contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/agent/module_data.rb

@@ -6,7 +6,8 @@ module Contrast
     # A simple wrapper around a Module and a call to its name, used to avoid
     # calling the Module#name method and generating extra Strings
     class ModuleData
-      attr_accessor :mod, :name
+      attr_reader :mod, :name
+
       def initialize mod, name = nil
         @mod = mod
         @name = name || mod.cs__name

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/class_util'
 
 module Contrast
@@ -9,16 +11,20 @@ module Contrast
       module Policy
         # Used to handle tracking patches that need to apply special instrumentation when a module is loaded
         class AfterLoadPatch
-          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil
+          include Contrast::Components::Interface
+          access_component :scope
+          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
+
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
             @instrumentation_file_path = instrumentation_file_path
+            @instrumenting_module = instrumenting_module
           end
 
           def applied?
-            @applied
+            applied
           end
 
           # Modules can be re-opened, so the first load may not
@@ -54,6 +60,10 @@ module Contrast
 
           def instrument!
             cs__scoped_require instrumentation_file_path
+            if instrumenting_module
+              mod = Module.cs__const_get(instrumenting_module)
+              with_contrast_scope { mod.instrument } if mod
+            end
             @applied = true
           end
 

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -3,6 +3,7 @@
 
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+cs__scoped_require 'contrast/framework/manager'
 
 module Contrast
   module Agent
@@ -12,69 +13,80 @@ module Contrast
         # after they've been loaded
         module AfterLoadPatcher
           include Contrast::Components::Interface
-          access_component :logging, :agent
-
-          AFTER_LOAD_PATCHES = Set.new([
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_time_zone_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Railties::Helper::ClassMethods',
-                                             'contrast/extensions/framework/rails/action_controller_railties_helper_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::Scoping::Named::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_named'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::Read::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Sinatra::Base',
-                                             'contrast/extensions/framework/sinatra/base'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rails::Application::Configuration',
-                                             'contrast/extensions/framework/rails/configuration',
-                                             method_to_instrument: :session_store),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Request',
-                                             'contrast/extensions/framework/rack/request'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Response',
-                                             'contrast/extensions/framework/rack/response'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Live::Buffer',
-                                             'contrast/extensions/framework/rails/buffer'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Session::Cookie',
-                                             'contrast/extensions/framework/rack/cookie')
-                                       ])
+          access_component :agent, :logging
 
           # After initialization run a catchup check to instrument any already loaded modules we care about
           def catchup_after_load_patches
-            applied = []
-            AFTER_LOAD_PATCHES.each do |after_load_patch|
+            apply_require_patches!
+            apply_direct_patches!
+            apply_load_patches!
+          end
+
+          private
+
+          # These patches need to be applied directly, not from our policy, so
+          # do so and do so only once. This should be the new standard so that
+          # there are no require time side effects of loading our core
+          # extensions.
+          def apply_direct_patches!
+            @_apply_direct_patches ||= begin
+                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+                                    Contrast::Extension::Assess::StringPropagator.instrument_string
+                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+
+                                    Contrast::Extension::Protect::Kernel.instrument
+                                    true
+                                  end
+          end
+
+          def apply_load_patches!
+            after_load_patches.each do |after_load_patch|
               next unless after_load_patch.target_defined?
               next if AGENT.skip_instrumentation?(after_load_patch.module_name)
 
-              logger.debug("Detected loading of #{ after_load_patch.module_name } - applying instrumentation")
+              logger.trace(
+                  'Catching up on already loaded afterload patch - applying instrumentation',
+                  module: after_load_patch.module_name)
               after_load_patch.instrument!
-              applied << after_load_patch
             end
-            AFTER_LOAD_PATCHES.subtract(applied)
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # These patches need to be applied directly, not from our policy, and
+          # are applied as a result of requiring the file as they alias methods
+          # directly, allowing us to control things like scope and exception
+          # handling
+          def apply_require_patches!
+            @_apply_require_patches ||= begin
+                                          cs__scoped_require 'contrast/extension/thread'
+                                          cs__scoped_require 'contrast/extension/kernel'
+                                          true
+                                        rescue LoadError, StandardError => e
+                                          logger.error('failed instrumenting apply_require_patches!', e)
+                                          false
+                                        end
+          end
+
+          def after_load_patches
+            @_after_load_patches ||= Contrast::Agent.framework_manager.find_after_load_patches
           end
 
           # Use for any checks after we've initialized
           def load_patches_for_module module_name
-            return if AFTER_LOAD_PATCHES.empty?
+            return if after_load_patches.empty?
 
