contrast-agent 3.11.0 → 3.13.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (298) hide show
  1. checksums.yaml +4 -4
  2. data/.dockerignore +0 -1
  3. data/.flayignore +1 -0
  4. data/.gitignore +1 -1
  5. data/.simplecov +1 -1
  6. data/Rakefile +31 -0
  7. data/ext/build_funchook.rb +0 -2
  8. data/ext/cs__assess_active_record_named/cs__active_record_named.c +7 -2
  9. data/ext/cs__assess_active_record_named/cs__active_record_named.h +1 -0
  10. data/ext/cs__assess_array/cs__assess_array.c +2 -1
  11. data/ext/cs__assess_array/cs__assess_array.h +1 -0
  12. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +3 -7
  13. data/ext/cs__assess_basic_object/cs__assess_basic_object.h +2 -1
  14. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -8
  15. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +0 -1
  16. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  17. data/ext/cs__assess_module/cs__assess_module.c +5 -7
  18. data/ext/cs__assess_module/cs__assess_module.h +3 -0
  19. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -6
  20. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -5
  21. data/ext/cs__assess_yield_track/cs__assess_yield_track.h +0 -1
  22. data/ext/cs__common/cs__common.c +25 -1
  23. data/ext/cs__common/cs__common.h +3 -0
  24. data/ext/cs__common/extconf.rb +0 -14
  25. data/ext/cs__protect_kernel/cs__protect_kernel.c +4 -2
  26. data/ext/cs__protect_kernel/cs__protect_kernel.h +1 -0
  27. data/ext/extconf_common.rb +0 -28
  28. data/lib/contrast.rb +3 -2
  29. data/lib/contrast/agent.rb +33 -24
  30. data/lib/contrast/agent/assess.rb +0 -9
  31. data/lib/contrast/agent/assess/contrast_event.rb +28 -167
  32. data/lib/contrast/agent/assess/events/source_event.rb +3 -7
  33. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  34. data/lib/contrast/agent/assess/policy/patcher.rb +1 -0
  35. data/lib/contrast/agent/assess/policy/policy_node.rb +5 -99
  36. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  37. data/lib/contrast/agent/assess/policy/propagation_method.rb +4 -2
  38. data/lib/contrast/agent/assess/policy/propagation_node.rb +5 -1
  39. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  40. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  41. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -3
  42. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -4
  43. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +9 -1
  44. data/lib/contrast/agent/assess/policy/propagator/remove.rb +6 -11
  45. data/lib/contrast/agent/assess/policy/propagator/select.rb +4 -4
  46. data/lib/contrast/agent/assess/policy/propagator/split.rb +2 -2
  47. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +4 -4
  48. data/lib/contrast/agent/assess/policy/propagator/trim.rb +6 -10
  49. data/lib/contrast/agent/assess/policy/source_method.rb +1 -2
  50. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +90 -0
  51. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +57 -0
  52. data/lib/contrast/agent/assess/policy/trigger_method.rb +2 -14
  53. data/lib/contrast/agent/assess/policy/trigger_node.rb +20 -5
  54. data/lib/contrast/agent/assess/properties.rb +4 -382
  55. data/lib/contrast/agent/assess/property/evented.rb +78 -0
  56. data/lib/contrast/agent/assess/property/tagged.rb +339 -0
  57. data/lib/contrast/agent/assess/rule/base.rb +0 -15
  58. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +5 -6
  59. data/lib/contrast/agent/assess/rule/redos.rb +0 -1
  60. data/lib/contrast/agent/assess/tag.rb +27 -12
  61. data/lib/contrast/agent/at_exit_hook.rb +4 -2
  62. data/lib/contrast/agent/class_reopener.rb +9 -4
