contrast-agent 3.10.2 → 3.11.0

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -12,9 +12,6 @@ module Contrast
           # in a 'get it work' state. hopefully, we'll be in
           # a 'get it right' state soon.
           class Select
-            include Contrast::Components::Interface
-            access_component :logging
-
             class << self
               def select_tagger patcher, preshift, ret, _block
                 source = preshift.object
@@ -49,32 +46,48 @@ module Contrast
 
               private
 
+              def handle_integer args, arg, source
+                length = args[1] || 1
+                # (void) negative range
+                arg += source.length if arg.negative?
+                Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+              end
+
+              def handle_string arg, source
+                idx = source.index(arg)
+                Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+              end
+
+              def handle_regexp args, arg, source
+                match_data = arg.match(source)
+                # nil has the same meaning as 0. use full match
+                group = args[1] || 0
+                Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+              end
+
+              def handle_range arg, source
+                start = arg.begin
+                finish = arg.end
+
+                # (void) negative range
+                start += source.length if start.negative?
+                finish += source.length if finish.negative?
+                finish += 1 unless arg.exclude_end?
+
+                Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+              end
+
               def determine_select_range source, args
                 arg = args[0]
                 case arg
                 when Integer
-                  length = args[1] || 1
-                  # (void) negative range
-                  arg += source.length if arg.negative?
-                  Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+                  handle_integer(args, arg, source)
                 when String
-                  idx = source.index(arg)
-                  Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+                  handle_string(arg, source)
                 when Regexp
-                  match_data = arg.match(source)
-                  # nil has the same meaning as 0. use full match
-                  group = args[1] || 0
-                  Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+                  handle_regexp(args, arg, source)
                 when Range
-                  start = arg.begin
-                  finish = arg.end
-
-                  # (void) negative range
-                  start += source.length if start.negative?
-                  finish += source.length if finish.negative?
-                  finish += 1 unless arg.exclude_end?
-
-                  Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+                  handle_range(arg, source)
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -19,8 +19,25 @@ module Contrast
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
             class << self
+              # Propagate taint from a source as it is split into composite
+              # sections. This method MUST return nil, otherwise it risks
+              # changing the result of of the propagation.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              #   the node that governs this propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+              #   of the state of the code just prior to the invocation of the
+              #   patched method.
+              # @param target [Array, String] the target to which to propagate.
+              # @return [nil]
               def propagate propagation_node, preshift, target
-                return Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target) unless target.is_a?(Array)
+                logger.trace('Propagation detected',
+                             node_id: propagation_node.id,
+                             target_id: target.__id__)
+                unless target.is_a?(Array)
+                  Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target)
+                  return
+                end
 
                 source = find_source(propagation_node.sources[0], preshift)
 
@@ -49,6 +66,7 @@ module Contrast
                   elem.cs__properties.add_properties(propagation_node.properties)
                   current_index = current_index + elem_length + separator_length
                 end
+                nil
               end
 
               # Marks the point in which the String#split method is called.
@@ -66,7 +84,7 @@ module Contrast
               rescue Exception => e # rubocop:disable Lint/RescueException
                 # don't let our errors propagate and disable String#split for
                 # this since we're in an error state
-                logger.warn(e, 'Unable to record split context')
+                logger.warn('Unable to record split context', e)
                 end_split
               end
 
@@ -86,7 +104,7 @@ module Contrast
                   SPLIT_TRACKER.set(:split_depth, depth)
                 end
               rescue StandardError => e
-                logger.warn(e, 'Unable to remove split context')
+                logger.warn('Unable to remove split context', e)
               end
 
               # This method is called whenever an rb_yield is called. We need
@@ -96,6 +114,8 @@ module Contrast
               # @param target [String] the entity being passed to the yield
               #   block
               def propagate_yield target
+                depth, index = nil
+
                 depth = SPLIT_TRACKER.get(:split_depth)
                 return unless depth
 
@@ -108,9 +128,9 @@ module Contrast
                 true_source = source[index]
                 target.cs__copy_from(true_source)
               rescue StandardError => e
-                logger.warn(e, 'Unable to track within split context')
+                logger.warn('Unable to track within split context', e)
               ensure
-                if defined?(depth) && defined?(index) && depth && index
+                if depth && index
                   idx = SPLIT_TRACKER.get(:split_index)
                   idx[depth] = index + 1 if defined?(idx) && idx.is_a?(Array)
                 end
@@ -122,7 +142,7 @@ module Contrast
                                                 cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield?
                                                 true
                                               rescue StandardError => e
-                                                logger.error(e, 'Error loading split rb_yield patch')
+                                                logger.error('Error loading split rb_yield patch', e)
                                                 false
                                               end
                 end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Agent
     module Assess

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -23,36 +23,17 @@ module Contrast
 
           class << self
             def rewrite_interpolations
-              return unless ASSESS.enabled?
-              return unless AGENT.rewrite_interpolation?
+              return unless agent_should_rewrite?
 
