contrast-agent 3.8.4

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -0,0 +1,34 @@
+#include <funchook.h>
+#include <ruby.h>
+
+static VALUE rb_sym_next;
+static VALUE fiber_class;
+static VALUE track_rb_fiber_new;
+static VALUE track_rb_fiber_yield;
+
+VALUE rb_fiber_new(VALUE (*func)(ANYARGS), VALUE obj);
+VALUE *(*rb_fiber_new_original)(VALUE (*func)(ANYARGS), VALUE obj);
+
+VALUE rb_fiber_yield(int argc, const VALUE *argv);
+VALUE *(*rb_fiber_yield_original)(int argc, const VALUE *argv);
+
+/* If you call `#next` on an enumerator object, that enumerator object
+ * instantiates a fiber and runs its given proc inside of that fiber.
+ * This minor design consideration presents a few significant edge-cases to us.
+ * - match data from regex is bound to execution context, and it's an open
+ *   question (but looking grim) as to whether we can propagate at that event.
+ *   Ruby doesn't expose much around ECs, so both finding an event to hook
+ *   and having a native way to access the EC data are onerous.
+ * - fiber_yield is implemented with jmps in YARV, so our primary paradigm
+ *   of operating on intercepted return values is off the table.
+ *   (And heaven help you if you execute `#next` within an rb_protect call.)
+ *   Luckily, we can read the fiber's return value before it executes a jump,
+ *   so we have a point at which we can reliably propagate.
+ */
+VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj);
+
+VALUE rb_fiber_yield_hook(int argc, const VALUE *argv);
+
+static int install_fiber_hooks();
+
+void Init_cs__assess_fiber_track(void);

data/ext/cs__assess_fiber_track/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -0,0 +1,64 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_hash.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
+                                              const VALUE hash) {
+    VALUE result;
+
+    /* Array of Arrays: Hash[ [ [key, value], ... ] ]   -> new_hash */
+    if (RB_TYPE_P(argv[0], T_ARRAY)) {
+        int i;
+        for (i = 0; i < argc; i++) {
+            argv[i] =
+                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+        }
+        /* Hash[ key, value, ... ]         -> new_hash */
+    } else if (argc > 1) {
+        int i;
+        for (i = 0; i < argc; i += 2) {
+            argv[i] =
+                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+        }
+    }
+
+    /* unhandled case - shouldn't need it since issue is only unfrozen
+     * String keys
+     * # Hash[ object ]                  -> new_hash
+     */
+    result = rb_funcall2(hash, rb_sym_assess_hash_brackets, argc, argv);
+
+    return result;
+}
+
+static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
+                                              const VALUE hash) {
+    VALUE result;
+    VALUE key;
+
+    key = rb_funcall2(hash, rb_sym_assess_hash_bracket_set, argc, argv);
+    argv[0] = key;
+    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
+
+    return result;
+}
+
+void Init_cs__assess_hash(void) {
+    rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
+    rb_sym_assess_hash_brackets = rb_intern("cs__patched_[]");
+    rb_sym_assess_hash_bracket_set = rb_intern("cs__bracket_set");
+    rb_sym_assess_hash_bracket_equals = rb_intern("cs__patched_[]=");
+
+    VALUE hash_class = rb_define_class("Hash", rb_cObject);
+    array_class = rb_define_class("Array", rb_cObject);
+
+    VALUE singleton = rb_singleton_class(hash_class);
+    contrast_alias_method(singleton, "cs__patched_[]", "[]");
+    rb_define_method(singleton, "[]", contrast_assess_hash_bracket_get, -1);
+
+    contrast_alias_method(hash_class, "cs__patched_[]=", "[]=");
+    rb_define_method(hash_class, "[]=", contrast_assess_hash_bracket_set, -1);
+}