  63. data/lib/contrast/agent/exclusion_matcher.rb +2 -3
  64. data/lib/contrast/agent/inventory/policy/datastores.rb +53 -0
  65. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  66. data/lib/contrast/agent/middleware.rb +36 -44
  67. data/lib/contrast/agent/patching/policy/after_load_patch.rb +11 -2
  68. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +51 -56
  69. data/lib/contrast/agent/patching/policy/patch.rb +3 -2
  70. data/lib/contrast/agent/patching/policy/patcher.rb +10 -12
  71. data/lib/contrast/agent/patching/policy/policy.rb +3 -3
  72. data/lib/contrast/agent/patching/policy/policy_node.rb +3 -3
  73. data/lib/contrast/agent/patching/policy/trigger_node.rb +1 -1
  74. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +63 -0
  75. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +52 -0
  76. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +68 -0
  77. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +117 -0
  78. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +54 -0
  79. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +129 -0
  80. data/lib/contrast/agent/protect/policy/policy.rb +6 -6
  81. data/lib/contrast/agent/protect/policy/rule_applicator.rb +51 -0
  82. data/lib/contrast/agent/protect/rule.rb +0 -5
  83. data/lib/contrast/agent/protect/rule/base.rb +25 -36
  84. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  85. data/lib/contrast/agent/protect/rule/cmd_injection.rb +3 -3
  86. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +2 -7
  87. data/lib/contrast/agent/protect/rule/path_traversal.rb +2 -7
  88. data/lib/contrast/agent/protect/rule/sqli.rb +4 -4
  89. data/lib/contrast/agent/protect/rule/xxe.rb +1 -0
  90. data/lib/contrast/agent/railtie.rb +1 -0
  91. data/lib/contrast/agent/reaction_processor.rb +3 -3
  92. data/lib/contrast/agent/request.rb +91 -334
  93. data/lib/contrast/agent/request_context.rb +17 -18
  94. data/lib/contrast/agent/request_handler.rb +2 -2
  95. data/lib/contrast/agent/response.rb +2 -83
  96. data/lib/contrast/agent/scope.rb +1 -1
  97. data/lib/contrast/agent/service_heartbeat.rb +8 -10
  98. data/lib/contrast/agent/static_analysis.rb +2 -3
  99. data/lib/contrast/agent/thread_watcher.rb +49 -0
  100. data/lib/contrast/agent/version.rb +1 -1
  101. data/lib/contrast/agent/worker_thread.rb +24 -0
  102. data/lib/contrast/api.rb +3 -5
  103. data/lib/contrast/api/communication.rb +20 -0
  104. data/lib/contrast/api/communication/connection_status.rb +41 -0
  105. data/lib/contrast/api/communication/messaging_queue.rb +79 -0
  106. data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb} +15 -22
  107. data/lib/contrast/api/communication/service_lifecycle.rb +61 -0
  108. data/lib/contrast/api/communication/socket.rb +45 -0
  109. data/lib/contrast/api/communication/socket_client.rb +76 -0
  110. data/lib/contrast/api/communication/speedracer.rb +111 -0
  111. data/lib/contrast/api/communication/tcp_socket.rb +31 -0
  112. data/lib/contrast/api/communication/unix_socket.rb +27 -0
  113. data/lib/contrast/api/decorators.rb +10 -0
  114. data/lib/contrast/api/decorators/address.rb +60 -0
  115. data/lib/contrast/api/decorators/application_settings.rb +7 -3
  116. data/lib/contrast/api/decorators/application_update.rb +0 -9
  117. data/lib/contrast/api/decorators/http_request.rb +139 -0
  118. data/lib/contrast/api/decorators/message.rb +75 -0
  119. data/lib/contrast/api/decorators/rasp_rule_sample.rb +28 -0
  120. data/lib/contrast/api/decorators/route_coverage.rb +57 -0
  121. data/lib/contrast/api/decorators/trace_event.rb +99 -0
  122. data/lib/contrast/api/decorators/trace_event_object.rb +57 -0
