contrast-agent 3.8.4

data/lib/contrast/core_extensions/assess/basic_object.rb

@@ -0,0 +1,15 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/eval_trigger'
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+
+# Our patch into the BasicObject class, allowing us to track calls to the eval
+# method
+class BasicObject
+  class << self
+    include Contrast::CoreExtensions::Assess::EvalTrigger
+  end
+end
+
+cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'

data/lib/contrast/core_extensions/assess/erb.rb

@@ -0,0 +1,42 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+# This module is used to track propagation through ERB template rendering
+module ERBPropagator
+  class << self
+    include Contrast::Components::Interface
+    access_component :logging
+
+    def result_tagger patcher, preshift, ret, _block
+      return unless preshift.args.length >= 1
+
+      logger.debug('ERBPropagator - running propagation')
+      used_binding = preshift.args[0]
+      binding_variable_set = used_binding.local_variables
+
+      erb_pre_result = preshift.object.src
+      binding_variable_set.each do |bound_var_symbol|
+        bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
+        next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
+        next unless erb_pre_result.include?(bound_var_symbol.to_s)
+
+        start_index = ret.index(bound_variable_value)
+        next if start_index.nil?
+
+        logger.debug('ERBPropagator - found bound_variable in erb template result')
+        ret.cs__copy_from(bound_variable_value, start_index)
+      end
+      ret.cs__properties.build_event(
+          patcher,
+          ret,
+          preshift.object,
+          ret,
+          preshift.args,
+          1)
+      logger.debug('ERBPropgator - Finished erb result propagation')
+      ret
+    end
+  end
+end

data/lib/contrast/core_extensions/assess/exec_trigger.rb

@@ -0,0 +1,48 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This Module allows us to track calls to the Kernel#exec method, which
+      # violates the design of most methods we track in that we have to apply
+      # the trigger at the start in order to account for the process hand off.
+      module ExecTrigger
+        include Contrast::Components::Interface
+        access_component :contrast_service
+        def apply_trigger source
+          current_context = Contrast::Agent::REQUEST_TRACKER.current
+          return unless current_context
+
+          # Since we know this is the source of the trigger, we can do some
+          # optimization here and return when it is not tracked
+          return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+          # source might not be all the args passed in, but it is the one we care
+          # about. we could pass in all the args in the last param here if it
+          # becomes an issue in rendering on TS
+          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+              current_context,
+              trigger_node,
+              source,
+              self,
+              '',
+              1,
+              source)
+          # Exec replaces the current process, if we occur in a forked process our appendage of this finding will not make it to TS
+          CONTRAST_SERVICE.send_message(current_context.activity)
+        end
+
+        private
+
+        def trigger_node
+          @_trigger_node ||= begin
+            Contrast::Agent::Assess::Policy::Policy.instance.find_node('cmd-injection', 'Kernel', :exec, false)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/assess/fiber.rb

