contrast-agent 3.10.2 → 3.13.0

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -1,11 +1,9 @@
 #include <ruby.h>
 
-static VALUE array_class;
-
 static VALUE rb_sym_assess_hash_dup_and_freeze;
-static VALUE rb_sym_assess_hash_brackets;
-static VALUE rb_sym_assess_hash_bracket_set;
+static VALUE rb_sym_assess_hash_bracket_constructor;
 static VALUE rb_sym_assess_hash_bracket_equals;
+static VALUE hash_propagator;
 
 /*
  * Monkeypatch Ruby Hash with Contrast Security Hash in order ot avoid losing
@@ -15,8 +13,8 @@ static VALUE rb_sym_assess_hash_bracket_equals;
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
  * -HM
  */
-static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
-                                              const VALUE hash);
+static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
+                                                      const VALUE hash);
 
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
                                               const VALUE hash);

data/ext/cs__assess_hash/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -18,19 +18,21 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
         rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
     }
 
-    return rb_funcall(self, rb_intern("cs__assess_kernel_exec"), argc, *argv);
+    /* maybe this should be rb_funcall2.  this works right now because *argv == argv[0].
+     * exec shouldn't ever be called with != 1 argc, so not a huge problem */
+    return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
 }
 
 void Init_cs__assess_kernel(void) {
-    kernel_propagator = rb_define_module("KernelPropagator");
+    kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
-    VALUE singleton = rb_singleton_class(rb_mKernel);
+    rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
+                                                        "exec",
+                                                        contrast_patched_kernel_exec);
 
-    contrast_alias_method(rb_mKernel, "cs__assess_kernel_exec", "exec");
-    rb_define_private_method(rb_mKernel, "exec", contrast_patched_kernel_exec,
-                             -1);
-
-    contrast_alias_method(singleton, "cs__assess_kernel_exec", "exec");
-    rb_define_method(singleton, "exec", contrast_patched_kernel_exec, -1);
+    /* should return the same value as above */
+    rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
+                                                                  "exec",
+                                                                  contrast_patched_kernel_exec);
 }

data/ext/cs__assess_kernel/cs__assess_kernel.h

@@ -2,6 +2,7 @@
 
 static VALUE exec_apply_trigger;
 static VALUE kernel_propagator;
+static VALUE rb_sym_assess_kernel_exec;
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,

data/ext/cs__assess_kernel/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -38,10 +38,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 void Init_cs__assess_marshal_module(void) {
     rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
 
-    marshal_module = rb_define_module("Marshal");
-
-    VALUE contrast_marshal = rb_define_module("MarshalWithContrastAssess");
-    rb_define_method(contrast_marshal, "load",
-                     contrast_assess_marshal_module_load, -1);
-    rb_prepend_module(rb_singleton_class(marshal_module), contrast_marshal);
+    contrast_register_singleton_prepend_patch("Marshal",
+                                              "load",
+                                              &contrast_assess_marshal_module_load);
 }

data/ext/cs__assess_marshal_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_module/cs__assess_module.c

@@ -6,8 +6,6 @@
 #include <ruby.h>
 
 void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
-    VALUE has_trigger_check = rb_respond_to(module, trigger_check_method);
-
     if (RTEST(
             rb_funcall(contrast_patcher(), rb_sym_skip_contrast_analysis, 0))) {
         return;
@@ -18,12 +16,12 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
 
     rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
 
-    if (!nested_scope && has_trigger_check) {
+    if (!nested_scope) {
         VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module, trigger_check_method, 3, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
     }
 
     rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -59,19 +57,23 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_module(void) {
-    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
-
-    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
-
+    module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     trigger_check_method = rb_intern("eval_trigger_check");
 
-    contrast_alias_method(rb_cModule, "cs__patched_class_eval", "class_eval");
+    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
 
-    rb_define_method(rb_cModule, "class_eval",
-                     contrast_assess_module_class_eval, -1);
+    /* Returns of these 2 patches are discarded.
+     * We're calling the underlying via direct C, instead of
+     * whatever method was there before.
+     * See similar comments in basic_object C ext patch.
+     */
 
