contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -0,0 +1,25 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/agent/assess/events/source_event'
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # This module returns the event type appropriate to the given Node
+        module EventFactory
+          def self.build policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+            case policy_node
+            when Contrast::Agent::Assess::Policy::SourceNode
+              Contrast::Agent::Assess::Events::SourceEvent.new(policy_node, tagged, object, ret, args, source_type, source_name)
+            when Contrast::Agent::Assess::Policy::PolicyNode
+              Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/events/source_event.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # This class holds the data about an event in the application
+        # We'll use it to build an event that TeamServer can consume if
+        # the object to which this event belongs ends in a trigger.
+        class SourceEvent < Contrast::Agent::Assess::ContrastEvent
+          attr_reader :source_name, :source_type, :request
+
+          def initialize policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+            super(policy_node, tagged, object, ret, args)
+            @source_type = source_type
+            @source_name = source_name
+            @request = Contrast::Agent::REQUEST_TRACKER.current&.request
+          end
+
+          def find_parent_ids _policy_node, _object, _ret, _args
+            nil
+          end
+
+          # Convert this event into a DTM that TeamServer can consume
+          def to_dtm_event
+            event = super
+            event.field_name = Contrast::Utils::StringUtils.force_utf8(source_name)
+            event_source_dtm = build_event_source_dtm
+            event.event_sources << event_source_dtm if event_source_dtm
+            event.object_id = event_id.to_i
+            event
+          end
+
+          def forced_source_type
+            @_forced_source_type ||= Contrast::Utils::StringUtils.force_utf8(source_type)
+          end
+
+          def forced_source_name
+            @_forced_source_name ||= Contrast::Utils::StringUtils.force_utf8(source_name)
+          end
+
+          # Probably only for source events, but we'll go
+          # with source_type instead. java & .net support source_type
+          # in propagation events, so we'll future proof this
+          def build_event_source_dtm
+            # You can have a source w/o a name, but not w/o a type
+            return unless source_type
+
+            dtm = Contrast::Api::Dtm::TraceEventSource.new
+            dtm.type = forced_source_type
+            dtm.name = forced_source_name
+            dtm
+          end
+
+          # We have to do a little work to figure out what our TS appropriate
+          # target is. To break this down, the logic is as follows:
+          # 1) If I have a highlight, it means that I have a P target that is
+          #    not in integer form (it was a named / keyword type for which I had
+          #    to find the index). I need to address this so that TS can process
+          #    it.
+          # 2) I'll set the event's source and target to TS values.
+          # 3) Return the highlight or the first source/target as the taint
+          #    target.
+          def determine_taint_target event_dtm
+            return unless @policy_node&.targets&.any?
+
+            event_dtm.source = @policy_node.source_string if @policy_node.source_string
+            event_dtm.target = @highlight ? "P#{ @highlight }" : @policy_node.target_string
+            @highlight || @policy_node.targets[0]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/insulator.rb

@@ -45,9 +45,5 @@ class SimpleDelegator
   def properties
     @delegate_properties ||= Contrast::Agent::Assess::Properties.new
   end
-
-  def frozen_properties
-    @delegate_frozen_properties ||= Contrast::Agent::Assess::FrozenProperties.new
-  end
   # rubocop:enable Naming/MemoizedInstanceVariableName
 end

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -20,7 +20,7 @@ module Contrast
             # such that calls to that method will result in a Source Event.
             #
             # @param klass [Class] the Class to taint
-            # @param tainted_columns [Hash<String, Contrast::Agent::Assess::Properties>]
+            # @param tainted_columns [Hash{String => Contrast::Agent::Assess::Properties}]
             #   the name of the method to taint, mapped to the properties it
             #   should apply
             def create_sources klass, tainted_columns

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -5,6 +5,7 @@ cs__scoped_require 'contrast/agent/assess/policy/policy'
 cs__scoped_require 'contrast/agent/patching/policy/patcher'
 cs__scoped_require 'contrast/agent/patching/policy/method_policy'
 cs__scoped_require 'contrast/agent/patching/policy/module_policy'
+cs__scoped_require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -34,12 +35,14 @@ module Contrast
             # pass us execution flow once a new method has been made available.
             def patch_assess_on_eval mod
               return unless ASSESS.enabled?
+              return if in_contrast_scope?
 
