contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/extension/assess/array.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/patch'
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      class ArrayPropagator
+        include Contrast::Components::Interface
+
+        access_component :scope
+
+        ARRAY_JOIN_HASH = {
+            'class_name' => 'Array',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'join',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'cs__track_join'
+        }.cs__freeze
+        ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
+
+        class << self
+          # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+          # Multiple Strings are appended with the #join method. Because that
+          # operation happens in C, we have to do it here rather than rely on the
+          # patch of our String append or concat methods.
+          def cs__track_join ary, separator, ret
+            return unless ary
+            return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
+
+            with_contrast_scope do
+              shift = 0
+              separator_length = separator.nil? ? 0 : separator.to_s.length
+              ary.each do |obj|
+                if obj # skip nil here
+                  ret.cs__copy_from(obj, shift)
+                  shift += obj.to_s.length
+                end
+                shift += separator_length
+              end
+              return ret unless ret.cs__tracked?
+
+              ret.cs__properties.cleanup_tags
+              ret.cs__properties.build_event(
+                  ARRAY_JOIN_NODE,
+                  ret,
+                  ary,
+                  ret,
+                  [separator])
+              ret
+            end
+          end
+
+          def instrument_array_track
+            @_instrument_array_track ||= begin
+                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
+                                           true
+                                         end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading assess track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/assess_extension.rb

@@ -5,13 +5,13 @@ cs__scoped_require 'contrast/agent/assess/properties'
 cs__scoped_require 'contrast/agent/assess/insulator'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This module is responsible for maintaining the data we need to
       # construct a trace event for the object in which it is included. Rather
       # than have this code all over the place, any class that wants to use
       # dataflow features should be sent
-      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
+      # 'include Contrast::Extension::Assess::AssessExtension'
       module AssessExtension
         # Lazily build properties object. Only objects that have been tracked
         # will have the @_cs__properties, but all will respond to the

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      class EvalTrigger
+        include Contrast::Components::Interface
+        access_component :logging
+
+        class << self
+          def instance_eval_trigger_check obj, source, ret
+            apply_trigger(obj, source, ret, 'BasicObject', :instance_eval)
+          end
+
+          def eval_trigger_check obj, source, ret, method
+            apply_trigger(obj, source, ret, 'Module', method)
+          end
+
+          def apply_trigger obj, source, ret, clazz, method
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
+                current_context,
+                trigger_node(clazz, method),
+                source,
+                obj,
+                ret,
+                source)
+          end
+
+          def instrument_basic_object_track
+            @_instrument_basic_object_track ||= begin
+                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading basic object track patch', e)
+            false
+          end
+
+          def instrument_module_track
+            @_instrument_module_track ||= begin
+                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading module track patch', e)
+            false
+          end
+
+          private
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb

@@ -4,7 +4,7 @@
 cs__scoped_require 'contrast/agent/at_exit_hook'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Module allows us to track calls to the Kernel#exec method, which
       # violates the design of most methods we track in that we have to apply

data/lib/contrast/{extensions/ruby_core → extension}/assess/fiber.rb

@@ -9,7 +9,7 @@ cs__scoped_require 'contrast/components/interface'
 # Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
 # order to track what happens within Enumerator#next.
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Regexp propagation for those
       # methods which are too complex to fit into one of the standard
@@ -20,15 +20,16 @@ module Contrast
 
         access_component :analysis, :logging, :scope
 
+        # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
         FIBER_NEW_NODE_HASH = {
             'class_name' => 'Fiber',
             'instance_method' => true,
             'method_visibility' => 'public',
-            'method_name' => 'c_new', # TODO: Why do we patch new here and not initialize? Historically, new has been problematic.
+            'method_name' => 'c_new',
             'action' => 'CUSTOM',
             'source' => 'O',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
             'patch_method' => 'track_rb_fiber_new'
         }.cs__freeze
         FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
@@ -43,7 +44,7 @@ module Contrast
             'action' => 'CUSTOM',
             'source' => 'O',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
             'patch_method' => 'track_rb_fiber_yield'
         }.cs__freeze
         FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
@@ -101,7 +102,7 @@ module Contrast
                 cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
                 true
               end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading fiber track patch', e)
             false
           end

data/lib/contrast/{extensions/ruby_core → extension}/assess/hash.rb

@@ -4,7 +4,7 @@
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Hash propagation for those
       # methods which are too complex to fit into one of the standard
@@ -28,7 +28,7 @@ module Contrast
                                             cs__scoped_require 'cs__assess_hash/cs__assess_hash'
                                             true
                                           end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
           end