-            patch = AFTER_LOAD_PATCHES.find { |after_load_patch| after_load_patch.applies?(module_name) }
+            patch = after_load_patches.find { |after_load_patch| after_load_patch.applies?(module_name) }
             return unless patch
 
-            logger.debug("Detected loading of #{ module_name } - applying instrumentation")
-
+            logger.trace('Detected loading of afterload patch - applying instrumentation', module: module_name)
             patch.instrument!
-            AFTER_LOAD_PATCHES.subtract([patch]) if patch.applied?
+            after_load_patches.delete_if(&:applied?)
           end
         end
       end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -7,9 +7,9 @@ module Contrast
       module Policy
         # This class is used to map each method to the trigger node that applies to it
         class MethodPolicy
-          attr_accessor :source_node, :propagation_node, :trigger_node,
-                        :inventory_node, :protect_node, :deadzone_node,
-                        :method_name, :method_visibility, :instance_method
+          attr_reader   :deadzone_node, :inventory_node, :propagation_node, :protect_node, :trigger_node
+          attr_accessor :source_node, :method_name, :method_visibility, :instance_method
+
           def initialize(source_node: nil, propagation_node: nil,
                          trigger_node: nil, inventory_node: nil,
                          protect_node: nil, deadzone_node: nil,

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -73,31 +73,6 @@ module Contrast
                                        end
           end
 
-          def collect_class_nodes nodes, clazz_name
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless nodes
-
-            nodes.select { |policy_node| clazz_name == policy_node.class_name }
-          end
-
-          def collect_method_nodes nodes, method, instance_method
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless nodes
-
-            nodes.select do |node|
-              node.instance_method? == instance_method && node.method_name == method
-            end
-          end
-
-          def create_method_policy_subset method, instance_method
-            method_policy = ModulePolicy.new
-            method_policy.source_nodes =     collect_method_nodes(source_nodes, method, instance_method)
-            method_policy.propagator_nodes = collect_method_nodes(propagator_nodes, method, instance_method)
-            method_policy.trigger_nodes =    collect_method_nodes(trigger_nodes, method, instance_method)
-            method_policy.inventory_nodes =  collect_method_nodes(inventory_nodes, method, instance_method)
-            method_policy.protect_nodes =    collect_method_nodes(protect_nodes, method, instance_method)
-            method_policy.deadzone_nodes =   collect_method_nodes(deadzone_nodes, method, instance_method)
-            method_policy
-          end
-
           private
 
           def sort_method_names nodes, instance_methods, singleton_methods

data/lib/contrast/agent/patching/policy/patch.rb

@@ -2,28 +2,25 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'monitor'
-# base
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/components/interface'
+
+cs__scoped_require 'contrast/agent'
+cs__scoped_require 'contrast/logger/log'
 cs__scoped_require 'contrast/agent/patching/policy/method_policy'
 cs__scoped_require 'contrast/agent/patching/policy/patch_status'
 cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
-cs__scoped_require 'contrast/components/interface'
 
 # assess
 cs__scoped_require 'contrast/agent/assess/policy/policy'
 cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
 cs__scoped_require 'contrast/agent/assess/policy/source_method'
 cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
-cs__scoped_require 'contrast/extensions/ruby_core/assess'
-
-# inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
-cs__scoped_require 'contrast/extensions/ruby_core/inventory'
 