               with_contrast_scope { patcher.patch_specific_module(mod) }
             rescue StandardError => e
               logger.warn(
+                  'Unable to patch assess during eval',
                   e,
-                  "Unable to patch assess into #{ mod.cs__name } on eval")
+                  module: mod.cs__name)
             end
 
             # Exposed so that methods can be dynamically patched on creation at
@@ -74,8 +77,9 @@ module Contrast
               end
             rescue StandardError => e
               logger.warn(
+                  'Unable to patch assess during define_method_attribute',
                   e,
-                  "Unable to patch assess into #{ class_name }##{ method_name } on define_method_attribute")
+                  module: mod.cs__name)
             end
           end
         end

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent
@@ -44,11 +45,6 @@ module Contrast
             end
           end
 
-          def source_string= value
-            @source_string = value
-            generate_sources
-          end
-
           def target_string= value
             @target_string = value
             generate_targets
@@ -74,7 +70,7 @@ module Contrast
           # 1) Split on ','
           # 2) If 'O', add the source, else it's P (we don't have R sources) and
           #    needs to be converted. P type will either be P:name or P# where #
-          #    is the index of the paramter. Drop the P and store the int as int
+          #    is the index of the parameter. Drop the P and store the int as int
           #    or name as symbol
           def generate_sources
             if source_string
@@ -142,7 +138,8 @@ module Contrast
             return unless tags
 
             tags.each do |tag|
-              next if VALID_TAGS.include?(tag) || VALID_SOURCE_TAGS.include?(tag)
+              next if Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
+                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
               raise(ArgumentError,
                     "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
@@ -150,8 +147,6 @@ module Contrast
           end
 
           ALL_TYPE = 'A'
-          CREATION_TYPE = 'CREATION'
-          TRIGGER_TYPE = 'TRIGGER'
           TO_MARKER = '2'
           # Convert our action, built from our source and target, into
           # the TS appropriate action. That's a single source to single
@@ -173,109 +168,13 @@ module Contrast
                 # values. Give it some help by changing them to 'A'
                 source = ALL_TYPE if source.include?(Contrast::Utils::ObjectShare::COMMA)
                 target = ALL_TYPE if target.include?(Contrast::Utils::ObjectShare::COMMA)
-                str = source[0] + TO_MARKER + target[0] # TODO: RUBY-139 PERF -- save in the patcher
+                str = source[0] + TO_MARKER + target[0]
                 str.to_sym
               end
             end
             @event_action
           end
 
