contrast-agent 3.12.2 → 3.15.0

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/trigger/reflected_xss'
-cs__scoped_require 'contrast/agent/assess/policy/trigger/xpath'
+require 'contrast/agent/assess/policy/trigger/reflected_xss'
+require 'contrast/agent/assess/policy/trigger/xpath'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent
@@ -99,16 +100,17 @@ module Contrast
             # if the source isn't tracked, there can't be a violation
             # this condition may not hold true forever, but for now it's
             # a nice optimization
-            return false unless source.cs__tracked?
+            return false unless Contrast::Agent::Assess::Tracker.tracked?(source)
 
+            properties = Contrast::Agent::Assess::Tracker.properties(source)
             # find the ranges that violate the rule (untrusted, etc)
-            vulnerable_ranges = find_ranges_by_all_tags(Contrast::Utils::StringUtils.ret_length(source), source.cs__properties, required_tags)
+            vulnerable_ranges = find_ranges_by_all_tags(Contrast::Utils::StringUtils.ret_length(source), properties, required_tags)
             # if there aren't any vulnerable ranges, nope out
             return false if vulnerable_ranges.empty?
 
             # find the ranges that are exempt from the rule
             # (validated, sanitized, etc)
-            secure_ranges = find_ranges_by_any_tag(source.cs__properties, disallowed_tags)
+            secure_ranges = find_ranges_by_any_tag(properties, disallowed_tags)
             # if there are vulnerable ranges and no secure, report
             return true if secure_ranges.empty?
 
@@ -167,8 +169,8 @@ module Contrast
 
             tags.each do |tag|
               raise(ArgumentError, "Rule #{ rule_id } had an invalid tag. #{ tag } is not a known value.") unless
-                  Contrast::Agent::Assess::Policy::PolicyNode::VALID_TAGS.include?(tag) ||
-                      Contrast::Agent::Assess::Policy::PolicyNode::VALID_SOURCE_TAGS.include?(tag)
+                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
+                      Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
             end
           end
 
@@ -177,24 +179,35 @@ module Contrast
           # @param length [Integer] the length of the object which may have the
           #   given tags -- used as the maximum index to search for all of the
           #   tags.
-          # @param cs__properties [Contrast::Agent::Assess::Properties] the
+          # @param properties [Contrast::Agent::Assess::Properties] the
           #   properties to check for the tags
           # @param tags [Set<String>] the list of tags on which to match
           # @return [Array<Contrast::Agent::Assess::Tag>] the ranges satisfied
           #   by the given conditions
-          def find_ranges_by_all_tags length, cs__properties, tags
+          def find_ranges_by_all_tags length, properties, tags
             # if there aren't any all_tags or tags, break early
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless cs__properties.tracked?
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
             return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
 
             # :zap: faster to treat all as any if there's only one tag
-            return find_ranges_by_any_tag(cs__properties, tags) if tags.length == 1
+            return find_ranges_by_any_tag(properties, tags) if tags.length == 1
 
             ranges = []
+            # TODO: RUBY-946 clean this up, perhaps with
+            #   tags.each { |tag| applicable << properties.fetch_tag(tag) }
+            #   return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless applicable.length == tags.length
+            #   ...
             # find all the indicies on the source that have all the given tags
             (0..length).each do |idx|
-              tags_at = cs__properties.tag_names_at(idx)
-              ranges << idx if tags.all? { |tag| tags_at.include?(tag) }
+              tags_at = properties.tags_at(idx)
+              ranges << idx if tags.all? do |tag|
+                found = false
+                tags_at.each do |tag_at|
+                  found = tag_at.label == tag
+                  break if found
+                end
+                found
+              end
             end
             # break early if no indicies satisfy all the tags
             return Contrast::Utils::ObjectShare::EMPTY_ARRAY if ranges.empty?
@@ -215,19 +228,19 @@ module Contrast
 
           # Find the ranges that satisfy any of the given tags.
           #
-          # @param cs__properties [Contrast::Agent::Assess::Properties] the
+          # @param properties [Contrast::Agent::Assess::Properties] the
           #   properties to check for the tags
           # @param tags [Set<String>] the list of tags on which to match
           # @return [Array<Contrast::Agent::Assess::Tag>] the ranges satisfied
           #   by the given conditions
-          def find_ranges_by_any_tag cs__properties, tags
+          def find_ranges_by_any_tag properties, tags
             # if there aren't any all_tags or tags, break early
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless cs__properties.tracked?
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
             return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
 
             ranges = []
             tags.each do |desired|
-              found = cs__properties.fetch_tag(desired)
+              found = properties.fetch_tag(desired)
               next unless found
 
               # we need to dup here so that we don't change the tags if target is

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -38,7 +38,8 @@ module Contrast
               finish = match.begin(:path)
               finish ||= url.length
 
-              args[0].cs__properties.any_tags_between?(start, finish)
+              properties = Contrast::Agent::Assess::Tracker.properties(args[0])
+              properties.any_tags_between?(start, finish)
             end
           end
         end