-    contrast_alias_method(rb_cModule, "cs__patched_module_eval", "module_eval");
+    contrast_register_patch("Module",
+                            "class_eval",
+                            contrast_assess_module_class_eval);
 
-    rb_define_method(rb_cModule, "module_eval",
-                     contrast_assess_module_module_eval, -1);
+    contrast_register_patch("Module",
+                            "module_eval",
+                            contrast_assess_module_module_eval);
 }

data/ext/cs__assess_module/cs__assess_module.h

@@ -4,6 +4,9 @@
 static VALUE assess_patcher;
 
 static VALUE rb_sym_assess_patch_eval;
+
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE module_eval_trigger;
 static VALUE trigger_check_method;
 
 /* c.f. cs__assess_basic_object.c for more context on how eval is patched. */

data/ext/cs__assess_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -2,6 +2,7 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_regexp.h"
+#include "../cs__common/cs__common.h"
 #include <ruby.h>
 
 void contrast_alias_method(const VALUE target, const char *to,
@@ -21,17 +22,21 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
         rb_hash_aset(infohash, rb_sym_result, result);
         rb_hash_aset(infohash, rb_sym_string, argv[0]);
         rb_hash_aset(infohash, rb_sym_back_ref, rb_backref_get());
-        rb_funcall(regexp, rb_sym_assess_track_regexp, 1, infohash);
+        rb_funcall(regexp_propagator, rb_sym_assess_track_regexp, 1, infohash);
     }
 
     return result;
 }
 
 void Init_cs__assess_regexp(void) {
-    rb_sym_assess_regexp_equal_squiggle =
-        rb_intern("cs__patched_equal_squiggle");
-    rb_sym_assess_track_regexp = rb_intern("cs__regexp_tagger");
-
+    regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
+    rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
+
+    /* These are the keys we use to define our hash of
+     * Regexp info.  rb_global_variable doesn't make
+     * them global in the $global sense, but marks them
+     * so they don't get swept by the GC.
+     */
     rb_sym_result = ID2SYM(rb_intern("result"));
     rb_global_variable(&rb_sym_result);
     rb_sym_regexp = ID2SYM(rb_intern("regexp"));
@@ -41,8 +46,7 @@ void Init_cs__assess_regexp(void) {
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
 
-    VALUE regexp_class = rb_define_class("Regexp", rb_cObject);
-    contrast_alias_method(regexp_class, "cs__patched_equal_squiggle", "=~");
-    rb_define_method(regexp_class, "=~", contrast_assess_regexp_equal_squiggle,
-                     -1);
+    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
+                                                                  "=~",
+                                                                  contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -6,6 +6,7 @@ static VALUE rb_sym_string;
 static VALUE rb_sym_back_ref;
 static VALUE rb_sym_assess_regexp_equal_squiggle;
 static VALUE rb_sym_assess_track_regexp;
+static VALUE regexp_propagator;
 
 /*
  * argc - number of arguments

data/ext/cs__assess_regexp/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string/cs__assess_string.c

@@ -5,7 +5,8 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_string_uminus(const VALUE obj) {
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj) {
     VALUE dup, tracked;
     if (!OBJ_FROZEN(obj)) {
         tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -25,14 +26,10 @@ static VALUE contrast_assess_string_uminus(const VALUE obj) {
 }
 
 void Init_cs__assess_string(void) {
-    VALUE string_class;
-
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
-    rb_sym_assess_string_uminus = rb_intern("cs__patched_minus_at");
 
-    string_class = rb_define_class("String", rb_cObject);
-    /* -@ */
-    contrast_alias_method(string_class, "cs__patched_minus_at", "-@");
-    rb_define_method(string_class, "-@", contrast_assess_string_uminus, 0);
+    rb_sym_assess_string_uminus = contrast_register_patch("String",
+                                                          "-@",
+                                                          &contrast_assess_string_uminus);
 }

data/ext/cs__assess_string/cs__assess_string.h

@@ -14,6 +14,7 @@ static VALUE rb_sym_freeze;
  * String#freeze, which will leave our properties alone.
  * -HM
  */
-static VALUE contrast_assess_string_uminus(const VALUE obj);
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj);
 
 void Init_cs__assess_string(void);

data/ext/cs__assess_string/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c

