contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -3,7 +3,7 @@
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+cs__scoped_require 'contrast/extension/assess/assess_extension'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -28,6 +28,7 @@ module Contrast
           INSERT_ACTION = 'INSERT'
           KEEP_ACTION = 'KEEP'
           NEXT_ACTION = 'NEXT'
+          NOOP_ACTION = 'NOOP'
           PREPEND_ACTION = 'PREPEND'
           REPLACE_ACTION = 'REPLACE'
           REMOVE_ACTION = 'REMOVE'
@@ -84,6 +85,7 @@ module Contrast
                 INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
                 KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
                 NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
+                NOOP_ACTION => nil,
                 PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
                 REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
                 REMOVE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Remove,
@@ -201,8 +203,7 @@ module Contrast
 
               length = Contrast::Utils::StringUtils.ret_length(target)
               propagation_node.tags.each do |tag|
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                target.cs__properties.add_tag(tag, span)
+                target.cs__properties.add_tag(tag, 0...length)
               end
             end
 
@@ -241,6 +242,7 @@ module Contrast
             end
 
             def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
+              return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
 
               # propagate all the tags from the sources to the target

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/policy/policy_node'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+
 module Contrast
   module Agent
     module Assess
@@ -73,7 +75,9 @@ module Contrast
             return unless untags
 
             untags.each do |tag|
-              raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.") unless VALID_TAGS.include?(tag)
+              unless Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag)
+                raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.")
+              end
               raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.") if tags&.include?(tag)
             end
           end

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -26,7 +26,7 @@ module Contrast
               end
 
               def propagate _propagation_node, _preshift, _target
-                raise NotImplementedError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
+                raise NoMethodError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -45,9 +45,7 @@ module Contrast
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  unless class_type < Contrast::CoreExtensions::Assess::AssessExtension
-                    class_type.send(:include, Contrast::CoreExtensions::Assess::AssessExtension)
-                  end
+                  class_type.send(:include, Contrast::Extension::Assess::AssessExtension) unless class_type < Contrast::Extension::Assess::AssessExtension
                   ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -35,10 +35,7 @@ module Contrast
                 # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
                 # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
                 insert_point = target.rindex(source, insert_point)
-
-                overflow = Contrast::Agent::Assess::AdjustedSpan.new(
-                    insert_point,
-                    insert_point + source.length)
+                overflow = insert_point...(insert_point + source.length)
 
                 # handle shifting the inserted range
                 target.cs__properties.shift_tags([overflow])

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -14,6 +14,8 @@ module Contrast
               def square_bracket_tagger propagation_node, preshift, ret, _block
                 if ret.is_a?(Array)
                   ret.each_with_index do |return_value, index|
+                    next unless return_value
+
                     target_matchdata_index = if preshift.args[0].is_a?(Range)
                                                arg_range = preshift.args[0]
                                                arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
@@ -32,6 +34,8 @@ module Contrast
 
               def captures_tagger propagation_node, preshift, ret, _block
                 ret.each_with_index do |return_value, index|
+                  next unless return_value
+
                   targetted_index = index + 1
                   square_bracket_single(targetted_index, preshift, return_value, propagation_node)
                 end
@@ -40,6 +44,8 @@ module Contrast
 
               def to_a_tagger propagation_node, preshift, ret, _block
                 ret.each_with_index do |return_value, index|
+                  next unless return_value
+
                   square_bracket_single(index, preshift, return_value, propagation_node)
                 end
                 ret
@@ -47,6 +53,8 @@ module Contrast
 
               def values_at_tagger propagation_node, preshift, ret, _block
                 ret.each_with_index do |return_value, return_index|
+                  next unless return_value
+
                   original_group_arg_index = preshift.args[return_index]
                   square_bracket_single(original_group_arg_index, preshift, return_value, propagation_node)
                 end
@@ -59,7 +67,7 @@ module Contrast
                 original_start_index = preshift.object.begin(argument_index)
                 original_end_index = preshift.object.end(argument_index)
                 original_properties = preshift.object.cs__properties
-                applicable_tags = original_properties.tags_at_range(Contrast::Agent::Assess::AdjustedSpan.new(original_start_index, original_end_index))
+                applicable_tags = original_properties.tags_at_range(original_start_index...original_end_index)
                 return if applicable_tags.empty?
 
                 applicable_tags.each do |tag_name, tag_ranges|

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -32,7 +32,7 @@ module Contrast
                 target_idx = 0
 
                 remove_ranges = []
-                current_range = nil
+                start = nil
 