-              logger.debug_with_time("\t\tRunning Assess interpolation rewrite") do
+              logger.debug_with_time('Running Assess interpolation rewrite') do
                 ObjectSpace.each_object(Module) do |mod|
                   rewrite_interpolation(mod)
                 end
               end
             end
 
-            # Rails is being a jerk, again. It passes in a class before it is
-            # done being defined. There is a state where the files have been
-            # loaded, but the class definition is not complete, so the
-            # methods of the class are not defined despite the class existing
-            #
-            # To get around this, we have those methods tell us the class
-            # isn't ready
-            def mid_defining? mod
-              mod.instance_variable_defined?(:@cs__defining_class) &&
-                  mod.instance_variable_get(:@cs__defining_class)
-            end
-
             def rewrite_interpolation mod, redo_rewrite = false
-              return unless ASSESS.enabled?
-              return unless AGENT.rewrite_interpolation?
-              return unless AGENT.interpolation_enabled?
-              return if AGENT.skip_instrumentation? mod.cs__name
-              return if mod.cs__frozen?
-              return if mod.singleton_class?
-              return if mid_defining?(mod)
+              return unless should_rewrite?(mod)
 
               status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
               return if (status&.rewritten? || status&.rewriting?) && !redo_rewrite
@@ -66,13 +47,43 @@ module Contrast
 
               end
               module_data = Contrast::Agent::ModuleData.new(mod, module_name)
-              logger.debug_with_time("\t\t\tRewriting #{ module_name }") do
+              logger.trace_with_time('Rewriting module', module: module_name) do
                 Contrast::Agent::Rewriter.rewrite_class(module_data, redo_rewrite)
               end
             rescue StandardError => e
-              logger.error(
-                  e,
-                  "Unable to patch assess into the module #{ mod }")
+              logger.error('Unable to patch for assess', e, module: mod)
+            end
+
+            private
+
+            # Rails is being a jerk, again. It passes in a class before it is
+            # done being defined. There is a state where the files have been
+            # loaded, but the class definition is not complete, so the
+            # methods of the class are not defined despite the class existing
+            #
+            # To get around this, we have those methods tell us the class
+            # isn't ready
+            def mid_defining? mod
+              mod.instance_variable_defined?(:@cs__defining_class) &&
+                  mod.instance_variable_get(:@cs__defining_class)
+            end
+
+            def agent_should_rewrite?
+              return false unless ASSESS.enabled?
+              return false unless AGENT.rewrite_interpolation?
+              return false unless AGENT.interpolation_enabled?
+
+              true
+            end
+
+            def should_rewrite? mod
+              return false unless agent_should_rewrite?
+              return false if AGENT.skip_instrumentation? mod.cs__name
+              return false if mod.cs__frozen?
+              return false if mod.singleton_class?
+              return false if mid_defining?(mod)
+
+              true
             end
           end
         end

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -82,8 +82,7 @@ module Contrast
                 target = ret
               end
 
-              invoked = 3 # apply_post_patch => apply_assess => source_patchers
-              apply_source(current_context, source_node, target, object, ret, source_node.type, nil, invoked, *args)
+              apply_source(current_context, source_node, target, object, ret, source_node.type, nil, *args)
 
               ret.cs__freeze if restore_frozen_state
               ret
@@ -106,37 +105,31 @@ module Contrast
             # @param source_name [String, nil] the name of this source, i.e.
             #   the key used to accessed if from a map or nil if a type like
             #   BODY
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, invoked = 0, *args
+            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
               return unless context && source_node && target
 
               source_name ||= determine_source_name(source_node, object, ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-                apply_tags(source_node, target, object, ret, source_type, source_name, invoked, *args)
+                apply_tags(source_node, target, object, ret, source_type, source_name, *args)
                 # While we don't taint hashes themselves, we may taint the things
                 # they hold. Let's pass their keys and values back to ourselves and
                 # try again
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                source_key_type = invoked.zero? ? key_type(source_type) : source_type
-                invoked += 1
                 to_replace = []
                 target.each_pair do |key, value|
                   # We only do this for Strings b/c of the way Hash lookup works.
                   # To replace another object would break hash lookup and,
                   # therefore, the application
-                  if ASSESS.track_frozen_sources? &&
-                        key.is_a?(String) &&
-                        Contrast::Utils::DuckUtils.quacks_to?(target, :delete)
+                  if can_track_hash_key?(key, target)
                     key = Contrast::Utils::FreezeUtil.unfreeze_dup(key)
                     to_replace << key
                   end
-                  apply_source(context, source_node, key, object, ret, source_key_type, key, invoked, *args)
-                  apply_source(context, source_node, value, object, ret, source_type, key, invoked, *args)
+                  apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
+                  apply_source(context, source_node, value, object, ret, source_type, key, *args)
                 end
 