@@ -3,29 +3,24 @@
 
 #include "cs__assess_string_interpolation26.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
     VALUE result = rb_str_concat_literals_original(num, strary);
     VALUE rb_params = rb_ary_new_from_values((int)num, strary);
-    rb_funcall(string_class, track_interpolation, 2, rb_params, result);
+    rb_funcall(string_propagator, track_interpolation, 2, rb_params, result);
     return result;
 }
 
 static int install_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_str_concat_literals_original = rb_str_concat_literals;
-    funchook_prepare(funchook, (void **)&rb_str_concat_literals_original,
-                     rb_str_concat_literals_hook);
+    patch_via_funchook(&rb_str_concat_literals_original, &rb_str_concat_literals_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 
 void Init_cs__assess_string_interpolation26(void) {
-    string_class = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
+    string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
     track_interpolation = rb_intern("track_interpolation");
     install_hooks();
 }

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h

@@ -1,10 +1,10 @@
 #include <ruby.h>
 
-static VALUE string_class;
+static VALUE string_propagator;
 static VALUE track_interpolation;
 
-void *rb_str_concat_literals(size_t num, const VALUE *strary);
-void *(*rb_str_concat_literals_original)(size_t, const VALUE *);
+VALUE *rb_str_concat_literals(size_t num, const VALUE *strary);
+VALUE (*rb_str_concat_literals_original)(size_t, const VALUE *);
 
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary);
 

data/ext/cs__assess_string_interpolation26/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_yield_track/cs__assess_yield_track.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_yield_track.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_yield_hook(VALUE val, const VALUE self) {
@@ -17,11 +16,8 @@ static VALUE rb_yield_hook(VALUE val, const VALUE self) {
 }
 
 static int install_yield_hooks() {
-    funchook_t *funchook = funchook_create();
     rb_yield_original = rb_yield;
-    funchook_prepare(funchook, (void **)&rb_yield_original,
-                     rb_yield_hook);
-    funchook_install(funchook, 0);
+    patch_via_funchook(&rb_yield_original, &rb_yield_hook);
     return 0;
 }
 

data/ext/cs__assess_yield_track/cs__assess_yield_track.h

@@ -1,10 +1,9 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE split_class;
 static VALUE propagate_yield, split_method;
 
-static VALUE *(*rb_yield_original)(VALUE val);
+static VALUE (*rb_yield_original)(VALUE val);
 static VALUE rb_yield_hook(VALUE val, const VALUE self);
 
 static int install_yield_hooks();

data/ext/cs__assess_yield_track/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__common/cs__common.c

@@ -3,12 +3,14 @@
 
 #include "cs__common.h"
 #include <ruby.h>
+#include <dlfcn.h>
 
 /* Globals */
 /* These are defined w/ `extern` in the header */
 VALUE contrast, agent, patching, policy, assess;
 VALUE core_extensions, core_assess;
 VALUE assess_policy, assess_propagator;
+VALUE funchook_path;
 
 VALUE rb_sym_enter_scope;
 VALUE rb_sym_exit_scope;
@@ -19,6 +21,28 @@ VALUE rb_sym_method;
 VALUE rb_sym_cs_tracked;
 /* end globals */
 