 # protect
 cs__scoped_require 'contrast/agent/protect/policy/policy'
-cs__scoped_require 'contrast/extensions/ruby_core/protect'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
+
+# inventory
+cs__scoped_require 'contrast/agent/inventory/policy/policy'
 
 module Contrast
   module Agent
@@ -40,7 +37,7 @@ module Contrast
             include Contrast::Agent::Assess::Policy::TriggerMethod
 
             include Contrast::Components::Interface
-            access_component :logging, :analysis, :agent, :scope
+            access_component :agent, :analysis, :logging, :scope
 
             POLICIES = [
               Contrast::Agent::Assess::Policy::Policy,
@@ -86,7 +83,7 @@ module Contrast
             rescue StandardError => e
               # Anything else was our bad and we gotta catch that to allow for
               # normal application flow
-              logger.error(e, 'Unable to apply pre patch to method.')
+              logger.error('Unable to apply pre patch to method.', e)
             rescue Exception => e # rubocop:disable Lint/RescueException
               # This is something like NoMemoryError that we can't
               # hope to handle.  Nonetheless, shouldn't leak scope.
@@ -115,7 +112,7 @@ module Contrast
             def apply_post_patch method_policy, preshift, object, ret, args, block
               apply_assess(method_policy, preshift, object, ret, args, block)
             rescue StandardError => e
-              logger.error(e, 'Unable to apply post patch to method.')
+              logger.error('Unable to apply post patch to method.', e)
             end
 
             # Apply the Protect patch which applies to the given method.
@@ -130,6 +127,7 @@ module Contrast
             # @param args [Array<Object>] The arguments passed to the method
             #   being invoked.
             def apply_protect method_policy, method, exception, object, args
+              return unless AGENT.enabled?
               return unless PROTECT.enabled?
 
               apply_trigger_only(method_policy&.protect_node,
@@ -184,14 +182,12 @@ module Contrast
 
               trigger_node = method_policy.trigger_node
               Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args) if trigger_node
-
               if method_policy.source_node
                 # If we were given a frozen return, and it was the target of a
                 # source, and we have frozen sources enabled, we'll need to
                 # replace the return. Note, this is not the default case.
                 source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret, args)
               end
-
               if method_policy.propagation_node
                 propagated_ret = Contrast::Agent::Assess::Policy::PropagationMethod.apply_propagation(
                     method_policy,
@@ -201,13 +197,12 @@ module Contrast
                     args,
                     block)
               end
-
               handle_return(propagated_ret, source_ret, ret)
             rescue StandardError => e
-              logger.error(e, 'Unable to assess method call.')
+              logger.error('Unable to assess method call.', e)
               handle_return(propagated_ret, source_ret, ret)
             rescue Exception => e # rubocop:disable Lint/RescueException
-              logger.error(e, 'Unable to assess method call.')
+              logger.error('Unable to assess method call.', e)
               handle_return(propagated_ret, source_ret, ret)
               raise e
             end
@@ -237,7 +232,6 @@ module Contrast
               # resembling CUSTOM - they all have a common interface but their
               # own logic based on what's in the method(s) they've been patched
               # into.
-              applicator = trigger_node.applicator
               # Each patch also knows the method of its applicator. Some
               # things, like AppliesXxeRule, have different methods depending
               # on the library patched. This lets us handle the boilerplate of
@@ -247,7 +241,7 @@ module Contrast
               # By calling send like this, we can reuse all the patching.
               # We `send` to the given method of the given class
               # (applicator) since they all accept the same inputs
-              applicator.send(applicator_method, method, exception, trigger_node.properties, object, args)
+              trigger_node.applicator.send(applicator_method, method, exception, trigger_node.properties, object, args)
             end
 
             # Method to choose which replaced return from the post_patch to
@@ -279,6 +273,15 @@ module Contrast
                   patched_method.to_s).to_sym
             end
 
