contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Agent
@@ -15,7 +15,7 @@ module Contrast
           access_component :scope
           attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
@@ -59,7 +59,7 @@ module Contrast
           end
 
           def instrument!
-            cs__scoped_require instrumentation_file_path
+            require instrumentation_file_path
             if instrumenting_module
               mod = Module.cs__const_get(instrumenting_module)
               with_contrast_scope { mod.instrument } if mod
@@ -71,10 +71,10 @@ module Contrast
 
           def module_lookup
             @_module_lookup ||= begin
-                                  Module.cs__const_get module_name
-                                rescue StandardError => _e
-                                  nil
-                                end
+              Module.cs__const_get module_name
+            rescue StandardError => _e
+              nil
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
-cs__scoped_require 'contrast/framework/manager'
+require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/components/interface'
+require 'contrast/framework/manager'
 
 module Contrast
   module Agent
@@ -30,19 +30,20 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
+              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+              Contrast::Extension::Assess::StringPropagator.instrument_string
+              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
 
-                                    Contrast::Extension::Protect::Kernel.instrument
-                                    true
-                                  end
+              Contrast::Extension::Protect::Kernel.instrument
+              true
+            end
           end
 
           def apply_load_patches!
@@ -64,13 +65,13 @@ module Contrast
           # handling
           def apply_require_patches!
             @_apply_require_patches ||= begin
-                                          cs__scoped_require 'contrast/extension/thread'
-                                          cs__scoped_require 'contrast/extension/kernel'
-                                          true
-                                        rescue LoadError, StandardError => e
-                                          logger.error('failed instrumenting apply_require_patches!', e)
-                                          false
-                                        end
+              require 'contrast/extension/thread'
+              require 'contrast/extension/kernel'
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
+            end
           end
 
           def after_load_patches

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -61,16 +61,16 @@ module Contrast
           # @return [Integer] count of methods to be patched
           def num_expected_patches
             @_num_expected_patches ||= begin
-                                         instance_methods = Set.new
-                                         singleton_methods = Set.new
-                                         sort_method_names(source_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(propagator_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(trigger_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(inventory_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(protect_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
-                                         instance_methods.length + singleton_methods.length
-                                       end
+              instance_methods = Set.new
+              singleton_methods = Set.new
+              sort_method_names(source_nodes, instance_methods, singleton_methods)
+              sort_method_names(propagator_nodes, instance_methods, singleton_methods)
+              sort_method_names(trigger_nodes, instance_methods, singleton_methods)
+              sort_method_names(inventory_nodes, instance_methods, singleton_methods)
+              sort_method_names(protect_nodes, instance_methods, singleton_methods)
+              sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
+              instance_methods.length + singleton_methods.length
+            end
           end
 
           private

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,26 +1,26 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-cs__scoped_require 'contrast/components/interface'
+require 'monitor'
+require 'contrast/components/interface'
 
-cs__scoped_require 'contrast/agent'
-cs__scoped_require 'contrast/logger/log'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent'
+require 'contrast/logger/log'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/trigger_node'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/propagation_method'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 module Contrast
   module Agent
@@ -371,7 +371,7 @@ module Contrast
               when :prepend
                 prepending_module = Module.new
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                prepending_module.send(visibility, :method_name)
+                prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
               end
@@ -414,4 +414,4 @@ module Contrast
   end
 end
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -1,36 +1,36 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
+require 'monitor'
 
 # base
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/policy_scanner'
-cs__scoped_require 'contrast/agent/assess/policy/rewriter_patch'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/policy_scanner'
+require 'contrast/agent/assess/policy/rewriter_patch'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # deadzone
-cs__scoped_require 'contrast/agent/deadzone/policy/policy'
+require 'contrast/agent/deadzone/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # patch
-cs__scoped_require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patch'
 
 # after load patched
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patcher'
+require 'contrast/agent/patching/policy/after_load_patcher'
 
 module Contrast
   module Agent
@@ -77,19 +77,21 @@ module Contrast
             # This method is called by TracePointHook to instrument a specific class during a require
             # or eval of dynamic class definition
             def patch_specific_module mod
-              mod_name = mod.cs__name
-              return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
-              return if AGENT.skip_instrumentation?(mod_name)
+              with_contrast_scope do
+                mod_name = mod.cs__name
+                return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
+                return if AGENT.skip_instrumentation?(mod_name)
 
-              load_patches_for_module(mod_name)
+                load_patches_for_module(mod_name)
 
-              return unless all_module_names.any? { |name| name == mod_name }
+                return unless all_module_names.any? { |name| name == mod_name }
 
-              module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
-              patch_into_module(module_data)
-              all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
-            rescue StandardError => e
-              logger.error('Unable to patch module', e, module: mod_name)
+                module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
+                patch_into_module(module_data)
+                all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
+              rescue StandardError => e
+                logger.error('Unable to patch module', e, module: mod_name)
+              end
             end
 