                 # loop over the target, the result of the delete
                 # every range of characters that it differs from the source
@@ -44,13 +44,12 @@ module Contrast
                   source_char = source_chars[source_idx]
                   if target_char == source_char
                     target_idx += 1
-                    if current_range
-                      current_range.stop = source_idx
-                      remove_ranges << current_range
-                      current_range = nil
+                    if start
+                      remove_ranges << (start...source_idx)
+                      start = nil
                     end
                   else
-                    current_range ||= Contrast::Agent::Assess::AdjustedSpan.new(source_idx)
+                    start ||= source_idx
                   end
                   source_idx += 1
                 end
@@ -58,11 +57,7 @@ module Contrast
                 # once we're done looping over the target, anything left
                 # over is extra from the source that was deleted. tags
                 # applying to it need to be removed.
-                if source_idx != source_chars.length
-                  remove_ranges << Contrast::Agent::Assess::AdjustedSpan.new(
-                      source_idx,
-                      source_chars.length)
-                end
+                remove_ranges << (source_idx...source_chars.length) if source_idx != source_chars.length
 
                 # handle deleting the removed ranges
                 target.cs__properties.delete_tags_at_ranges(remove_ranges)

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -50,19 +50,19 @@ module Contrast
                 length = args[1] || 1
                 # (void) negative range
                 arg += source.length if arg.negative?
-                Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+                arg...(arg + length)
               end
 
               def handle_string arg, source
                 idx = source.index(arg)
-                Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+                idx...(idx + arg.length)
               end
 
               def handle_regexp args, arg, source
                 match_data = arg.match(source)
                 # nil has the same meaning as 0. use full match
                 group = args[1] || 0
-                Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+                match_data.begin(group)...match_data.end(group)
               end
 
               def handle_range arg, source
@@ -74,7 +74,7 @@ module Contrast
                 finish += source.length if finish.negative?
                 finish += 1 unless arg.exclude_end?
 
-                Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+                start...finish
               end
 
               def determine_select_range source, args

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -52,7 +52,7 @@ module Contrast
                 current_index = 0
                 target.each do |elem|
                   elem_length = elem.length
-                  range = Contrast::Agent::Assess::AdjustedSpan.new(current_index, current_index + elem_length)
+                  range = current_index...(current_index + elem_length)
                   tags = source.cs__properties.tags_at_range(range)
 
                   elem.cs__properties.clear_tags
@@ -139,7 +139,7 @@ module Contrast
               def instrument_string_split
                 if @_instrument_string_split.nil?
                   @_instrument_string_split = begin
-                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield?
+                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
                                                 true
                                               rescue StandardError => e
                                                 logger.error('Error loading split rb_yield patch', e)

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/duck_utils'
 
 module Contrast
   module Agent
@@ -109,7 +110,7 @@ module Contrast
                   last_idx = idx ? idx + 1 : nil
                   start_index = idx
                   end_index = idx + incoming.length
-                  ranges << Contrast::Agent::Assess::AdjustedSpan.new(start_index, end_index)
+                  ranges << (start_index...end_index)
                   break unless global
                 end
                 ret.cs__properties.delete_tags_at_ranges(ranges)
@@ -133,12 +134,11 @@ module Contrast
               end
 
               def pattern_gsub preshift, ret
-                return unless ret
+                return unless Contrast::Utils::DuckUtils.trackable?(ret)
 
                 source = preshift.object
                 source.cs__properties.tag_keys.each do |key|
-                  span = Contrast::Agent::Assess::AdjustedSpan.new(0, 1)
-                  ret.cs__properties.add_tag(key, span)
+                  ret.cs__properties.add_tag(key, 0...1)
                 end
               end
 

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -28,23 +28,19 @@ module Contrast
                 else
                   remove_ranges = []
                   ret_chars = ret.chars
-                  curr_span = nil
+                  start = nil
                   source_chars.each_with_index do |char, idx|
                     if ret_chars[idx] == char
-                      next unless curr_span
+                      next unless start
 
-                      curr_span.stop = idx
-                      remove_ranges << curr_span
-                      curr_span = nil
+                      remove_ranges << (start...idx)
+                      start = nil
                     else
-                      curr_span ||= Contrast::Agent::Assess::AdjustedSpan.new(idx)
+                      start ||= idx
                     end
                   end
                   # account for the last char being different
-                  if curr_span
-                    curr_span.stop = source_chars.length
-                    remove_ranges << curr_span
-                  end
+                  remove_ranges << (start...source_chars.length) if start
                   ret.cs__properties.delete_tags_at_ranges(remove_ranges, false)
                 end
 