data/lib/contrast/extension/assess/kernel.rb

@@ -0,0 +1,110 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/assess/exec_trigger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This module provides us with a way to invoke Kernel propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Kernel Module or exposing our methods there.
+      module KernelPropagator
+        class << self
+          include Contrast::Components::Interface
+          include Contrast::Extension::Assess::ExecTrigger
+
+          access_component :logging
+
+          # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+          # in, the entire result will be tracked out. We're going to take this
+          # approach for now b/c it's fast and easy. I don't super love it, and by
+          # that I mean I hate it.
+          #
+          # To actually track this, we'd have to find the index of the new things
+          # being added, then remove the tags at the range of the format marker,
+          # which is some arbitrary length thing, and add the new tags from the
+          # inserted string, shifted down by the length of the aforementioned
+          # marker.
+          #
+          # marker is in the format %[flags][width][.precision]type, type being a
+          # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+          #
+          # also, b/c Ruby hates us, there are things called absolute markers,
+          # (digit)$, that go in the flags section. These cannot be mixed w/ the
+          # order assumed type
+          #
+          # oh, and there's also %<name>type and %{name}... b/c of course there is
+          # -HM
+          def sprintf_tagger patcher, preshift, ret, _block
+            format_string = preshift.args[0]
+            args = preshift.args[1]
+
+            track_sprintf(ret, format_string, args)
+
+            ret.cs__properties.build_event(
+                patcher,
+                ret,
+                preshift.object,
+                ret,
+                preshift.args,
+                1)
+            ret
+          end
+
+          def track_sprintf result, format_string, args
+            handle_sprintf_value(format_string, result)
+            if args.is_a?(String)
+              handle_sprintf_value(args, result)
+            elsif args.is_a?(Hash)
+              handle_sprintf_hash(args, result)
+            elsif args.is_a?(Array)
+              handle_sprintf_array args, result
+            end
+
+            result
+          rescue StandardError => e
+            logger.error(
+                'Unable to track dataflow through sprintf', e)
+            result
+          end
+
+          def instrument_kernel_track
+            @_instrument_fiber_variables ||= begin
+                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel track patch', e)
+            false
+          end
+
+          private
+
+          def handle_sprintf_value value, result
+            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+
+            value.cs__properties.events.each do |event|
+              result.cs__properties.events << event
+            end
+            value.cs__splat_tags(result)
+          end
+
+          def handle_sprintf_array args, result
+            args.each do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+
+          def handle_sprintf_hash args, result
+            args.each_value do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/regexp.rb

@@ -5,7 +5,7 @@ cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Regexp propagation for those
       # methods which are too complex to fit into one of the standard
@@ -25,7 +25,7 @@ module Contrast
             'action' => 'CUSTOM',
             'source' => 'P0',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::RegexpPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::RegexpPropagator',
             'patch_method' => 'track_equal_squiggle'
         }.cs__freeze
         REGEXP_EQUAL_SQUIGGLE_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
@@ -43,7 +43,7 @@ module Contrast
             # As such, a scope of 1 here indicates that,
             # so we know that we're in the top level call for this method.
             # normal patch [-alias-]> special case patch [-alias-]> original method
-            # TODO:  RUBY-686
+            # TODO: RUBY-686
             return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
 
             target = info_hash[:back_ref]
@@ -73,7 +73,7 @@ module Contrast
                                                cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
                                                true
                                              end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading regexp track patch', e)
             false
           end

data/lib/contrast/{extensions/ruby_core → extension}/assess/string.rb

@@ -3,16 +3,16 @@
 
 cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+cs__scoped_require 'contrast/extension/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
 # litter our code with Contrast::Utils::DuckUtils.trackable? checks.
 class String
-  include Contrast::CoreExtensions::Assess::AssessExtension
+  include Contrast::Extension::Assess::AssessExtension
 end
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke String propagation for those
       # methods which are too complex to fit into one of the standard
@@ -57,7 +57,7 @@ module Contrast
                                       cs__scoped_require 'cs__assess_string/cs__assess_string'
                                       true
                                     end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
           end
@@ -69,7 +69,7 @@ module Contrast
                                                       cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
-                                                  rescue StandardError => e
+                                                  rescue StandardError, LoadError => e
                                                     logger.error('Error loading interpolation patch', e)
                                                     false
                                                   end

data/lib/contrast/{extensions/ruby_core → extension}/inventory.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Inventory namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Inventory namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #

data/lib/contrast/extension/kernel.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/scope'
+
+# This is a reasonable place for the Kernel#catch hook to live.
+# No current plans for component re-design, but if we had some kind of
+# "do this when a component is hooked in" thing, this would live there.
+# For now, it's over-engineering to live anywhere else.  -ajm
+module Kernel # :nodoc:
+  alias_method :cs__catch, :catch
+
+  # In the event of a `throw`, we need to override `catch`
+  # to save & restore scope state:
+  #
+  #   scope_level == 0
+  #
+  #   catch(:abc) do
+  #     with_contrast_scope do
+  #       throw :abc # will leak
+  #     end
+  #   end
+  #
+  #   scope_level == 1
+  #
+  # Frankly, this isn't how scope should be used.  This is in place of
+  # proper `ensure` blocks within the instrumentation call stack.
+  # This will actually /create/ scope leaks if you're doing something like:
+  #
+  #   catch(:ohno) do
+  #     enter scope
+  #   end
+  #
+  #   abc()
+  #
+  #   exit scope
+  #
+  # i.e. if you intend to change net scope across a catch block boundary.
+
+  private
+
+  def catch *args, &block
+    # Save current scope level
+    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+
+    # Run original catch with block.
+    retval = cs__catch(*args, &block)
+
+    # Restore scope.
+    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+
+    retval
+  end
+end