contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/policy/policy_node'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+
 module Contrast
   module Agent
     module Assess
@@ -17,7 +19,8 @@ module Contrast
           JSON_PATCH_CLASS = 'patch_class'
           JSON_PATCH_METHOD = 'patch_method'
 
-          attr_accessor :action, :untags, :patch_class, :patch_method
+          attr_reader :untags, :patch_method
+          attr_accessor :action, :patch_class
 
           # Most things here carry over from PolicyNode.
           # A couple things are new / have new rules
@@ -72,7 +75,9 @@ module Contrast
             return unless untags
 
             untags.each do |tag|
-              raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.") unless VALID_TAGS.include?(tag)
+              unless Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag)
+                raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.")
+              end
               raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.") if tags&.include?(tag)
             end
           end

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -18,6 +18,7 @@ module Contrast
           cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
+          cs__scoped_require 'contrast/agent/assess/policy/propagator/match_data'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -26,7 +26,7 @@ module Contrast
               end
 
               def propagate _propagation_node, _preshift, _target
-                raise NotImplementedError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
+                raise NoMethodError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -45,9 +45,7 @@ module Contrast
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  unless class_type < Contrast::CoreExtensions::Assess::AssessExtension
-                    class_type.send(:include, Contrast::CoreExtensions::Assess::AssessExtension)
-                  end
+                  class_type.send(:include, Contrast::Extension::Assess::AssessExtension) unless class_type < Contrast::Extension::Assess::AssessExtension
                   ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -35,10 +35,7 @@ module Contrast
                 # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
                 # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
                 insert_point = target.rindex(source, insert_point)
-
-                overflow = Contrast::Agent::Assess::AdjustedSpan.new(
-                    insert_point,
-                    insert_point + source.length)
+                overflow = insert_point...(insert_point + source.length)
 
                 # handle shifting the inserted range
                 target.cs__properties.shift_tags([overflow])

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -0,0 +1,88 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target exactly as is. The target's preexisting tags
+          # are unaffected beyond any merging of overlapping tags.
+          class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              def square_bracket_tagger propagation_node, preshift, ret, _block
+                if ret.is_a?(Array)
+                  ret.each_with_index do |return_value, index|
+                    next unless return_value
+
+                    target_matchdata_index = if preshift.args[0].is_a?(Range)
+                                               arg_range = preshift.args[0]
+                                               arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
+                                             else
+                                               preshift.args[index]
+                                             end
+                    square_bracket_single(target_matchdata_index, preshift, return_value, propagation_node)
+                  end
+                elsif ret.is_a?(String)
+                  target_matchdata_index = preshift.args[0]
+                  square_bracket_single(target_matchdata_index, preshift, ret, propagation_node)
+                end
+
+                ret
+              end
+
+              def captures_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, index|
+                  next unless return_value
+
+                  targetted_index = index + 1
+                  square_bracket_single(targetted_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def to_a_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, index|
+                  next unless return_value
+
+                  square_bracket_single(index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def values_at_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, return_index|
+                  next unless return_value
+
+                  original_group_arg_index = preshift.args[return_index]
+                  square_bracket_single(original_group_arg_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              private
+
+              def square_bracket_single argument_index, preshift, return_value, propagation_node
+                original_start_index = preshift.object.begin(argument_index)
+                original_end_index = preshift.object.end(argument_index)
+                original_properties = preshift.object.cs__properties
+                applicable_tags = original_properties.tags_at_range(original_start_index...original_end_index)
+                return if applicable_tags.empty?
+
+                applicable_tags.each do |tag_name, tag_ranges|
+                  return_value.cs__properties.set_tags(tag_name, tag_ranges)
+                end
+                preshift.object.cs__properties.events.each do |event|
+                  return_value.cs__properties.add_event(event)
+                end
+                return_value.cs__properties.build_event(
+                    propagation_node, return_value, preshift.object, return_value, preshift.args)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -32,7 +32,7 @@ module Contrast
                 target_idx = 0
 
                 remove_ranges = []
-                current_range = nil
+                start = nil
 