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -0,0 +1,24 @@
+#include <ruby.h>
+
+static VALUE array_class;
+
+static VALUE rb_sym_assess_hash_dup_and_freeze;
+static VALUE rb_sym_assess_hash_brackets;
+static VALUE rb_sym_assess_hash_bracket_set;
+static VALUE rb_sym_assess_hash_bracket_equals;
+
+/*
+ * Monkeypatch Ruby Hash with Contrast Security Hash in order ot avoid losing
+ * tracking across Strings. Hashes, when given unfrozen Strings as keys,
+ * replace these Strings with a frozen copy in the hash. This copy is done is C
+ * and does not take into account the tag properties we've provided. Freezing
+ * ahead of time should avoid this, similar to the behavior of the -@ Strings
+ * -HM
+ */
+static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
+                                              const VALUE hash);
+
+static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
+                                              const VALUE hash);
+
+void Init_cs__assess_hash(void);

data/ext/cs__assess_hash/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -0,0 +1,36 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_kernel.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+VALUE
+contrast_patched_kernel_exec(const int argc, const VALUE *argv,
+                             const VALUE self) {
+    int nested_scope =
+        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+
+    if (!nested_scope && argc > 0) {
+        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+        VALUE data = argv[0];
+        rb_funcall(kernel_propagator, exec_apply_trigger, 1, data);
+        rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    }
+
+    return rb_funcall(self, rb_intern("cs__assess_kernel_exec"), argc, *argv);
+}
+
+void Init_cs__assess_kernel(void) {
+    kernel_propagator = rb_define_module("KernelPropagator");
+    exec_apply_trigger = rb_intern("apply_trigger");
+
+    VALUE singleton = rb_singleton_class(rb_mKernel);
+
+    contrast_alias_method(rb_mKernel, "cs__assess_kernel_exec", "exec");
+    rb_define_private_method(rb_mKernel, "exec", contrast_patched_kernel_exec,
+                             -1);
+
+    contrast_alias_method(singleton, "cs__assess_kernel_exec", "exec");
+    rb_define_method(singleton, "exec", contrast_patched_kernel_exec, -1);
+}

data/ext/cs__assess_kernel/cs__assess_kernel.h

@@ -0,0 +1,10 @@
+#include <ruby.h>
+
+static VALUE exec_apply_trigger;
+static VALUE kernel_propagator;
+
+VALUE
+contrast_patched_kernel_exec(const int argc, const VALUE *argv,
+                             const VALUE self);
+
+void Init_cs__assess_kernel(void);

data/ext/cs__assess_kernel/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -0,0 +1,47 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_marshal_module.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+static VALUE contrast_assess_marshal_module_load(const int argc,
+                                                 const VALUE *argv) {
+    VALUE result;
+    VALUE source_string;
+
+    result = rb_call_super(argc, argv);
+
+    if (argc >= 1) {
+        source_string = argv[0];
+
+        if (rb_respond_to(source_string, rb_sym_cs_tracked)) {
+            VALUE tracked = rb_funcall(source_string, rb_sym_cs_tracked, 0);
+
+            if (tracked == Qtrue) {
+                VALUE skip = rb_funcall(contrast_patcher(),
+                                        rb_sym_skip_assess_analysis, 0);
+
+                if (skip == Qfalse) {
+                    VALUE scope =
+                        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+                    rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
+                               2, source_string, result);
+                    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
+                }
+            }
+        }
+    }
+    return result;
+}
+
+void Init_cs__assess_marshal_module(void) {
+    rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
+
+    marshal_module = rb_define_module("Marshal");
+
+    VALUE contrast_marshal = rb_define_module("MarshalWithContrastAssess");
+    rb_define_method(contrast_marshal, "load",
+                     contrast_assess_marshal_module_load, -1);
+    rb_prepend_module(rb_singleton_class(marshal_module), contrast_marshal);
+}

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h

@@ -0,0 +1,18 @@
+#include <ruby.h>
+
+static VALUE marshal_module;
+
+static VALUE rb_sym_assess_load_trigger_check;
+
+/*
+ * Rails is a jerk. In Rails 5, they decided to do away with the alias chaining
+ * approach in favor of the prepend approach. While we'll need to add long term
+ * support for prepend, so far, the only method that we've found that is used
+ * regularly by Rails / that is constantly prepended is Marshal.load. We'll
+ * special case this for now.
+ * -HM (shamelessly commenting on DP's work)
+ */
+static VALUE contrast_assess_marshal_module_load(const int argc,
+                                                 const VALUE *argv);
+
+void Init_cs__assess_marshal_module(void);

data/ext/cs__assess_marshal_module/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_module/cs__assess_module.c

