contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/configuration.rb

@@ -88,13 +88,13 @@ module Contrast
           puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
           next
         end
-        config = yaml_to_hash(path)
+        config = yaml_to_hash(path) || {}
         break
       end
 
       if config.empty?
         puts "!!! Contrast - working directory: #{ Dir.pwd }"
-        puts '!!! Contrast - configuration file could not be found at any of the search paths'
+        puts '!!! Contrast - valid configuration file could not be found at any of the search paths'
         puts 'Valid configuration paths are: '
         configuration_paths.each do |path|
           puts(path)

data/lib/contrast/{extensions/ruby_core → extension}/assess.rb

@@ -2,14 +2,15 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
     # @deprecated This is one of our earliest designs and is not nearly as
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
+    #   Removing it requires a C refactor to handle the namespace.
     module Assess
       cs__scoped_require 'contrast/agent/patching/policy/patcher'
 
@@ -31,22 +32,18 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/agent/assess/frozen_properties'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+      cs__scoped_require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/string'
+      cs__scoped_require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/array'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/erb'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/fiber'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/hash'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/kernel'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/regexp'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/module'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/basic_object'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/tilt_template_trigger'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/xpath_library_trigger'
+      cs__scoped_require 'contrast/extension/assess/array'
+      cs__scoped_require 'contrast/extension/assess/erb'
+      cs__scoped_require 'contrast/extension/assess/eval_trigger'
+      cs__scoped_require 'contrast/extension/assess/fiber'
+      cs__scoped_require 'contrast/extension/assess/hash'
+      cs__scoped_require 'contrast/extension/assess/kernel'
+      cs__scoped_require 'contrast/extension/assess/regexp'
     end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/patch'
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      class ArrayPropagator
+        include Contrast::Components::Interface
+
+        access_component :scope
+
+        ARRAY_JOIN_HASH = {
+            'class_name' => 'Array',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'join',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'cs__track_join'
+        }.cs__freeze
+        ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
+
+        class << self
+          # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+          # Multiple Strings are appended with the #join method. Because that
+          # operation happens in C, we have to do it here rather than rely on the
+          # patch of our String append or concat methods.
+          def cs__track_join ary, separator, ret
+            return unless ary
+            return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
+
+            with_contrast_scope do
+              shift = 0
+              separator_length = separator.nil? ? 0 : separator.to_s.length
+              ary.each do |obj|
+                if obj # skip nil here
+                  ret.cs__copy_from(obj, shift)
+                  shift += obj.to_s.length
+                end
+                shift += separator_length
+              end
+              return ret unless ret.cs__tracked?
+
+              ret.cs__properties.cleanup_tags
+              ret.cs__properties.build_event(
+                  ARRAY_JOIN_NODE,
+                  ret,
+                  ary,
+                  ret,
+                  [separator])
+              ret
+            end
+          end
+
+          def instrument_array_track
+            @_instrument_array_track ||= begin
+                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
+                                           true
+                                         end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading assess track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/assess_extension.rb

@@ -2,17 +2,16 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/frozen_properties'
 cs__scoped_require 'contrast/agent/assess/insulator'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This module is responsible for maintaining the data we need to
       # construct a trace event for the object in which it is included. Rather
       # than have this code all over the place, any class that wants to use
       # dataflow features should be sent
-      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
+      # 'include Contrast::Extension::Assess::AssessExtension'
       module AssessExtension
         # Lazily build properties object. Only objects that have been tracked
         # will have the @_cs__properties, but all will respond to the
@@ -86,6 +85,7 @@ module Contrast
             existing = cs__properties.fetch_tag(key)
             if existing
               existing.concat(new_tags)
+              Contrast::Utils::TagUtil.size_aware_merge(self, existing)
             else
               cs__properties.set_tags(key, new_tags)
             end
@@ -99,33 +99,38 @@ module Contrast
         # If the return already had that tag, the existing tag
         # range is recycled to save us an object.
         def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.quacks_to?(
-              ret,
-              :cs__tracked?)
+          return unless Contrast::Utils::DuckUtils.trackable?(ret)
 
-          splat_source = Contrast::Utils::DuckUtils.quacks_to?(
-              source,
-              :cs__tracked?)
+          length = Contrast::Utils::StringUtils.ret_length(ret)
+          return if length.zero?
+
+          cs__splat_from_source(ret, length, source)
+          cs__splat_from_ret(ret, length)
+        end
+
+        def cs__splat_from_source ret, ret_length, source
+          splat_source = Contrast::Utils::DuckUtils.trackable?(source)
           splat_source &&= source.cs__tracked?
-          if splat_source
-            length = Contrast::Utils::StringUtils.ret_length(ret)
-            source.cs__properties.tag_keys.each do |key|
-              existing = ret.cs__properties.fetch_tag(key)
-              # if the tag already exists, drop all but the first range
-              # then change that range to cover the entire return
-              if existing
-                existing.drop(existing.length - 1)
-                range = existing[0]
-                range.repurpose(0, length)
-              else
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                ret.cs__properties.add_tag(key, span)
-              end
+          return unless splat_source
+
+          source.cs__properties.tag_keys.each do |key|
+            existing = ret.cs__properties.fetch_tag(key)
+            # if the tag already exists, drop all but the first range
+            # then change that range to cover the entire return
+            if existing
+              existing.drop(existing.length - 1)
+              range = existing[0]
+              range.repurpose(0, ret_length)
+            else
+              span = Contrast::Agent::Assess::AdjustedSpan.new(0, ret_length)
+              ret.cs__properties.add_tag(key, span)
             end
           end
+        end
+
+        def cs__splat_from_ret ret, length
           return unless ret.cs__tracked?
 