@@ -0,0 +1,125 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+cs__scoped_require 'fiber'
+
+# In order to instrument some difficult methods like String#gsub, as it
+# returns an enumerator, we need to instrument methods on Fiber.
+# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
+# order to track what happens within Enumerator#next.
+# TODO: RUBY-531 move these out of Fiber class
+class Fiber
+  include Contrast::CoreExtensions::Assess::AssessExtension
+  include Contrast::Components::Interface
+
+  access_component :analysis, :scope
+
+  FIBER_NEW_NODE_HASH = {
+      'class_name' => 'Fiber',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'c_new', # TODO: Why do we patch new here and not initalize? Historically, new has been problematic.
+      'action' => 'CUSTOM',
+      'source' => 'O',
+      'target' => 'R',
+      'patch_class' => 'NOOP',
+      'patch_method' => 'track_rb_fiber_new'
+  }.cs__freeze
+  FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
+  private_constant :FIBER_NEW_NODE_HASH
+  private_constant :FIBER_NEW_NODE
+
+  FIBER_YIELD_NODE_HASH = {
+      'class_name' => 'Fiber',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'c_yield',
+      'action' => 'CUSTOM',
+      'source' => 'O',
+      'target' => 'R',
+      'patch_class' => 'NOOP',
+      'patch_method' => 'track_rb_fiber_yield'
+  }.cs__freeze
+  FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
+  private_constant :FIBER_YIELD_NODE_HASH
+  private_constant :FIBER_YIELD_NODE
+
+  class << self
+    def track_rb_fiber_yield fiber, _method, results
+      # results will be nil if StopIteration was raised,
+      # otherwise an Array of the yielded arguments
+      return if results.nil?
+
+      return unless ASSESS.enabled?
+
+      with_contrast_scope do
+        results.each do |result|
+          next unless Contrast::Utils::DuckUtils.quacks_like_cs_patched?(result)
+          next if result.cs__frozen?
+
+          cs__splat_tags(result, fiber)
+          result.cs__properties.build_event(
+              FIBER_YIELD_NODE,
+              result,
+              fiber,
+              result,
+              [])
+        end
+      end
+    end
+
+    def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
+      return unless Contrast::Utils::DuckUtils.quacks_like_cs_patched?(underlying)
+      return unless underlying.is_a?(String) && !underlying.empty?
+
+      return unless ASSESS.enabled?
+
+      with_contrast_scope do
+        cs__splat_tags(fiber, underlying)
+        fiber.cs__properties.build_event(
+            FIBER_NEW_NODE,
+            fiber,
+            underlying,
+            fiber,
+            [])
+      end
+    end
+
+    def instrument_fiber_track
+      @_instrument_fiber_variables ||= begin
+          cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+          true
+        end
+    rescue StandardError => e
+      logger.error(e, 'Error loading fiber track patch')
+      false
+    end
+
+    # Some propagation occurred, but we're not sure what the
+    # exact transformation was. To be safe, we just explode
+    # all the tags from the source to the return.
+    #
+    # If the return already had that tag, the existing tag
+    # range is recycled to save us an object.
+    def cs__splat_tags ret, source = self
+      source.cs__properties.tag_keys.each do |key|
+        length = Contrast::Utils::StringUtils.ret_length(ret)
+        existing = ret.cs__properties.fetch_tag(key)
+        # if the tag already exists, drop all but the first range
+        # then change that range to cover the entire return
+        if existing&.any?
+          existing.drop(existing.length - 1)
+          range = existing[0]
+          range.repurpose(0, length)
+        else
+          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
+          ret.cs__properties.add_tag(key, span)
+        end
+      end
+    end
+  end
+end
+
+Fiber.instrument_fiber_track

data/lib/contrast/core_extensions/assess/hash.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# This Class provides us with a way to invoke Hash propagation for those
+# methods which are too complex to fit into one of the standard
+# Contrast::Agent::Assess::Policy::Propagator molds.
+class Hash
+  def self.cs__duplicate_and_freeze object
+    return object unless object.is_a?(String) && !object.cs__frozen?
+    return object unless object.cs__tracked?
+
+    object.dup.cs__freeze
+  rescue StandardError
+    logger.error("Unable to track dataflow through array for #{ object }")
+  end
+
+  def cs__bracket_set *args
+    Hash.cs__duplicate_and_freeze(args[0])
+  end
+end
+
+cs__scoped_require 'cs__assess_hash/cs__assess_hash'

