contrast-agent 3.10.2 → 3.11.0

data/funchook/config.status

@@ -1,4 +1,4 @@
-#! /bin/bash
+#! /bin/sh
 # Generated by configure.
 # Run this file to recreate the current configuration.
 # Compiler output produced by configure, useful for debugging
@@ -8,7 +8,7 @@ debug=false
 ac_cs_recheck=false
 ac_cs_silent=false
 
-SHELL=${CONFIG_SHELL-/bin/bash}
+SHELL=${CONFIG_SHELL-/bin/sh}
 export SHELL
 ## -------------------- ##
 ## M4sh Initialization. ##
@@ -433,7 +433,7 @@ Copyright (C) 2012 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it."
 
-ac_pwd='/opt/atlassian/pipelines/agent/build/funchook'
+ac_pwd='/Users/donaldpropst/Projects/ruby-agent/funchook'
 srcdir='.'
 test -n "$AWK" || AWK=awk
 # The default lists apply if the user does not specify any file.
@@ -512,10 +512,10 @@ if $ac_cs_silent; then
 fi
 
 if $ac_cs_recheck; then
-  set X /bin/bash './configure'  $ac_configure_extra_args --no-create --no-recursion
+  set X /bin/sh './configure'  $ac_configure_extra_args --no-create --no-recursion
   shift
-  $as_echo "running CONFIG_SHELL=/bin/bash $*" >&6
-  CONFIG_SHELL='/bin/bash'
+  $as_echo "running CONFIG_SHELL=/bin/sh $*" >&6
+  CONFIG_SHELL='/bin/sh'
   export CONFIG_SHELL
   exec "$@"
 fi
@@ -604,24 +604,24 @@ echo 'BEGIN {' >"$ac_tmp/subs1.awk" &&
 cat >>"$ac_tmp/subs1.awk" <<\_ACAWK &&
 S["LTLIBOBJS"]=""
 S["LIBOBJS"]=""
-S["IF_OSX"]="#"
-S["IF_LINUX"]=""
+S["IF_OSX"]=""
+S["IF_LINUX"]="#"
 S["IF_WIN32"]="#"
 S["PIC_CFLAGS"]="-fPIC"
 S["LINK_SHARED"]="$(CC) -shared"
-S["LIBFUNCHOOK_SO"]="libfunchook.so"
+S["LIBFUNCHOOK_SO"]="libfunchook.dylib"
 S["FUNCHOOK_OS"]="unix"
 S["FUNCHOOK_CPU"]="x86_64"
-S["host_os"]="linux-gnu"
-S["host_vendor"]="unknown"
+S["host_os"]="darwin18.6.0"
+S["host_vendor"]="apple"
 S["host_cpu"]="x86_64"
-S["host"]="x86_64-unknown-linux-gnu"
-S["build_os"]="linux-gnu"
-S["build_vendor"]="unknown"
+S["host"]="x86_64-apple-darwin18.6.0"
+S["build_os"]="darwin18.6.0"
+S["build_vendor"]="apple"
 S["build_cpu"]="x86_64"
-S["build"]="x86_64-unknown-linux-gnu"
-S["EGREP"]="/bin/grep -E"
-S["GREP"]="/bin/grep"
+S["build"]="x86_64-apple-darwin18.6.0"
+S["EGREP"]="/usr/bin/grep -E"
+S["GREP"]="/usr/bin/grep"
 S["CPP"]="gcc -E"
 S["OBJEXT"]="o"
 S["EXEEXT"]=""
@@ -633,10 +633,10 @@ S["CC"]="gcc"
 S["target_alias"]=""
 S["host_alias"]=""
 S["build_alias"]=""
-S["LIBS"]="-ldl"
+S["LIBS"]=""
 S["ECHO_T"]=""
-S["ECHO_N"]="-n"
-S["ECHO_C"]=""
+S["ECHO_N"]=""
+S["ECHO_C"]="\\c"
 S["DEFS"]="-DHAVE_CONFIG_H"
 S["mandir"]="${datarootdir}/man"
 S["localedir"]="${datarootdir}/locale"
@@ -649,7 +649,6 @@ S["infodir"]="${datarootdir}/info"
 S["docdir"]="${datarootdir}/doc/${PACKAGE_TARNAME}"
 S["oldincludedir"]="/usr/include"
 S["includedir"]="${prefix}/include"
-S["runstatedir"]="${localstatedir}/run"
 S["localstatedir"]="${prefix}/var"
 S["sharedstatedir"]="${prefix}/com"
 S["sysconfdir"]="${prefix}/etc"
@@ -668,7 +667,7 @@ S["PACKAGE_VERSION"]="0.1"
 S["PACKAGE_TARNAME"]="funchook"
 S["PACKAGE_NAME"]="funchook"
 S["PATH_SEPARATOR"]=":"
-S["SHELL"]="/bin/bash"
+S["SHELL"]="/bin/sh"
 _ACAWK
 cat >>"$ac_tmp/subs1.awk" <<_ACAWK &&
   for (key in S) S_is_set[key] = 1
@@ -732,8 +731,8 @@ D["_GNU_SOURCE"]=" 1"
 D["_POSIX_PTHREAD_SEMANTICS"]=" 1"
 D["_TANDEM_SOURCE"]=" 1"
 D["SIZEOF_VOIDP"]=" 8"
-D["HAVE_DECL__SYS_NERR"]=" 1"
-D["HAVE_DECL__SYS_ERRLIST"]=" 1"
+D["HAVE_DECL__SYS_NERR"]=" 0"
+D["HAVE_DECL__SYS_ERRLIST"]=" 0"
 D["HAVE_DECL_SYS_NERR"]=" 1"
 D["HAVE_DECL_SYS_ERRLIST"]=" 1"
   for (key in D) D_is_set[key] = 1

