contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/extension/assess/hash.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Hash propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds.
+      class HashPropagator
+        include Contrast::Components::Interface
+        access_component :logging
+        class << self
+          def cs__duplicate_and_freeze object
+            return object unless object.is_a?(String) && !object.cs__frozen?
+            return object unless object.cs__tracked?
+
+            object.dup.cs__freeze
+          rescue StandardError
+            # we'll rescue this error, but we can't log it here as that will
+            # result in a seg fault
+          end
+
+          def instrument_hash_track
+            @_instrument_hash_track ||= begin
+                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
+                                            true
+                                          end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading hash track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/kernel.rb

@@ -0,0 +1,110 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/assess/exec_trigger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This module provides us with a way to invoke Kernel propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Kernel Module or exposing our methods there.
+      module KernelPropagator
+        class << self
+          include Contrast::Components::Interface
+          include Contrast::Extension::Assess::ExecTrigger
+
+          access_component :logging
+
+          # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+          # in, the entire result will be tracked out. We're going to take this
+          # approach for now b/c it's fast and easy. I don't super love it, and by
+          # that I mean I hate it.
+          #
+          # To actually track this, we'd have to find the index of the new things
+          # being added, then remove the tags at the range of the format marker,
+          # which is some arbitrary length thing, and add the new tags from the
+          # inserted string, shifted down by the length of the aforementioned
+          # marker.
+          #
+          # marker is in the format %[flags][width][.precision]type, type being a
+          # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+          #
+          # also, b/c Ruby hates us, there are things called absolute markers,
+          # (digit)$, that go in the flags section. These cannot be mixed w/ the
+          # order assumed type
+          #
+          # oh, and there's also %<name>type and %{name}... b/c of course there is
+          # -HM
+          def sprintf_tagger patcher, preshift, ret, _block
+            format_string = preshift.args[0]
+            args = preshift.args[1]
+
+            track_sprintf(ret, format_string, args)
+
+            ret.cs__properties.build_event(
+                patcher,
+                ret,
+                preshift.object,
+                ret,
+                preshift.args,
+                1)
+            ret
+          end
+
+          def track_sprintf result, format_string, args
+            handle_sprintf_value(format_string, result)
+            if args.is_a?(String)
+              handle_sprintf_value(args, result)
+            elsif args.is_a?(Hash)
+              handle_sprintf_hash(args, result)
+            elsif args.is_a?(Array)
+              handle_sprintf_array args, result
+            end
+
+            result
+          rescue StandardError => e
+            logger.error(
+                'Unable to track dataflow through sprintf', e)
+            result
+          end
+
+          def instrument_kernel_track
+            @_instrument_fiber_variables ||= begin
+                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel track patch', e)
+            false
+          end
+
+          private
+
+          def handle_sprintf_value value, result
+            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+
+            value.cs__properties.events.each do |event|
+              result.cs__properties.events << event
+            end
+            value.cs__splat_tags(result)
+          end
+
+          def handle_sprintf_array args, result
+            args.each do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+
+          def handle_sprintf_hash args, result
+            args.each_value do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/regexp.rb

@@ -0,0 +1,84 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Regexp Class or exposing our methods there.
+      class RegexpPropagator
+        include Contrast::Components::Interface
+
+        access_component :analysis, :logging, :scope
+
+        REGEXP_EQUAL_SQUIGGLE_HASH = {
+            'id' => 'regexp_100',
+            'class_name' => 'Regexp',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => '=~',
+            'action' => 'CUSTOM',
+            'source' => 'P0',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::RegexpPropagator',
+            'patch_method' => 'track_equal_squiggle'
+        }.cs__freeze
+        REGEXP_EQUAL_SQUIGGLE_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
+        private_constant :REGEXP_EQUAL_SQUIGGLE_HASH
+        private_constant :REGEXP_EQUAL_SQUIGGLE_NODE
+
+        class << self
+          def track_equal_squiggle info_hash
+            return unless ASSESS.enabled?
+
+            # Because we have a special case for this propagation,
+            # it falls out of regular scoping. As such, any patch to the `=~` method
+            # that goes through normal channels, like that for the redos rule,
+            # will force this to be in a scope of 1 (instead of the normal 0).
+            # As such, a scope of 1 here indicates that,
+            # so we know that we're in the top level call for this method.
+            # normal patch [-alias-]> special case patch [-alias-]> original method
+            # TODO: RUBY-686
+            return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
+
+            target = info_hash[:back_ref]
+            return unless Contrast::Utils::DuckUtils.trackable?(target)
+
+            with_contrast_scope do
+              result = info_hash[:result]
+              return unless result
+
+              string = info_hash[:string]
+              return unless string
+
+              string.cs__splat_tags(target)
+              target.cs__properties.build_event(
+                  REGEXP_EQUAL_SQUIGGLE_NODE,
+                  target,
+                  self,
+                  result,
+                  [string])
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Regexp#=~', e)
+          end
+
+          def instrument_regexp_track
+            @_instrument_regexp_track ||= begin
+                                               cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading regexp track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/string.rb

