanitizer.sanitize(waf_args)
-        waf_budget = [self.budget, budget && budget * 1_000_000].compact.min.to_i
-        action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args, waf_budget)
+
+        if budget
+          rem_budget_s = budget - (Sqreen.time - start)
+          return advise_action(nil) if rem_budget_s <= 0.0
+
+          waf_gen_budget_us = [(rem_budget_s * 1_000_000).to_i, MAX_FIXNUM].min
+        else # no budget
+          waf_gen_budget_us = INFINITE_BUDGET_US
+        end
+
+        action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args,
+                                            waf_gen_budget_us, @max_run_budget_us)
 
         case action
         when :monitor
-          record_event({ 'waf_data' => data })
+          record_event({ waf_data: data })
           advise_action(nil)
         when :block
-          record_event({ 'waf_data' => data })
+          record_event({ waf_data: data })
           advise_action(:raise)
         when :good
           advise_action(nil)
@@ -110,20 +132,23 @@ module Sqreen
       end
 
       def record_exception(exception, infos = {}, at = Time.now.utc)
-        infos.merge!(exception_to_infos(exception)) if exception.is_a?(Sqreen::WAFError)
+        infos.merge!(waf_infos(exception)) if exception.is_a?(Sqreen::WAFError)
         super(exception, infos, at)
       end
 
       private
 
-      def exception_to_infos(e)
+      # see https://github.com/sqreen/TechDoc/blob/master/content/specs/spec000016-waf-integration.md#error-management
+      def waf_infos(e)
         {
-          waf_rule: e.rule_name,
-          error_code: ERROR_CODES[e.error],
-        }.tap do |r|
-          r[:error_data] = e.data if e.data
-          r[:args] = e.args if e.args
-        end
+          waf:  {
+            waf_rule: e.rule_name,
+            error_code: ERROR_CODES[e.error],
+          }.tap do |r|
+            r[:error_data] = e.data if e.data
+            r[:args] = e.args if e.arg
+          end,
+        }
       end
 
       ERROR_CODES = {

data/lib/sqreen/rules/xss_cb.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/run_when_called_cb.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/runner.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -18,8 +20,10 @@ require 'sqreen/deliveries/simple'
 require 'sqreen/deliveries/batch'
 require 'sqreen/performance_notifications/metrics'
 require 'sqreen/performance_notifications/binned_metrics'
-require 'sqreen/instrumentation'
+require 'sqreen/legacy/instrumentation'
 require 'sqreen/call_countable'
+require 'sqreen/weave/legacy/instrumentation'
+require 'sqreen/kit/configuration'
 
 module Sqreen
   @features = {}
@@ -34,6 +38,8 @@ module Sqreen
   PERF_METRICS_PERIOD = 60 # 1 min
   DEFAULT_PERF_LEVEL = 0 # disabled
 
+  DEFAULT_USE_SIGNALS = false
+
   class << self
     attr_reader :features
     def update_features(features)
@@ -84,7 +90,9 @@ module Sqreen
 
     attr_accessor :heartbeat_delay
     attr_accessor :metrics_engine
+    # @return [Sqreen::Deliveries::Simple]
     attr_reader :deliverer
+    # @return [Sqreen::Session]
     attr_reader :session
     attr_reader :instrumenter
     attr_accessor :running
@@ -108,16 +116,30 @@ module Sqreen
       @token = @configuration.get(:token)
       @app_name = @configuration.get(:app_name)
       @url = @configuration.get(:url)
+      @proxy_url = @configuration.get(:proxy_url)
       Sqreen.update_whitelisted_paths([])
       Sqreen.update_whitelisted_ips({})
       Sqreen.update_performance_budget(nil)
       raise(Sqreen::Exception, 'no url found') unless @url
       raise(Sqreen::TokenNotFoundException, 'no token found') unless @token
 
+      Sqreen::Kit::Configuration.logger = Sqreen.log
+      Sqreen::Kit::Configuration.ingestion_url = @configuration.get(:ingestion_url)
+      Sqreen::Kit::Configuration.proxy_url = @configuration.get(:proxy_url)
+
       register_exit_cb if set_at_exit
 
       self.metrics_engine = MetricsStore.new
-      @instrumenter = Instrumentation.new(metrics_engine)
+
+      needs_weave = proc do
+        Gem::Specification.select { |s| s.name == 'scout_apm' && Gem::Requirement.new('>= 2.5.2').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      end
+
+      if @configuration.get(:weave) || needs_weave.call
+        @instrumenter = Sqreen::Weave::Legacy::Instrumentation.new(metrics_engine)
+      else
+        @instrumenter = Sqreen::Legacy::Instrumentation.new(metrics_engine)
+      end
 
       Sqreen.log.debug "Using token #{@token}"
       response = create_session(session_class)
@@ -130,7 +152,7 @@ module Sqreen
           Sqreen.log.debug do
             "Override initial features with #{conf_features.inspect}"
           end
-          wanted_features = conf_features
+          wanted_features = wanted_features.merge(conf_features)
         rescue
           Sqreen.log.warn do
             "NOT using invalid inital features #{conf_initial_features}"
@@ -149,7 +171,7 @@ module Sqreen
     end
 
     def create_session(session_class)
-      @session = session_class.new(@url, @token, @app_name)
+      @session = session_class.new(@url, @token, @app_name, @proxy_url)
       session.login(@framework)
     end
 