data/funchook/configure

@@ -665,7 +665,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -736,7 +735,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -989,15 +987,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1135,7 +1124,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1288,7 +1277,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]

data/funchook/src/Makefile

@@ -7,11 +7,11 @@ VPATH = $(DISTORM3_DIR)/src:$(top_srcdir)/include
 
 CC = gcc
 CFLAGS = -g -O2 -Wall -fvisibility=hidden -fPIC -g -I. -I$(top_srcdir)/include -I$(DISTORM3_DIR)/include
-LIBS = -ldl
+LIBS = 
 LINK_SHARED = $(CC) -shared
 
 #LIBS += -lpsapi
-#LDFLAGS += -install_name @rpath/libfunchook.dylib
+LDFLAGS += -install_name @rpath/libfunchook.dylib
 
 FUNCHOOK_OBJS = \
 	os_func.o \
@@ -22,8 +22,8 @@ FUNCHOOK_OBJS = \
 	funchook_x86.o \
 	funchook_unix.o
 
-FUNCHOOK_OBJS += funchook_syscall.o
 #FUNCHOOK_OBJS += funchook_syscall.o
+FUNCHOOK_OBJS += funchook_syscall.o
 
 DISTORM3_OBJS = \
 	mnemonics.o \
@@ -43,13 +43,13 @@ HEADERS = \
 
 OBJS = $(FUNCHOOK_OBJS) $(DISTORM3_OBJS)
 
-all: libfunchook.so
+all: libfunchook.dylib
 
 check:
 	cd ../test && $(MAKE) check
 
-libfunchook.so: $(OBJS)
-	$(LINK_SHARED) $(LDFLAGS) -o libfunchook.so $(OBJS) $(LIBS)
+libfunchook.dylib: $(OBJS)
+	$(LINK_SHARED) $(LDFLAGS) -o libfunchook.dylib $(OBJS) $(LIBS)
 
 funchook.o: funchook.c $(HEADERS)
 funchook_linux.o: funchook_linux.c $(HEADERS)
@@ -64,7 +64,7 @@ insts.o: insts.c
 	$(CC) $(CFLAGS) -c -o $@ $< -Wno-missing-braces
 
 clean:
-	$(RM) libfunchook.so $(OBJS)
+	$(RM) libfunchook.dylib $(OBJS)
 
