contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/{extensions/ruby_core → extension}/assess/assess_extension.rb

@@ -2,17 +2,16 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/frozen_properties'
 cs__scoped_require 'contrast/agent/assess/insulator'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This module is responsible for maintaining the data we need to
       # construct a trace event for the object in which it is included. Rather
       # than have this code all over the place, any class that wants to use
       # dataflow features should be sent
-      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
+      # 'include Contrast::Extension::Assess::AssessExtension'
       module AssessExtension
         # Lazily build properties object. Only objects that have been tracked
         # will have the @_cs__properties, but all will respond to the
@@ -86,6 +85,7 @@ module Contrast
             existing = cs__properties.fetch_tag(key)
             if existing
               existing.concat(new_tags)
+              Contrast::Utils::TagUtil.size_aware_merge(self, existing)
             else
               cs__properties.set_tags(key, new_tags)
             end
@@ -99,33 +99,37 @@ module Contrast
         # If the return already had that tag, the existing tag
         # range is recycled to save us an object.
         def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.quacks_to?(
-              ret,
-              :cs__tracked?)
+          return unless Contrast::Utils::DuckUtils.trackable?(ret)
 
-          splat_source = Contrast::Utils::DuckUtils.quacks_to?(
-              source,
-              :cs__tracked?)
+          length = Contrast::Utils::StringUtils.ret_length(ret)
+          return if length.zero?
+
+          cs__splat_from_source(ret, length, source)
+          cs__splat_from_ret(ret, length)
+        end
+
+        def cs__splat_from_source ret, ret_length, source
+          splat_source = Contrast::Utils::DuckUtils.trackable?(source)
           splat_source &&= source.cs__tracked?
-          if splat_source
-            length = Contrast::Utils::StringUtils.ret_length(ret)
-            source.cs__properties.tag_keys.each do |key|
-              existing = ret.cs__properties.fetch_tag(key)
-              # if the tag already exists, drop all but the first range
-              # then change that range to cover the entire return
-              if existing
-                existing.drop(existing.length - 1)
-                range = existing[0]
-                range.repurpose(0, length)
-              else
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                ret.cs__properties.add_tag(key, span)
-              end
+          return unless splat_source
+
+          source.cs__properties.tag_keys.each do |key|
+            existing = ret.cs__properties.fetch_tag(key)
+            # if the tag already exists, drop all but the first range
+            # then change that range to cover the entire return
+            if existing
+              existing.drop(existing.length - 1)
+              range = existing[0]
+              range.repurpose(0, ret_length)
+            else
+              ret.cs__properties.add_tag(key, 0...ret_length)
             end
           end
+        end
+
+        def cs__splat_from_ret ret, length
           return unless ret.cs__tracked?
 
-          length ||= Contrast::Utils::StringUtils.ret_length(ret)
           ret.cs__properties.tag_keys.each do |key|
             next unless key
 

data/lib/contrast/{extensions/ruby_core → extension}/assess/erb.rb

@@ -1,18 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-
 # This module is used to track propagation through ERB template rendering
 module ERBPropagator
   class << self
-    include Contrast::Components::Interface
-    access_component :logging
-
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
 
-      logger.debug('ERBPropagator - running propagation')
       used_binding = preshift.args[0]
       binding_variable_set = used_binding.local_variables
 
@@ -25,7 +19,6 @@ module ERBPropagator
         start_index = ret.index(bound_variable_value)
         next if start_index.nil?
 
-        logger.debug('ERBPropagator - found bound_variable in erb template result')
         ret.cs__copy_from(bound_variable_value, start_index)
       end
       ret.cs__properties.build_event(
@@ -35,7 +28,6 @@ module ERBPropagator
           ret,
           preshift.args,
           1)
-      logger.debug('ERBPropgator - Finished erb result propagation')
       ret
     end
   end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      class EvalTrigger
+        include Contrast::Components::Interface
+        access_component :logging
+
+        class << self
+          def instance_eval_trigger_check obj, source, ret
+            apply_trigger(obj, source, ret, 'BasicObject', :instance_eval)
+          end
+
+          def eval_trigger_check obj, source, ret, method
+            apply_trigger(obj, source, ret, 'Module', method)
+          end
+
+          def apply_trigger obj, source, ret, clazz, method
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
+                current_context,
+                trigger_node(clazz, method),
+                source,
+                obj,
+                ret,
+                source)
+          end
+
+          def instrument_basic_object_track
+            @_instrument_basic_object_track ||= begin
+                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading basic object track patch', e)
+            false
+          end
+
+          def instrument_module_track
+            @_instrument_module_track ||= begin
+                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading module track patch', e)
+            false
+          end
+
+          private
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb

