contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -89,14 +89,12 @@ module Contrast
 
               finding = Contrast::Api::Dtm::Finding.new
               finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
               finding.version = CURRENT_FINDING_VERSION
 
               build_from_source(finding, source)
               trigger_event = Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret, args).to_dtm_event
               finding.events << trigger_event
               build_hash(finding, source)
-              build_tags(context)
               finding.routes << context.route if context.route
               context.activity.findings << finding
               logger.trace('Finding created',
@@ -109,10 +107,6 @@ module Contrast
 
             private
 
-            def settings
-              Contrast::Agent::FeatureState.instance
-            end
-
             # This is our method that actually checks the taint on the object
             # our trigger_node targets.
             #
@@ -140,7 +134,7 @@ module Contrast
                 build_finding(context, trigger_node, source, object, ret, *args)
               end
             rescue StandardError => e
-              logger.warn('Unable to apply trigger', e, node_id: trigger_ndoe.id)
+              logger.warn('Unable to apply trigger', e, node_id: trigger_node.id)
             end
 
             # Given the marker from the trigger_node (the pointer indicating
@@ -234,7 +228,7 @@ module Contrast
               else
                 logger.warn('Trigger source is of unknown type. Unable to inspect.',
                             node_id: trigger_node.id,
-                            source_id: target.__id__,
+                            source_id: source.__id__,
                             source_type: source.cs__class.to_s)
                 logger.trace(source.to_s[0..99])
               end
@@ -269,12 +263,6 @@ module Contrast
               finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
             end
-
-            def build_tags context
-              return unless ASSESS.tags
-
-              context.activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,6 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/assess/policy/trigger/reflected_xss'
+cs__scoped_require 'contrast/agent/assess/policy/trigger/xpath'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+
 module Contrast
   module Agent
     module Assess
@@ -64,7 +68,7 @@ module Contrast
           end
 
           def rule_disabled?
-            Contrast::Agent::FeatureState.instance.assess_disabled_rules.include?(rule_id)
+            ASSESS.rule_disabled?(rule_id)
           end
 
           # Indicate if this is a dataflow based trigger, meaning it has a proper
@@ -164,8 +168,8 @@ module Contrast
 
             tags.each do |tag|
               raise(ArgumentError, "Rule #{ rule_id } had an invalid tag. #{ tag } is not a known value.") unless
-                  Contrast::Agent::Assess::Policy::PolicyNode::VALID_TAGS.include?(tag) ||
-                      Contrast::Agent::Assess::Policy::PolicyNode::VALID_SOURCE_TAGS.include?(tag)
+                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
+                      Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
             end
           end
 
@@ -188,10 +192,21 @@ module Contrast
             return find_ranges_by_any_tag(cs__properties, tags) if tags.length == 1
 
             ranges = []
+            # TODO: RUBY-946 clean this up, perhaps with
+            #   tags.each { |tag| applicable << cs__properties.fetch_tag(tag) }
+            #   return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless applicable.length == tags.length
+            #   ...
             # find all the indicies on the source that have all the given tags
             (0..length).each do |idx|
-              tags_at = cs__properties.tag_names_at(idx)
-              ranges << idx if tags.all? { |tag| tags_at.include?(tag) }
+              tags_at = cs__properties.tags_at(idx)
+              ranges << idx if tags.all? do |tag|
+                found = false
+                tags_at.each do |tag_at|
+                  found = tag_at.label == tag
+                  break if found
+                end
+                found
+              end
             end
             # break early if no indicies satisfy all the tags
             return Contrast::Utils::ObjectShare::EMPTY_ARRAY if ranges.empty?

data/lib/contrast/agent/assess/properties.rb

@@ -4,9 +4,8 @@
 cs__scoped_require 'set'
 cs__scoped_require 'base64'
 cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/events/event_factory'
-cs__scoped_require 'contrast/agent/assess/events/source_event'
+cs__scoped_require 'contrast/agent/assess/property/evented'
+cs__scoped_require 'contrast/agent/assess/property/tagged'
 
 module Contrast
   module Agent
@@ -19,6 +18,8 @@ module Contrast
       # user input.
       class Properties
         include Contrast::Utils::PreventSerialization
+        include Contrast::Agent::Assess::Property::Evented
+        include Contrast::Agent::Assess::Property::Tagged
 
         # CONTRAST-36937
         # Creating these on Properties is expensive. We want to delay this for
@@ -27,18 +28,6 @@ module Contrast
           @_properties ||= {}
         end
 
