contrast-agent 3.12.1 → 3.14.0

data/ext/cs__protect_kernel/cs__protect_kernel.c

@@ -10,7 +10,7 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
     VALUE ret;
     if (rb_block_given_p()) {
         /* We call our hook, but it's a little complicated.
-         * We wrap the fork block with our own lambda in 
+         * We wrap the fork block with our own lambda in
          * order to instrument it.  There are no public
          * methods in the Ruby C API to set the prevailing
          * block, so we have to use rb_funcall_with_block.
@@ -20,12 +20,14 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
          */
         VALUE wrapper;
         wrapper =
-            rb_funcall_with_block(kernel_protect, rb_sym_protect_kernel_wrapper, 0,
-                                   NULL, rb_block_proc());
-        rb_funcall(rb_mKernel, rb_intern("public"), 1, ID2SYM(rb_sym_protect_kernel_fork));
+            rb_funcall_with_block(kernel_protect, rb_sym_protect_kernel_wrapper,
+                                  0, NULL, rb_block_proc());
+        rb_funcall(rb_mKernel, rb_intern("public"), 1,
+                   ID2SYM(rb_sym_protect_kernel_fork));
         ret = rb_funcall_with_block(self, rb_sym_protect_kernel_fork, argc,
                                     argv, wrapper);
-        rb_funcall(rb_mKernel, rb_intern("private"), 1, ID2SYM(rb_sym_protect_kernel_fork));
+        rb_funcall(rb_mKernel, rb_intern("private"), 1,
+                   ID2SYM(rb_sym_protect_kernel_fork));
     } else {
         ret = rb_funcall2(self, rb_sym_protect_kernel_fork, argc, argv);
     }
@@ -37,12 +39,9 @@ void Init_cs__protect_kernel(void) {
     kernel_protect = rb_define_module_under(core_protect, "Kernel");
     rb_sym_protect_kernel_wrapper = rb_intern("build_wrapper");
 
-    rb_sym_protect_kernel_fork = contrast_register_patch("Kernel",
-                                                         "fork",
-                                                         &contrast_protect_fork);
-
-    rb_sym_protect_kernel_fork = contrast_register_singleton_patch("Kernel",
-                                                                   "fork",
-                                                                   &contrast_protect_fork);
+    rb_sym_protect_kernel_fork =
+        contrast_register_patch("Kernel", "fork", &contrast_protect_fork);
 
+    rb_sym_protect_kernel_fork = contrast_register_singleton_patch(
+        "Kernel", "fork", &contrast_protect_fork);
 }

data/ext/cs__protect_kernel/cs__protect_kernel.h

@@ -6,7 +6,7 @@ static VALUE kernel_protect;
 static VALUE rb_sym_protect_kernel_fork;
 static VALUE rb_sym_protect_kernel_wrapper;
 
-static VALUE
-contrast_protect_fork(const int argc, const VALUE *argv, const VALUE self);
+static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
+                                   const VALUE self);
 
 void Init_cs__protect_kernel(void);

data/ext/extconf_common.rb

@@ -18,34 +18,6 @@ def ext_path
   __dir__
 end
 
-def rpath_root
-  if (/darwin/ =~ RUBY_PLATFORM).nil?
-    '\$${ORIGIN}'
-  else
-    '@loader_path'
-  end
-end
-
-def funchook_rpath!
-  options = " -Wl,-rpath,#{ rpath_root }/../../shared_libraries"
-  raise unless try_link('int main() {return 0;}', options)
-
-  $LDFLAGS << options
-  $LDFLAGS << " -L#{ __dir__ }/../shared_libraries"
-
-  find_header('funchook.h', ext_path)
-  have_header('funchook.h')
-
-  find_library('funchook', 'funchook_create', '../shared_libraries')
-  find_library('funchook', 'funchook_install')
-  find_library('funchook', 'funchook_prepare')
-  have_library('funchook', 'funchook_create')
-  have_library('funchook', 'funchook_install')
-  have_library('funchook', 'funchook_prepare')
-end
-
 require_relative './build_funchook'
 
-# default make pathway, here for convenience
-funchook_rpath!
 make!

data/lib/contrast-agent.rb

@@ -5,4 +5,4 @@
 # want to go through the trouble of renaming to contrast_agent.gem, which we
 # shouldn't do until we're ready to go to RubyGems
 