 Makefile config.h: $(srcdir)/Makefile.in $(srcdir)/config.h.in $(top_builddir)/config.status
 	cd $(top_builddir) && ./config.status

data/funchook/src/config.h

@@ -11,11 +11,11 @@
 
 /* Define to 1 if you have the declaration of `_sys_errlist', and to 0 if you
    don't. */
-#define HAVE_DECL__SYS_ERRLIST 1
+#define HAVE_DECL__SYS_ERRLIST 0
 
 /* Define to 1 if you have the declaration of `_sys_nerr', and to 0 if you
    don't. */
-#define HAVE_DECL__SYS_NERR 1
+#define HAVE_DECL__SYS_NERR 0
 
 /* Define to 1 if you have the <inttypes.h> header file. */
 #define HAVE_INTTYPES_H 1

data/funchook/test/Makefile

@@ -14,7 +14,7 @@ DLLTOOL = $(firstword $(CC:gcc=dlltool))
 SO_OBJS = $(srcdir)/libfunchook_test.c $(srcdir)/libfunchook_test2.c
 #LDFLAGS += -Wl,--out-implib,funchook_test.lib
 #FUNCHOOK_TEST_LIB = funchook_test_exe.lib
-#LDFLAGS += -Wl,-undefined,dynamic_lookup
+LDFLAGS += -Wl,-undefined,dynamic_lookup
 
 VPATH = ../src
 
@@ -24,7 +24,7 @@ test: funchook_test$(EXEEXT)
 	# cmp -s $(top_builddir)/src/funchook.dll funchook.dll || cp $(top_builddir)/src/funchook.dll funchook.dll
 	./funchook_test$(EXEEXT)
 
-funchook_test$(EXEEXT): $(OBJS) libfunchook.so libfunchook_test.so
+funchook_test$(EXEEXT): $(OBJS) libfunchook.dylib libfunchook_test.so
 	$(CC) -o funchook_test$(EXEEXT) $(OBJS) $(LIBS)
 
 libfunchook_test.so: $(SO_OBJS) $(FUNCHOOK_TEST_LIB)

data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+	<dict>
+		<key>CFBundleDevelopmentRegion</key>
+		<string>English</string>
+		<key>CFBundleIdentifier</key>
+		<string>com.apple.xcode.dsym.libfunchook_test.so</string>
+		<key>CFBundleInfoDictionaryVersion</key>
+		<string>6.0</string>
+		<key>CFBundlePackageType</key>
+		<string>dSYM</string>
+		<key>CFBundleSignature</key>
+		<string>????</string>
+		<key>CFBundleShortVersionString</key>
+		<string>1.0</string>
+		<key>CFBundleVersion</key>
+		<string>1</string>
+	</dict>
+</plist>

data/lib/contrast.rb

@@ -54,4 +54,5 @@ cs__scoped_require 'contrast/utils/timer'
 cs__scoped_require 'contrast/utils/random_util'
 cs__scoped_require 'contrast/utils/preflight_util'
 
+cs__scoped_require 'contrast/utils/assess/sampling_util'
 cs__scoped_require 'contrast/agent'

data/lib/contrast/agent.rb

@@ -3,11 +3,25 @@
 
 cs__scoped_require 'English'
 
+# Config interface, also cruft around logger interfaces etc.
+# this comes early bc legacy.
+cs__scoped_require 'contrast/agent/feature_state'
+
 # This must precede other Contrast C extensions
 cs__scoped_require 'cs__common/cs__common'
 
+# defining instrumentation, this must precede core extensions
+# because they need to register their patches
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/agent/patching/policy/patch'
+
+# core extensions
+cs__scoped_require 'contrast/extensions/ruby_core/assess'
 cs__scoped_require 'contrast/extensions/ruby_core/delegator'
+cs__scoped_require 'contrast/extensions/ruby_core/inventory'
 cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extensions/ruby_core/protect'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/boolean_util'
@@ -20,20 +34,11 @@ cs__scoped_require 'contrast/common_agent_configuration'
 cs__scoped_require 'contrast/utils/hash_digest'
 cs__scoped_require 'contrast/utils/invalid_configuration_util'
 