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -12,7 +12,6 @@ cs__scoped_require 'set'
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/adjusted_span'
 cs__scoped_require 'contrast/agent/assess/policy/source_validation/source_validation'
 
 cs__scoped_require 'contrast/components/interface'
@@ -170,7 +169,7 @@ module Contrast
                 next unless Contrast::Agent::Assess::Policy::SourceValidation.valid?(tag, source_type, source_name)
 
                 length = Contrast::Utils::StringUtils.ret_length(target)
-                target.cs__properties.add_tag(tag, Contrast::Agent::Assess::AdjustedSpan.new(0, length))
+                target.cs__properties.add_tag(tag, 0...length)
                 target.cs__properties.add_properties(source_node.properties)
                 logger.trace('Source detected',
                              node_id: source_node.id,

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -0,0 +1,90 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Trigger
+          # This acts a trigger to handle the special cases of the Tilt
+          # library gem. Reflected XSS data may come into the trigger methods
+          # from these classes.
+          class ReflectedXss
+            class << self
+              NODE_HASH = {
+                  'class_name' => 'Tilt::Template',
+                  'instance_method' => true,
+                  'method_name' => 'render',
+                  'method_visibility' => 'public',
+                  'action' => 'CUSTOM',
+                  'source' => 'O,P0',
+                  'target' => 'R',
+                  'patch_class' => 'Contrast::Agent::Assess::Policy::Trigger::ReflectedXss',
+                  'patch_method' => 'xss_tilt_trigger'
+              }.cs__freeze
+              TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
+
+              def xss_tilt_trigger context, trigger_node, _source, object, ret, *args
+                scope = args[0]
+
+                erb_template_prerender = object.instance_variable_get(:@data)
+                interpolated_inputs = []
+                handle_binding_variables(scope, erb_template_prerender, ret, interpolated_inputs)
+
+                handle_local_variables(args, erb_template_prerender, ret, interpolated_inputs)
+
+                unless interpolated_inputs.empty?
+                  interpolated_inputs.each do |input|
+                    input.cs__properties.events.each do |event|
+                      ret.cs__properties.events << event
+                    end
+                  end
+                  ret.cs__properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+                end
+
+                if ret.cs__tracked?
+                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, interpolated_inputs)
+                end
+
+                ret
+              end
+
+              private
+
+              def handle_binding_variables scope, erb_template_prerender, ret, interpolated_inputs
+                binding_variables = scope.instance_variables
+
+                binding_variables.each do |bound_variable_sym|
+                  bound_variable_value = scope.instance_variable_get(bound_variable_sym)
+
+                  next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
+                  next unless erb_template_prerender.include?(bound_variable_sym.to_s)
+
+                  start_index = ret.index(bound_variable_value)
+                  next if start_index.nil?
+
+                  ret.cs__copy_from(bound_variable_value, start_index)
+                  interpolated_inputs << bound_variable_sym
+                end
+              end
+
+              def handle_local_variables args, erb_template_prerender, ret, interpolated_inputs
+                locals = args[1]
+                locals.each do |local_name, local_value|
+                  next unless local_value.cs__respond_to?(:cs__tracked?) && local_value.cs__tracked?
+                  next unless erb_template_prerender.include?(local_name.to_s)
+
+                  start_index = ret.index(local_value)
+                  next if start_index.nil?
+
+                  ret.cs__copy_from(local_value, start_index)
+                  interpolated_inputs << local_name
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Trigger
+          # This acts a trigger to handle the special cases of the XPath
+          # library gem and the Oga gem. Untrusted data may come into the
+          # trigger methods from these classes as an array or hash,
+          # respectively. Since untrusted user input comes into these triggers
+          # as a splat argument or an options hash, we need to iterate through
+          # these objects to see if we were tracking on any of them and report
+          # a finding if so.
+          class Xpath
+            include Contrast::Components::Interface
+
+            class << self
+              def xpath_expression_trigger context, trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                process(context, trigger_node, object, ret, *args)
+              end
+
+              def xpath_oga_trigger context, trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                # convert the options arg in Oga::XML::CharacterNode#initialize into an
+                # array of its values so we can check if any are unsafe
+                args = args.first.values if args.first.cs__is_a?(Hash)
+                process(context, trigger_node, object, ret, *args)
+              end
+
+              private
+
+              def process context, trigger_node, object, ret, *args
+                args.each do |arg|
+                  next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
+                  next unless arg.cs__tracked?
+                  next unless trigger_node.violated?(arg)
+
+                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                      context, trigger_node, arg, object, ret, args)
+                end
+
+                ret
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end