-        def events
-          @_events ||= []
-        end
-
-        def tracked?
-          tags? && tags.any?
-        end
-
-        def tagged? label
-          tags? && tags.key?(label)
-        end
-
         def add_properties hash
           return unless hash
 
@@ -50,373 +39,6 @@ module Contrast
 
           properties[name] = value
         end
-
-        def any_tags_between? start, finish
-          return false unless tags?
-
-          range = Contrast::Agent::Assess::Tag.new(start + finish, start)
-          tags.each_value do |tag_array|
-            return true if tag_array.any? { |tag| tag.overlaps?(range) }
-          end
-          false
-        end
-
-        # Find all of the ranges that span a given index. This is used
-        # in propagation when we need to shift tags about. For instance, in
-        # the append method when we need to see if any tag at the end needs
-        # to be expanded out to the size of the new String.
-        #
-        # Note: Tags do not know their key, so this is only the range covered
-        #
-        # @param idx [Integer] the index to check for tags
-        # @return [Array<Contrast::Agent::Assess::Tag>] a set of all the Tags
-        #   covering the given index. This is only the ranges, not the names.
-        def tags_at idx
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          at = []
-          tags.each_value do |tag_array|
-            tag_array.each do |tag|
-              if tag.covers?(idx)
-                at << tag
-              elsif tag.above?(idx)
-                break
-              end
-            end
-          end
-          at
-        end
-
-        # Find all of the tag names that span a given index.
-        #
-        # @param idx [Integer] the index to check for tags
-        # @return [Set<String>] a set of all the tags covering the given index.
-        #   This is only the names of the tags, not their ranges.
-        def tag_names_at idx
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          at = Set.new
-          tags.each_pair do |tag_name, tag_array|
-            tag_array.each do |tag|
-              if tag.covers?(idx)
-                at << tag_name
-              elsif tag.above?(idx)
-                break
-              end
-            end
-          end
-          at
-        end
-
-        # given a range, select all tags in that range the selected tags are
-        # shifted such that the start index of the new tag (0) aligns with the
-        # given start index in the range
-        #
-        # current tags: 5-15
-        # range       : 5-10
-        # result      : 0-05
-        def tags_at_range range
-          return Contrast::Utils::ObjectShare::EMPTY_HASH unless tags?
-
-          at = Hash.new { |h, k| h[k] = [] }
-          length = range.stop - range.start
-          tags.each_pair do |key, value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # BELOW and ABOVE are applicable to this check and are removed.
-              case comparison
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # the tag exists in the requested range, figure out the boundaries
-              when Contrast::Agent::Assess::Tag::WITHIN
-                start = tag.start_idx - range.start
-                finish = length - start
-                add << Contrast::Agent::Assess::Tag.new(finish, start)
-              # the tag spans the requested range.
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              end
-            end
-            next if add.empty?
-
-            at[key] = add
-          end
-          at
-        end
-
-        # Given a tag name and range object, add a new tag to this
-        # collection. If the given range touches an existing tag,
-        # we'll combine the two, adjusting the existing one and
-        # dropping this new one.
-        #
-        # @param label [String] the name of the tag
-        # @param range [Contrast::Agent::Assess::AdjustedSpan] the span that
-        #   the tag covers
-        def add_tag label, range
-          length = range.stop - range.start
-          tag = Contrast::Agent::Assess::Tag.new(length, range.start)
-          existing = fetch_tag(label)
-          tags[label] = Contrast::Utils::TagUtil.ordered_merge(existing, tag)
-        end
-
-        def set_tags label, tag_ranges
-          tags[label] = tag_ranges
-        end
-
-        # Remove all tags with a given label
-        def delete_tags label
-          return unless tags?
-
-          tags.delete(label)
-        end
-
-        # Reset the tag hash
-        def clear_tags
-          return unless tags?
-
-          tags.clear
-        end
-
-        # Returns a list of all current tag labels, most likely to be used for
-        # a splat operation
-        def tag_keys
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          tags.keys
-        end
-
-        # Calls merge to combine touching or overlapping tags
-        # Deletes empty tags
-        def cleanup_tags
-          return unless tags?
-
-          Contrast::Utils::TagUtil.merge_tags(tags)
-          tags.delete_if { |_, value| value.empty? }
-        end
-
-        # We'll use this as a helper method to retrieve tags from the hash.
-        # Because the hash auto-populates an empty array when we try to access
-        # a tag in it, we cannot use the [] method without side effect. To get
-        # around this, we'll use a fetch work around.
-        def fetch_tag label
-          return unless tags?
-
-          tags.fetch(label, nil)
-        end
-
-        # Convert the tags of this object into the TraceTaintRange requried to
-        # be sent to the service
-        def tags_to_dtm
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          ranges = []
-          tags.each_pair do |key, value|
-            next if value.empty?
-
-            value.each do |tag|
-              range = Contrast::Api::Dtm::TraceTaintRange.new
-              range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(key)
-              range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
