contrast-agent 3.11.0 → 3.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ef521f3316b8c5e911a3781bb0dc0c228b01a6166ad1f6a2abb429e67941878
-  data.tar.gz: 16305c60287b244efb6d0a1fb23a979b405e4960deaa2a84e45b1da994c21c14
+  metadata.gz: 243b30b36043569647a00b004f6e1b2055f488b63cfd8a3f023a106f101cf889
+  data.tar.gz: 3bee1adbd1399cda966e480e982c15ac4cf29151148a0f3583707f976bd65704
 SHA512:
-  metadata.gz: 228c42ed0e8453f3b2720818d7127729991e8d2cad7e480fc616f0975481e7810ff0ebfae44ebe406c62ff51398307e6cadd685a0805b34a7cb699641278c064
-  data.tar.gz: e9d180bb7004a818d346bb2d5f4ea5b57d1d6fef58284569fdb80dcbaf44cb215d4ae3b86c7984c683387011af9bf20f9428947820bf9e13fa67cc9084d6d8b8
+  metadata.gz: 25b33e16000c0ff543bce8d3b01185cc161e88c9d2d14f14210966f7789962f06fadad30c2343cb8a8b00c22e754dbd2f7335a177d2c42be1251c74debb26ca4
+  data.tar.gz: 186908641b731c23c873ee5a4821d74e2c112e61e33c1206769837774196055431de419e8e826f3324f85812ab324e9c2c6c15d02ca6b5d1001bd6a9fb2f2277

data/.dockerignore

@@ -4,7 +4,6 @@ docker/
 code-deploy/
 
 Jenkinsfile
-bitbucket-pipelines.yml
 docker-compose.yml
 .rubocop.yml
 .travis.yml

data/.flayignore

@@ -0,0 +1 @@
+./lib/contrast/api/*_pb.rb

data/.gitignore

@@ -52,7 +52,7 @@ contrast-agent-*.gem
 service_executables/*-*
 
 # Generated Protobuf files
-/lib/contrast/api/*_pb.rb
+/lib/contrast/api/*.pb.rb
 
 # IDE stuff
 tags

data/.simplecov

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-SimpleCov.minimum_coverage line: 92.30
+SimpleCov.minimum_coverage line: 94.75
 SimpleCov.start do
   add_filter '/spec/'
 end

data/Rakefile

@@ -1,9 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+$stdout.sync = true
+
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rake/extensiontask'
+load 'protobuf/tasks/compile.rake'
+require 'fileutils'
 
 CLOBBER << 'shared_libraries/*'
 
@@ -13,3 +17,30 @@ Dir['ext/cs__*'].each do |extension|
     ext.lib_dir = "lib/#{ name }"
   end
 end
+
+task :contrast_pb_compile do
+  # do some stuff before compile
+
+  # Invoke the protobuf compile task with your sensible defaults
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/dtm.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ::Rake::Task['protobuf:compile'].reenable
+
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/settings.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ['dtm.pb.rb', 'settings.pb.rb'].each do |target_file|
+    target_path = File.absolute_path(File.join(__dir__, "./lib/contrast/api/#{ target_file }"))
+    unless File.exist?(target_path)
+      puts "File not found #{ target_path }"
+      exit 1
+    end
+  end
+
+  puts 'Protobuf copied successfully'
+end

data/ext/build_funchook.rb

@@ -62,5 +62,3 @@ unless find_header('funchook.h', ext_path)
     end
   end
 end
-
-have_header('funchook.h', ext_path)

data/ext/cs__assess_active_record_named/cs__active_record_named.c

@@ -19,7 +19,7 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
      */
     VALUE new_body, ret;
     VALUE new_args[3];
-    new_body = rb_funcall(self, rb_sym_assess_rewrite, 2, argv[0], argv[1]);
+    new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self, argv[0], argv[1]);
     new_args[0] = argv[0];
     if (NIL_P(new_body)) {
         new_args[1] = argv[1];
@@ -32,7 +32,12 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_active_record_named(void) {
-    rb_sym_assess_rewrite = rb_intern("_cs__rewrite");
+    VALUE framework, rails, rewrite;
+    framework = rb_define_module_under(contrast, "Framework");
+    rails = rb_define_module_under(framework, "Rails");
+    rewrite = rb_define_module_under(rails, "Rewrite");
+    active_record_named = rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
+    rb_sym_assess_rewrite = rb_intern("rewrite");
     rb_sym_assess_scope   = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
                                                     "scope",
                                                     contrast_assess_active_record_scope);

data/ext/cs__assess_active_record_named/cs__active_record_named.h

@@ -1,5 +1,6 @@
 #include <ruby.h>
 
+static VALUE active_record_named;
 static VALUE rb_sym_assess_rewrite;
 static VALUE rb_sym_assess_scope;
 

data/ext/cs__assess_array/cs__assess_array.c

@@ -23,12 +23,13 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     /* Finally, default to empty String. Implicit since nil.to_s is ''*/
 
     result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
-    result = rb_funcall(ary, rb_sym_assess_track_array_join, 2, sep, result);
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3, ary, sep, result);
 
     return result;
 }
 
 void Init_cs__assess_array(void) {
+    array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
     rb_sym_assess_array_join = contrast_register_patch("Array",
                                                        "join",

data/ext/cs__assess_array/cs__assess_array.h

@@ -1,5 +1,6 @@
 #include <ruby.h>
 
+static VALUE array_propagator;
 static VALUE rb_sym_assess_array_join;
 static VALUE rb_sym_assess_track_array_join;
 