                 # loop over the target, the result of the delete
                 # every range of characters that it differs from the source
@@ -44,13 +44,12 @@ module Contrast
                   source_char = source_chars[source_idx]
                   if target_char == source_char
                     target_idx += 1
-                    if current_range
-                      current_range.stop = source_idx
-                      remove_ranges << current_range
-                      current_range = nil
+                    if start
+                      remove_ranges << (start...source_idx)
+                      start = nil
                     end
                   else
-                    current_range ||= Contrast::Agent::Assess::AdjustedSpan.new(source_idx)
+                    start ||= source_idx
                   end
                   source_idx += 1
                 end
@@ -58,11 +57,7 @@ module Contrast
                 # once we're done looping over the target, anything left
                 # over is extra from the source that was deleted. tags
                 # applying to it need to be removed.
-                if source_idx != source_chars.length
-                  remove_ranges << Contrast::Agent::Assess::AdjustedSpan.new(
-                      source_idx,
-                      source_chars.length)
-                end
+                remove_ranges << (source_idx...source_chars.length) if source_idx != source_chars.length
 
                 # handle deleting the removed ranges
                 target.cs__properties.delete_tags_at_ranges(remove_ranges)

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -12,9 +12,6 @@ module Contrast
           # in a 'get it work' state. hopefully, we'll be in
           # a 'get it right' state soon.
           class Select
-            include Contrast::Components::Interface
-            access_component :logging
-
             class << self
               def select_tagger patcher, preshift, ret, _block
                 source = preshift.object
@@ -49,32 +46,48 @@ module Contrast
 
               private
 
+              def handle_integer args, arg, source
+                length = args[1] || 1
+                # (void) negative range
+                arg += source.length if arg.negative?
+                arg...(arg + length)
+              end
+
+              def handle_string arg, source
+                idx = source.index(arg)
+                idx...(idx + arg.length)
+              end
+
+              def handle_regexp args, arg, source
+                match_data = arg.match(source)
+                # nil has the same meaning as 0. use full match
+                group = args[1] || 0
+                match_data.begin(group)...match_data.end(group)
+              end
+
+              def handle_range arg, source
+                start = arg.begin
+                finish = arg.end
+
+                # (void) negative range
+                start += source.length if start.negative?
+                finish += source.length if finish.negative?
+                finish += 1 unless arg.exclude_end?
+
+                start...finish
+              end
+
               def determine_select_range source, args
                 arg = args[0]
                 case arg
                 when Integer
-                  length = args[1] || 1
-                  # (void) negative range
-                  arg += source.length if arg.negative?
-                  Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+                  handle_integer(args, arg, source)
                 when String
-                  idx = source.index(arg)
-                  Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+                  handle_string(arg, source)
                 when Regexp
-                  match_data = arg.match(source)
-                  # nil has the same meaning as 0. use full match
-                  group = args[1] || 0
-                  Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+                  handle_regexp(args, arg, source)
                 when Range
-                  start = arg.begin
-                  finish = arg.end
-
-                  # (void) negative range
-                  start += source.length if start.negative?
-                  finish += source.length if finish.negative?
-                  finish += 1 unless arg.exclude_end?
-
-                  Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+                  handle_range(arg, source)
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -19,8 +19,25 @@ module Contrast
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
             class << self
+              # Propagate taint from a source as it is split into composite
+              # sections. This method MUST return nil, otherwise it risks
+              # changing the result of of the propagation.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              #   the node that governs this propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+              #   of the state of the code just prior to the invocation of the
+              #   patched method.
+              # @param target [Array, String] the target to which to propagate.
+              # @return [nil]
               def propagate propagation_node, preshift, target
-                return Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target) unless target.is_a?(Array)
+                logger.trace('Propagation detected',
+                             node_id: propagation_node.id,
+                             target_id: target.__id__)
+                unless target.is_a?(Array)
+                  Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target)
+                  return
+                end
 
                 source = find_source(propagation_node.sources[0], preshift)
 
