contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/contrast_event'
-cs__scoped_require 'contrast/agent/assess/events/source_event'
+require 'contrast/agent/assess/contrast_event'
+require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/events/source_event.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/contrast_event'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/agent/assess/contrast_event'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Agent
@@ -65,15 +65,11 @@ module Contrast
           # 2) I'll set the event's source and target to TS values.
           # 3) Return the highlight or the first source/target as the taint
           #    target.
-          def determine_taint_target event
+          def determine_taint_target event_dtm
             return unless @policy_node&.targets&.any?
 
-            event.source = @policy_node.source_string if @policy_node.source_string
-            event.target = if @highlight
-                             "P#{ @highlight }"
-                           else
-                             @policy_node.target_string
-                           end
+            event_dtm.source = @policy_node.source_string if @policy_node.source_string
+            event_dtm.target = @highlight ? "P#{ @highlight }" : @policy_node.target_string
             @highlight || @policy_node.targets[0]
           end
         end

data/lib/contrast/agent/assess/finalizers/finalize.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/finalizers/hash'
+require 'contrast/agent/assess/finalizers/freeze'
+
+module Contrast
+  module Agent
+    module Assess
+      module Finalizers
+        # Our module for handling finalizing, allowing for the tracking of
+        # Objects without impacting GC and causing a memory leak. Access to any
+        # Finalizers object should run through this module as the Finalizers
+        # have tightly coupled dependencies on each other.
+        module Finalize
+          PROPERTIES_HASH = Contrast::Agent::Assess::Finalizers::Hash.new
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/finalizers/freeze.rb

@@ -0,0 +1,13 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# Our patch of the Object#freeze method, allowing any Object we track to
+# function with our Contrast::Agent::Assess::Finalizers::Hash
+class Object
+  alias_method :cs__patched_object_freeze, :freeze
+
+  def freeze
+    Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
+    cs__patched_object_freeze
+  end
+end

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Finalizers
+        # An extension of Hash that doesn't impact GC of the object being
+        # stored by storing its ID as a Key to lookup and registering a
+        # finalizer on the object to remove its entry from the Hash immediately
+        # after it's GC'd.
+        class Hash < Hash
+          FROZEN_FINALIZED_IDS = Set.new
+
+          def []= key, obj
+            # We can't finalize frozen things, so only act on those that went
+            # through .pre_freeze
+            if key.cs__frozen?
+              return unless FROZEN_FINALIZED_IDS.include?(key.__id__)
+            else
+              ObjectSpace.define_finalizer(key, finalize(key.__id__))
+            end
+            super key.__id__, obj
+          end
+
+          def [] key
+            super key.__id__
+          end
+
+          def finalize key_id
+            proc do
+              FROZEN_FINALIZED_IDS.delete(key_id)
+              delete(key_id)
+            end
+          end
+
+          def pre_freeze key
+            return if key.cs__frozen?
+            return if FROZEN_FINALIZED_IDS.include?(key.__id__)
+            return unless Contrast::Utils::DuckUtils.trackable?(key)
+
+            ObjectSpace.define_finalizer(key, finalize(key.__id__))
+            FROZEN_FINALIZED_IDS << key.__id__
+          rescue StandardError => _e
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -20,7 +20,7 @@ module Contrast
             # such that calls to that method will result in a Source Event.
             #
             # @param klass [Class] the Class to taint
-            # @param tainted_columns [Hash<String, Contrast::Agent::Assess::Properties>]
+            # @param tainted_columns [Hash{String => Contrast::Agent::Assess::Properties}]
             #   the name of the method to taint, mapped to the properties it
             #   should apply
             def create_sources klass, tainted_columns

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,15 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-cs__scoped_require 'contrast/agent/assess/policy/source_node'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'json'
+require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+require 'contrast/agent/assess/rule/provider/hardcoded_key'
+require 'contrast/agent/assess/rule/provider/hardcoded_password'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/assess/policy/source_node'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/agent/assess/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent
@@ -69,7 +70,7 @@ module Contrast
           # 1) Split on ','
           # 2) If 'O', add the source, else it's P (we don't have R sources) and
           #    needs to be converted. P type will either be P:name or P# where #
-          #    is the index of the paramter. Drop the P and store the int as int
+          #    is the index of the parameter. Drop the P and store the int as int
           #    or name as symbol
           def generate_sources
             if source_string
@@ -137,7 +138,8 @@ module Contrast
             return unless tags
 
             tags.each do |tag|
-              next if VALID_TAGS.include?(tag) || VALID_SOURCE_TAGS.include?(tag)
+              next if Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
+                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
               raise(ArgumentError,
                     "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
@@ -173,102 +175,6 @@ module Contrast
             @event_action
           end
 