  123. data/lib/contrast/api/decorators/trace_event_signature.rb +46 -0
  124. data/lib/contrast/api/decorators/trace_taint_range.rb +51 -0
  125. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +109 -0
  126. data/lib/contrast/api/decorators/user_input.rb +40 -0
  127. data/lib/contrast/components/agent.rb +17 -12
  128. data/lib/contrast/components/app_context.rb +27 -2
  129. data/lib/contrast/components/assess.rb +25 -15
  130. data/lib/contrast/components/config.rb +4 -9
  131. data/lib/contrast/components/contrast_service.rb +23 -67
  132. data/lib/contrast/components/interface.rb +5 -13
  133. data/lib/contrast/components/inventory.rb +5 -1
  134. data/lib/contrast/components/logger.rb +2 -2
  135. data/lib/contrast/components/protect.rb +40 -4
  136. data/lib/contrast/components/scope.rb +2 -52
  137. data/lib/contrast/components/settings.rb +18 -18
  138. data/lib/contrast/config/protect_rules_configuration.rb +0 -1
  139. data/lib/contrast/configuration.rb +2 -2
  140. data/lib/contrast/{extensions/ruby_core → extension}/assess.rb +12 -15
  141. data/lib/contrast/extension/assess/array.rb +77 -0
  142. data/lib/contrast/{extensions/ruby_core → extension}/assess/assess_extension.rb +3 -4
  143. data/lib/contrast/{extensions/ruby_core → extension}/assess/erb.rb +0 -0
  144. data/lib/contrast/extension/assess/eval_trigger.rb +78 -0
  145. data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb +1 -1
  146. data/lib/contrast/{extensions/ruby_core → extension}/assess/fiber.rb +7 -6
  147. data/lib/contrast/{extensions/ruby_core → extension}/assess/hash.rb +2 -2
  148. data/lib/contrast/extension/assess/kernel.rb +110 -0
  149. data/lib/contrast/{extensions/ruby_core → extension}/assess/regexp.rb +4 -4
  150. data/lib/contrast/{extensions/ruby_core → extension}/assess/string.rb +6 -6
  151. data/lib/contrast/{extensions/ruby_core → extension}/delegator.rb +0 -0
  152. data/lib/contrast/{extensions/ruby_core → extension}/inventory.rb +2 -3
  153. data/lib/contrast/extension/kernel.rb +54 -0
  154. data/lib/contrast/{extensions/ruby_core → extension}/module.rb +0 -0
  155. data/lib/contrast/{extensions/ruby_core → extension}/protect.rb +2 -2
  156. data/lib/contrast/extension/protect/kernel.rb +44 -0
  157. data/lib/contrast/{extensions/ruby_core → extension}/protect/psych.rb +1 -1
  158. data/lib/contrast/{extensions/ruby_core → extension}/thread.rb +0 -0
  159. data/lib/contrast/framework/base_support.rb +22 -23
  160. data/lib/contrast/framework/manager.rb +31 -15
  161. data/lib/contrast/framework/rack/patch/session_cookie.rb +126 -0
  162. data/lib/contrast/framework/rack/patch/support.rb +24 -0
  163. data/lib/contrast/framework/rack/support.rb +22 -0
  164. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +41 -0
  165. data/lib/contrast/framework/rails/patch/assess_configuration.rb +102 -0
  166. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +31 -0
  167. data/lib/contrast/framework/rails/patch/support.rb +67 -0
  168. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +34 -0
  169. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +39 -0
  170. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +73 -0
  171. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +33 -0
  172. data/lib/contrast/framework/rails/support.rb +86 -0
  173. data/lib/contrast/framework/sinatra/patch/base.rb +83 -0
  174. data/lib/contrast/framework/sinatra/patch/support.rb +27 -0
  175. data/lib/contrast/framework/sinatra/support.rb +98 -0
  176. data/lib/contrast/funchook/funchook.rb +45 -0
  177. data/lib/contrast/logger/application.rb +80 -0