@@ -1,16 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
-# litter our code with responds_to? checks.
+# litter our code with Contrast::Utils::DuckUtils.trackable? checks.
 class String
-  include Contrast::CoreExtensions::Assess::AssessExtension
+  include Contrast::Extension::Assess::AssessExtension
 end
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke String propagation for those
       # methods which are too complex to fit into one of the standard
@@ -19,7 +21,7 @@ module Contrast
       class StringPropagator
         include Contrast::Components::Interface
 
-        access_component :analysis, :agent, :logging, :scope
+        access_component :agent, :analysis, :logging, :scope
 
         NODE_HASH = {
             'class_name' => 'String',
@@ -50,6 +52,16 @@ module Contrast
             end
           end
 
+          def instrument_string
+            @_instrument_string ||= begin
+                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
+                                      true
+                                    end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading hash track patch', e)
+            false
+          end
+
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
@@ -57,8 +69,8 @@ module Contrast
                                                       cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
-                                                  rescue StandardError => e
-                                                    logger.error(e, 'Error loading interpolation patch')
+                                                  rescue StandardError, LoadError => e
+                                                    logger.error('Error loading interpolation patch', e)
                                                     false
                                                   end
             end
@@ -69,7 +81,3 @@ module Contrast
     end
   end
 end
-
-cs__scoped_require 'cs__assess_string/cs__assess_string'
-
-Contrast::CoreExtensions::Assess::StringPropagator.instrument_string_interpolation

data/lib/contrast/{extensions/ruby_core → extension}/inventory.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Inventory namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Inventory namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #

data/lib/contrast/extension/kernel.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/scope'
+
+# This is a reasonable place for the Kernel#catch hook to live.
+# No current plans for component re-design, but if we had some kind of
+# "do this when a component is hooked in" thing, this would live there.
+# For now, it's over-engineering to live anywhere else.  -ajm
+module Kernel # :nodoc:
+  alias_method :cs__catch, :catch
+
+  # In the event of a `throw`, we need to override `catch`
+  # to save & restore scope state:
+  #
+  #   scope_level == 0
+  #
+  #   catch(:abc) do
+  #     with_contrast_scope do
+  #       throw :abc # will leak
+  #     end
+  #   end
+  #
+  #   scope_level == 1
+  #
+  # Frankly, this isn't how scope should be used.  This is in place of
+  # proper `ensure` blocks within the instrumentation call stack.
+  # This will actually /create/ scope leaks if you're doing something like:
+  #
+  #   catch(:ohno) do
+  #     enter scope
+  #   end
+  #
+  #   abc()
+  #
+  #   exit scope
+  #
+  # i.e. if you intend to change net scope across a catch block boundary.
+
+  private
+
+  def catch *args, &block
+    # Save current scope level
+    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+
+    # Run original catch with block.
+    retval = cs__catch(*args, &block)
+
+    # Restore scope.
+    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+
+    retval
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Protect namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #

data/lib/contrast/extension/protect/kernel.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Protect
+      # This Module functions as our patch into the Kernel class for Protect,
+      # allowing us to track activity as it crosses spawned processes.
+      module Kernel
+        class << self
+          include Contrast::Components::Interface
+          access_component :contrast_service
+
+          def build_wrapper
+            lambda {
+              proc_start
+              yield
+              # AtExitHook handles sending any messages generated in the new forked process
+            }
+          end
+
+          def proc_start
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless context
+
+            context.reset_activity
+          end
+
+          def instrument
+            @_instrument ||= begin
+                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel protect patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
+  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
   cs__scoped_require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -42,6 +42,38 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
+        def retrieve_request _env
+          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
+        end
+
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like configuration scanning. To accommodate this, this
+        # method provides a place to register those patches for invocation on
+        # Agent load.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        def before_load_patches; end
+
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like routing. To accommodate this, this method provides
+        # a place to register those patches for invocation in our
+        # AfterLoadPatcher flow.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        #
+        # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>,nil]
+        #   those patches required for a Framework which can only be installed
+        #   once a specific module has been loaded.
+        def after_load_patches; end
+
+        # We only support websockets in rails right now, so we won't detect streaming in
+        # any other framework
+        def streaming? _env
+          false
+        end
+
         protected
 
         def source_or_string obj