contrast-agent 3.12.1 → 3.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b2d4359b44c796de0747e2234dbd2a4f418c7392ff7238a247dfcf0d9bbb10f6
-  data.tar.gz: 39131596bd4eb2625c32cd71971ad772c6b5af5540bdfb2b662a1278e24a708b
+  metadata.gz: c3ef67bfca5c3d772078af285e4b3fa1ab314b06af04355db1aa50cce0d284e8
+  data.tar.gz: 5eb0fe6b5dba8f64b5947c1c7cade90718b18224b62b5e02eed470613e6fbe6d
 SHA512:
-  metadata.gz: 38a99de9a280a7334986aaa62f63b73f2c948acf01c1d927b98f3a1ab0dee7da69b0a9bbbca39aad61d8bbcd7a38bd2c4218cff74d37703f63057b23b6e9bca4
-  data.tar.gz: f6137708523bd8d0c9b995d03002b028f7f7eacf41e0e00ba85d11a6996d7486370b387d295ac060d99b91df7b594bf36d87c55043187116ff1914bec3ff69c9
+  metadata.gz: caf748a141fe652cbb1cb3e658969820b22ca4e58a11cdc46ee9bc94932c00e031b186b96e8c44b884d6f658951e8936a75444aa4d52cb9d0d5e563ab29ef26b
+  data.tar.gz: b3235852bb77977f244beed747b032bfa6e80eb86ebdcfab622a8dba7acc7a939f87e08022a07e795d2c455ec3d3107771e5cdae0d5b893a4c6019f09945db43

data/.dockerignore

@@ -4,7 +4,6 @@ docker/
 code-deploy/
 
 Jenkinsfile
-bitbucket-pipelines.yml
 docker-compose.yml
 .rubocop.yml
 .travis.yml

data/.gitignore

@@ -52,7 +52,7 @@ contrast-agent-*.gem
 service_executables/*-*
 
 # Generated Protobuf files
-/lib/contrast/api/*_pb.rb
+/lib/contrast/api/*.pb.rb
 
 # IDE stuff
 tags

data/.simplecov

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-SimpleCov.minimum_coverage line: 92.30
+SimpleCov.minimum_coverage line: 94.75
 SimpleCov.start do
   add_filter '/spec/'
 end

data/Rakefile

@@ -1,9 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+$stdout.sync = true
+
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rake/extensiontask'
+load 'protobuf/tasks/compile.rake'
+require 'fileutils'
 
 CLOBBER << 'shared_libraries/*'
 
@@ -13,3 +17,30 @@ Dir['ext/cs__*'].each do |extension|
     ext.lib_dir = "lib/#{ name }"
   end
 end
+
+task :contrast_pb_compile do
+  # do some stuff before compile
+
+  # Invoke the protobuf compile task with your sensible defaults
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/dtm.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ::Rake::Task['protobuf:compile'].reenable
+
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/settings.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ['dtm.pb.rb', 'settings.pb.rb'].each do |target_file|
+    target_path = File.absolute_path(File.join(__dir__, "./lib/contrast/api/#{ target_file }"))
+    unless File.exist?(target_path)
+      puts "File not found #{ target_path }"
+      exit 1
+    end
+  end
+
+  puts 'Protobuf copied successfully'
+end

data/exe/contrast_service

@@ -3,19 +3,13 @@
 # frozen_string_literal: true
 
 def mac?
-  RUBY_PLATFORM.match?(/darwin/)
-end
-
-def windows?
-  RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
+  RUBY_PLATFORM.include?('darwin')
 end
 
 def path
   base_path = "#{ File.dirname(__FILE__) }/.."
   if mac?
     "#{ base_path }/service_executables/mac/contrast-service"
-  elsif windows?
-    "#{ base_path }/service_executables/windows/contrast-service.exe"
   else
     "#{ base_path }/service_executables/linux/contrast-service"
   end

data/ext/build_funchook.rb

@@ -62,5 +62,3 @@ unless find_header('funchook.h', ext_path)
     end
   end
 end
-
-have_header('funchook.h', ext_path)

data/ext/cs__assess_active_record_named/cs__active_record_named.c

@@ -2,8 +2,8 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__active_record_named.h"
-#include <ruby.h>
 #include "../cs__common/cs__common.h"
+#include <ruby.h>
 
 VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
                                           const VALUE self) {
@@ -19,7 +19,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
      */
     VALUE new_body, ret;
     VALUE new_args[3];
-    new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self, argv[0], argv[1]);
+    new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
+                          argv[0], argv[1]);
     new_args[0] = argv[0];
     if (NIL_P(new_body)) {
         new_args[1] = argv[1];
@@ -36,10 +37,10 @@ void Init_cs__assess_active_record_named(void) {
     framework = rb_define_module_under(contrast, "Framework");
     rails = rb_define_module_under(framework, "Rails");
     rewrite = rb_define_module_under(rails, "Rewrite");
-    active_record_named = rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
+    active_record_named =
+        rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
     rb_sym_assess_rewrite = rb_intern("rewrite");
-    rb_sym_assess_scope   = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
-                                                    "scope",
-                                                    contrast_assess_active_record_scope);
+    rb_sym_assess_scope =
+        contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
+                                "scope", contrast_assess_active_record_scope);
 }
-

data/ext/cs__assess_array/cs__assess_array.c

@@ -23,15 +23,16 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     /* Finally, default to empty String. Implicit since nil.to_s is ''*/
 
     result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
-    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3, ary, sep, result);
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
+                        ary, sep, result);
 
     return result;
 }
 
 void Init_cs__assess_array(void) {
-    array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
+    array_propagator =
+        rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
-    rb_sym_assess_array_join = contrast_register_patch("Array",
-                                                       "join",
-                                                       contrast_assess_array_join);
+    rb_sym_assess_array_join =
+        contrast_register_patch("Array", "join", contrast_assess_array_join);
 }

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -7,7 +7,8 @@
 
 void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
                                                  VALUE ret) {
-    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self, source, ret);
+    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
+               source, ret);
 }
 
 VALUE
@@ -36,7 +37,8 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_basic_object(void) {
-    basic_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
+    basic_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
 
     /* We don't keep a reference to the underlying method.
@@ -45,8 +47,6 @@ void Init_cs__assess_basic_object(void) {
      * but if someone else patched BasicObject#instance_eval,
      * IDK if this is intentional... noting it.  -ajm
      */
-    contrast_register_patch("BasicObject",
-                            "instance_eval",
+    contrast_register_patch("BasicObject", "instance_eval",
                             contrast_assess_basic_object_instance_eval);
-
 }

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_fiber_track.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
@@ -64,22 +63,18 @@ VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
 }
 
 int install_fiber_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_fiber_new_original = rb_fiber_new;
-    funchook_prepare(funchook, (void **)&rb_fiber_new_original,
-                     rb_fiber_new_hook);
+    patch_via_funchook(&rb_fiber_new_original, &rb_fiber_new_hook);
 
     rb_fiber_yield_original = rb_fiber_yield;
-    funchook_prepare(funchook, (void **)&rb_fiber_yield_original,
-                     rb_fiber_yield_hook);
+    patch_via_funchook(&rb_fiber_yield_original, &rb_fiber_yield_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 
 void Init_cs__assess_fiber_track(void) {
-    fiber_propagator = rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
+    fiber_propagator =
+        rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
     track_rb_fiber_new = rb_intern("track_rb_fiber_new");
     track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
     rb_sym_next = rb_intern("next");

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -1,4 +1,3 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_sym_next;

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -12,23 +12,24 @@
  * This method instruments that unique bracket-construction style
  * of initializing a hash.
  */
-static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
-                                              const VALUE hash) {
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
+                                                      const VALUE hash) {
     VALUE result;
 
     /* Array of Arrays: Hash[ [ [key, value], ... ] ]   -> new_hash */
     if (RB_TYPE_P(argv[0], T_ARRAY)) {
         int i;
         for (i = 0; i < argc; i++) {
-            argv[i] =
-                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
         /* Hash[ key, value, ... ]         -> new_hash */
     } else if (argc > 1) {
         int i;
         for (i = 0; i < argc; i += 2) {
-            argv[i] =
-                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
     }
 
@@ -36,7 +37,8 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *arg
      * String keys
      * # Hash[ object ]                  -> new_hash
      */
-    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
+    result =
+        rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
 
     return result;
 }
@@ -61,8 +63,9 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
      * We haven't revisited this approach since we started more extensively
      * hooking public C functions.)
      */
-    if(argc > 0) {
-        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[0]);
+    if (argc > 0) {
+        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
+                             1, argv[0]);
     }
     /* This is the underlying assignment, w/ our instrumented key. */
     result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
@@ -71,17 +74,15 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
 }
 
 void Init_cs__assess_hash(void) {
-    hash_propagator = rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
+    hash_propagator =
+        rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
     rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
 
     VALUE hash_class = rb_define_class("Hash", rb_cObject);
 
-    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch("Hash",
-                                                                               "[]",
-                                                                               contrast_assess_hash_bracket_constructor);
-
-    rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
-                                                                "[]=",
-                                                                contrast_assess_hash_bracket_set);
+    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
+        "Hash", "[]", contrast_assess_hash_bracket_constructor);
 