  178. data/lib/contrast/logger/format.rb +51 -0
  179. data/lib/contrast/{agent/logger.rb → logger/log.rb} +39 -63
  180. data/lib/contrast/logger/time.rb +50 -0
  181. data/lib/contrast/tasks/config.rb +54 -0
  182. data/lib/contrast/tasks/service.rb +1 -5
  183. data/lib/contrast/utils/assess/tracking_util.rb +45 -20
  184. data/lib/contrast/utils/class_util.rb +4 -2
  185. data/lib/contrast/utils/gemfile_reader.rb +2 -2
  186. data/lib/contrast/utils/hash_digest.rb +13 -9
  187. data/lib/contrast/utils/invalid_configuration_util.rb +2 -18
  188. data/lib/contrast/utils/inventory_util.rb +2 -7
  189. data/lib/contrast/utils/job_servers_running.rb +4 -2
  190. data/lib/contrast/utils/object_share.rb +0 -2
  191. data/lib/contrast/utils/os.rb +16 -4
  192. data/lib/contrast/utils/stack_trace_utils.rb +0 -1
  193. data/lib/contrast/utils/tag_util.rb +1 -1
  194. data/lib/contrast/utils/thread_tracker.rb +1 -14
  195. data/lib/contrast/utils/timer.rb +1 -17
  196. data/resources/assess/policy.json +9 -50
  197. data/resources/inventory/policy.json +2 -2
  198. data/resources/protect/policy.json +6 -6
  199. data/ruby-agent.gemspec +9 -5
  200. data/service_executables/VERSION +1 -1
  201. data/service_executables/linux/contrast-service +0 -0
  202. data/service_executables/mac/contrast-service +0 -0
  203. metadata +103 -139
  204. data/funchook/Makefile +0 -29
  205. data/funchook/autom4te.cache/output.0 +0 -4964
  206. data/funchook/autom4te.cache/requests +0 -77
  207. data/funchook/autom4te.cache/traces.0 +0 -361
  208. data/funchook/config.log +0 -651
  209. data/funchook/config.status +0 -1015
  210. data/funchook/configure +0 -4964
  211. data/funchook/src/Makefile +0 -70
  212. data/funchook/src/config.h +0 -101
  213. data/funchook/src/config.h.in +0 -100
  214. data/funchook/src/decoder.o +0 -0
  215. data/funchook/src/distorm.o +0 -0
  216. data/funchook/src/funchook.o +0 -0
  217. data/funchook/src/funchook_io.o +0 -0
  218. data/funchook/src/funchook_syscall.o +0 -0
  219. data/funchook/src/funchook_unix.o +0 -0
  220. data/funchook/src/funchook_x86.o +0 -0
  221. data/funchook/src/instructions.o +0 -0
  222. data/funchook/src/insts.o +0 -0
  223. data/funchook/src/libfunchook.dylib +0 -0
  224. data/funchook/src/mnemonics.o +0 -0
  225. data/funchook/src/operands.o +0 -0
  226. data/funchook/src/os_func.o +0 -0
  227. data/funchook/src/os_func_unix.o +0 -0
  228. data/funchook/src/prefix.o +0 -0
  229. data/funchook/src/printf_base.o +0 -0
  230. data/funchook/src/textdefs.o +0 -0
  231. data/funchook/src/wstring.o +0 -0
  232. data/funchook/test/Makefile +0 -43
  233. data/funchook/test/funchook_test +0 -0
  234. data/funchook/test/libfunchook_test.so +0 -0
  235. data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist +0 -20
  236. data/funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so +0 -0
  237. data/funchook/test/test_main.o +0 -0
  238. data/funchook/test/x86_64_test.o +0 -0
  239. data/lib/contrast/agent/assess/adjusted_span.rb +0 -27
  240. data/lib/contrast/agent/assess/rule/csrf.rb +0 -66
  241. data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +0 -28
  242. data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +0 -53
  243. data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +0 -136
  244. data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +0 -47
  245. data/lib/contrast/agent/assess/rule/response_watcher.rb +0 -36
  246. data/lib/contrast/agent/assess/rule/watcher.rb +0 -36
  247. data/lib/contrast/agent/feature_state.rb +0 -346
  248. data/lib/contrast/agent/protect/rule/csrf.rb +0 -119
  249. data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +0 -100
