contrast-agent 3.12.2 → 3.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c4c1231012886dbd14e4cd13bef64286f18d970be8c3b5c7daa7e585ae500aa
-  data.tar.gz: 23a64e21d451cea85ce8b2e4c19ac98c5d7e14c294abac30e3a4310c8809a7ea
+  metadata.gz: ac8fc7d0e9c127859cf7bdb149c7ac519286c4329bd81ad28db4963128e0cd63
+  data.tar.gz: 784afc67ef269df8dfbaed392e8ad28e2e3b679113ed8679625f95033e324929
 SHA512:
-  metadata.gz: 49c90e08126185be367fef4c5494fc074faf0af77e1d376966a976e8f4c839d94ba292a24fa0826e332c9adf1ae42fa281ab0ab44dfc0040128856b332f28e82
-  data.tar.gz: 58f501e22a5c0654b8fbe64f7f1668de9308a63e61749d3ebc8b0c033cf6e41cc4928d890db8de6943ec38a53d90d5affc812c258382137249bde0d3471a18e8
+  metadata.gz: c1a5563b34a4eba33fdf8094986362f70c88bda53102899bb01ad0096588d26883b5e7ad475e41afa15b95674b8c2810cfe6546c6779b8e3b2030bf7bb1e33d6
+  data.tar.gz: 1a1eb220719c1caf3f7153108bff4ac5132130d6879dc2b425e6dd31720e4c76bda9c27c0ac65fa00ccb846a31cb173e04dc7d3320ba3079ea9b785a62991f00

data/.dockerignore

@@ -4,7 +4,6 @@ docker/
 code-deploy/
 
 Jenkinsfile
-bitbucket-pipelines.yml
 docker-compose.yml
 .rubocop.yml
 .travis.yml

data/.gitignore

@@ -52,7 +52,7 @@ contrast-agent-*.gem
 service_executables/*-*
 
 # Generated Protobuf files
-/lib/contrast/api/*_pb.rb
+/lib/contrast/api/*.pb.rb
 
 # IDE stuff
 tags

data/.simplecov

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-SimpleCov.minimum_coverage line: 92.30
+SimpleCov.minimum_coverage line: 94.75
 SimpleCov.start do
   add_filter '/spec/'
 end

data/Rakefile

@@ -1,9 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+$stdout.sync = true
+
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rake/extensiontask'
+load 'protobuf/tasks/compile.rake'
+require 'fileutils'
 
 CLOBBER << 'shared_libraries/*'
 
@@ -13,3 +17,30 @@ Dir['ext/cs__*'].each do |extension|
     ext.lib_dir = "lib/#{ name }"
   end
 end
+
+task :contrast_pb_compile do
+  # do some stuff before compile
+
+  # Invoke the protobuf compile task with your sensible defaults
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/dtm.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ::Rake::Task['protobuf:compile'].reenable
+
+  ::Rake::Task['protobuf:compile'].invoke('lib',
+                                          './agent-service-api/protobuf ./agent-service-api/protobuf/settings.proto',
+                                          'lib/contrast/api',
+                                          nil)
+
+  ['dtm.pb.rb', 'settings.pb.rb'].each do |target_file|
+    target_path = File.absolute_path(File.join(__dir__, "./lib/contrast/api/#{ target_file }"))
+    unless File.exist?(target_path)
+      puts "File not found #{ target_path }"
+      exit 1
+    end
+  end
+
+  puts 'Protobuf copied successfully'
+end

data/exe/contrast_service

@@ -3,19 +3,13 @@
 # frozen_string_literal: true
 
 def mac?
-  RUBY_PLATFORM.match?(/darwin/)
-end
-
-def windows?
-  RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
+  RUBY_PLATFORM.include?('darwin')
 end
 
 def path
   base_path = "#{ File.dirname(__FILE__) }/.."
   if mac?
     "#{ base_path }/service_executables/mac/contrast-service"
-  elsif windows?
-    "#{ base_path }/service_executables/windows/contrast-service.exe"
   else
     "#{ base_path }/service_executables/linux/contrast-service"
   end

data/ext/build_funchook.rb

@@ -62,5 +62,3 @@ unless find_header('funchook.h', ext_path)
     end
   end
 end
-
-have_header('funchook.h', ext_path)

data/ext/cs__assess_active_record_named/cs__active_record_named.c

@@ -2,8 +2,8 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__active_record_named.h"
-#include <ruby.h>
 #include "../cs__common/cs__common.h"
+#include <ruby.h>
 
 VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
                                           const VALUE self) {
@@ -19,7 +19,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
      */
     VALUE new_body, ret;
     VALUE new_args[3];
-    new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self, argv[0], argv[1]);
+    new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
+                          argv[0], argv[1]);
     new_args[0] = argv[0];
     if (NIL_P(new_body)) {
         new_args[1] = argv[1];
@@ -36,10 +37,10 @@ void Init_cs__assess_active_record_named(void) {
     framework = rb_define_module_under(contrast, "Framework");
     rails = rb_define_module_under(framework, "Rails");
     rewrite = rb_define_module_under(rails, "Rewrite");
-    active_record_named = rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
+    active_record_named =
+        rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
     rb_sym_assess_rewrite = rb_intern("rewrite");
-    rb_sym_assess_scope   = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
-                                                    "scope",
-                                                    contrast_assess_active_record_scope);
+    rb_sym_assess_scope =
+        contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
+                                "scope", contrast_assess_active_record_scope);
 }
-

data/ext/cs__assess_array/cs__assess_array.c

@@ -23,15 +23,16 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     /* Finally, default to empty String. Implicit since nil.to_s is ''*/
 
     result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
-    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3, ary, sep, result);
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
+                        ary, sep, result);
 
     return result;
 }
 
 void Init_cs__assess_array(void) {
-    array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
+    array_propagator =
+        rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
-    rb_sym_assess_array_join = contrast_register_patch("Array",
-                                                       "join",
-                                                       contrast_assess_array_join);
+    rb_sym_assess_array_join =
+        contrast_register_patch("Array", "join", contrast_assess_array_join);
 }

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -7,7 +7,8 @@
 
 void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
                                                  VALUE ret) {
-    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self, source, ret);
+    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
+               source, ret);
 }
 
 VALUE
@@ -36,7 +37,8 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_basic_object(void) {
-    basic_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
+    basic_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
 
     /* We don't keep a reference to the underlying method.
@@ -45,8 +47,6 @@ void Init_cs__assess_basic_object(void) {
      * but if someone else patched BasicObject#instance_eval,
      * IDK if this is intentional... noting it.  -ajm
      */
-    contrast_register_patch("BasicObject",
-                            "instance_eval",
+    contrast_register_patch("BasicObject", "instance_eval",
                             contrast_assess_basic_object_instance_eval);
-
 }

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -3,7 +3,6 @@
 
 #include "cs__assess_fiber_track.h"
 #include "../cs__common/cs__common.h"
-#include <funchook.h>
 #include <ruby.h>
 
 VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
@@ -64,22 +63,18 @@ VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
 }
 
 int install_fiber_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_fiber_new_original = rb_fiber_new;
-    funchook_prepare(funchook, (void **)&rb_fiber_new_original,
-                     rb_fiber_new_hook);
+    patch_via_funchook(&rb_fiber_new_original, &rb_fiber_new_hook);
 
     rb_fiber_yield_original = rb_fiber_yield;
-    funchook_prepare(funchook, (void **)&rb_fiber_yield_original,
-                     rb_fiber_yield_hook);
+    patch_via_funchook(&rb_fiber_yield_original, &rb_fiber_yield_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 
 void Init_cs__assess_fiber_track(void) {
-    fiber_propagator = rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
+    fiber_propagator =
+        rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
     track_rb_fiber_new = rb_intern("track_rb_fiber_new");
     track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
     rb_sym_next = rb_intern("next");

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -1,4 +1,3 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_sym_next;

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -12,23 +12,24 @@
  * This method instruments that unique bracket-construction style
  * of initializing a hash.
  */
-static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
-                                              const VALUE hash) {
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
+                                                      const VALUE hash) {
     VALUE result;
 
     /* Array of Arrays: Hash[ [ [key, value], ... ] ]   -> new_hash */
     if (RB_TYPE_P(argv[0], T_ARRAY)) {
         int i;
         for (i = 0; i < argc; i++) {
-            argv[i] =
-                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
         /* Hash[ key, value, ... ]         -> new_hash */
     } else if (argc > 1) {
         int i;
         for (i = 0; i < argc; i += 2) {
-            argv[i] =
-                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
     }
 
@@ -36,7 +37,8 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *arg
      * String keys
      * # Hash[ object ]                  -> new_hash
      */
-    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
+    result =
+        rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
 
     return result;
 }
@@ -61,8 +63,9 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
      * We haven't revisited this approach since we started more extensively
      * hooking public C functions.)
      */
-    if(argc > 0) {
-        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[0]);
+    if (argc > 0) {
+        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
+                             1, argv[0]);
     }
     /* This is the underlying assignment, w/ our instrumented key. */
     result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
@@ -71,17 +74,15 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
 }
 
 void Init_cs__assess_hash(void) {
-    hash_propagator = rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
+    hash_propagator =
+        rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
     rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
 