-require_relative './contrast' # rubocop:disable  Kernel/RequireRelative
+require_relative './contrast'

data/lib/contrast.rb

@@ -1,6 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+# Used to prevent deprecation warnings from flooding stdout
+ENV['PB_IGNORE_DEPRECATIONS'] = 'truee'
+
 # Top-level namespace for Contrast Security agent
 module Contrast
 end
@@ -22,36 +25,25 @@ class Object
   alias_method :cs__singleton_class, :singleton_class
 end
 
-require_relative './contrast/agent/require_state' # rubocop:disable  Kernel/RequireRelative
-
-# We have to do this here BEOFRE we require anything b/c we can't use the
-# Contrast require methods without it.
-module Kernel
-  def cs__scoped_require path
-    Contrast::Agent::RequireStates.enter
-    require(path) # rubocop:disable  Kernel/Require
-  ensure
-    Contrast::Agent::RequireStates.exit
-  end
-end
-
 # component interface for class creation
 # config gets built as a consequence of this require
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
+
+# This needs to be required very early, after component interfaces, and before instrumentation attempts
+require 'contrast/funchook/funchook'
 
 # shared configuration support
-cs__scoped_require 'contrast/config'
-cs__scoped_require 'contrast/configuration'
+require 'contrast/config'
+require 'contrast/configuration'
 
-cs__scoped_require 'contrast/agent/version'
+require 'contrast/agent/version'
 
 # errors and exceptions
-cs__scoped_require 'contrast/security_exception'
-cs__scoped_require 'contrast/internal_exception'
+require 'contrast/security_exception'
 
 # shared utils
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/preflight_util'
+require 'contrast/utils/timer'
+require 'contrast/utils/preflight_util'
 
-cs__scoped_require 'contrast/utils/assess/sampling_util'
-cs__scoped_require 'contrast/agent'
+require 'contrast/utils/assess/sampling_util'
+require 'contrast/agent'

data/lib/contrast/agent.rb

@@ -1,45 +1,50 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'English'
+require 'English'
 
 # This must precede other Contrast C extensions
-cs__scoped_require 'cs__common/cs__common'
+require 'cs__common/cs__common'
 # This must precede any patching we do as we log patches and we shouldn't cause
 # requires to happen during that process.
-cs__scoped_require 'contrast/components/logger'
+require 'contrast/components/logger'
 
 # defining instrumentation, this must precede core extensions
 # because they need to register their patches
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/agent/patching/policy/patch'
 
 # core extensions
-cs__scoped_require 'contrast/extension/assess'
-cs__scoped_require 'contrast/extension/delegator'
-cs__scoped_require 'contrast/extension/inventory'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/extension/protect'
-cs__scoped_require 'contrast/extension/protect/kernel'
+require 'contrast/extension/assess'
+require 'contrast/extension/delegator'
+require 'contrast/extension/inventory'
+require 'contrast/extension/module'
+require 'contrast/extension/protect'
+require 'contrast/extension/protect/kernel'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/boolean_util'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/io_util'
-cs__scoped_require 'contrast/utils/os'
+require 'contrast/utils/object_share'
+require 'contrast/utils/boolean_util'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/io_util'
+require 'contrast/utils/os'
 
-cs__scoped_require 'contrast/common_agent_configuration'
+require 'contrast/common_agent_configuration'
 
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/utils/hash_digest'
+require 'contrast/utils/invalid_configuration_util'
 
 # scoping
-cs__scoped_require 'contrast/agent/scope'
+require 'contrast/agent/scope'
 
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'contrast/utils/thread_tracker'
 
 # Framework support
-cs__scoped_require 'contrast/framework/manager'
+require 'contrast/framework/manager'
+
+# Communication to SR
+require 'contrast/api/communication'
+
+require 'contrast/agent/thread_watcher'
 
 module Contrast
   # Top namespace of the Agent section. Holds tracking contexts that will be
@@ -51,43 +56,50 @@ module Contrast
     def self.framework_manager
       @_framework_manager ||= Contrast::Framework::Manager.new
     end
+
+    def self.messaging_queue
+      @_messaging_queue ||= Contrast::Api::Communication::MessagingQueue.new
+    end
+
+    def self.thread_watcher
+      @_thread_watcher ||= Contrast::Agent::ThreadWatcher.new
+    end
   end
 end
 
