contrast-agent 3.10.1 → 3.12.2

data/ext/cs__assess_kernel/cs__assess_kernel.h

@@ -2,6 +2,7 @@
 
 static VALUE exec_apply_trigger;
 static VALUE kernel_propagator;
+static VALUE rb_sym_assess_kernel_exec;
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,

data/ext/cs__assess_kernel/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -38,10 +38,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 void Init_cs__assess_marshal_module(void) {
     rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
 
-    marshal_module = rb_define_module("Marshal");
-
-    VALUE contrast_marshal = rb_define_module("MarshalWithContrastAssess");
-    rb_define_method(contrast_marshal, "load",
-                     contrast_assess_marshal_module_load, -1);
-    rb_prepend_module(rb_singleton_class(marshal_module), contrast_marshal);
+    contrast_register_singleton_prepend_patch("Marshal",
+                                              "load",
+                                              &contrast_assess_marshal_module_load);
 }

data/ext/cs__assess_marshal_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_module/cs__assess_module.c

@@ -6,8 +6,6 @@
 #include <ruby.h>
 
 void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
-    VALUE has_trigger_check = rb_respond_to(module, trigger_check_method);
-
     if (RTEST(
             rb_funcall(contrast_patcher(), rb_sym_skip_contrast_analysis, 0))) {
         return;
@@ -18,12 +16,12 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
 
     rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
 
-    if (!nested_scope && has_trigger_check) {
+    if (!nested_scope) {
         VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module, trigger_check_method, 3, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
     }
 
     rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -59,19 +57,23 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_module(void) {
-    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
-
-    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
-
+    module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     trigger_check_method = rb_intern("eval_trigger_check");
 
-    contrast_alias_method(rb_cModule, "cs__patched_class_eval", "class_eval");
+    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
 
-    rb_define_method(rb_cModule, "class_eval",
-                     contrast_assess_module_class_eval, -1);
+    /* Returns of these 2 patches are discarded.
+     * We're calling the underlying via direct C, instead of
+     * whatever method was there before.
+     * See similar comments in basic_object C ext patch.
+     */
 
-    contrast_alias_method(rb_cModule, "cs__patched_module_eval", "module_eval");
+    contrast_register_patch("Module",
+                            "class_eval",
+                            contrast_assess_module_class_eval);
 
-    rb_define_method(rb_cModule, "module_eval",
-                     contrast_assess_module_module_eval, -1);
+    contrast_register_patch("Module",
+                            "module_eval",
+                            contrast_assess_module_module_eval);
 }

data/ext/cs__assess_module/cs__assess_module.h

@@ -4,6 +4,9 @@
 static VALUE assess_patcher;
 
 static VALUE rb_sym_assess_patch_eval;
+
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE module_eval_trigger;
 static VALUE trigger_check_method;
 
 /* c.f. cs__assess_basic_object.c for more context on how eval is patched. */

data/ext/cs__assess_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -2,6 +2,7 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_regexp.h"
+#include "../cs__common/cs__common.h"
 #include <ruby.h>
 
 void contrast_alias_method(const VALUE target, const char *to,
@@ -21,17 +22,21 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
         rb_hash_aset(infohash, rb_sym_result, result);
         rb_hash_aset(infohash, rb_sym_string, argv[0]);
         rb_hash_aset(infohash, rb_sym_back_ref, rb_backref_get());
-        rb_funcall(regexp, rb_sym_assess_track_regexp, 1, infohash);
+        rb_funcall(regexp_propagator, rb_sym_assess_track_regexp, 1, infohash);
     }
 
     return result;
 }
 
 void Init_cs__assess_regexp(void) {
-    rb_sym_assess_regexp_equal_squiggle =
-        rb_intern("cs__patched_equal_squiggle");
-    rb_sym_assess_track_regexp = rb_intern("cs__regexp_tagger");
-
+    regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
+    rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
+
+    /* These are the keys we use to define our hash of
+     * Regexp info.  rb_global_variable doesn't make
+     * them global in the $global sense, but marks them
+     * so they don't get swept by the GC.
+     */
     rb_sym_result = ID2SYM(rb_intern("result"));
     rb_global_variable(&rb_sym_result);
     rb_sym_regexp = ID2SYM(rb_intern("regexp"));
@@ -41,8 +46,7 @@ void Init_cs__assess_regexp(void) {
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
 