                 # Hash is designed to keep one instance of the string key in it.
@@ -152,19 +145,23 @@ module Contrast
                 # they hold. Let's pass their keys and values back to ourselves and
                 # try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                invoked += 1
-                target.each { |value| apply_source(context, source_node, value, object, ret, source_type, source_name, invoked, *args) }
+                target.each { |value| apply_source(context, source_node, value, object, ret, source_type, source_name, *args) }
               end
             rescue StandardError => e
-              logger.warn(e, "Unable to apply source for source_node #{ source_node.id }")
+              logger.warn('Unable to apply source', e, node_id: source_node.id)
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, invoked, *args
+            def can_track_hash_key? key, target
+              ASSESS.track_frozen_sources? &&
+                  key.is_a?(String) &&
+                  Contrast::Utils::DuckUtils.quacks_to?(target, :delete)
+            end
+
+            def apply_tags source_node, target, object, ret, source_type, source_name, *args
               # don't apply second source -- probably needs tuning later if we
               # use more than 'UNTRUSTED' in our sources
               return if target.cs__tracked? || target.cs__frozen?
 
-              invoked += 1
               # otherwise for each tag this source_node applies, create a tag range
               # on the target object
               # I realize this looping is counter-intuitive from the above
@@ -175,11 +172,14 @@ module Contrast
                 length = Contrast::Utils::StringUtils.ret_length(target)
                 target.cs__properties.add_tag(tag, Contrast::Agent::Assess::AdjustedSpan.new(0, length))
                 target.cs__properties.add_properties(source_node.properties)
-                logger.debug(nil, "Source #{ source_node.id } detected: #{ target.__id__ } tagged with #{ tag }")
+                logger.trace('Source detected',
+                             node_id: source_node.id,
+                             target_id: target.__id__,
+                             tag: tag)
               end
 
               # make a representation of this method that TeamServer can render
-              target.cs__properties.build_event(source_node, target, object, ret, args, invoked, source_type, source_name)
+              target.cs__properties.build_event(source_node, target, object, ret, args, source_type, source_name)
             end
 
             # Find the name of the source

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -13,22 +13,7 @@ module Contrast
         class SourceNode < PolicyNode
           attr_accessor :type
 
-          DB_SOURCE_TYPE = 'TAINTED_DATABASE'
-          def self.build_dynamic_source _id, dynamic_source
-            dynamic_source_hash = {
-                JSON_CLASS_NAME => dynamic_source.class_name,
-                JSON_METHOD_NAME => dynamic_source.method_name,
-                JSON_INSTANCE_METHOD => dynamic_source.instance_method,
-                JSON_TYPE => DB_SOURCE_TYPE,
-                JSON_METHOD_VISIBILITY => 'public',
-                JSON_TARGET => dynamic_source.target,
-                JSON_PROPERTIES => dynamic_source.properties
-            }
-            Contrast::Agent::Assess::Policy::SourceNode.new(dynamic_source_hash)
-          end
-
           JSON_TYPE = 'type'
-          JSON_SOURCE_NAME = 'source_name'
           SOURCE_TAG = 'UNTRUSTED'
           def initialize source_hash = {}
             super(source_hash)

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -3,8 +3,8 @@
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/sha256_builder'
+cs__scoped_require 'contrast/agent/assess/events/event_factory'
 cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
-
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
@@ -18,7 +18,7 @@ module Contrast
         # it was not, a Finding report is issued to the Service
         module TriggerMethod
           include Contrast::Components::Interface
-          access_component :logging, :analysis
+          access_component :analysis, :logging
 
           # The level of TeamServer compliance our traces meet
           CURRENT_FINDING_VERSION = 2
@@ -47,7 +47,6 @@ module Contrast
                                 source,
                                 object,
                                 ret,
-                                1,
                                 *args)
                 end
               else
@@ -56,13 +55,12 @@ module Contrast
                               nil,
                               object,
                               ret,
-                              1,
                               *args)
               end
             end
 
-            def apply_eval_trigger context, trigger_node, source, object, ret, invoked, *args
-              apply_trigger(context, trigger_node, source, object, ret, invoked, *args)
+            def apply_eval_trigger context, trigger_node, source, object, ret, *args
+              apply_trigger(context, trigger_node, source, object, ret, *args)
             end
 