             # We did it, team. We found a patcher(s) that applies to the given
@@ -186,7 +188,7 @@ module Contrast
               clazz = module_data.mod
 
               status.patching!
-              patched = include_module(module_data)
+              patched = false
 
               counts = 0
               # Monkey patch any methods in this class that have matching nodes in the policy
@@ -219,17 +221,6 @@ module Contrast
                                module_data.mod).patch_status)
             end
 
-            # Includes the given module with the
-            # Contrast::Extension::Assess::AssessExtension
-            # @param module_data [Contrast::Agent::ModuleData] the module, and
-            #   its name, that's being patched into
-            def include_module module_data
-              return false unless Contrast::Agent::Assess::Policy::Policy.instance.tracked_classes.include?(module_data.name)
-
-              module_data.mod.send(:include, Contrast::Extension::Assess::AssessExtension)
-              true
-            end
-
             # Get all of the instance methods on the given module, excluding
             # those from super classes. this list will always include the
             # initialize method
@@ -247,6 +238,14 @@ module Contrast
               instance_methods.concat(mod.private_instance_methods(false)) if private
               # initialize is an exception to the inheritance rule.
               instance_methods << :initialize unless instance_methods.include?(:initialize)
+              # Object owns these, but we don't want to patch every :dup or
+              # :clone, just the ones on String, so we'll special case this.
+              # This breaks the norm, where we usually instrument the lowest
+              # method possible.
+              if mod == String
+                instance_methods << :clone
+                instance_methods << :dup
+              end
               instance_methods
             end
 
@@ -298,10 +297,10 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/extension/assess'
-cs__scoped_require 'contrast/extension/inventory'
-cs__scoped_require 'contrast/extension/protect'
-cs__scoped_require 'contrast/extension/protect/kernel'
+require 'contrast/extension/module'
+require 'contrast/extension/assess'
+require 'contrast/extension/inventory'
+require 'contrast/extension/protect'
+require 'contrast/extension/protect/kernel'
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'singleton'
+require 'json'
+require 'singleton'
 
-cs__scoped_require 'contrast'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast'
+require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -37,13 +37,12 @@ module Contrast
 
           access_component :analysis, :logging
 
-          attr_reader :sources, :propagators, :triggers, :providers, :tracked_classes
+          attr_reader :sources, :propagators, :triggers, :providers
 
           SOURCES_KEY =          'sources'
           PROPAGATION_KEY =      'propagators'
           RULES_KEY = 'rules'
           TRIGGERS_KEY = 'triggers'
-          TRACKED_CLASSES_KEY = 'tracked_classes'
 
           def self.policy_json
             File.join(policy_folder, 'policy.json').cs__freeze
@@ -54,7 +53,6 @@ module Contrast
             @propagators = []
             @triggers = []
             @providers = {}
-            @tracked_classes = []
 
             json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
             from_hash_string(json)
@@ -114,7 +112,6 @@ module Contrast
           def module_names
             @_module_names ||= begin
               m = Set.new
-              tracked_classes.each { |tracked| m << tracked }
               sources.each { |source| m << source.class_name }
               propagators.each { |propagator| m << propagator.class_name }
               triggers.each { |trigger| m << trigger.class_name }
@@ -127,12 +124,26 @@ module Contrast
           end
 
           def find_source_node class_name, method_name, instance_method
-            sources.find { |source| source.class_name == class_name && source.method_name == method_name && source.instance_method == instance_method }
+            sources.find do |source|
+              source.class_name == class_name &&
+                  source.method_name == method_name &&
+                  source.instance_method == instance_method
+            end
+          end
+
+          def find_propagator_node class_name, method_name, instance_method
+            propagators.find do |propagator|
+              propagator.class_name == class_name &&
+                  propagator.method_name == method_name &&
+                  propagator.instance_method == instance_method
+            end
           end
 
           def find_node rule_id, class_name, method_name, instance_method
             find_triggers_by_rule(rule_id).find do |node|
-              node.class_name == class_name && node.method_name == method_name && node.instance_method == instance_method
+              node.class_name == class_name &&
+                  node.method_name == method_name &&
+                  node.instance_method == instance_method
             end
           end
         end

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/extension/module'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
-cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent
@@ -30,11 +30,9 @@ module Contrast
               Contrast::Agent::Protect::Policy::AppliesDeserializationRule.apply_deserialization_command_check(command)
               return if skip_analysis?
 
-              begin
-                clazz = object.is_a?(Module) ? object : object.cs__class
-                class_name = clazz.cs__name
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
-              end
+              clazz = object.is_a?(Module) ? object : object.cs__class
+              class_name = clazz.cs__name
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
             end
 
             protected