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -5,14 +5,9 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-void contrast_assess_instance_eval_trigger_check(VALUE module, VALUE source,
+void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
                                                  VALUE ret) {
-    VALUE has_trigger_check =
-        rb_respond_to(rb_cBasicObject, instance_trigger_check_method);
-    if (has_trigger_check) {
-        rb_funcall(rb_cBasicObject, instance_trigger_check_method, 2, source,
-                   ret);
-    }
+    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self, source, ret);
 }
 
 VALUE
@@ -41,6 +36,7 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_basic_object(void) {
+    basic_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
 
     /* We don't keep a reference to the underlying method.

data/ext/cs__assess_basic_object/cs__assess_basic_object.h

@@ -1,6 +1,7 @@
 #include <ruby.h>
 
-/* Contrast::Agent::Patching::Policy::Patcher */
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE basic_eval_trigger;
 static VALUE instance_trigger_check_method;
 
 void contrast_alias_method(const VALUE target, const char *to,

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_fiber_track.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
@@ -64,17 +63,12 @@ VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
 }
 
 int install_fiber_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_fiber_new_original = rb_fiber_new;
-    funchook_prepare(funchook, (void **)&rb_fiber_new_original,
-                     rb_fiber_new_hook);
+    patch_via_funchook(&rb_fiber_new_original, &rb_fiber_new_hook);
 
     rb_fiber_yield_original = rb_fiber_yield;
-    funchook_prepare(funchook, (void **)&rb_fiber_yield_original,
-                     rb_fiber_yield_hook);
+    patch_via_funchook(&rb_fiber_yield_original, &rb_fiber_yield_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -1,4 +1,3 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_sym_next;

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -24,7 +24,7 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_kernel(void) {
-    kernel_propagator = rb_define_module("KernelPropagator");
+    kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
     rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",

data/ext/cs__assess_module/cs__assess_module.c

@@ -6,8 +6,6 @@
 #include <ruby.h>
 
 void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
-    VALUE has_trigger_check = rb_respond_to(module, trigger_check_method);
-
     if (RTEST(
             rb_funcall(contrast_patcher(), rb_sym_skip_contrast_analysis, 0))) {
         return;
@@ -18,12 +16,12 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
 
     rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
 
-    if (!nested_scope && has_trigger_check) {
+    if (!nested_scope) {
         VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module, trigger_check_method, 3, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
     }
 
     rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -59,12 +57,12 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_module(void) {
-    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+    module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
+    trigger_check_method = rb_intern("eval_trigger_check");
 
+    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
     assess_patcher = rb_define_module_under(assess_policy, "Patcher");
 
-    trigger_check_method = rb_intern("eval_trigger_check");
-
     /* Returns of these 2 patches are discarded.
      * We're calling the underlying via direct C, instead of
      * whatever method was there before.

data/ext/cs__assess_module/cs__assess_module.h

@@ -4,6 +4,9 @@
 static VALUE assess_patcher;
 
 static VALUE rb_sym_assess_patch_eval;
+
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE module_eval_trigger;
 static VALUE trigger_check_method;
 
 /* c.f. cs__assess_basic_object.c for more context on how eval is patched. */

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_string_interpolation26.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
@@ -14,13 +13,9 @@ static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
 }
 
 static int install_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_str_concat_literals_original = rb_str_concat_literals;
-    funchook_prepare(funchook, (void **)&rb_str_concat_literals_original,
-                     rb_str_concat_literals_hook);
+    patch_via_funchook(&rb_str_concat_literals_original, &rb_str_concat_literals_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 

data/ext/cs__assess_yield_track/cs__assess_yield_track.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_yield_track.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_yield_hook(VALUE val, const VALUE self) {
@@ -17,11 +16,8 @@ static VALUE rb_yield_hook(VALUE val, const VALUE self) {
 }
 
 static int install_yield_hooks() {
-    funchook_t *funchook = funchook_create();
     rb_yield_original = rb_yield;
-    funchook_prepare(funchook, (void **)&rb_yield_original,
-                     rb_yield_hook);
-    funchook_install(funchook, 0);
+    patch_via_funchook(&rb_yield_original, &rb_yield_hook);
     return 0;
 }
 

data/ext/cs__assess_yield_track/cs__assess_yield_track.h

@@ -1,4 +1,3 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE split_class;

data/ext/cs__common/cs__common.c

@@ -3,12 +3,14 @@
 
 #include "cs__common.h"
 #include <ruby.h>
+#include <dlfcn.h>
 
 /* Globals */
 /* These are defined w/ `extern` in the header */
 VALUE contrast, agent, patching, policy, assess;
 VALUE core_extensions, core_assess;
 VALUE assess_policy, assess_propagator;
+VALUE funchook_path;
 