-cs__scoped_require 'contrast/utils/cache'
-
 # scoping
 cs__scoped_require 'contrast/agent/scope'
 
 cs__scoped_require 'contrast/utils/thread_tracker'
 
-cs__scoped_require 'contrast/api'
-
-cs__scoped_require 'contrast/utils/resource_loader'
-cs__scoped_require 'contrast/utils/duck_utils'
-cs__scoped_require 'contrast/agent/tracepoint_hook'
-cs__scoped_require 'contrast/agent/at_exit_hook'
-
 # Framework support
 cs__scoped_require 'contrast/framework/manager'
 
@@ -50,16 +55,17 @@ module Contrast
   end
 end
 
-# keep tracker of logger updates
-cs__scoped_require 'contrast/agent/logger_manager'
+cs__scoped_require 'contrast/api'
+
+cs__scoped_require 'contrast/utils/resource_loader'
+cs__scoped_require 'contrast/utils/duck_utils'
+cs__scoped_require 'contrast/agent/tracepoint_hook'
+cs__scoped_require 'contrast/agent/at_exit_hook'
 
 # communication with contrast service
 cs__scoped_require 'contrast/agent/exclusion_matcher'
 cs__scoped_require 'contrast/agent/socket_client'
 
-# config interface
-cs__scoped_require 'contrast/agent/feature_state'
-
 # threads that handle contrast scope
 cs__scoped_require 'contrast/agent/thread'
 
@@ -72,7 +78,7 @@ cs__scoped_require 'contrast/agent/assess'
 # These happen regardless of analysis mode, & should be lightweight.
 cs__scoped_require 'contrast/utils/rack_assess_session_cookie'
 cs__scoped_require 'contrast/utils/rails_assess_configuration'
-# Also: should document the necessity of patching this ASAP.
+
 # In Rails, session configuration occurs extremely early & only once.
 # If we defer our patching of the rails session configuration too long
 # (i.e., where we normally patch) we will miss the configuration

data/lib/contrast/agent/assess.rb

@@ -36,9 +36,8 @@ module Contrast
       # reporting / tracking
       cs__scoped_require 'contrast/agent/assess/insulator'
       cs__scoped_require 'contrast/agent/assess/properties'
-      cs__scoped_require 'contrast/agent/assess/frozen_properties'
       cs__scoped_require 'contrast/agent/assess/tag'
-      cs__scoped_require 'contrast/agent/assess/contrast_event'
+      cs__scoped_require 'contrast/agent/assess/events/event_factory'
     end
   end
 end

data/lib/contrast/agent/assess/adjusted_span.rb

@@ -14,7 +14,9 @@ module Contrast
       # Note: Unlike ranges, it is assumed that the stop
       # value is exclusive, not inclusive. [start, end)
       class AdjustedSpan
-        attr_accessor :start, :stop
+        attr_accessor :stop
+        attr_reader :start
+
         def initialize start = nil, stop = nil
           @start = start if start
           @stop = stop if stop

data/lib/contrast/agent/assess/contrast_event.rb

@@ -1,8 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/utils/assess/tracking_util'
 cs__scoped_require 'contrast/utils/class_util'
+cs__scoped_require 'contrast/utils/duck_utils'
+cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/prevent_serialization'
+cs__scoped_require 'contrast/utils/stack_trace_utils'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -53,8 +59,7 @@ module Contrast
           end
         end
 
-        attr_accessor :source_name
-        attr_reader :event_id, :source_type, :parent_ids
+        attr_reader :event_id, :parent_ids
 
         # We need this to track the parent id's of events to build up a flow
         # chart of the finding
@@ -69,13 +74,13 @@ module Contrast
           end
         end
 