-    VALUE regexp_class = rb_define_class("Regexp", rb_cObject);
-    contrast_alias_method(regexp_class, "cs__patched_equal_squiggle", "=~");
-    rb_define_method(regexp_class, "=~", contrast_assess_regexp_equal_squiggle,
-                     -1);
+    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
+                                                                  "=~",
+                                                                  contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -6,6 +6,7 @@ static VALUE rb_sym_string;
 static VALUE rb_sym_back_ref;
 static VALUE rb_sym_assess_regexp_equal_squiggle;
 static VALUE rb_sym_assess_track_regexp;
+static VALUE regexp_propagator;
 
 /*
  * argc - number of arguments

data/ext/cs__assess_regexp/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string/cs__assess_string.c

@@ -5,7 +5,8 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_string_uminus(const VALUE obj) {
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj) {
     VALUE dup, tracked;
     if (!OBJ_FROZEN(obj)) {
         tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -25,14 +26,10 @@ static VALUE contrast_assess_string_uminus(const VALUE obj) {
 }
 
 void Init_cs__assess_string(void) {
-    VALUE string_class;
-
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
-    rb_sym_assess_string_uminus = rb_intern("cs__patched_minus_at");
 
-    string_class = rb_define_class("String", rb_cObject);
-    /* -@ */
-    contrast_alias_method(string_class, "cs__patched_minus_at", "-@");
-    rb_define_method(string_class, "-@", contrast_assess_string_uminus, 0);
+    rb_sym_assess_string_uminus = contrast_register_patch("String",
+                                                          "-@",
+                                                          &contrast_assess_string_uminus);
 }

data/ext/cs__assess_string/cs__assess_string.h

@@ -14,6 +14,7 @@ static VALUE rb_sym_freeze;
  * String#freeze, which will leave our properties alone.
  * -HM
  */
-static VALUE contrast_assess_string_uminus(const VALUE obj);
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj);
 
 void Init_cs__assess_string(void);

data/ext/cs__assess_string/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c

@@ -9,7 +9,7 @@
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
     VALUE result = rb_str_concat_literals_original(num, strary);
     VALUE rb_params = rb_ary_new_from_values((int)num, strary);
-    rb_funcall(string_class, track_interpolation, 2, rb_params, result);
+    rb_funcall(string_propagator, track_interpolation, 2, rb_params, result);
     return result;
 }
 
@@ -25,7 +25,7 @@ static int install_hooks() {
 }
 
 void Init_cs__assess_string_interpolation26(void) {
-    string_class = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
+    string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
     track_interpolation = rb_intern("track_interpolation");
     install_hooks();
 }

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h

@@ -1,10 +1,10 @@
 #include <ruby.h>
 
-static VALUE string_class;
+static VALUE string_propagator;
 static VALUE track_interpolation;
 
-void *rb_str_concat_literals(size_t num, const VALUE *strary);
-void *(*rb_str_concat_literals_original)(size_t, const VALUE *);
+VALUE *rb_str_concat_literals(size_t num, const VALUE *strary);
+VALUE (*rb_str_concat_literals_original)(size_t, const VALUE *);
 
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary);
 

data/ext/cs__assess_string_interpolation26/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_yield_track/cs__assess_yield_track.h

@@ -4,7 +4,7 @@
 static VALUE split_class;
 static VALUE propagate_yield, split_method;
 
-static VALUE *(*rb_yield_original)(VALUE val);
+static VALUE (*rb_yield_original)(VALUE val);
 static VALUE rb_yield_hook(VALUE val, const VALUE self);
 
 static int install_yield_hooks();

data/ext/cs__assess_yield_track/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__common/cs__common.c