@@ -35,7 +52,7 @@ module Contrast
                 current_index = 0
                 target.each do |elem|
                   elem_length = elem.length
-                  range = Contrast::Agent::Assess::AdjustedSpan.new(current_index, current_index + elem_length)
+                  range = current_index...(current_index + elem_length)
                   tags = source.cs__properties.tags_at_range(range)
 
                   elem.cs__properties.clear_tags
@@ -49,6 +66,7 @@ module Contrast
                   elem.cs__properties.add_properties(propagation_node.properties)
                   current_index = current_index + elem_length + separator_length
                 end
+                nil
               end
 
               # Marks the point in which the String#split method is called.
@@ -66,7 +84,7 @@ module Contrast
               rescue Exception => e # rubocop:disable Lint/RescueException
                 # don't let our errors propagate and disable String#split for
                 # this since we're in an error state
-                logger.warn(e, 'Unable to record split context')
+                logger.warn('Unable to record split context', e)
                 end_split
               end
 
@@ -86,7 +104,7 @@ module Contrast
                   SPLIT_TRACKER.set(:split_depth, depth)
                 end
               rescue StandardError => e
-                logger.warn(e, 'Unable to remove split context')
+                logger.warn('Unable to remove split context', e)
               end
 
               # This method is called whenever an rb_yield is called. We need
@@ -96,6 +114,8 @@ module Contrast
               # @param target [String] the entity being passed to the yield
               #   block
               def propagate_yield target
+                depth, index = nil
+
                 depth = SPLIT_TRACKER.get(:split_depth)
                 return unless depth
 
@@ -108,9 +128,9 @@ module Contrast
                 true_source = source[index]
                 target.cs__copy_from(true_source)
               rescue StandardError => e
-                logger.warn(e, 'Unable to track within split context')
+                logger.warn('Unable to track within split context', e)
               ensure
-                if defined?(depth) && defined?(index) && depth && index
+                if depth && index
                   idx = SPLIT_TRACKER.get(:split_index)
                   idx[depth] = index + 1 if defined?(idx) && idx.is_a?(Array)
                 end
@@ -119,10 +139,10 @@ module Contrast
               def instrument_string_split
                 if @_instrument_string_split.nil?
                   @_instrument_string_split = begin
-                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield?
+                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
                                                 true
                                               rescue StandardError => e
-                                                logger.error(e, 'Error loading split rb_yield patch')
+                                                logger.error('Error loading split rb_yield patch', e)
                                                 false
                                               end
                 end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,6 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/duck_utils'
+
 module Contrast
   module Agent
     module Assess
@@ -107,7 +110,7 @@ module Contrast
                   last_idx = idx ? idx + 1 : nil
                   start_index = idx
                   end_index = idx + incoming.length
-                  ranges << Contrast::Agent::Assess::AdjustedSpan.new(start_index, end_index)
+                  ranges << (start_index...end_index)
                   break unless global
                 end
                 ret.cs__properties.delete_tags_at_ranges(ranges)
@@ -131,12 +134,11 @@ module Contrast
               end
 
               def pattern_gsub preshift, ret
-                return unless ret
+                return unless Contrast::Utils::DuckUtils.trackable?(ret)
 
                 source = preshift.object
                 source.cs__properties.tag_keys.each do |key|
-                  span = Contrast::Agent::Assess::AdjustedSpan.new(0, 1)
-                  ret.cs__properties.add_tag(key, span)
+                  ret.cs__properties.add_tag(key, 0...1)
                 end
               end
 