@@ -0,0 +1,78 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_module.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
+    VALUE has_trigger_check = rb_respond_to(module, trigger_check_method);
+
+    if (RTEST(
+            rb_funcall(contrast_patcher(), rb_sym_skip_contrast_analysis, 0))) {
+        return;
+    }
+
+    int nested_scope =
+        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+
+    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+
+    if (!nested_scope && has_trigger_check) {
+        VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
+        /* If this method ever throws an exception, the scope-leave
+         * needs to be moved within a rescue call.
+         */
+        rb_funcall(module, trigger_check_method, 3, source, ret, method);
+    }
+
+    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+}
+
+VALUE
+contrast_assess_module_class_eval(const int argc, const VALUE *argv,
+                                  const VALUE mod) {
+    VALUE ret = rb_mod_module_eval(argc, argv, mod);
+
+    if (argc > 0) {
+        VALUE data = argv[0];
+        contrast_assess_eval_trigger_check(mod, data, ret);
+    }
+    rb_funcall(assess_patcher, rb_sym_assess_patch_eval, 1, mod);
+
+    return ret;
+}
+
+VALUE
+contrast_assess_module_module_eval(const int argc, const VALUE *argv,
+                                   const VALUE mod) {
+    VALUE ret = rb_mod_module_eval(argc, argv, mod);
+
+    if (argc > 0) {
+        VALUE data = argv[0];
+        contrast_assess_eval_trigger_check(mod, data, ret);
+    }
+
+    rb_funcall(assess_patcher, rb_sym_assess_patch_eval, 1, mod);
+
+    return ret;
+}
+
+void Init_cs__assess_module(void) {
+    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+
+    VALUE assess_policy = rb_define_module_under(assess, "Policy");
+    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
+
+    trigger_check_method = rb_intern("eval_trigger_check");
+
+    contrast_alias_method(rb_cModule, "cs__patched_class_eval", "class_eval");
+
+    rb_define_method(rb_cModule, "class_eval",
+                     contrast_assess_module_class_eval, -1);
+
+    contrast_alias_method(rb_cModule, "cs__patched_module_eval", "module_eval");
+
+    rb_define_method(rb_cModule, "module_eval",
+                     contrast_assess_module_module_eval, -1);
+}

data/ext/cs__assess_module/cs__assess_module.h

@@ -0,0 +1,25 @@
+#include <ruby.h>
+
+/* Contrast::Agent::Assess::Policy::Patcher */
+static VALUE assess_patcher;
+
+static VALUE rb_sym_assess_patch_eval;
+static VALUE trigger_check_method;
+
+/* c.f. cs__assess_basic_object.c for more context on how eval is patched. */
+void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret);
+
+/*
+ * rb_mod_module_eval is the C method equivalent of Module.class_eval and
+ * Module.module_eval. Calling it like this maintains the Ruby method scope
+ * that rb_mod_module_eval expects.
+ */
+VALUE
+contrast_assess_module_class_eval(const int argc, const VALUE *argv,
+                                  const VALUE mod);
+
+VALUE
+contrast_assess_module_module_eval(const int argc, const VALUE *argv,
+                                   const VALUE mod);
+
+void Init_cs__assess_module(void);

data/ext/cs__assess_module/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -0,0 +1,48 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_regexp.h"
+#include <ruby.h>
+
+void contrast_alias_method(const VALUE target, const char *to,
+                           const char *from);
+
+static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
+                                                   const VALUE *argv,
+                                                   const VALUE regexp) {
+    VALUE result, infohash;
+
+    result =
+        rb_funcall2(regexp, rb_sym_assess_regexp_equal_squiggle, argc, argv);
+
+    if (RTEST(result)) {
+        infohash = rb_hash_new();
+        rb_hash_aset(infohash, rb_sym_regexp, regexp);
+        rb_hash_aset(infohash, rb_sym_result, result);
+        rb_hash_aset(infohash, rb_sym_string, argv[0]);
+        rb_hash_aset(infohash, rb_sym_back_ref, rb_backref_get());
+        rb_funcall(regexp, rb_sym_assess_track_regexp, 1, infohash);
+    }
+
+    return result;
+}
+
+void Init_cs__assess_regexp(void) {
+    rb_sym_assess_regexp_equal_squiggle =
+        rb_intern("cs__patched_equal_squiggle");
+    rb_sym_assess_track_regexp = rb_intern("cs__regexp_tagger");
+
+    rb_sym_result = ID2SYM(rb_intern("result"));
+    rb_global_variable(&rb_sym_result);
+    rb_sym_regexp = ID2SYM(rb_intern("regexp"));
+    rb_global_variable(&rb_sym_regexp);
+    rb_sym_string = ID2SYM(rb_intern("string"));
+    rb_global_variable(&rb_sym_string);
+    rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
+    rb_global_variable(&rb_sym_back_ref);
+
+    VALUE regexp_class = rb_define_class("Regexp", rb_cObject);
+    contrast_alias_method(regexp_class, "cs__patched_equal_squiggle", "=~");
+    rb_define_method(regexp_class, "=~", contrast_assess_regexp_equal_squiggle,
+                     -1);
+}