@@ -29,6 +29,79 @@ VALUE contrast_patcher() {
     return patcher;
 }
 
+VALUE contrast_register_patch(const char *module_name,
+                               const char *method_name,
+                               VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                               ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
+}
+
+
+VALUE contrast_register_singleton_patch(const char *module_name,
+                                        const char *method_name,
+                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                        ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
+}
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                                ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
+}
+
+static VALUE _contrast_register_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
+                                      patch_impl patch
+                                      ) {
+    VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
+    VALUE unbound_method = Qnil;
+    VALUE rb_str_module_name = rb_str_new_cstr(module_name);
+    VALUE rb_str_method_name = rb_str_new_cstr(method_name);
+
+    /* We register the c function as an instance method on an
+     * anonymous module, and then unbind it.  This creates
+     * an UnboundMethod object that we register.  This
+     * UnboundMethod object can then be bound to a class
+     * with define_method:
+     *
+     * my_method = get_patch_from_c_somehow()
+     *
+     * class MyClass
+     *   define_method('name', my_method.bind(self))
+     * end
+     *
+     * MyClass.new.name # calls my_method
+     */
+    /* This is an anonymous module, upon which we define C functions
+     * as Ruby functions.  We immediately unbind and undef them.
+     * This module doesn't do anything.
+     */
+    rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
+    VALUE rb_sym_instance_method = rb_intern("instance_method");
+    unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
+    rb_undef_method(contrast_bind_module, method_name);
+
+    /* map impl enum -> ruby symbol */
+    VALUE impl = Qnil;
+    switch(patch) {
+      case IMPL_ALIAS_INSTANCE:
+        impl = ID2SYM(rb_sym_alias_instance);
+        break;
+      case IMPL_ALIAS_SINGLETON:
+        impl = ID2SYM(rb_sym_alias_singleton);
+        break;
+      case IMPL_PREPEND:
+        impl = ID2SYM(rb_sym_prepend);
+        break;
+    }
+
+    VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
+    return SYM2ID(underlying_method_name);
+}
+
 void Init_cs__common(void) {
     cs__send_method = rb_intern("send");
     cs__alias_method_sym = ID2SYM(rb_intern("alias_method"));
@@ -42,6 +115,12 @@ void Init_cs__common(void) {
     rb_sym_method = rb_intern("__method__");
     rb_sym_cs_tracked = rb_intern("cs__tracked?");
 
+    /* Used for returning unbound C functions */
+    rb_sym_register_c_patch = rb_intern("register_c_patch");
+    rb_sym_alias_instance   = rb_intern("alias_instance");
+    rb_sym_alias_singleton  = rb_intern("alias_singleton");
+    rb_sym_prepend          = rb_intern("prepend");
+
     /* Ensure definition of core Contrast instrumentation modules */
     contrast = rb_define_module("Contrast");
     agent = rb_define_module_under(contrast, "Agent");
@@ -55,6 +134,6 @@ void Init_cs__common(void) {
     assess_policy = rb_define_module_under(assess, "Policy");
     assess_propagator = rb_define_module_under(assess_policy, "Propagator");
 
-    core_extensions = rb_define_module_under(contrast, "CoreExtensions");
+    core_extensions = rb_define_module_under(contrast, "Extension");
     core_assess = rb_define_module_under(core_extensions, "Assess");
 }

data/ext/cs__common/cs__common.h

@@ -3,6 +3,13 @@
 
 #include <ruby.h>
 
+typedef enum {
+  IMPL_ALIAS_INSTANCE,
+  IMPL_ALIAS_SINGLETON,
+  IMPL_PREPEND
+} patch_impl;
+
+
 static VALUE cs__send_method;
 static VALUE cs__alias_method_sym;
 
@@ -19,10 +26,37 @@ extern VALUE rb_sym_method;
 extern VALUE rb_sym_cs_tracked;
 
 static VALUE patcher;
+static VALUE rb_sym_instance_method;
+static VALUE rb_sym_register_c_patch;
+static VALUE rb_sym_alias_instance;
+static VALUE rb_sym_alias_singleton;
+static VALUE rb_sym_prepend;
 
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 
+VALUE contrast_register_patch(const char *module_name,
+                              const char *method_name,
+                              VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                              );
+
+VALUE contrast_register_singleton_patch(const char *module_name,
+                                        const char *method_name,
+                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                        );
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                                );
+
+static VALUE _contrast_register_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
+                                      patch_impl patch_impl
+                                      );
+
+
 VALUE contrast_patcher();
 
 void Init_cs__common(void);

data/ext/cs__common/extconf.rb

@@ -1,19 +1,20 @@
-require 'mkmf'
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
 
+require 'mkmf'
 require_relative '../../lib/contrast/agent/version'
+
 installed_path = __dir__
 
-origin =  if (darwin = !(/darwin/ =~ RUBY_PLATFORM).nil?)
-            "@loader_path"
+origin =  if !(/darwin/ =~ RUBY_PLATFORM).nil?
+            '@loader_path'
           else
-            "\\$${ORIGIN}"
+            '\$${ORIGIN}'
           end
 
-options = " -Wl,-rpath,#{origin}/../../shared_libraries"
+options = " -Wl,-rpath,#{ origin }/../../shared_libraries"
 
-if try_link('int main() {return 0;}', options)
-  $LDFLAGS << options
-end
+$LDFLAGS << options if try_link('int main() {return 0;}', options)
 
 $LIBPATH << installed_path