data/lib/contrast/core_extensions/assess/kernel.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/core_extensions/assess/exec_trigger'
+
+# This module provides us with a way to invoke Kernel propagation for those
+# methods which are too complex to fit into one of the standard
+# Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+# Kernel Module or exposing our methods there.
+module KernelPropagator
+  class << self
+    include Contrast::Components::Interface
+    include Contrast::CoreExtensions::Assess::ExecTrigger
+
+    access_component :logging
+
+    # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+    # in, the entire result will be tracked out. We're going to take this
+    # approach for now b/c it's fast and easy. I don't super love it, and by
+    # that I mean I hate it.
+    #
+    # To actually track this, we'd have to find the index of the new things
+    # being added, then remove the tags at the range of the format marker,
+    # which is some arbitrary length thing, and add the new tags from the
+    # inserted string, shifted down by the length of the aforementioned
+    # marker.
+    #
+    # marker is in the format %[flags][width][.precision]type, type being a
+    # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+    #
+    # also, b/c Ruby hates us, there are things called absolute markers,
+    # (digit)$, that go in the flags section. These cannot be mixed w/ the
+    # order assumed type
+    #
+    # oh, and there's also %<name>type and %{name}... b/c of course there is
+    # -HM
+    def sprintf_tagger patcher, preshift, ret, _block
+      format_string = preshift.args[0]
+      args = preshift.args[1]
+
+      track_sprintf(ret, format_string, args)
+
+      ret.cs__properties.build_event(
+          patcher,
+          ret,
+          preshift.object,
+          ret,
+          preshift.args,
+          1)
+      ret
+    end
+
+    def track_sprintf result, format_string, args
+      tracked_inputs = []
+      tracked_inputs << format_string if format_string.cs__tracked?
+      if args.is_a?(String)
+        tracked_inputs << args if args.cs__tracked?
+      elsif args.is_a?(Hash)
+        args.each_value do |value|
+          next unless Contrast::Utils::DuckUtils.quacks_to?(
+              value,
+              :cs__tracked?)
+          next unless value.cs__tracked?
+
+          tracked_inputs << value
+        end
+      elsif args.is_a?(Array)
+        args.each do |value|
+          next unless Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?)
+          next unless value.cs__tracked?
+
+          tracked_inputs << value
+        end
+      end
+      return result if tracked_inputs.empty?
+
+      tracked_inputs.each do |input|
+        input.cs__properties.events.each do |event|
+          result.cs__properties.events << event
+        end
+        input.cs__splat_tags(result)
+      end
+
+      result
+    rescue StandardError => e
+      logger.error(
+          e,
+          'Unable to track dataflow through sprintf')
+      result
+    end
+  end
+end
+
+cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'

data/lib/contrast/core_extensions/assess/module.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/eval_trigger'
+
+# Our patch into the Module class, allowing us to track calls to the eval
+# method
+class Module
+  class << self
+    include Contrast::CoreExtensions::Assess::EvalTrigger
+  end
+end
+
+cs__scoped_require 'cs__assess_module/cs__assess_module'