-          # EventTagTypeDTM
-          VALID_TAGS = %w[
-            XML_ENCODED
-            XML_DECODED
-            HTML_ENCODED
-            HTML_DECODED
-            URL_ENCODED
-            URL_DECODED
-            CSS_ENCODED
-            CSS_DECODED
-            BASE64_ENCODED
-            BASE64_DECODED
-            JAVASCRIPT_ENCODED
-            JAVASCRIPT_DECODED
-            JAVA_ENCODED
-            JAVA_DECODED
-            CSV_ENCODED
-            CSV_DECODED
-            SQL_ENCODED
-            SQL_DECODED
-            LDAP_ENCODED
-            LDAP_DECODED
-            XPATH_ENCODED
-            XPATH_DECODED
-            OS_ENCODED
-            OS_DECODED
-            VBSCRIPT_ENCODED
-            VBSCRIPT_DECODED
-            POTENTIAL_SANITIZED
-            POTENTIAL_VALIDATED
-            NO_CONTROL_CHARS
-            CUSTOM
-
-            CUSTOM_ENCODED
-            CUSTOM_ENCODED_CMD_INJECTION
-            CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_ENCODED_HEADER_INJECTION
-            CUSTOM_ENCODED_HQL_INJECTION
-            CUSTOM_ENCODED_LDAP_INJECTION
-            CUSTOM_ENCODED_LOG_INJECTION
-            CUSTOM_ENCODED_NOSQL_INJECTION
-            CUSTOM_ENCODED_PATH_TRAVERSAL
-            CUSTOM_ENCODED_REDOS
-            CUSTOM_ENCODED_REFLECTED_XSS
-            CUSTOM_ENCODED_REFLECTION_INJECTION
-            CUSTOM_ENCODED_SMTP_INJECTION
-            CUSTOM_ENCODED_SQL_INJECTION
-            CUSTOM_ENCODED_SSRF
-            CUSTOM_ENCODED_STORED_XSS
-            CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
-            CUSTOM_ENCODED_UNSAFE_READLINE
-            CUSTOM_ENCODED_UNSAFE_XML_DECODE
-            CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_ENCODED_UNVALIDATED_FORWARD
-            CUSTOM_ENCODED_UNVALIDATED_REDIRECT
-            CUSTOM_ENCODED_XPATH_INJECTION
-            CUSTOM_ENCODED_XXE
-            CUSTOM_SECURITY_CONTROL_APPLIED
-
-            CUSTOM_VALIDATED
-            CUSTOM_VALIDATED_CMD_INJECTION
-            CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_VALIDATED_HEADER_INJECTION
-            CUSTOM_VALIDATED_HQL_INJECTION
-            CUSTOM_VALIDATED_LDAP_INJECTION
-            CUSTOM_VALIDATED_LOG_INJECTION
-            CUSTOM_VALIDATED_NOSQL_INJECTION
-            CUSTOM_VALIDATED_PATH_TRAVERSAL
-            CUSTOM_VALIDATED_REDOS
-            CUSTOM_VALIDATED_REFLECTED_XSS
-            CUSTOM_VALIDATED_REFLECTION_INJECTION
-            CUSTOM_VALIDATED_SMTP_INJECTION
-            CUSTOM_VALIDATED_SQL_INJECTION
-            CUSTOM_VALIDATED_SSRF
-            CUSTOM_VALIDATED_STORED_XSS
-            CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
-            CUSTOM_VALIDATED_UNSAFE_READLINE
-            CUSTOM_VALIDATED_UNSAFE_XML_DECODE
-            CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_VALIDATED_UNVALIDATED_FORWARD
-            CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
-            CUSTOM_VALIDATED_XPATH_INJECTION
-            CUSTOM_VALIDATED_XXE
-
-            DATABASE_WRITE
-          ].cs__freeze
-
-          VALID_SOURCE_TAGS = %w[
-            NO_NEWLINES
-            UNTRUSTED
-            CROSS_SITE
-            LIMITED_CHARS
-          ].cs__freeze
-
           # The keys used to read from policy.json to create the individual
           # policy nodes. These are common across node types
           JSON_SOURCE = 'source'