-cs__scoped_require 'contrast/api'
+require 'contrast/api'
 
-cs__scoped_require 'contrast/utils/resource_loader'
-cs__scoped_require 'contrast/utils/duck_utils'
-cs__scoped_require 'contrast/agent/tracepoint_hook'
-cs__scoped_require 'contrast/agent/at_exit_hook'
+require 'contrast/utils/resource_loader'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/tracepoint_hook'
+require 'contrast/agent/at_exit_hook'
 
 # communication with contrast service
-cs__scoped_require 'contrast/agent/exclusion_matcher'
-cs__scoped_require 'contrast/agent/socket_client'
+require 'contrast/agent/exclusion_matcher'
 
 # threads that handle contrast scope
-cs__scoped_require 'contrast/agent/thread'
+require 'contrast/agent/thread'
 
 # keep track of attacks
-cs__scoped_require 'contrast/agent/request_context'
+require 'contrast/agent/request_context'
 
-cs__scoped_require 'contrast/agent/assess'
+require 'contrast/agent/assess'
 
 # protect rules
-cs__scoped_require 'contrast/agent/protect/rule'
+require 'contrast/agent/protect/rule'
 
-# application libraries and technologies
-cs__scoped_require 'contrast/utils/gemfile_reader'
+# application libraries
+require 'contrast/utils/gemfile_reader'
 
 # rack event monitoring
-cs__scoped_require 'contrast/agent/middleware'
+require 'contrast/agent/middleware'
 
 # TODO: RUBY-919
 # Refactor to use Contrast::Framework::Manager
 # Contrast::Framework::Manager.before_load_patches!
 if defined?(::Rails)
-  cs__scoped_require 'contrast/framework/rails/patch/support'
-  cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
+  require 'contrast/framework/rails/patch/support'
+  require 'contrast/framework/rails/patch/rails_application_configuration'
   Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-  cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+  require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
 end

data/lib/contrast/agent/assess.rb

@@ -8,27 +8,26 @@ module Contrast
     # class under this namespace should be required here, providing a single
     # point of require for this functionality.
     module Assess
-      cs__scoped_require 'contrast/agent/module_data'
-      cs__scoped_require 'contrast/agent/rewriter'
-      cs__scoped_require 'contrast/agent/assess/policy/preshift'
+      require 'contrast/agent/module_data'
+      require 'contrast/agent/rewriter'
+      require 'contrast/agent/assess/policy/preshift'
 
-      cs__scoped_require 'contrast/utils/prevent_serialization'
+      require 'contrast/utils/prevent_serialization'
 
       # Rules - generic
-      cs__scoped_require 'contrast/agent/assess/rule'
-      cs__scoped_require 'contrast/agent/assess/rule/base'
+      require 'contrast/agent/assess/rule'
+      require 'contrast/agent/assess/rule/base'
 
       # Dynamic Sources
-      cs__scoped_require 'contrast/agent/assess/policy/dynamic_source_factory'
+      require 'contrast/agent/assess/policy/dynamic_source_factory'
 
       # Rule: REDOS
-      cs__scoped_require 'contrast/agent/assess/rule/redos'
+      require 'contrast/agent/assess/rule/redos'
 
       # reporting / tracking
-      cs__scoped_require 'contrast/agent/assess/insulator'
-      cs__scoped_require 'contrast/agent/assess/properties'
-      cs__scoped_require 'contrast/agent/assess/tag'
-      cs__scoped_require 'contrast/agent/assess/events/event_factory'
+      require 'contrast/agent/assess/properties'
+      require 'contrast/agent/assess/tag'
+      require 'contrast/agent/assess/events/event_factory'
     end
   end
 end

data/lib/contrast/agent/assess/contrast_event.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'contrast/utils/class_util'
-cs__scoped_require 'contrast/utils/duck_utils'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/utils/assess/tracking_util'
+require 'contrast/utils/class_util'
+require 'contrast/utils/duck_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/prevent_serialization'
+require 'contrast/utils/stack_trace_utils'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -52,14 +52,16 @@ module Contrast
             return nil unless original
 
             begin
-              original.dup
+              duplicate = original.dup
+              original.cs__transfer_properties(duplicate)
+              duplicate
             rescue StandardError
               original
             end
           end
         end
 