-          # EventTagTypeDTM
-          VALID_TAGS = %w[
-            XML_ENCODED
-            XML_DECODED
-            HTML_ENCODED
-            HTML_DECODED
-            URL_ENCODED
-            URL_DECODED
-            CSS_ENCODED
-            CSS_DECODED
-            BASE64_ENCODED
-            BASE64_DECODED
-            JAVASCRIPT_ENCODED
-            JAVASCRIPT_DECODED
-            JAVA_ENCODED
-            JAVA_DECODED
-            CSV_ENCODED
-            CSV_DECODED
-            SQL_ENCODED
-            SQL_DECODED
-            LDAP_ENCODED
-            LDAP_DECODED
-            XPATH_ENCODED
-            XPATH_DECODED
-            OS_ENCODED
-            OS_DECODED
-            VBSCRIPT_ENCODED
-            VBSCRIPT_DECODED
-            POTENTIAL_SANITIZED
-            POTENTIAL_VALIDATED
-            NO_CONTROL_CHARS
-            CUSTOM
-
-            CUSTOM_ENCODED
-            CUSTOM_ENCODED_CMD_INJECTION
-            CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_ENCODED_HEADER_INJECTION
-            CUSTOM_ENCODED_HQL_INJECTION
-            CUSTOM_ENCODED_LDAP_INJECTION
-            CUSTOM_ENCODED_LOG_INJECTION
-            CUSTOM_ENCODED_NOSQL_INJECTION
-            CUSTOM_ENCODED_PATH_TRAVERSAL
-            CUSTOM_ENCODED_REDOS
-            CUSTOM_ENCODED_REFLECTED_XSS
-            CUSTOM_ENCODED_REFLECTION_INJECTION
-            CUSTOM_ENCODED_SMTP_INJECTION
-            CUSTOM_ENCODED_SQL_INJECTION
-            CUSTOM_ENCODED_SSRF
-            CUSTOM_ENCODED_STORED_XSS
-            CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
-            CUSTOM_ENCODED_UNSAFE_READLINE
-            CUSTOM_ENCODED_UNSAFE_XML_DECODE
-            CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_ENCODED_UNVALIDATED_FORWARD
-            CUSTOM_ENCODED_UNVALIDATED_REDIRECT
-            CUSTOM_ENCODED_XPATH_INJECTION
-            CUSTOM_ENCODED_XXE
-            CUSTOM_SECURITY_CONTROL_APPLIED
-
-            CUSTOM_VALIDATED
-            CUSTOM_VALIDATED_CMD_INJECTION
-            CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_VALIDATED_HEADER_INJECTION
-            CUSTOM_VALIDATED_HQL_INJECTION
-            CUSTOM_VALIDATED_LDAP_INJECTION
-            CUSTOM_VALIDATED_LOG_INJECTION
-            CUSTOM_VALIDATED_NOSQL_INJECTION
-            CUSTOM_VALIDATED_PATH_TRAVERSAL
-            CUSTOM_VALIDATED_REDOS
-            CUSTOM_VALIDATED_REFLECTED_XSS
-            CUSTOM_VALIDATED_REFLECTION_INJECTION
-            CUSTOM_VALIDATED_SMTP_INJECTION
-            CUSTOM_VALIDATED_SQL_INJECTION
-            CUSTOM_VALIDATED_SSRF
-            CUSTOM_VALIDATED_STORED_XSS
-            CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
-            CUSTOM_VALIDATED_UNSAFE_READLINE
-            CUSTOM_VALIDATED_UNSAFE_XML_DECODE
-            CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_VALIDATED_UNVALIDATED_FORWARD
-            CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
-            CUSTOM_VALIDATED_XPATH_INJECTION
-            CUSTOM_VALIDATED_XXE
-
-            DATABASE_WRITE
-          ].cs__freeze
-
-          VALID_SOURCE_TAGS = %w[
-            NO_NEWLINES
-            UNTRUSTED
-            CROSS_SITE
-            LIMITED_CHARS
-          ].cs__freeze
-
           # The keys used to read from policy.json to create the individual
           # policy nodes. These are common across node types
           JSON_SOURCE = 'source'

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -3,7 +3,7 @@
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+cs__scoped_require 'contrast/extension/assess/assess_extension'
 
 module Contrast
   module Agent
@@ -15,7 +15,7 @@ module Contrast
         # or Keys.
         module PolicyScanner
           include Contrast::Components::Interface
-          access_component :analysis, :logging
+          access_component :analysis
 
           class << self
             def scan trace_point

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -51,7 +51,7 @@ module Contrast
 
             preshift
           rescue StandardError => e
-            logger.error(e, 'Unable to build preshift for method.')
+            logger.error('Unable to build preshift for method.', e)
             nil
           end
 

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -28,13 +28,13 @@ module Contrast
           INSERT_ACTION = 'INSERT'
           KEEP_ACTION = 'KEEP'
           NEXT_ACTION = 'NEXT'
+          NOOP_ACTION = 'NOOP'
           PREPEND_ACTION = 'PREPEND'
           REPLACE_ACTION = 'REPLACE'
           REMOVE_ACTION = 'REMOVE'
           REVERSE_ACTION = 'REVERSE'
           SPLAT_ACTION = 'SPLAT'
           SPLIT_ACTION = 'SPLIT'
-          TAG_ACTION = 'TAG'
           DB_WRITE_ACTION = 'DB_WRITE'
           CUSTOM_ACTION = 'CUSTOM'
 