-          length ||= Contrast::Utils::StringUtils.ret_length(ret)
           ret.cs__properties.tag_keys.each do |key|
             next unless key
 

data/lib/contrast/{extensions/ruby_core → extension}/assess/erb.rb

@@ -1,18 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-
 # This module is used to track propagation through ERB template rendering
 module ERBPropagator
   class << self
-    include Contrast::Components::Interface
-    access_component :logging
-
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
 
-      logger.debug('ERBPropagator - running propagation')
       used_binding = preshift.args[0]
       binding_variable_set = used_binding.local_variables
 
@@ -25,7 +19,6 @@ module ERBPropagator
         start_index = ret.index(bound_variable_value)
         next if start_index.nil?
 
-        logger.debug('ERBPropagator - found bound_variable in erb template result')
         ret.cs__copy_from(bound_variable_value, start_index)
       end
       ret.cs__properties.build_event(
@@ -35,7 +28,6 @@ module ERBPropagator
           ret,
           preshift.args,
           1)
-      logger.debug('ERBPropgator - Finished erb result propagation')
       ret
     end
   end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      class EvalTrigger
+        include Contrast::Components::Interface
+        access_component :logging
+
+        class << self
+          def instance_eval_trigger_check obj, source, ret
+            apply_trigger(obj, source, ret, 'BasicObject', :instance_eval)
+          end
+
+          def eval_trigger_check obj, source, ret, method
+            apply_trigger(obj, source, ret, 'Module', method)
+          end
+
+          def apply_trigger obj, source, ret, clazz, method
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
+                current_context,
+                trigger_node(clazz, method),
+                source,
+                obj,
+                ret,
+                source)
+          end
+
+          def instrument_basic_object_track
+            @_instrument_basic_object_track ||= begin
+                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading basic object track patch', e)
+            false
+          end
+
+          def instrument_module_track
+            @_instrument_module_track ||= begin
+                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading module track patch', e)
+            false
+          end
+
+          private
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb

@@ -1,17 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/at_exit_hook'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Module allows us to track calls to the Kernel#exec method, which
       # violates the design of most methods we track in that we have to apply
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
-        include Contrast::Components::Interface
-        access_component :contrast_service
         def apply_trigger source
           current_context = Contrast::Agent::REQUEST_TRACKER.current
           return unless current_context
@@ -27,12 +25,12 @@ module Contrast
               current_context,
               trigger_node,
               source,
-              self,
-              '',
-              1,
+              Kernel,
+              nil,
               source)
-          # Exec replaces the current process, if we occur in a forked process our appendage of this finding will not make it to TS
-          CONTRAST_SERVICE.send_message(current_context.activity)
+          # Exec replaces the current process, if we occur in a forked process
+          # our appendage of this finding will not make it to TS
+          Contrast::Agent::AtExitHook.on_exit
         end
 
         private

data/lib/contrast/extension/assess/fiber.rb

@@ -0,0 +1,113 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
+cs__scoped_require 'contrast/components/interface'
+
+# In order to instrument some difficult methods like String#gsub, as it
+# returns an enumerator, we need to instrument methods on Fiber.
+# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
+# order to track what happens within Enumerator#next.
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Fiber Class or exposing our methods there.
+      class FiberPropagator
+        include Contrast::Components::Interface
+
+        access_component :analysis, :logging, :scope
+
+        # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
+        FIBER_NEW_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_new',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_new'
+        }.cs__freeze
+        FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
+        private_constant :FIBER_NEW_NODE_HASH
+        private_constant :FIBER_NEW_NODE
+
+        FIBER_YIELD_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_yield',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_yield'
+        }.cs__freeze
+        FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
+        private_constant :FIBER_YIELD_NODE_HASH
+        private_constant :FIBER_YIELD_NODE
+
+        class << self
+          def track_rb_fiber_yield fiber, _method, results
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
+
+            # results will be nil if StopIteration was raised,
+            # otherwise an Array of the yielded arguments
+            return unless results.cs__is_a?(Array)
+
+            with_contrast_scope do
+              results.each do |result|
+                next unless Contrast::Utils::DuckUtils.trackable?(result)
+                next if result.cs__frozen?
+
+                fiber.cs__splat_tags(result)
+                result.cs__properties.build_event(
+                    FIBER_YIELD_NODE,
+                    result,
+                    fiber,
+                    result,
+                    [])
+              end
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber#yield', e)
+          end
+
+          def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
+            return unless Contrast::Utils::DuckUtils.trackable?(underlying)
+            return unless underlying.is_a?(String) && !underlying.empty?
+
+            with_contrast_scope do
+              underlying.cs__splat_tags(fiber)
+              fiber.cs__properties.build_event(
+                  FIBER_NEW_NODE,
+                  fiber,
+                  underlying,
+                  fiber,
+                  [])
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber.new', e)
+          end
+
+          def instrument_fiber_track
+            @_instrument_fiber_variables ||= begin
+                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+                true
+              end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading fiber track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end