     VALUE hash_class = rb_define_class("Hash", rb_cObject);
 
-    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch("Hash",
-                                                                               "[]",
-                                                                               contrast_assess_hash_bracket_constructor);
-
-    rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
-                                                                "[]=",
-                                                                contrast_assess_hash_bracket_set);
+    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
+        "Hash", "[]", contrast_assess_hash_bracket_constructor);
 
+    rb_sym_assess_hash_bracket_equals = contrast_register_patch(
+        "Hash", "[]=", contrast_assess_hash_bracket_set);
 }

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -13,7 +13,8 @@ static VALUE hash_propagator;
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
  * -HM
  */
-static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
                                                       const VALUE hash);
 
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -18,8 +18,9 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
         rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
     }
 
-    /* maybe this should be rb_funcall2.  this works right now because *argv == argv[0].
-     * exec shouldn't ever be called with != 1 argc, so not a huge problem */
+    /* maybe this should be rb_funcall2.  this works right now because *argv ==
+     * argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
+     * problem */
     return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
 }
 
@@ -27,12 +28,10 @@ void Init_cs__assess_kernel(void) {
     kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
-    rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
-                                                        "exec",
-                                                        contrast_patched_kernel_exec);
+    rb_sym_assess_kernel_exec =
+        contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
 
     /* should return the same value as above */
-    rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
-                                                                  "exec",
-                                                                  contrast_patched_kernel_exec);
+    rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
+        "Kernel", "exec", contrast_patched_kernel_exec);
 }

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -9,26 +9,24 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
                                                  const VALUE *argv) {
     VALUE result;
     VALUE source_string;
-
     result = rb_call_super(argc, argv);
 
     if (argc >= 1) {
         source_string = argv[0];
 
-        if (rb_respond_to(source_string, rb_sym_cs_tracked)) {
-            VALUE tracked = rb_funcall(source_string, rb_sym_cs_tracked, 0);
+        VALUE tracked =
+            rb_funcall(properties_hash, rb_sym_hash_tracked, 1, source_string);
 
-            if (tracked == Qtrue) {
-                VALUE skip = rb_funcall(contrast_patcher(),
-                                        rb_sym_skip_assess_analysis, 0);
+        if (tracked == Qtrue) {
+            VALUE skip =
+                rb_funcall(contrast_patcher(), rb_sym_skip_assess_analysis, 0);
 
-                if (skip == Qfalse) {
-                    VALUE scope =
-                        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
-                    rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
-                               2, source_string, result);
-                    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
-                }
+            if (skip == Qfalse) {
+                VALUE scope =
+                    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+                rb_funcall(marshal_module, rb_sym_assess_load_trigger_check, 2,
+                           source_string, result);
+                rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
             }
         }
     }
@@ -36,9 +34,13 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 }
 
 void Init_cs__assess_marshal_module(void) {
+    // Contrast::Agent::Assess::Tracker::PROPERTIES_HASH
+    VALUE tracker = rb_define_class_under(assess, "Tracker", rb_cObject);
+    properties_hash = rb_const_get(tracker, rb_intern("PROPERTIES_HASH"));
+    marshal_module =
+        rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
     rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
 
-    contrast_register_singleton_prepend_patch("Marshal",
-                                              "load",
-                                              &contrast_assess_marshal_module_load);
+    contrast_register_singleton_prepend_patch(
+        "Marshal", "load", &contrast_assess_marshal_module_load);
 }

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h

@@ -3,6 +3,7 @@
 static VALUE marshal_module;
 
 static VALUE rb_sym_assess_load_trigger_check;
+static VALUE properties_hash;
 
 /*
  * Rails is a jerk. In Rails 5, they decided to do away with the alias chaining

data/ext/cs__assess_module/cs__assess_module.c

@@ -21,7 +21,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
+                   ret, method);
     }
 
     rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -57,7 +58,8 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_module(void) {
-    module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
+    module_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     trigger_check_method = rb_intern("eval_trigger_check");
 
     rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
@@ -69,11 +71,9 @@ void Init_cs__assess_module(void) {
      * See similar comments in basic_object C ext patch.
      */
 
-    contrast_register_patch("Module",
-                            "class_eval",
+    contrast_register_patch("Module", "class_eval",
                             contrast_assess_module_class_eval);
 
-    contrast_register_patch("Module",
-                            "module_eval",
+    contrast_register_patch("Module", "module_eval",
                             contrast_assess_module_module_eval);
 }