-        attr_reader :event_id, :parent_ids
+        attr_reader :event_id, :parent_ids, :policy_node, :stack_trace, :time, :thread, :object, :ret, :args
 
         # We need this to track the parent id's of events to build up a flow
         # chart of the finding
@@ -78,7 +80,7 @@ module Contrast
           @policy_node = policy_node
           # so long as this event is built in a factory, we know Contrast Code
           # will be the first three events
-          @caller = caller(3, 20)
+          @stack_trace = caller(3, 20)
           @time = Contrast::Utils::Timer.now_ms
           @thread = Thread.current.object_id
 
@@ -157,6 +159,31 @@ module Contrast
           end
         end
 
+        # We have to do a little work to figure out what our TS appropriate
+        # target is. To break this down, the logic is as follows:
+        # 1) If my policy_node has a target, work on targets. Else, work on sources.
+        #    Per TS law, each policy_node must have at least a source or a target.
+        #    The only type of policy_node w/o targets is a Trigger, but that may
+        #    change.
+        # 2) If I have a highlight, it means that I have a P target that is
+        #    not in integer form (it was a named / keyword type for which I had
+        #    to find the index). I need to address this so that TS can process
+        #    it.
+        # 3) I'll set the event's source and target to TS values.
+        # 4) Return the highlight or the first source/target as the taint
+        #    target.
+        def determine_taint_target event_dtm
+          if @policy_node&.targets&.any?
+            event_dtm.source = @policy_node.source_string if @policy_node.source_string
+            event_dtm.target = @highlight ? "P#{ @highlight }" : @policy_node.target_string
+            @highlight || @policy_node.targets[0]
+          elsif policy_node&.sources&.any?
+            event_dtm.source = @highlight ? "P#{ @highlight }" : @policy_node.source_string
+            event_dtm.target = @policy_node.target_string if @policy_node.target_string
+            @highlight || @policy_node.sources[0]
+          end
+        end
+
         def value_of_source source, object, ret, args
           case source
           when Contrast::Utils::ObjectShare::OBJECT_KEY
@@ -179,171 +206,7 @@ module Contrast
 