  250. data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +0 -85
  251. data/lib/contrast/agent/settings_state.rb +0 -88
  252. data/lib/contrast/agent/socket_client.rb +0 -134
  253. data/lib/contrast/api/connection_status.rb +0 -49
  254. data/lib/contrast/api/decorators/exclusion.rb +0 -20
  255. data/lib/contrast/api/socket.rb +0 -43
  256. data/lib/contrast/api/speedracer.rb +0 -188
  257. data/lib/contrast/api/tcp_socket.rb +0 -29
  258. data/lib/contrast/api/unix_socket.rb +0 -25
  259. data/lib/contrast/extensions/framework/rack/cookie.rb +0 -24
  260. data/lib/contrast/extensions/framework/rack/request.rb +0 -24
  261. data/lib/contrast/extensions/framework/rack/response.rb +0 -23
  262. data/lib/contrast/extensions/framework/rails/action_controller_inheritance.rb +0 -39
  263. data/lib/contrast/extensions/framework/rails/action_controller_railties_helper_inherited.rb +0 -20
  264. data/lib/contrast/extensions/framework/rails/active_record.rb +0 -26
  265. data/lib/contrast/extensions/framework/rails/active_record_named.rb +0 -58
  266. data/lib/contrast/extensions/framework/rails/active_record_time_zone_inherited.rb +0 -21
  267. data/lib/contrast/extensions/framework/rails/buffer.rb +0 -28
  268. data/lib/contrast/extensions/framework/rails/configuration.rb +0 -27
  269. data/lib/contrast/extensions/framework/sinatra/base.rb +0 -59
  270. data/lib/contrast/extensions/ruby_core/assess/array.rb +0 -59
  271. data/lib/contrast/extensions/ruby_core/assess/basic_object.rb +0 -15
  272. data/lib/contrast/extensions/ruby_core/assess/kernel.rb +0 -96
  273. data/lib/contrast/extensions/ruby_core/assess/module.rb +0 -14
  274. data/lib/contrast/extensions/ruby_core/assess/tilt_template_trigger.rb +0 -78
  275. data/lib/contrast/extensions/ruby_core/assess/xpath_library_trigger.rb +0 -40
  276. data/lib/contrast/extensions/ruby_core/eval_trigger.rb +0 -51
  277. data/lib/contrast/extensions/ruby_core/inventory/datastores.rb +0 -37
  278. data/lib/contrast/extensions/ruby_core/protect/applies_command_injection_rule.rb +0 -61
  279. data/lib/contrast/extensions/ruby_core/protect/applies_deserialization_rule.rb +0 -50
  280. data/lib/contrast/extensions/ruby_core/protect/applies_no_sqli_rule.rb +0 -66
  281. data/lib/contrast/extensions/ruby_core/protect/applies_path_traversal_rule.rb +0 -115
  282. data/lib/contrast/extensions/ruby_core/protect/applies_sqli_rule.rb +0 -53
  283. data/lib/contrast/extensions/ruby_core/protect/applies_xxe_rule.rb +0 -127
  284. data/lib/contrast/extensions/ruby_core/protect/kernel.rb +0 -30
  285. data/lib/contrast/extensions/ruby_core/protect/rule_applicator.rb +0 -50
  286. data/lib/contrast/framework/rails_support.rb +0 -104
  287. data/lib/contrast/framework/sinatra_application_helper.rb +0 -49
  288. data/lib/contrast/framework/sinatra_support.rb +0 -104
  289. data/lib/contrast/framework/view_technologies_descriptor.rb +0 -21
  290. data/lib/contrast/internal_exception.rb +0 -8
  291. data/lib/contrast/utils/cache.rb +0 -58
  292. data/lib/contrast/utils/data_store_util.rb +0 -23
  293. data/lib/contrast/utils/rack_assess_session_cookie.rb +0 -104
  294. data/lib/contrast/utils/rails_assess_configuration.rb +0 -95
  295. data/lib/contrast/utils/random_util.rb +0 -22
  296. data/lib/contrast/utils/service_sender_util.rb +0 -110
  297. data/lib/contrast/utils/sinatra_helper.rb +0 -49
  298. data/resources/csrf/inject.js +0 -44

There are too many changes on this page to be displayed.

The amount of changes on this page would crash your brower.

You can still verify the content by downloading the gem file manually.