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -0,0 +1,22 @@
+#include <ruby.h>
+
+static VALUE rb_sym_result;
+static VALUE rb_sym_regexp;
+static VALUE rb_sym_string;
+static VALUE rb_sym_back_ref;
+static VALUE rb_sym_assess_regexp_equal_squiggle;
+static VALUE rb_sym_assess_track_regexp;
+
+/*
+ * argc - number of arguments
+ * argv - array of arguments, can be:
+ * [nil]
+ * [Symbol]
+ * [String]
+ * regex - reference to self object
+ */
+static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
+                                                   const VALUE *argv,
+                                                   const VALUE regexp);
+
+void Init_cs__assess_regexp(void);

data/ext/cs__assess_regexp/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c

@@ -0,0 +1,63 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_regexp_track.h"
+#include <funchook.h>
+#include <ruby.h>
+
+static VALUE rb_reg_match_pre_hook(VALUE match) {
+    VALUE result = rb_reg_match_pre_original(match);
+    result = rb_funcall(regexp_class, track_rb_pre_match, 2, match, result);
+    return result;
+}
+
+static VALUE rb_reg_match_post_hook(VALUE match) {
+    VALUE result = rb_reg_match_post_original(match);
+    result = rb_funcall(regexp_class, track_rb_post_match, 2, match, result);
+    return result;
+}
+
+static VALUE rb_reg_match_last_hook(VALUE match) {
+    VALUE result = rb_reg_match_last_original(match);
+    result =
+        rb_funcall(regexp_class, track_rb_reg_match_last, 2, match, result);
+    return result;
+}
+
+static VALUE rb_reg_nth_match_hook(int nth, VALUE match) {
+    VALUE result = rb_reg_nth_match_original(nth, match);
+    result = rb_funcall(regexp_class, track_rb_n_match, 2, match, result);
+    return result;
+}
+
+static int install_regexp_hooks() {
+    funchook_t *funchook = funchook_create();
+
+    rb_reg_match_pre_original = rb_reg_match_pre;
+    funchook_prepare(funchook, (void **)&rb_reg_match_pre_original,
+                     rb_reg_match_pre_hook);
+
+    rb_reg_match_post_original = rb_reg_match_post;
+    funchook_prepare(funchook, (void **)&rb_reg_match_post_original,
+                     rb_reg_match_post_hook);
+
+    rb_reg_match_last_original = rb_reg_match_last;
+    funchook_prepare(funchook, (void **)&rb_reg_match_last_original,
+                     rb_reg_match_last_hook);
+
+    rb_reg_nth_match_original = rb_reg_nth_match;
+    funchook_prepare(funchook, (void **)&rb_reg_nth_match_original,
+                     rb_reg_nth_match_hook);
+
+    funchook_install(funchook, 0);
+    return 0;
+}
+
+void Init_cs__assess_regexp_track(void) {
+    regexp_class = rb_define_class("Regexp", rb_cObject);
+    track_rb_n_match = rb_intern("track_rb_n_match");
+    track_rb_pre_match = rb_intern("track_rb_pre_match");
+    track_rb_post_match = rb_intern("track_rb_post_match");
+    track_rb_reg_match_last = rb_intern("track_rb_reg_match_last");
+    install_regexp_hooks();
+}