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
+require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
+require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/properties.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/events/event_factory'
-cs__scoped_require 'contrast/agent/assess/events/source_event'
+require 'base64'
+require 'set'
+require 'contrast/agent/assess/property/evented'
+require 'contrast/agent/assess/property/tagged'
+require 'contrast/agent/assess/property/updated'
+require 'contrast/utils/prevent_serialization'
 
 module Contrast
   module Agent
@@ -19,6 +19,11 @@ module Contrast
       # user input.
       class Properties
         include Contrast::Utils::PreventSerialization
+        include Contrast::Agent::Assess::Property::Evented
+        include Contrast::Agent::Assess::Property::Tagged
+        include Contrast::Agent::Assess::Property::Updated
+
+        attr_accessor :dupped_from
 
         # CONTRAST-36937
         # Creating these on Properties is expensive. We want to delay this for
@@ -27,18 +32,6 @@ module Contrast
           @_properties ||= {}
         end
 
-        def events
-          @_events ||= []
-        end
-
-        def tracked?
-          tags? && tags.any?
-        end
-
-        def tagged? label
-          tags? && tags.key?(label)
-        end
-
         def add_properties hash
           return unless hash
 
@@ -51,371 +44,10 @@ module Contrast
           properties[name] = value
         end
 
-        def any_tags_between? start, finish
-          return false unless tags?
-
-          range = Contrast::Agent::Assess::Tag.new(start + finish, start)
-          tags.each_value do |tag_array|
-            return true if tag_array.any? { |tag| tag.overlaps?(range) }
-          end
-          false
-        end
-
-        # Find all of the ranges that span a given index. This is used
-        # in propagation when we need to shift tags about. For instance, in
-        # the append method when we need to see if any tag at the end needs
-        # to be expanded out to the size of the new String.
-        #
-        # Note: Tags do not know their key, so this is only the range covered
-        #
-        # @param idx [Integer] the index to check for tags
-        # @return [Array<Contrast::Agent::Assess::Tag>] a set of all the Tags
-        #   covering the given index. This is only the ranges, not the names.
-        def tags_at idx
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          at = []
-          tags.each_value do |tag_array|
-            tag_array.each do |tag|
-              if tag.covers?(idx)
-                at << tag
-              elsif tag.above?(idx)
-                break
-              end
-            end
-          end
-          at
-        end
-
-        # Find all of the tag names that span a given index.
-        #
-        # @param idx [Integer] the index to check for tags
-        # @return [Set<String>] a set of all the tags covering the given index.
-        #   This is only the names of the tags, not their ranges.
-        def tag_names_at idx
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          at = Set.new
-          tags.each_pair do |tag_name, tag_array|
-            tag_array.each do |tag|
-              if tag.covers?(idx)
-                at << tag_name
-              elsif tag.above?(idx)
-                break
-              end
-            end
-          end
-          at
-        end
-
-        # given a range, select all tags in that range the selected tags are
-        # shifted such that the start index of the new tag (0) aligns with the
-        # given start index in the range
-        #
-        # current tags: 5-15
-        # range       : 5-10
-        # result      : 0-05
-        def tags_at_range range
-          return Contrast::Utils::ObjectShare::EMPTY_HASH unless tags?
-
-          at = Hash.new { |h, k| h[k] = [] }
-          length = range.stop - range.start
-          tags.each_pair do |key, value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # BELOW and ABOVE are applicable to this check and are removed.
-              case comparison
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # the tag exists in the requested range, figure out the boundaries
-              when Contrast::Agent::Assess::Tag::WITHIN
-                start = tag.start_idx - range.start
-                finish = length - start
-                add << Contrast::Agent::Assess::Tag.new(finish, start)
-              # the tag spans the requested range.
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              end
-            end
-            next if add.empty?
-
-            at[key] = add
-          end
-          at
-        end
-
-        # Given a tag name and range object, add a new tag to this
-        # collection. If the given range touches an existing tag,
-        # we'll combine the two, adjusting the existing one and
-        # dropping this new one.
-        #
-        # @param label [String] the name of the tag
-        # @param range [Contrast::Agent::Assess::AdjustedSpan] the span that
-        #   the tag covers
-        def add_tag label, range
-          length = range.stop - range.start
-          tag = Contrast::Agent::Assess::Tag.new(length, range.start)
-          existing = fetch_tag(label)
-          tags[label] = Contrast::Utils::TagUtil.ordered_merge(existing, tag)
-        end
-
-        def set_tags label, tag_ranges
-          tags[label] = tag_ranges
-        end
-
-        # Remove all tags with a given label
-        def delete_tags label
-          return unless tags?
-
-          tags.delete(label)
-        end
-
-        # Reset the tag hash
-        def clear_tags
-          return unless tags?
-
-          tags.clear
-        end
-
-        # Returns a list of all current tag labels, most likely to be used for
-        # a splat operation
-        def tag_keys
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          tags.keys
-        end
-
-        # Calls merge to combine touching or overlapping tags
-        # Deletes empty tags
-        def cleanup_tags
-          return unless tags?
-
-          Contrast::Utils::TagUtil.merge_tags(tags)
-          tags.delete_if { |_, value| value.empty? }
-        end
-
-        # We'll use this as a helper method to retrieve tags from the hash.
-        # Because the hash auto-populates an empty array when we try to access
-        # a tag in it, we cannot use the [] method without side effect. To get
-        # around this, we'll use a fetch work around.
-        def fetch_tag label
-          return unless tags?
-
-          tags.fetch(label, nil)
-        end
-