data/lib/contrast/core_extensions/assess/regexp.rb

@@ -0,0 +1,206 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+# Monkeypatch Ruby Regexp with Contrast Security tagging support
+class Regexp
+  include Contrast::Components::Interface
+  include Contrast::CoreExtensions::Assess::AssessExtension
+
+  access_component :analysis, :logging, :scope
+
+  def cs__regexp_tagger info_hash
+    return unless ASSESS.enabled?
+
+    # Because we have a special case for this propagation,
+    # it falls out of regular scoping. As such, any patch to the `=~` method
+    # that goes through normal channels, like that for the redos rule,
+    # will force this to be in a scope of 1 (instead of the normal 0).
+    # As such, a scope of 1 here indicates that,
+    # so we know that we're in the top level call for this method.
+    # normal patch [-alias-]> special case patch [-alias-]> original method
+    # TODO:  RUBY-686
+    return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
+
+    with_contrast_scope do
+      result = info_hash[:result]
+      return unless result
+
+      string = info_hash[:string] || nil
+      return unless string
+
+      regexp = info_hash[:regexp]
+      return unless (Contrast::Utils::DuckUtils.quacks_to?(string, :cs__tracked?) && string.cs__tracked?) ||
+          (Contrast::Utils::DuckUtils.quacks_to?(regexp, :cs__tracked?) && regexp.cs__tracked?)
+
+      Regexp.cs__splat_tags(info_hash[:back_ref], string)
+      Regexp.cs__build_event(ARRAY_NODE, info_hash[:back_ref], result, [string])
+    end
+  end
+
+  REGEXP_EQUAL_SQUIGGLE_HASH = {
+      'id' => 'regexp_100',
+      'class_name' => 'Regexp',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => '=~',
+      'source' => 'P0',
+      'target' => 'R',
+      'action' => 'KEEP'
+  }.cs__freeze
+  ARRAY_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
+  private_constant :REGEXP_EQUAL_SQUIGGLE_HASH
+  private_constant :ARRAY_NODE
+
+  REGEXP_MATCH_HASH = {
+      'id' => 'regexp_101',
+      'class_name' => 'Regexp',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'match',
+      'source' => 'P0',
+      'target' => 'R',
+      'action' => 'SPLAT'
+  }.cs__freeze
+  MATCH_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_MATCH_HASH)
+  private_constant :REGEXP_MATCH_HASH
+  private_constant :MATCH_NODE
+
+  POST_HASH = {
+      'class_name' => 'MatchData',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'post_match',
+      'source' => 'O',
+      'target' => 'R',
+      'action' => 'REMOVE'
+  }.cs__freeze
+  POST_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(POST_HASH)
+  private_constant :POST_HASH
+  private_constant :POST_WEAVER
+
+  PRE_HASH = {
+      'class_name' => 'MatchData',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'pre_match',
+      'source' => 'O',
+      'target' => 'R',
+      'action' => 'SPLAT'
+  }.cs__freeze
+  PRE_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(PRE_HASH)
+  private_constant :PRE_HASH
+  private_constant :PRE_WEAVER
+
+  LAST_PAREN_HASH = {
+      'class_name' => 'MatchData',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'last_paren',
+      'source' => 'O',
+      'target' => 'R',
+      'action' => 'SPLAT'
+  }.cs__freeze
+  LAST_PAREN_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(LAST_PAREN_HASH)
+  private_constant :LAST_PAREN_HASH
+  private_constant :LAST_PAREN_WEAVER
+
+  NTH_HASH = {
+      'class_name' => 'MatchData',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'nth_match',
+      'source' => 'O',
+      'target' => 'R',
+      'action' => 'SPLAT'
+  }.cs__freeze
+  NTH_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(NTH_HASH)
+  private_constant :NTH_HASH
+  private_constant :NTH_WEAVER
+
+  class << self
+    def track_rb_pre_match backref, target
+      track_rb_c(PRE_WEAVER, backref, target)
+    end
+
+    def track_rb_post_match backref, target
+      track_rb_c(POST_WEAVER, backref, target)
+    end
+
+    def track_rb_reg_match_last backref, target
+      track_rb_c(LAST_PAREN_WEAVER, backref, target)
+    end
+
+    def track_rb_n_match backref, target
+      track_rb_c(NTH_WEAVER, backref, target)
+    end
+
+    # Some propagation occurred, but we're not sure what the
+    # exact transformation was. To be safe, we just explode
+    # all the tags from the source to the return.
+    #
+    # If the return already had that tag, the existing tag
+    # range is recycled to save us an object.
+    def cs__splat_tags ret, source = self
+      source.cs__properties.tag_keys.each do |key|
+        length = Contrast::Utils::StringUtils.ret_length(ret)
+        existing = ret.cs__properties.fetch_tag(key)
+        # if the tag already exists, drop all but the first range
+        # then change that range to cover the entire return
+        if existing&.any?
+          existing.drop(existing.length - 1)
+          range = existing[0]
+          range.repurpose(0, length)
+        else
+          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
+          ret.cs__properties.add_tag(key, span)
+        end
+      end
+    end
+
+    def cs__build_event node, target, ret, args
+      return unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__tracked?)
+      return unless target.cs__tracked?
+
+      target.cs__properties.build_event(
+          node,
+          target,
+          self,
+          ret,
+          args)
+    end
+
+    def instrument_regexp_track
+      @_instrument_regexp_variables ||= begin
+          cs__scoped_require 'cs__assess_regexp_track/cs__assess_regexp_track'
+          true
+        end
+    rescue StandardError => e
+      logger.error(e, 'Error loading regexp track patch')
+      false
+    end
+
+    private
+
+    def track_rb_c weaver, backref, target
+      return target unless ASSESS.enabled?
+      return target unless backref&.respond_to?(:cs__properties)
+      return target unless target.is_a?(String) && !target.empty?
+
+      with_contrast_scope do
+        cs__splat_tags(target, backref)
+        target.cs__properties.build_event(
+            weaver,
+            target,
+            self,
+            target,
+            [])
+        target
+      end
+    end
+  end
+end
+
+cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
+Regexp.instrument_regexp_track