@@ -56,6 +56,19 @@ module Contrast
               arg
             end
 
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
+            #   the policy that governs the patches to this method
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+            #   of the state of the code just prior to the invocation of the
+            #   patched method.
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method
+            #   was invoked
+            # @param block [Block] the Block passed to the original method
+            # @return [Object, nil] the tracked Return or nil if no changes
+            #   were made; will replace the return of the original function if
+            #   not nil
             def apply_propagation method_policy, preshift, object, ret, args, block
               return unless method_policy.propagation_node
               return unless preshift
@@ -63,7 +76,7 @@ module Contrast
               propagation_node = method_policy.propagation_node
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, 0, args, block)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
             end
 
             PROPAGATION_ACTIONS = {
@@ -72,6 +85,7 @@ module Contrast
                 INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
                 KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
                 NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
+                NOOP_ACTION => nil,
                 PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
                 REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
                 REMOVE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Remove,
@@ -80,12 +94,32 @@ module Contrast
                 SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
             }.cs__freeze
 
-            # I lied above. We had to figure out what the target of the propagation was.
-            # Now that we know, we'll actually do things to it.
-            def apply_propagator propagation_node, preshift, target, object, ret, invoked, args, block
-              context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless context && propagation_node && valid_target?(target, propagation_node)
-              return unless valid_length?(target, propagation_node.action)
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
+            # I lied above. We had to figure out what the target of the
+            # propagation was. Now that we know, we'll actually do things to
+            # it. Note that the return of this method will replace the original
+            # return of the patched function unless it is nil, so be sure
+            # you're returning what you intend.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+            #   the node that governs this propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+            #   of the state of the code just prior to the invocation of the
+            #   patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method
+            #   was invoked
+            # @param block [Block] the Block passed to the original method
+            # @return [Object, nil] the tracked Return or nil if no changes
+            #   were made; will replace the return of the original function if
+            #   not nil
+            def apply_propagator propagation_node, preshift, target, object, ret, args, block
+              return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
@@ -93,18 +127,15 @@ module Contrast
                 Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
-                logger.debug(
-                    nil,
-                    "Propagator #{ propagation_node.id } detected: propagated to #{ target.__id__ }")
               elsif Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
               end
             rescue StandardError => e
-              logger.warn(e, "Unable to apply propagator #{ propagation_node.id }")
+              logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
             end
 
             # Custom actions tend to be the more complex of our propagations.
@@ -172,8 +203,7 @@ module Contrast
 
               length = Contrast::Utils::StringUtils.ret_length(target)
               propagation_node.tags.each do |tag|
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                target.cs__properties.add_tag(tag, span)
+                target.cs__properties.add_tag(tag, 0...length)
               end
             end
 
@@ -188,34 +218,40 @@ module Contrast
 
             private
 
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            # This is checked right before actual propagation
+            def propagation_possible? propagation_node, target
+              return false unless context_available? && propagation_node && valid_target?(target, propagation_node)
+              return false unless valid_length?(target, propagation_node.action)
+
+              true
+            end
+
+            def handle_hash_propagation propagation_node, preshift, target, object, ret, args, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, invoked, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, key, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
               end
             end
 
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
               target.each do |value|
                 next if target == value # Some Enumerable#each are overriden to return self the first time which leads to infinite propagation
 
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
               end
             end
 
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, invoked, args, _block
-              invoked += 1
+            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
+              return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
 
               # propagate all the tags from the sources to the target
               propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil)
               unless propagation_class
                 logger.warn(
-                    nil,
-                    "Unknown action type #{ propagation_node.action }. Unable to "\
-                    "propagate for #{ propagation_node.id }.")
+                    'Unknown propgation action receieved. Unable to propagate.',
+                    node_id: propagation_node.id,
+                    action: propagation_node.action)
                 return ret
               end
 
@@ -244,13 +280,11 @@ module Contrast
 
               target.cs__properties.add_properties(propagation_node.properties)
 
-              target.cs__properties.build_event(propagation_node, target, object, ret, args, invoked)
-
-              logger.debug(
-                  nil,
-                  "Propagator #{ propagation_node.id } detected: propagated to "\
-                  "#{ target.__id__ }")
+              target.cs__properties.build_event(propagation_node, target, object, ret, args)
 
+              logger.trace('Propagation detected',
+                           node_id: propagation_node.id,
+                           target_id: target.__id__)
               ret.cs__freeze if restore_frozen_state
               ret
             end