@@ -158,8 +180,18 @@ module Sqreen
       @deliverer = new_deliverer
     end
 
-    def batch_events(batch_size, max_staleness = nil)
+    def batch_events(batch_size, max_staleness = nil, use_signals = false)
       size = batch_size.to_i
+
+      if size <= 1 && use_signals
+        Sqreen.log.warn do
+          "Using signals with no delivery batching is unsupported. " \
+          "Using instead batching with batch size = 30, max_staleness = 60"
+        end
+        size = 30
+        max_staleness = 60
+      end
+
       self.deliverer = if size < 1
                          Deliveries::Simple.new(session)
                        else
@@ -235,7 +267,7 @@ module Sqreen
     def remove_instrumentation(_context_infos = {})
       Sqreen.log.debug 'Removing instrumentation'
       instrumenter.remove_all_callbacks
-      Sqreen::Actions::Repository.instance.clear
+      Sqreen::Actions::Repository.clear
       Sqreen.log.debug 'Instrumentation removed'
       true
     end
@@ -244,7 +276,6 @@ module Sqreen
       Sqreen.log.debug 'Reloading rules'
       rulespack_id, rules = load_rules
       instrumenter.remove_all_callbacks
-      Sqreen::Actions::Repository.instance.clear
 
       @framework.instrument_when_ready!(instrumenter, rules)
       Sqreen.log.debug 'Rules reloaded'
@@ -290,31 +321,55 @@ module Sqreen
     def do_heartbeat
       @last_heartbeat_request = Time.now
       @next_metrics.concat(metrics_engine.publish(false)) if metrics_engine
-      res = session.heartbeat(next_command_results, next_metrics)
+      metrics_in_hb = use_signals? ? nil : next_metrics
+
+      res = session.heartbeat(next_command_results, metrics_in_hb)
       next_command_results.clear
+
+      deliver_metrics_as_event if use_signals?
       next_metrics.clear
+
       process_commands(res['commands'])
     end
 
+    def deliver_metrics_as_event
+      # this is disastrous withe simple delivery strategy,
+      # as each aggregated metric would trigger an http request
+      # Sending of metrics is therefore not supported with simple delivery strategy
+      # TODO: Confirm that only batch is used in production
+      next_metrics.each { |x| deliverer.post_event(x) }
+    end
+
     def features(_context_infos = {})
       Sqreen.features
     end
 
+    def use_signals?
+      features.fetch('use_signals', DEFAULT_USE_SIGNALS)
+    end
+
     def features=(features)
       Sqreen.update_features(features)
       session.request_compression = features['request_compression'] if session
+      session.use_signals = use_signals?
       self.performance_metrics_period = features['performance_metrics_period']
+
+      unless @configuration.get(:weave)
+
       config_binned_metrics(features['perf_level'] || DEFAULT_PERF_LEVEL,
                             features['perf_base'] || PerformanceNotifications::BinnedMetrics::DEFAULT_PERF_BASE,
                             features['perf_unit'] || PerformanceNotifications::BinnedMetrics::DEFAULT_PERF_UNIT,
                             features['perf_pct_base'] || PerformanceNotifications::BinnedMetrics::DEFAULT_PERF_PCT_BASE,
                             features['perf_pct_unit'] || PerformanceNotifications::BinnedMetrics::DEFAULT_PERF_PCT_UNIT,
                            )
+
+      end
+
       self.call_counts_metrics_period = features['call_counts_metrics_period']
       hd = features['heartbeat_delay'].to_i
       self.heartbeat_delay = hd if hd > 0
       return if features['batch_size'].nil?
-      batch_events(features['batch_size'], features['max_staleness'])
+      batch_events(features['batch_size'], features['max_staleness'], use_signals?)
     end
 
     def change_whitelisted_paths(paths, _context_infos = {})
@@ -456,13 +511,12 @@ module Sqreen
     def load_actions(hashes)
       unsupported = Set.new
 
-      repos = Sqreen::Actions::Repository.instance
-      repos.clear
+      new_repos = Sqreen::Actions::Repository.new
 
       actions = hashes.map do |h|
         begin
           act = Sqreen::Actions.deserialize_action(h)
-          repos.add h['parameters'], act
+          new_repos.add h['parameters'], act
           act
         rescue Sqreen::Actions::UnknownActionType => e
           Sqreen.log.warn("Unsupported action type: #{e.action_type}")
@@ -476,6 +530,8 @@ module Sqreen
       actions = actions.reject(&:nil?)
       Sqreen.log.debug("Added #{actions.size} valid actions")
 
+      Sqreen::Actions::Repository.current = new_repos
+
       unsupported
     end
   end

data/lib/sqreen/runtime_infos.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/safe_json.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/sdk.rb

@@ -1,6 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
+require 'sqreen/frameworks'
+
 # Sqreen Namespace
 module Sqreen