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -28,23 +28,19 @@ module Contrast
                 else
                   remove_ranges = []
                   ret_chars = ret.chars
-                  curr_span = nil
+                  start = nil
                   source_chars.each_with_index do |char, idx|
                     if ret_chars[idx] == char
-                      next unless curr_span
+                      next unless start
 
-                      curr_span.stop = idx
-                      remove_ranges << curr_span
-                      curr_span = nil
+                      remove_ranges << (start...idx)
+                      start = nil
                     else
-                      curr_span ||= Contrast::Agent::Assess::AdjustedSpan.new(idx)
+                      start ||= idx
                     end
                   end
                   # account for the last char being different
-                  if curr_span
-                    curr_span.stop = source_chars.length
-                    remove_ranges << curr_span
-                  end
+                  remove_ranges << (start...source_chars.length) if start
                   ret.cs__properties.delete_tags_at_ranges(remove_ranges, false)
                 end
 

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -23,36 +23,17 @@ module Contrast
 
           class << self
             def rewrite_interpolations
-              return unless ASSESS.enabled?
-              return unless AGENT.rewrite_interpolation?
+              return unless agent_should_rewrite?
 
-              logger.debug_with_time("\t\tRunning Assess interpolation rewrite") do
+              logger.debug_with_time('Running Assess interpolation rewrite') do
                 ObjectSpace.each_object(Module) do |mod|
                   rewrite_interpolation(mod)
                 end
               end
             end
 
-            # Rails is being a jerk, again. It passes in a class before it is
-            # done being defined. There is a state where the files have been
-            # loaded, but the class definition is not complete, so the
-            # methods of the class are not defined despite the class existing
-            #
-            # To get around this, we have those methods tell us the class
-            # isn't ready
-            def mid_defining? mod
-              mod.instance_variable_defined?(:@cs__defining_class) &&
-                  mod.instance_variable_get(:@cs__defining_class)
-            end
-
             def rewrite_interpolation mod, redo_rewrite = false
-              return unless ASSESS.enabled?
-              return unless AGENT.rewrite_interpolation?
-              return unless AGENT.interpolation_enabled?
-              return if AGENT.skip_instrumentation? mod.cs__name
-              return if mod.cs__frozen?
-              return if mod.singleton_class?
-              return if mid_defining?(mod)
+              return unless should_rewrite?(mod)
 
               status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
               return if (status&.rewritten? || status&.rewriting?) && !redo_rewrite
@@ -66,13 +47,43 @@ module Contrast
 
               end
               module_data = Contrast::Agent::ModuleData.new(mod, module_name)
-              logger.debug_with_time("\t\t\tRewriting #{ module_name }") do
+              logger.trace_with_time('Rewriting module', module: module_name) do
                 Contrast::Agent::Rewriter.rewrite_class(module_data, redo_rewrite)
               end
             rescue StandardError => e
-              logger.error(
-                  e,
-                  "Unable to patch assess into the module #{ mod }")
+              logger.error('Unable to patch for assess', e, module: mod)
+            end
+
+            private
+
+            # Rails is being a jerk, again. It passes in a class before it is
+            # done being defined. There is a state where the files have been
+            # loaded, but the class definition is not complete, so the
+            # methods of the class are not defined despite the class existing
+            #
+            # To get around this, we have those methods tell us the class
+            # isn't ready
+            def mid_defining? mod
+              mod.instance_variable_defined?(:@cs__defining_class) &&
+                  mod.instance_variable_get(:@cs__defining_class)
+            end
+
+            def agent_should_rewrite?
+              return false unless ASSESS.enabled?
+              return false unless AGENT.rewrite_interpolation?
+              return false unless AGENT.interpolation_enabled?
+
+              true
+            end
+
+            def should_rewrite? mod
+              return false unless agent_should_rewrite?
+              return false if AGENT.skip_instrumentation? mod.cs__name
+              return false if mod.cs__frozen?
+              return false if mod.singleton_class?
+              return false if mid_defining?(mod)
+
+              true
             end
           end
         end