# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true module Contrast module Framework # The API for all subclasses to implement to correctly support a given framework class BaseSupport class << self # The top level module name used by the framework def detection_class raise NoMethodError('Subclasses of BaseSupport should implement this method') end def version raise NoMethodError('Subclasses of BaseSupport should implement this method') end def application_name raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end def server_type raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end # Iterate through known locations, looking for files # that represent view or template files. If found, for each file in the directory # append the technology and the view object to the application update instance def scan_views raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end # Find all the predefined routes for this application and append them to the # provided inventory message # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg # that has a routes array consisting of Contrast::Api::Dtm::RouteCoverage def collect_routes raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end def current_route raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end def retrieve_request _env raise NoMethodError, 'Subclasses of BaseSupport should implement this method' end # Some Frameworks require specific patching for their classes to handle # functionality like configuration scanning. To accommodate this, this # method provides a place to register those patches for invocation on # Agent load. # # By default, and hopefully in all cases, we won't need these patches, # so we're allowing nil here rather than raising an exception. def before_load_patches; end # Some Frameworks require specific patching for their classes to handle # functionality like routing. To accommodate this, this method provides # a place to register those patches for invocation in our # AfterLoadPatcher flow. # # By default, and hopefully in all cases, we won't need these patches, # so we're allowing nil here rather than raising an exception. # # @return [Set,nil] # those patches required for a Framework which can only be installed # once a specific module has been loaded. def after_load_patches; end # We only support websockets in rails right now, so we won't detect streaming in # any other framework def streaming? _env false end protected def source_or_string obj if obj.cs__is_a?(Regexp) obj.source elsif obj.cs__respond_to?(:safe_string) obj.safe_string else obj.to_s end end def scan_view_directories view_technology_descriptors view_technology_descriptors.reject(&:empty?) end end end end end