+void patch_via_funchook(void *original_function, void *hook_function) {
+    VALUE funchook_module_wrapper = rb_define_module("Funchook");
+    funchook_path = rb_iv_get(funchook_module_wrapper, "@path");
+
+    void *funchook_lib_handle;
+    void *funchook_reference, *(*funchook_create)(void);
+    int prepareResult, (*funchook_prepare)(void*, void**, void*);
+    int installResult, (*funchook_install)(void*, int);
+
+    funchook_lib_handle = dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
+
+    /* Load the funchook methods we need */
+    funchook_create  = (void* (*)(void))dlsym(funchook_lib_handle, "funchook_create");
+    funchook_prepare = (int (*)(void*, void**, void*))dlsym(funchook_lib_handle, "funchook_prepare");
+    funchook_install = (int (*)(void*, int))dlsym(funchook_lib_handle, "funchook_install");
+
+    funchook_reference = (void*)(*funchook_create)();
+
+    prepareResult = (*funchook_prepare)(funchook_reference, (void**)original_function, hook_function);
+    installResult = (*funchook_install)(funchook_reference, 0);
+}
+
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from) {
     rb_funcall(target, cs__send_method, 3, cs__alias_method_sym,
@@ -29,6 +53,79 @@ VALUE contrast_patcher() {
     return patcher;
 }
 
+VALUE contrast_register_patch(const char *module_name,
+                               const char *method_name,
+                               VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                               ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
+}
+
+
+VALUE contrast_register_singleton_patch(const char *module_name,
+                                        const char *method_name,
+                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                        ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
+}
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                                ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
+}
+
+static VALUE _contrast_register_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
+                                      patch_impl patch
+                                      ) {
+    VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
+    VALUE unbound_method = Qnil;
+    VALUE rb_str_module_name = rb_str_new_cstr(module_name);
+    VALUE rb_str_method_name = rb_str_new_cstr(method_name);
+
+    /* We register the c function as an instance method on an
+     * anonymous module, and then unbind it.  This creates
+     * an UnboundMethod object that we register.  This
+     * UnboundMethod object can then be bound to a class
+     * with define_method:
+     *
+     * my_method = get_patch_from_c_somehow()
+     *
+     * class MyClass
+     *   define_method('name', my_method.bind(self))
+     * end
+     *
+     * MyClass.new.name # calls my_method
+     */
+    /* This is an anonymous module, upon which we define C functions
+     * as Ruby functions.  We immediately unbind and undef them.
+     * This module doesn't do anything.
+     */
+    rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
+    VALUE rb_sym_instance_method = rb_intern("instance_method");
+    unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
+    rb_undef_method(contrast_bind_module, method_name);
+
+    /* map impl enum -> ruby symbol */
+    VALUE impl = Qnil;
+    switch(patch) {
+      case IMPL_ALIAS_INSTANCE:
+        impl = ID2SYM(rb_sym_alias_instance);
+        break;
+      case IMPL_ALIAS_SINGLETON:
+        impl = ID2SYM(rb_sym_alias_singleton);
+        break;
+      case IMPL_PREPEND:
+        impl = ID2SYM(rb_sym_prepend);
+        break;
+    }
+
+    VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
+    return SYM2ID(underlying_method_name);
+}
+
 void Init_cs__common(void) {
     cs__send_method = rb_intern("send");
     cs__alias_method_sym = ID2SYM(rb_intern("alias_method"));
@@ -42,6 +139,12 @@ void Init_cs__common(void) {
     rb_sym_method = rb_intern("__method__");
     rb_sym_cs_tracked = rb_intern("cs__tracked?");
 
+    /* Used for returning unbound C functions */
+    rb_sym_register_c_patch = rb_intern("register_c_patch");
+    rb_sym_alias_instance   = rb_intern("alias_instance");
+    rb_sym_alias_singleton  = rb_intern("alias_singleton");
+    rb_sym_prepend          = rb_intern("prepend");
+
     /* Ensure definition of core Contrast instrumentation modules */
     contrast = rb_define_module("Contrast");
     agent = rb_define_module_under(contrast, "Agent");
@@ -55,6 +158,6 @@ void Init_cs__common(void) {
     assess_policy = rb_define_module_under(assess, "Policy");
     assess_propagator = rb_define_module_under(assess_policy, "Propagator");
 
-    core_extensions = rb_define_module_under(contrast, "CoreExtensions");
+    core_extensions = rb_define_module_under(contrast, "Extension");
     core_assess = rb_define_module_under(core_extensions, "Assess");
 }