@@ -1,17 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/at_exit_hook'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Module allows us to track calls to the Kernel#exec method, which
       # violates the design of most methods we track in that we have to apply
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
-        include Contrast::Components::Interface
-        access_component :contrast_service
         def apply_trigger source
           current_context = Contrast::Agent::REQUEST_TRACKER.current
           return unless current_context
@@ -27,12 +25,12 @@ module Contrast
               current_context,
               trigger_node,
               source,
-              self,
-              '',
-              1,
+              Kernel,
+              nil,
               source)
-          # Exec replaces the current process, if we occur in a forked process our appendage of this finding will not make it to TS
-          CONTRAST_SERVICE.send_message(current_context.activity)
+          # Exec replaces the current process, if we occur in a forked process
+          # our appendage of this finding will not make it to TS
+          Contrast::Agent::AtExitHook.on_exit
         end
 
         private

data/lib/contrast/extension/assess/fiber.rb

@@ -0,0 +1,113 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
+cs__scoped_require 'contrast/components/interface'
+
+# In order to instrument some difficult methods like String#gsub, as it
+# returns an enumerator, we need to instrument methods on Fiber.
+# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
+# order to track what happens within Enumerator#next.
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Fiber Class or exposing our methods there.
+      class FiberPropagator
+        include Contrast::Components::Interface
+
+        access_component :analysis, :logging, :scope
+
+        # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
+        FIBER_NEW_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_new',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_new'
+        }.cs__freeze
+        FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
+        private_constant :FIBER_NEW_NODE_HASH
+        private_constant :FIBER_NEW_NODE
+
+        FIBER_YIELD_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_yield',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_yield'
+        }.cs__freeze
+        FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
+        private_constant :FIBER_YIELD_NODE_HASH
+        private_constant :FIBER_YIELD_NODE
+
+        class << self
+          def track_rb_fiber_yield fiber, _method, results
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
+
+            # results will be nil if StopIteration was raised,
+            # otherwise an Array of the yielded arguments
+            return unless results.cs__is_a?(Array)
+
+            with_contrast_scope do
+              results.each do |result|
+                next unless Contrast::Utils::DuckUtils.trackable?(result)
+                next if result.cs__frozen?
+
+                fiber.cs__splat_tags(result)
+                result.cs__properties.build_event(
+                    FIBER_YIELD_NODE,
+                    result,
+                    fiber,
+                    result,
+                    [])
+              end
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber#yield', e)
+          end
+
+          def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
+            return unless Contrast::Utils::DuckUtils.trackable?(underlying)
+            return unless underlying.is_a?(String) && !underlying.empty?
+
+            with_contrast_scope do
+              underlying.cs__splat_tags(fiber)
+              fiber.cs__properties.build_event(
+                  FIBER_NEW_NODE,
+                  fiber,
+                  underlying,
+                  fiber,
+                  [])
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber.new', e)
+          end
+
+          def instrument_fiber_track
+            @_instrument_fiber_variables ||= begin
+                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
+                true
+              end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading fiber track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/hash.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Hash propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds.
+      class HashPropagator
+        include Contrast::Components::Interface
+        access_component :logging
+        class << self
+          def cs__duplicate_and_freeze object
+            return object unless object.is_a?(String) && !object.cs__frozen?
+            return object unless object.cs__tracked?
+
+            object.dup.cs__freeze
+          rescue StandardError
+            # we'll rescue this error, but we can't log it here as that will
+            # result in a seg fault
+          end
+
+          def instrument_hash_track
+            @_instrument_hash_track ||= begin
+                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
+                                            true
+                                          end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading hash track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/kernel.rb

@@ -0,0 +1,110 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/assess/exec_trigger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This module provides us with a way to invoke Kernel propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Kernel Module or exposing our methods there.
+      module KernelPropagator
+        class << self
+          include Contrast::Components::Interface
+          include Contrast::Extension::Assess::ExecTrigger
+
+          access_component :logging
+
+          # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+          # in, the entire result will be tracked out. We're going to take this
+          # approach for now b/c it's fast and easy. I don't super love it, and by
+          # that I mean I hate it.
+          #
+          # To actually track this, we'd have to find the index of the new things
+          # being added, then remove the tags at the range of the format marker,
+          # which is some arbitrary length thing, and add the new tags from the
+          # inserted string, shifted down by the length of the aforementioned
+          # marker.
+          #
+          # marker is in the format %[flags][width][.precision]type, type being a
+          # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+          #
+          # also, b/c Ruby hates us, there are things called absolute markers,
+          # (digit)$, that go in the flags section. These cannot be mixed w/ the
+          # order assumed type
+          #
+          # oh, and there's also %<name>type and %{name}... b/c of course there is
+          # -HM
+          def sprintf_tagger patcher, preshift, ret, _block
+            format_string = preshift.args[0]
+            args = preshift.args[1]
+
+            track_sprintf(ret, format_string, args)
+
+            ret.cs__properties.build_event(
+                patcher,
+                ret,
+                preshift.object,
+                ret,
+                preshift.args,
+                1)
+            ret
+          end
+
+          def track_sprintf result, format_string, args
+            handle_sprintf_value(format_string, result)
+            if args.is_a?(String)
+              handle_sprintf_value(args, result)
+            elsif args.is_a?(Hash)
+              handle_sprintf_hash(args, result)
+            elsif args.is_a?(Array)
+              handle_sprintf_array args, result
+            end
+
+            result
+          rescue StandardError => e
+            logger.error(
+                'Unable to track dataflow through sprintf', e)
+            result
+          end
+
+          def instrument_kernel_track
+            @_instrument_fiber_variables ||= begin
+                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel track patch', e)
+            false
+          end
+
+          private
+
+          def handle_sprintf_value value, result
+            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+
+            value.cs__properties.events.each do |event|
+              result.cs__properties.events << event
+            end
+            value.cs__splat_tags(result)
+          end
+
+          def handle_sprintf_array args, result
+            args.each do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+
+          def handle_sprintf_hash args, result
+            args.each_value do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+        end
+      end
+    end
+  end
+end