             # This converts the source of the finding, and the events leading
@@ -75,14 +73,12 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
             # @return [Contrast::Api::Dtm::Finding, nil] the
             #   Contrast::Api::Dtm::Finding to send to TeamServer or nil if
             #   conditions were not met
-            def build_finding context, trigger_node, source, object, ret, invoked, *args
+            def build_finding context, trigger_node, source, object, ret, *args
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
               request = context.request
@@ -97,15 +93,18 @@ module Contrast
               finding.version = CURRENT_FINDING_VERSION
 
               build_from_source(finding, source)
-              trigger_event = Contrast::Agent::Assess::ContrastEvent.new(trigger_node, source, object, ret, args, invoked + 1).to_dtm_event
+              trigger_event = Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret, args).to_dtm_event
               finding.events << trigger_event
               build_hash(finding, source)
               build_tags(context)
               finding.routes << context.route if context.route
               context.activity.findings << finding
-              logger.debug(nil, "Trigger #{ trigger_node.id } detected: #{ source.__id__ } triggered #{ trigger_node.rule_id }")
+              logger.trace('Finding created',
+                           node_id: trigger_node.id,
+                           source_id: source.__id__,
+                           rule: trigger_node.rule_id)
             rescue StandardError => e
-              logger.error(e, "Unable to build a finding for #{ trigger_node.id }")
+              logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
 
             private
@@ -124,27 +123,24 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_trigger context, trigger_node, source, object, ret, invoked, *args
+            def apply_trigger context, trigger_node, source, object, ret, *args
               return unless context && trigger_node
               return if trigger_node.rule_disabled?
               return if trigger_node.dataflow? && source.nil?
 
-              invoked += 1
               if trigger_node.regexp_rule?
-                apply_regexp_rule(context, trigger_node, source, object, ret, invoked, *args)
+                apply_regexp_rule(context, trigger_node, source, object, ret, *args)
               elsif trigger_node.custom_trigger?
-                trigger_node.apply_custom_trigger(context, trigger_node, source, object, ret, invoked, *args)
+                trigger_node.apply_custom_trigger(context, trigger_node, source, object, ret, *args)
               elsif trigger_node.dataflow?
-                apply_dataflow_rule(context, trigger_node, source, object, ret, invoked, *args)
+                apply_dataflow_rule(context, trigger_node, source, object, ret, *args)
               else # trigger rule - just calling the method is dangerous
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
+                build_finding(context, trigger_node, source, object, ret, *args)
               end
             rescue StandardError => e
-              logger.warn(e, 'Unable to apply trigger.')
+              logger.warn('Unable to apply trigger', e, node_id: trigger_ndoe.id)
             end
 
             # Given the marker from the trigger_node (the pointer indicating
@@ -196,17 +192,14 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_regexp_rule context, trigger_node, source, object, ret, invoked, *args
+            def apply_regexp_rule context, trigger_node, source, object, ret, *args
               return unless source.is_a?(String)
               return if trigger_node.good_value && source.match?(trigger_node.good_value)
               return if trigger_node.bad_value && source !~ trigger_node.bad_value
 
-              invoked += 1
-              build_finding(context, trigger_node, source, object, ret, invoked, *args)
+              build_finding(context, trigger_node, source, object, ret, *args)
             end
 
             # This is our method that actually checks the taint on the object
@@ -219,35 +212,31 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_dataflow_rule context, trigger_node, source, object, ret, invoked, *args
+            def apply_dataflow_rule context, trigger_node, source, object, ret, *args
               return unless source
 
-              invoked += 1
               if Contrast::Utils::DuckUtils.quacks_to?(source, :cs__properties)
                 return unless source.cs__tracked?
                 return unless trigger_node.violated?(source)
 
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
+                build_finding(context, trigger_node, source, object, ret, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(source)
-                invoked += 2 # the each & the block
                 source.each_pair do |key, value|
-                  apply_dataflow_rule(context, trigger_node, key, object, ret, invoked, *args)
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
+                  apply_dataflow_rule(context, trigger_node, key, object, ret, *args)
+                  apply_dataflow_rule(context, trigger_node, value, object, ret, *args)
                 end
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(source)
-                invoked += 2 # the each & the block
                 source.each do |value|
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
+                  apply_dataflow_rule(context, trigger_node, value, object, ret, *args)
                 end
               else
-                logger.warn(
-                    nil,
-                    "Target is a #{ source.cs__class.name } -- not sure how to inspect: #{ trigger_node.inspect }")
-                logger.debug(nil, source.to_s[0..99])
+                logger.warn('Trigger source is of unknown type. Unable to inspect.',
+                            node_id: trigger_node.id,
+                            source_id: target.__id__,
+                            source_type: source.cs__class.to_s)
+                logger.trace(source.to_s[0..99])
               end
             end