-              ranges << range
-            end
-          end
-          ranges
-        end
-
-        # Remove all tags within the given ranges.
-        # This does not delete an entire tag if part of that tag is
-        # outside this range, meaning we may reduce sizes of tags
-        # or split them.
-        #
-        # If shift is true, it is assumed the characters at those ranges were
-        # removed. If shift is false, it is assumed those ranges were replaced
-        # by the same number of characters and no shift is needed.
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-15
-        def delete_tags_at_ranges ranges, shift = true
-          return unless tags?
-
-          # Stage one - delete the tags w/o changing their
-          # location.
-          ranges.each do |range|
-            remove_tags(range)
-          end
-
-          return unless shift
-
-          # the amount we've already removed from the string
-          shift = 0
-          # Stage two - shift the tags to the left to account
-          # for the sections that were deleted.
-          ranges.each do |range|
-            shift_tags_for_deletion(range, shift)
-            shift += (range.stop - range.start)
-          end
-
-          # Clean up and merge any touching tags
-          Contrast::Utils::TagUtil.merge_tags(tags)
-        end
-
-        # Shift all the tags in this object by the given ranges.
-        # This method assumes the ranges are sorted, meaning
-        # the leftmost (lowest) range is first
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-20
-        def shift_tags ranges
-          return unless tags?
-
-          ranges.each do |range|
-            shift_tags_for_insertion(range)
-          end
-        end
-
-        # Add an event to these properties. It will be used to build
-        # a trace if this object ends up in a trigger.
-        def add_event event
-          events << event
-          self
-        end
-
-        def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
-          add_event(event)
-          report_sources(tagged, event)
-        end
-
-        private
-
-        def report_sources tagged, event
-          return unless tagged && !tagged.to_s.empty?
-          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
-          return unless event&.source_type
-
-          current_request = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_request
-          return if current_request.observed_route.sources.any? { |source| source.type == event.forced_source_type && source.name == event.forced_source_name }
-
-          event_source_dtm = event.build_event_source_dtm
-          return unless event_source_dtm
-
-          current_request.observed_route.sources << event_source_dtm
-        end
-
-        # Because of the auto-fill thing, we should not allow direct access to
-        # the tags hash. Instead, the methods above should be used to do
-        # operations like add, delete, and fetch.
-        #
-        # CONTRAST-22914
-        # please do NOT expose this w/ an attr_reader / accessor. there are
-        # helper methods in this class that safely access the hash. the tags
-        # method is private to avoid the side effect of a direct lookup with
-        # `[]` adding an empty array to the hash.
-        def tags
-          @_tags ||= Hash.new { |h, k| h[k] = [] }
-        end
-
-        # Creating Tags is expensive and we check for Tags all the time on
-        # untracked things. ALWAYS!!! call this method before checking if
-        # an object has tags
-        def tags?
-          instance_variable_defined?(:@_tags)
-        end
-
-        # Remove the tag ranges covering the given range
-        def remove_tags range
-          return unless tags?
-
-          full_delete = []
-          tags.each_pair do |key, value|
-            remove = []
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # ABOVE and BELOW are not affected by this check
-              case comparison
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::WITHIN
-                remove << tag
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.stop)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                tag.update_start(range.stop)
-              end
-            end
-            value.delete_if { |tag| remove.include?(tag) }
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-            full_delete << key if value.empty?
-          end
-          full_delete.each { |key| tags.delete(key) }
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a deletion, meaning we
-        # have to move tags to the left
-        def shift_tags_for_deletion range, shift
-          return unless tags?
-
-          tags.each_value do |value|
-            value.each do |tag|
-              comparison = tag.compare_range(range.start - shift, range.stop - shift)
-              length = range.stop - range.start
-              case comparison
-              # this is really the only thing we need to shift
-              when Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(0 - length)
-              end
-            end
-          end
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a insertion, meaning we
-        # have to move tags to the right
-        def shift_tags_for_insertion range
-          return unless tags?
-
-          tags.each_value do |value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              length = range.stop - range.start
-              # BELOW is not affected by this check
-              case comparison
-              # part of the tag is being inserted on
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              # the tag exists in the inserted range. it is partially shifted
-              when Contrast::Agent::Assess::Tag::WITHIN
-                tag.shift(length)
-              # the tag spans the range. leave the part below alone
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(length)
-              end
-            end
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-          end
-        end
       end
     end
   end