+            # Given a method, return a symbol in the format
+            # <method_start>_unbound_<method_name>
+            def build_unbound_method_name patcher_method
+              (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
+                  'unbound' +
+                  Contrast::Utils::ObjectShare::UNDERSCORE +
+                  patcher_method.to_s).to_sym
+            end
+
             # @param mod [Module] the module in which the patch should be
             #   placed.
             # @param methods [Array(Symbol)] all the instance or singleton
@@ -297,10 +300,11 @@ module Contrast
               rescue NameError => e
                 # This shouldn't happen anymore, but just in case calling alias
                 # results in a NameError, we'll be safe here.
-                logger.debug(
+                logger.error(
+                    'Attempted to alias a method on a Module that doesn\'t respond to it.',
                     e,
-                    "The class #{ mod.cs__name } does not respond to the "\
-                    "method#{ method_policy.method_name }.")
+                    module: mod.cs__name,
+                    method: method_policy.method_name)
                 return false
               end
               true
@@ -316,9 +320,79 @@ module Contrast
               contrast_prepend_method(mod, method_policy)
             end
 
+            # @param unbound_method [UnboundMethod] An unbound method, that doesn't reference its binding.
+            #   This method executes C hooking code.
+            def register_c_hook unbound_method
+              # current binding is as meaningless as any other.  but we need something
+              unbound_method.bind_call(self)
+            end
+
+            # @param target_module_name [String] Fully-qualified module name, as string, to which the C patch applies.
+            # @param unbound_method [UnboundMethod] An unbound method, to be patched into target_module.
+            # @param impl [Symbol] Strategy for applying the patch: { :alias_instance, :alias_singleton, or :prepend }:
+            #   :alias_instance     -> alias instance method of module
+            #   :alias_singleton    -> alias instance method of singleton class of module
+            #                          (equivalent to :alias, where `module = module.singleton class`)
+            #                          (this is a.k.a. "class-method patch")
+            #   :prepend            -> prepend instance method of module
+            #   [prepending singleton is easily supported too, just not implemented yet.]
+            # @return [Symbol] new alias for the underlying method (presumably, so the patched method can call it)
+            def register_c_patch target_module_name, unbound_method, impl = :alias_instance
+              # These could be set as AfterLoadPatches.
+              method_name = unbound_method.name.to_sym
+              underlying_method_name = build_unbound_method_name(method_name).to_sym
+
+              target_module = Module.cs__const_get(target_module_name)
+
+              target_module = target_module.cs__singleton_class if %i[alias_singleton prepend].include? impl
+
+              visibility = if target_module.private_instance_methods(false).include?(method_name)
+                             :private
+                           elsif target_module.protected_instance_methods(false).include?(method_name)
+                             :protected
+                           elsif target_module.public_instance_methods(false).include?(method_name)
+                             :public
+                           else
+                             raise NoMethodError,
+                                   <<~ERR
+                                     Tried to register a C-defined #{ impl } patch for \
+                                     #{ target_module_name }##{ method_name }, but can't find :#{ method_name }.
+                                   ERR
+                           end
+
+              case impl
+              when :alias_instance, :alias_singleton
+                unless target_module.instance_methods(false).include? underlying_method_name
+                  # alias_method may be private
+                  target_module.send(:alias_method, underlying_method_name, method_name)
+                  target_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                end
+                target_module.send(visibility, method_name) # e.g., module.private(:my_method)
+              when :prepend
+                prepending_module = Module.new
+                prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                prepending_module.send(visibility, :method_name)
+                # This prepends to the singleton class (it patches a class method)
+                target_module.prepend prepending_module
+              end
+              # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
+              # can't invoke this logging method or we'll seg fault as we'd
+              # change the method definition mid-call
+              # if method_name != :[]=
+              #   logger.trace(
+              #       'Registered C-defined patch',
+              #       implementation: impl,
+              #       module: target_module_name,
+              #       method: method_name,
+              #       visibility: visibility)
+              # end
+              underlying_method_name.to_sym
+            end
+
             # @return [Boolean]
             def skip_contrast_analysis?
               return true if in_contrast_scope?
+              return true unless defined?(Contrast::Agent::REQUEST_TRACKER)
               return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
 
               false