contrast-agent 3.12.2 → 3.15.0

data/lib/contrast/extension/assess/string.rb

@@ -1,15 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
-
-# This patch installs our extension as early as possible. The alternative is to
-# litter our code with Contrast::Utils::DuckUtils.trackable? checks.
-class String
-  include Contrast::Extension::Assess::AssessExtension
-end
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -40,21 +33,26 @@ module Contrast
           def track_interpolation inputs, result
             return unless AGENT.interpolation_enabled?
             return if in_contrast_scope?
-            return unless inputs.any?(&:cs__tracked?)
+            return unless inputs.any? { |input| Contrast::Agent::Assess::Tracker.tracked?(input) }
 
             with_contrast_scope do
+              properties = Contrast::Agent::Assess::Tracker.properties(result)
+              return unless properties
+
               offset = 0
               inputs.each do |input|
-                result.cs__copy_from(input, offset)
+                properties.copy_from(input, result, offset)
                 offset += input.length
               end
-              result.cs__properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
             end
+          rescue StandardError => e
+            logger.error('Unable to track interpolation', e)
           end
 
           def instrument_string
             @_instrument_string ||= begin
-                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
+                                      require 'cs__assess_string/cs__assess_string'
                                       true
                                     end
           rescue StandardError, LoadError => e
@@ -65,8 +63,8 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                                                    if AGENT.patch_interpolation? && Funchook.available?
+                                                      require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
                                                   rescue StandardError, LoadError => e

data/lib/contrast/extension/inventory.rb

@@ -11,12 +11,11 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/internal_exception'
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/inventory/policy/policy'
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
     end
   end
 end

data/lib/contrast/extension/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/scope'
+require 'contrast/components/scope'
 
 # This is a reasonable place for the Kernel#catch hook to live.
 # No current plans for component re-design, but if we had some kind of

data/lib/contrast/extension/module.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 # Some developers override various methods on Module, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being

data/lib/contrast/extension/protect.rb

@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -30,7 +30,7 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               require 'cs__protect_kernel/cs__protect_kernel'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -23,13 +23,6 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
         # Find all the predefined routes for this application and append them to the
         # provided inventory message
         # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
@@ -73,22 +66,6 @@ module Contrast
         def streaming? _env
           false
         end
-
-        protected
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        def scan_view_directories view_technology_descriptors
-          view_technology_descriptors.reject(&:empty?)
-        end
       end
     end
   end

data/lib/contrast/framework/manager.rb

@@ -1,13 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/rack/support'
-cs__scoped_require 'contrast/framework/rails/support'
-cs__scoped_require 'contrast/framework/sinatra/support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/framework/platform_version'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
@@ -59,10 +58,6 @@ module Contrast
         patches
       end
 
-      def find_applicable_view_technologies
-        scan_views_for_all_frameworks
-      end
-
       def find_route_discovery_data
         routes_for_all_frameworks
       end
@@ -124,10 +119,6 @@ module Contrast
         Contrast::Utils::ClassUtil.truly_defined?(klass)
       end
 
-      def scan_views_for_all_frameworks
-        data_for_all_frameworks :scan_views
-      end
-
       def routes_for_all_frameworks
         data_for_all_frameworks :collect_routes
       end
@@ -137,10 +128,9 @@ module Contrast
       # @param method_name [Symbol] the method to call on each FrameworkSupport class
       # @return [Array]
       def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
+        @_frameworks.flat_map do |framework|
           framework.send(method_name)
         end.compact
-        data
       end
 
       # This returns a single object from the first framework to successfully respond

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -67,12 +67,10 @@ module Contrast
                   options,
                   safe_default: false)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SECURE_RULE_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SECURE_RULE_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to secure session', e)
@@ -88,12 +86,10 @@ module Contrast
                                                 safe_default: false,
                                                 comparison_type: :greater_than)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SESSION_TIMEOUT_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SESSION_TIMEOUT_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -105,12 +101,10 @@ module Contrast
             def apply_httponly options
               return unless vulnerable_setting?(:httponly, true, options)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__HTTPONLY_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__HTTPONLY_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to httponly', e)

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rack/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/service_sender_util'
-
 module Contrast
   module Framework
     module Rails
@@ -15,7 +13,7 @@ module Contrast
               return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
 
               [context.server_activity, context.activity, context.observed_route].each do |msg|
-                Contrast::Utils::ServiceSenderUtil.send_event_immediately(msg)
+                Contrast::Agent.messaging_queue.send_event_immediately(msg)
               end
             end
 

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/components/interface'
+require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
   module Framework
@@ -12,7 +12,7 @@ module Contrast
         module AssessConfiguration
           include Contrast::Components::Interface
 
-          access_component :agent, :analysis, :logging, :scope
+          access_component :agent, :analysis, :logging
 
           CS__SESSION_TIMEOUT_NAME = 'session-timeout'
           SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
@@ -23,7 +23,6 @@ module Contrast
             include Contrast::Utils::InvalidConfigurationUtil
 
             def analyze_session_store *args
-              return unless AGENT.enabled?
               return if PROTECT.enabled?
 
               apply_httponly_disabled(*args)
@@ -53,9 +52,7 @@ module Contrast
               return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
-              end
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -69,9 +66,7 @@ module Contrast
               return unless vulnerable_setting?(:secure, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-              end
+              cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable secure cookies', e)
@@ -85,9 +80,7 @@ module Contrast
               return unless vulnerable_setting?(:httponly, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-              end
+              cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable httponly in session cookie', e)

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+require 'contrast/framework/rails/patch/assess_configuration'
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework
@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -17,9 +17,9 @@ module Contrast
             @_instrument ||= begin
                                ::ActionController::Railties::Helpers.class_eval do
                                  alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass
+                                 def inherited klass # rubocop:disable Lint/MissingSuper
                                    klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass)
+                                   cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
                                  ensure
                                    klass&.instance_variable_set(:@cs__defining_class, false)
                                  end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -58,7 +58,7 @@ module Contrast
 
             def instrument
               @_instrument_named_track ||= begin
-                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                                                 require 'cs__assess_active_record_named/cs__assess_active_record_named'
                                                  true
                                                end
             rescue StandardError, LoadError => e