-        # Convert the tags of this object into the TraceTaintRange requried to
-        # be sent to the service
-        def tags_to_dtm
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          ranges = []
-          tags.each_pair do |key, value|
-            next if value.empty?
-
-            value.each do |tag|
-              range = Contrast::Api::Dtm::TraceTaintRange.new
-              range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(key)
-              range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
-              ranges << range
-            end
-          end
-          ranges
-        end
-
-        # Remove all tags within the given ranges.
-        # This does not delete an entire tag if part of that tag is
-        # outside this range, meaning we may reduce sizes of tags
-        # or split them.
-        #
-        # If shift is true, it is assumed the characters at those ranges were
-        # removed. If shift is false, it is assumed those ranges were replaced
-        # by the same number of characters and no shift is needed.
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-15
-        def delete_tags_at_ranges ranges, shift = true
-          return unless tags?
-
-          # Stage one - delete the tags w/o changing their
-          # location.
-          ranges.each do |range|
-            remove_tags(range)
-          end
-
-          return unless shift
-
-          # the amount we've already removed from the string
-          shift = 0
-          # Stage two - shift the tags to the left to account
-          # for the sections that were deleted.
-          ranges.each do |range|
-            shift_tags_for_deletion(range, shift)
-            shift += (range.stop - range.start)
-          end
-
-          # Clean up and merge any touching tags
-          Contrast::Utils::TagUtil.merge_tags(tags)
-        end
-
-        # Shift all the tags in this object by the given ranges.
-        # This method assumes the ranges are sorted, meaning
-        # the leftmost (lowest) range is first
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-20
-        def shift_tags ranges
-          return unless tags?
-
-          ranges.each do |range|
-            shift_tags_for_insertion(range)
-          end
-        end
-
-        # Add an event to these properties. It will be used to build
-        # a trace if this object ends up in a trigger.
-        def add_event event
-          events << event
-          self
-        end
-
-        def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
-          add_event(event)
-          report_sources(tagged, event)
-        end
-
-        private
-
-        def report_sources tagged, event
-          return unless tagged && !tagged.to_s.empty?
-          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
-          return unless event&.source_type
-
-          current_request = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_request
-          return if current_request.observed_route.sources.any? { |source| source.type == event.forced_source_type && source.name == event.forced_source_name }
-
-          event_source_dtm = event.build_event_source_dtm
-          return unless event_source_dtm
-
-          current_request.observed_route.sources << event_source_dtm
-        end
-
-        # Because of the auto-fill thing, we should not allow direct access to
-        # the tags hash. Instead, the methods above should be used to do
-        # operations like add, delete, and fetch.
-        #
-        # CONTRAST-22914
-        # please do NOT expose this w/ an attr_reader / accessor. there are
-        # helper methods in this class that safely access the hash. the tags
-        # method is private to avoid the side effect of a direct lookup with
-        # `[]` adding an empty array to the hash.
-        def tags
-          @_tags ||= Hash.new { |h, k| h[k] = [] }
-        end
-
-        # Creating Tags is expensive and we check for Tags all the time on
-        # untracked things. ALWAYS!!! call this method before checking if
-        # an object has tags
-        def tags?
-          instance_variable_defined?(:@_tags)
-        end
-
-        # Remove the tag ranges covering the given range
-        def remove_tags range
-          return unless tags?
-
-          full_delete = []
-          tags.each_pair do |key, value|
-            remove = []
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # ABOVE and BELOW are not affected by this check
-              case comparison
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::WITHIN
-                remove << tag
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.stop)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                tag.update_start(range.stop)
-              end
-            end
-            value.delete_if { |tag| remove.include?(tag) }
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-            full_delete << key if value.empty?
-          end
-          full_delete.each { |key| tags.delete(key) }
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a deletion, meaning we
-        # have to move tags to the left
-        def shift_tags_for_deletion range, shift
-          return unless tags?
-
-          tags.each_value do |value|
-            value.each do |tag|
-              comparison = tag.compare_range(range.start - shift, range.stop - shift)
-              length = range.stop - range.start
-              case comparison
-              # this is really the only thing we need to shift
-              when Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(0 - length)
-              end
-            end
-          end
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a insertion, meaning we
-        # have to move tags to the right
-        def shift_tags_for_insertion range
-          return unless tags?
-
-          tags.each_value do |value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              length = range.stop - range.start
-              # BELOW is not affected by this check
-              case comparison
-              # part of the tag is being inserted on
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              # the tag exists in the inserted range. it is partially shifted
-              when Contrast::Agent::Assess::Tag::WITHIN
-                tag.shift(length)
-              # the tag spans the range. leave the part below alone
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(length)
-              end
-            end
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-          end
+        def dup
+          ret = super
+          ret.dupped_from = __id__
+          ret
         end
       end
     end