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/assess_extension'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -69,21 +69,31 @@ module Contrast
           end
 
           def append_object_details preshift, initializing, object
-            preshift.object = can_dup?(initializing, object) ? object.dup : object
-            preshift.object.cs__copy_from(object) if object.cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :cs__copy_from)
+            can = can_dup?(initializing, object)
+            preshift.object = can ? object.dup : object
             preshift.object_length = if Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :length)
                                        object.length
                                      else
                                        0
                                      end
+            return unless can
+
+            props = Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[object]
+            return unless props
+
+            Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[preshift.object] ||= props.dup
           end
 
           def append_arg_details preshift, args
             preshift.args = args.dup
             preshift.args.each_with_index do |arg, index|
-              next unless args[index].cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(arg, :cs__copy_from)
+              original_arg = args[index]
+              next if arg.__id__ == original_arg.__id__
+
+              props = Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[original_arg]
+              next unless props
 
-              arg.cs__copy_from(args[index])
+              Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[arg] ||= props.dup
             end
             preshift.arg_lengths = preshift.args.map { |arg| Contrast::Utils::DuckUtils.quacks_to?(arg, :length) ? arg.length : 0 }
           end

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,24 +1,21 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the continuation of traces. A Propagator is any
-# method that transforms an untrusted value. In general, these methods work on
-# the String class or a holder of Strings
-cs__scoped_require 'set'
+require 'set'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-
-cs__scoped_require 'contrast/agent/assess/policy/propagator'
-
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagator'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # This module contains the logic for determining how to propagate tags
-        # and events from a source to a target
+        # This class is responsible for the continuation of traces. A
+        # Propagator is any method that transforms an untrusted value. In
+        # general, these methods work on the String class or a holder of
+        # Strings
         module PropagationMethod
           include Contrast::Components::Interface
           access_component :logging
@@ -174,15 +171,7 @@ module Contrast
             # If the source of this patcher is not tracked, there's no need to do
             # anything. A copy of nothing is still nothing.
             def can_propagate? propagation_node, preshift, target
-              # We cannot propagate to things that do not have cs__properties.
-              return false unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-
-              # We cannot propagate to frozen things that have not been
-              # previously tracked. We probably shouldn't propagate to frozen
-              # things at all, as they're supposed to be immutable, but third
-              # parties do jenky things, so allow it as long as it is safe to do.
-              return false if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties &&
-                  propagation_node.targets[0] != Contrast::Utils::ObjectShare::RETURN_KEY
+              return false unless appropriate_target?(propagation_node, target)
               return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
               return false unless preshift
 
@@ -197,14 +186,28 @@ module Contrast
               false
             end
 
+            def appropriate_target? propagation_node, target
+              # We cannot propagate to things that do not have cs__properties.
+              return false unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
+
+              # We cannot propagate to frozen things that have not been
+              # previously tracked. We probably shouldn't propagate to frozen
+              # things at all, as they're supposed to be immutable, but third
+              # parties do jenky things, so allow it as long as it is safe to do.
+              return false if target.cs__frozen? &&
+                  !target.cs__tracked? &&
+                  propagation_node.targets[0] != Contrast::Utils::ObjectShare::RETURN_KEY
+
+              true
+            end
+
             # If this patcher has tags, apply them to the entire target
             def apply_tags propagation_node, target
               return unless propagation_node.tags
 
               length = Contrast::Utils::StringUtils.ret_length(target)
               propagation_node.tags.each do |tag|
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                target.cs__properties.add_tag(tag, span)
+                target.cs__properties.add_tag(tag, 0...length)
               end
             end
 
@@ -264,7 +267,6 @@ module Contrast
                 ret = Contrast::Utils::FreezeUtil.unfreeze_dup(target)
                 target = ret
               end
-              return if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
 
               propagation_class.propagate(propagation_node, preshift, target)