contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -45,7 +45,7 @@ module Contrast
 
           def instrument_basic_object_track
             @_instrument_basic_object_track ||= begin
-                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               require 'cs__assess_basic_object/cs__assess_basic_object'
                                                true
                                              end
           rescue StandardError, LoadError => e
@@ -55,7 +55,7 @@ module Contrast
 
           def instrument_module_track
             @_instrument_module_track ||= begin
-                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               require 'cs__assess_module/cs__assess_module'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/at_exit_hook'
 
 module Contrast
   module Extension

data/lib/contrast/extension/assess/fiber.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -99,7 +99,7 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+                require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
                 true
               end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/hash.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -17,7 +17,9 @@ module Contrast
             return object unless object.is_a?(String) && !object.cs__frozen?
             return object unless object.cs__tracked?
 
-            object.dup.cs__freeze
+            ret = object.dup
+            object.cs__transfer_properties(ret)
+            ret.cs__freeze
           rescue StandardError
             # we'll rescue this error, but we can't log it here as that will
             # result in a seg fault
@@ -25,7 +27,7 @@ module Contrast
 
           def instrument_hash_track
             @_instrument_hash_track ||= begin
-                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
+                                            require 'cs__assess_hash/cs__assess_hash'
                                             true
                                           end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/exec_trigger'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/exec_trigger'
 
 module Contrast
   module Extension
@@ -56,11 +56,12 @@ module Contrast
 
           def track_sprintf result, format_string, args
             handle_sprintf_value(format_string, result)
-            if args.is_a?(String)
+            case args
+            when String
               handle_sprintf_value(args, result)
-            elsif args.is_a?(Hash)
+            when Hash
               handle_sprintf_hash(args, result)
-            elsif args.is_a?(Array)
+            when Array
               handle_sprintf_array args, result
             end
 
@@ -73,7 +74,7 @@ module Contrast
 
           def instrument_kernel_track
             @_instrument_fiber_variables ||= begin
-                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               require 'cs__assess_kernel/cs__assess_kernel'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/marshal.rb

@@ -0,0 +1,62 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      # This module is used for our Marshal#load patches
+      class MarshalPropagator
+        include Contrast::Components::Interface
+
+        access_component :logging
+
+        class << self
+          def cs__load_trigger_check source, ret
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                current_context,
+                trigger_node('Marshal', :load),
+                source,
+                self,
+                ret,
+                source)
+            ret.cs__copy_from(source) if ret.cs__respond_to?(:cs__copy_from)
+          rescue StandardError => e
+            logger.error('Unable to determine if a trigger occurred in Marshal.load', e)
+          end
+
+          def instrument_marshal_load
+            @_instrument_marshal_load ||= begin
+                                            require 'cs__assess_marshal_module/cs__assess_marshal_module'
+                                            true
+                                          end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading marshal load patch', e)
+            false
+          end
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/regexp.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -70,7 +70,7 @@ module Contrast
 
           def instrument_regexp_track
             @_instrument_regexp_track ||= begin
-                                               cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
+                                               require 'cs__assess_regexp/cs__assess_regexp'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/string.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
 # litter our code with Contrast::Utils::DuckUtils.trackable? checks.
@@ -54,7 +54,7 @@ module Contrast
 
           def instrument_string
             @_instrument_string ||= begin
-                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
+                                      require 'cs__assess_string/cs__assess_string'
                                       true
                                     end
           rescue StandardError, LoadError => e
@@ -65,8 +65,8 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                                                    if AGENT.patch_interpolation? && Funchook.available?
+                                                      require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
                                                   rescue StandardError, LoadError => e

data/lib/contrast/extension/inventory.rb

@@ -11,12 +11,11 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/internal_exception'
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/inventory/policy/policy'
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
     end
   end
 end

data/lib/contrast/extension/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/scope'
+require 'contrast/components/scope'
 
 # This is a reasonable place for the Kernel#catch hook to live.
 # No current plans for component re-design, but if we had some kind of

data/lib/contrast/extension/module.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 # Some developers override various methods on Module, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being

data/lib/contrast/extension/protect.rb

@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -30,7 +30,7 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               require 'cs__protect_kernel/cs__protect_kernel'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -23,13 +23,6 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
         # Find all the predefined routes for this application and append them to the
         # provided inventory message
         # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
@@ -73,22 +66,6 @@ module Contrast
         def streaming? _env
           false
         end
-
-        protected
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        def scan_view_directories view_technology_descriptors
-          view_technology_descriptors.reject(&:empty?)
-        end
       end
     end
   end

data/lib/contrast/framework/manager.rb

@@ -1,13 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/rack/support'
-cs__scoped_require 'contrast/framework/rails/support'
-cs__scoped_require 'contrast/framework/sinatra/support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/framework/platform_version'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
@@ -59,10 +58,6 @@ module Contrast
         patches
       end
 
-      def find_applicable_view_technologies
-        scan_views_for_all_frameworks
-      end
-
       def find_route_discovery_data
         routes_for_all_frameworks
       end
@@ -124,10 +119,6 @@ module Contrast
         Contrast::Utils::ClassUtil.truly_defined?(klass)
       end
 
-      def scan_views_for_all_frameworks
-        data_for_all_frameworks :scan_views
-      end
-
       def routes_for_all_frameworks
         data_for_all_frameworks :collect_routes
       end
@@ -137,10 +128,9 @@ module Contrast
       # @param method_name [Symbol] the method to call on each FrameworkSupport class
       # @return [Array]
       def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
+        @_frameworks.flat_map do |framework|
           framework.send(method_name)
         end.compact
-        data
       end
 
       # This returns a single object from the first framework to successfully respond

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rack/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/service_sender_util'
-
 module Contrast
   module Framework
     module Rails
@@ -15,7 +13,7 @@ module Contrast
               return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
 
               [context.server_activity, context.activity, context.observed_route].each do |msg|
-                Contrast::Utils::ServiceSenderUtil.send_event_immediately(msg)
+                Contrast::Agent.messaging_queue.send_event_immediately(msg)
               end
             end