         # Convert this event into a DTM that TeamServer can consume
         def to_dtm_event
-          event = Contrast::Api::Dtm::TraceEvent.new
-
-          # Figure out what the target of this event was. It's a little
-          # annoying for us since P can be named (thanks, Ruby) where
-          # as for everyone else it is idx based.
-          taint_target = determine_taint_target(event)
-
-          event.type = @policy_node.node_type
-          event.action = @policy_node.build_action
-          event.timestamp_ms = @time.to_i
-          event.thread = Contrast::Utils::StringUtils.force_utf8(@thread)
-          truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
-          event.object = build_event_object(@object, truncate_obj)
-          truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
-          event.ret = build_event_object(@ret, truncate_ret)
-          built_args = build_event_args(taint_target)
-          built_args.each do |arg|
-            event.args << arg
-          end
-          taint_ranges = find_taint_ranges(@object, @args, @ret, taint_target)
-          taint_ranges.each do |range|
-            event.taint_ranges << range
-          end
-
-          # We delayed doing this as long as possible b/c it's expensive
-          stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(@caller)
-          event.stack += stack
-
-          event.object_id = event_id.to_i
-          parent_ids&.each do |id|
-            parent = Contrast::Api::Dtm::ParentObjectId.new
-            parent.id = id.to_i
-            event.parent_object_ids << parent
-          end
-
-          # not to be confused w/ the partial signature
-          build_complete_signature(event)
-
-          event
-        end
-
-        # We're not going to build the signature string here, b/c we have all
-        # the composite pieces of it. Instead, we're going to let TeamServer
-        # render this for us.
-        def build_complete_signature event
-          signature = Contrast::Api::Dtm::TraceEventSignature.new
-          event.signature = signature
-          return_type = @ret ? @ret.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
-          signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
-          signature.class_name = Contrast::Utils::StringUtils.force_utf8(@policy_node.class_name)
-          signature.method_name = Contrast::Utils::StringUtils.force_utf8(@policy_node.method_name)
-          if @args
-            @args&.each do |arg|
-              arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
-              signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
-            end
-          end
-          signature.constructor = @policy_node.method_name == :new
-          # if there's a ret, then this method isn't nil. not 100% full proof since you can
-          # return nil, but this is the best we've got currently.
-          signature.void_method = @ret.nil?
-          # 8 is STATIC in Java... we have to placate them for now
-          # it has been requested that flags be removed since it isn't used
-          signature.flags = 8 unless @policy_node.instance_method?
-        end
-
-        # Wrapper around build_event_object for the args array. Handles
-        # tainting the correct argument.
-        def build_event_args taint_target
-          event_args = []
-          @args.each_index do |idx|
-            truncate_arg = taint_target != idx
-            event_arg = build_event_object(@args[idx], truncate_arg)
-            event_args << event_arg
-          end
-          event_args
-        end
-
-        # Build the event object. We were originally going to include taint on
-        # each one, but TS doesn't accept / use that, so it is a waste of time.
-        #
-        # We'll truncate any object that isn't important to the taint ranges of
-        # this event, so that we don't murder TeamServer by, for instance,
-        # hypothetically sending the entire rendered HTML page >_>  <_<  >_>
-        ELLIPSIS = '...'
-        UNTRUNCATED_PORTION_LENGTH = 25
-        TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + 3 # ELLIPSIS length
-        def build_event_object object, truncate
-          event_object = Contrast::Api::Dtm::TraceEventObject.new
-          obj_string = Contrast::Utils::StringUtils.force_utf8(object)
-          if truncate && Contrast::Utils::StringUtils.ret_length(obj_string) > TRUNCATION_LENGTH
-            tmp = []
-            tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
-            tmp << ELLIPSIS
-            tmp << obj_string[
-                obj_string.length - UNTRUNCATED_PORTION_LENGTH,
-                UNTRUNCATED_PORTION_LENGTH]
-            obj_string = tmp.join
-          end
-          event_object.value = Base64.encode64(obj_string)
-          event_object.tracked = Contrast::Utils::Assess::TrackingUtil.tracked?(object)
-          event_object
-        end
-
-        # We have to do a little work to figure out what our TS appropriate
-        # target is. To break this down, the logic is as follows:
-        # 1) If my policy_node has a target, work on targets. Else, work on sources.
-        #    Per TS law, each policy_node must have at least a source or a target.
-        #    The only type of policy_node w/o targets is a Trigger, but that may
-        #    change.
-        # 2) If I have a highlight, it means that I have a P target that is
-        #    not in integer form (it was a named / keyword type for which I had
-        #    to find the index). I need to address this so that TS can process
-        #    it.
-        # 3) I'll set the event's source and target to TS values.
-        # 4) Return the highlight or the first source/target as the taint
-        #    target.
-        def determine_taint_target event
-          if @policy_node&.targets&.any?
-            event.source = @policy_node.source_string if @policy_node.source_string
-            event.target = if @highlight
-                             "P#{ @highlight }"
-                           else
-                             @policy_node.target_string
-                           end
-            @highlight || @policy_node.targets[0]
-          elsif @policy_node&.sources&.any?
-            event.source = if @highlight
-                             "P#{ @highlight }"
-                           else
-                             @policy_node.source_string
-                           end
-            event.target = @policy_node.target_string if @policy_node.target_string
-            @highlight || @policy_node.sources[0]
-          end
-        end
-
-        # TeamServer only supports one object's taint ranges at a time.
-        # We'll find the taint ranges for the target and return those
-        def find_taint_ranges object, args, ret, taint_target
-          # If there's no taint_target, this isn't a dataflow trace, but a
-          # trigger one
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless taint_target
-
-          properties = case taint_target
-                       when Contrast::Utils::ObjectShare::OBJECT_KEY
-                         object.cs__properties
-                       when Contrast::Utils::ObjectShare::RETURN_KEY
-                         ret.cs__properties
-                       else
-                         target = args[taint_target]
-                         if target.is_a?(Hash)
-                           if @policy_node&.targets&.any?
-                             target[@policy_node.targets[0]].cs__properties
-                           else
-                             target[@policy_node.sources[0]].cs__properties
-                           end
-                         else
-                           target.cs__properties
-                         end
-                       end
-
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
-
-          properties.tags_to_dtm
+          Contrast::Api::Dtm::TraceEvent.build(self)
         end
       end
     end