-        def initialize policy_node, tagged, object, ret, args, invoked = 0, source_type = nil, source_name = nil
-          @caller = caller_locations(get_call_start(policy_node, invoked), 10)
+        def initialize policy_node, tagged, object, ret, args
           @policy_node = policy_node
+          # so long as this event is built in a factory, we know Contrast Code
+          # will be the first three events
+          @caller = caller(3, 20)
           @time = Contrast::Utils::Timer.now_ms
           @thread = Thread.current.object_id
-          @source_type = source_type
-          @source_name = source_name
 
           # These methods rely on the above being set. Don't move them!
           @event_id = Contrast::Agent::Assess::ContrastEvent.next_atomic_id
@@ -86,8 +91,6 @@ module Contrast
         # Parent IDs are the event ids of all the sources of this event which
         # were tracked prior to this event occurring
         def find_parent_ids policy_node, object, ret, args
-          return if policy_node.is_a?(Contrast::Agent::Assess::Policy::SourceNode)
-
           mapped = policy_node.sources.map do |source|
             value_of_source(source, object, ret, args)
           end
@@ -137,6 +140,8 @@ module Contrast
         # one w/ a dup, but good enough for now. Trying not to make this too
         # complicated. - HM 8/8/19
         def save_target_arg target, tagged
+          return if @args.cs__frozen?
+
           if target.is_a?(Integer)
             @args[target] = cs__class.safe_dup(tagged)
             return
@@ -172,27 +177,6 @@ module Contrast
           end
         end
 
-        # each policy_node has a certain number of levels down it calls
-        # before getting here. since we know them, we can skip
-        # right to the part of the stack we care about.
-        #
-        # Note: if our callstack changes, this number has to change
-        def get_call_start policy_node, invoked
-          # TODO: RUBY-440 audit these numbers to get stacktraces to render
-          #   properly
-          base = case policy_node
-                 when Contrast::Agent::Assess::Policy::SourceNode
-                   6
-                 when Contrast::Agent::Assess::Policy::PropagationNode
-                   7
-                 when Contrast::Agent::Assess::Policy::TriggerNode
-                   7
-                 else
-                   2
-                 end
-          base + invoked
-        end
-
         # Convert this event into a DTM that TeamServer can consume
         def to_dtm_event
           event = Contrast::Api::Dtm::TraceEvent.new
@@ -220,20 +204,11 @@ module Contrast
           end
 
           # We delayed doing this as long as possible b/c it's expensive
-          stack = Contrast::Utils::StackTraceUtils.to_dtm_stack(
-              stack_locations: @caller,
-              rasp_element: false)
-          stack.each do |frame|
-            event.stack << frame
-          end
-
-          event.field_name = Contrast::Utils::StringUtils.force_utf8(source_name)
-
-          event_source_dtm = build_event_source_dtm
-          event.event_sources << event_source_dtm if event_source_dtm
+          stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(@caller)
+          event.stack += stack
 
           event.object_id = event_id.to_i
-          @parent_ids&.each do |id|
+          parent_ids&.each do |id|
             parent = Contrast::Api::Dtm::ParentObjectId.new
             parent.id = id.to_i
             event.parent_object_ids << parent
@@ -245,27 +220,6 @@ module Contrast
           event
         end
 
-        def forced_source_type
-          @_forced_source_type ||= Contrast::Utils::StringUtils.force_utf8(source_type)
-        end
-
-        def forced_source_name
-          @_forced_source_name ||= Contrast::Utils::StringUtils.force_utf8(source_name)
-        end
-
-        # Probably only for source events, but we'll go
-        # with source_type instead. java & .net support source_type
-        # in propagation events, so we'll future proof this
-        def build_event_source_dtm
-          # You can have a source w/o a name, but not w/o a type
-          return unless source_type
-
-          dtm = Contrast::Api::Dtm::TraceEventSource.new
-          dtm.type = forced_source_type
-          dtm.name = forced_source_name
-          dtm
-        end
-
         # We're not going to build the signature string here, b/c we have all
         # the composite pieces of it. Instead, we're going to let TeamServer
         # render this for us.