 VALUE rb_sym_enter_scope;
 VALUE rb_sym_exit_scope;
@@ -19,6 +21,28 @@ VALUE rb_sym_method;
 VALUE rb_sym_cs_tracked;
 /* end globals */
 
+void patch_via_funchook(void *original_function, void *hook_function) {
+    VALUE funchook_module_wrapper = rb_define_module("Funchook");
+    funchook_path = rb_iv_get(funchook_module_wrapper, "@path");
+
+    void *funchook_lib_handle;
+    void *funchook_reference, *(*funchook_create)(void);
+    int prepareResult, (*funchook_prepare)(void*, void**, void*);
+    int installResult, (*funchook_install)(void*, int);
+
+    funchook_lib_handle = dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
+
+    /* Load the funchook methods we need */
+    funchook_create  = (void* (*)(void))dlsym(funchook_lib_handle, "funchook_create");
+    funchook_prepare = (int (*)(void*, void**, void*))dlsym(funchook_lib_handle, "funchook_prepare");
+    funchook_install = (int (*)(void*, int))dlsym(funchook_lib_handle, "funchook_install");
+
+    funchook_reference = (void*)(*funchook_create)();
+
+    prepareResult = (*funchook_prepare)(funchook_reference, (void**)original_function, hook_function);
+    installResult = (*funchook_install)(funchook_reference, 0);
+}
+
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from) {
     rb_funcall(target, cs__send_method, 3, cs__alias_method_sym,
@@ -134,6 +158,6 @@ void Init_cs__common(void) {
     assess_policy = rb_define_module_under(assess, "Policy");
     assess_propagator = rb_define_module_under(assess_policy, "Propagator");
 
-    core_extensions = rb_define_module_under(contrast, "CoreExtensions");
+    core_extensions = rb_define_module_under(contrast, "Extension");
     core_assess = rb_define_module_under(core_extensions, "Assess");
 }

data/ext/cs__common/cs__common.h

@@ -16,6 +16,7 @@ static VALUE cs__alias_method_sym;
 extern VALUE contrast, agent, patching, policy, assess;
 extern VALUE core_extensions, core_assess;
 extern VALUE assess_policy, assess_propagator;
+extern VALUE funchook_path;
 
 extern VALUE rb_sym_enter_scope;
 extern VALUE rb_sym_exit_scope;
@@ -32,6 +33,8 @@ static VALUE rb_sym_alias_instance;
 static VALUE rb_sym_alias_singleton;
 static VALUE rb_sym_prepend;
 
+void patch_via_funchook(void *original_function, void *hook_function);
+
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 

data/ext/cs__common/extconf.rb

@@ -4,18 +4,4 @@
 require 'mkmf'
 require_relative '../../lib/contrast/agent/version'
 
-installed_path = __dir__
-
-origin =  if !(/darwin/ =~ RUBY_PLATFORM).nil?
-            '@loader_path'
-          else
-            '\$${ORIGIN}'
-          end
-
-options = " -Wl,-rpath,#{ origin }/../../shared_libraries"
-
-$LDFLAGS << options if try_link('int main() {return 0;}', options)
-
-$LIBPATH << installed_path
-
 create_makefile 'cs__common/cs__common'

data/ext/cs__protect_kernel/cs__protect_kernel.c

@@ -20,7 +20,7 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
          */
         VALUE wrapper;
         wrapper =
-            rb_funcall_with_block(rb_mKernel, rb_sym_protect_kernel_wrapper, 0,
+            rb_funcall_with_block(kernel_protect, rb_sym_protect_kernel_wrapper, 0,
                                    NULL, rb_block_proc());
         rb_funcall(rb_mKernel, rb_intern("public"), 1, ID2SYM(rb_sym_protect_kernel_fork));
         ret = rb_funcall_with_block(self, rb_sym_protect_kernel_fork, argc,
@@ -33,7 +33,9 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
 }
 
 void Init_cs__protect_kernel(void) {
-    rb_sym_protect_kernel_wrapper = rb_intern("cs__protect_build_wrapper");
+    VALUE core_protect = rb_define_module_under(core_extensions, "Protect");
+    kernel_protect = rb_define_module_under(core_protect, "Kernel");
+    rb_sym_protect_kernel_wrapper = rb_intern("build_wrapper");
 
     rb_sym_protect_kernel_fork = contrast_register_patch("Kernel",
                                                          "fork",

data/ext/cs__protect_kernel/cs__protect_kernel.h

@@ -2,6 +2,7 @@
 
 extern VALUE rb_vm_top_self(void);
 
+static VALUE kernel_protect;
 static VALUE rb_sym_protect_kernel_fork;
 static VALUE rb_sym_protect_kernel_wrapper;