+    rb_sym_assess_hash_bracket_equals = contrast_register_patch(
+        "Hash", "[]=", contrast_assess_hash_bracket_set);
 }

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -13,7 +13,8 @@ static VALUE hash_propagator;
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
  * -HM
  */
-static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
                                                       const VALUE hash);
 
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -18,8 +18,9 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
         rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
     }
 
-    /* maybe this should be rb_funcall2.  this works right now because *argv == argv[0].
-     * exec shouldn't ever be called with != 1 argc, so not a huge problem */
+    /* maybe this should be rb_funcall2.  this works right now because *argv ==
+     * argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
+     * problem */
     return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
 }
 
@@ -27,12 +28,10 @@ void Init_cs__assess_kernel(void) {
     kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
-    rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
-                                                        "exec",
-                                                        contrast_patched_kernel_exec);
+    rb_sym_assess_kernel_exec =
+        contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
 
     /* should return the same value as above */
-    rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
-                                                                  "exec",
-                                                                  contrast_patched_kernel_exec);
+    rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
+        "Kernel", "exec", contrast_patched_kernel_exec);
 }

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -9,7 +9,6 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
                                                  const VALUE *argv) {
     VALUE result;
     VALUE source_string;
-
     result = rb_call_super(argc, argv);
 
     if (argc >= 1) {
@@ -27,7 +26,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
                         rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
                     rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
                                2, source_string, result);
-                    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
+                    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
                 }
             }
         }
@@ -36,9 +35,9 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 }
 
 void Init_cs__assess_marshal_module(void) {
+    marshal_module = rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
     rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
 
-    contrast_register_singleton_prepend_patch("Marshal",
-                                              "load",
-                                              &contrast_assess_marshal_module_load);
+    contrast_register_singleton_prepend_patch(
+        "Marshal", "load", &contrast_assess_marshal_module_load);
 }

data/ext/cs__assess_module/cs__assess_module.c

@@ -21,7 +21,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
+                   ret, method);
     }
 
     rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -57,7 +58,8 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_module(void) {
-    module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
+    module_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     trigger_check_method = rb_intern("eval_trigger_check");
 
     rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
@@ -69,11 +71,9 @@ void Init_cs__assess_module(void) {
      * See similar comments in basic_object C ext patch.
      */
 
-    contrast_register_patch("Module",
-                            "class_eval",
+    contrast_register_patch("Module", "class_eval",
                             contrast_assess_module_class_eval);
 
-    contrast_register_patch("Module",
-                            "module_eval",
+    contrast_register_patch("Module", "module_eval",
                             contrast_assess_module_module_eval);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -29,7 +29,8 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
 }
 
 void Init_cs__assess_regexp(void) {
-    regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
+    regexp_propagator =
+        rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
     rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
 
     /* These are the keys we use to define our hash of
@@ -46,7 +47,6 @@ void Init_cs__assess_regexp(void) {
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
 
-    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
-                                                                  "=~",
-                                                                  contrast_assess_regexp_equal_squiggle);
+    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
+        "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_string/cs__assess_string.c

@@ -6,7 +6,7 @@
 #include <ruby.h>
 
 static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
-                                              const VALUE obj) {
+                                           const VALUE obj) {
     VALUE dup, tracked;
     if (!OBJ_FROZEN(obj)) {
         tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -17,6 +17,7 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
              * string.c, but we ignore any other monkey patches on String#-@
              */
             dup = rb_funcall(obj, rb_sym_dup, 0);
+            rb_funcall(obj, rb_intern("cs__transfer_properties"), 1, dup);
             rb_funcall(dup, rb_sym_freeze, 0);
             return dup;
         }
@@ -25,11 +26,26 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
     return rb_funcall(obj, rb_sym_assess_string_uminus, 0);
 }
 
+static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
+                                           const VALUE obj) {
+    if (!OBJ_FROZEN(obj)) {
+        // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
+        rb_funcall(properties_hash, rb_intern("pre_freeze"), 1, obj);
+    }
+    return rb_funcall(obj, rb_sym_assess_string_freeze, 0);
+}
+
 void Init_cs__assess_string(void) {
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
 
-    rb_sym_assess_string_uminus = contrast_register_patch("String",
-                                                          "-@",
-                                                          &contrast_assess_string_uminus);
+    // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
+    VALUE finalizers = rb_define_module_under(assess, "Finalizers");
+    VALUE finalize = rb_define_module_under(finalizers, "Finalize");
+    properties_hash = rb_const_get(finalize, rb_intern("PROPERTIES_HASH"));
+
+    rb_sym_assess_string_uminus =
+        contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
+    rb_sym_assess_string_freeze = contrast_register_patch(
+        "String", "freeze", &contrast_assess_string_freeze);
 }