contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/extension/assess.rb

@@ -12,37 +12,36 @@ module Contrast
     #   therein.
     #   Removing it requires a C refactor to handle the namespace.
     module Assess
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/patching/policy/patcher'
 
-      cs__scoped_require 'contrast/utils/tag_util'
+      require 'contrast/utils/tag_util'
 
       # provider rules - have to come before policy
-      cs__scoped_require 'contrast/agent/assess/rule/provider'
+      require 'contrast/agent/assess/rule/provider'
 
       # tagging / dataflow
-      cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-      cs__scoped_require 'contrast/agent/assess/policy/source_node'
-      cs__scoped_require 'contrast/agent/assess/policy/source_method'
-      cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-      cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-      cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
-      cs__scoped_require 'contrast/agent/assess/policy/policy'
-      cs__scoped_require 'contrast/agent/assess/policy/patcher'
+      require 'contrast/agent/assess/policy/policy_node'
+      require 'contrast/agent/assess/policy/source_node'
+      require 'contrast/agent/assess/policy/source_method'
+      require 'contrast/agent/assess/policy/propagation_node'
+      require 'contrast/agent/assess/policy/propagation_method'
+      require 'contrast/agent/assess/policy/trigger_node'
+      require 'contrast/agent/assess/policy/trigger_method'
+      require 'contrast/agent/assess/policy/policy'
+      require 'contrast/agent/assess/policy/patcher'
 
-      # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extension/assess/string'
+      require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extension/assess/array'
-      cs__scoped_require 'contrast/extension/assess/erb'
-      cs__scoped_require 'contrast/extension/assess/eval_trigger'
-      cs__scoped_require 'contrast/extension/assess/fiber'
-      cs__scoped_require 'contrast/extension/assess/hash'
-      cs__scoped_require 'contrast/extension/assess/kernel'
-      cs__scoped_require 'contrast/extension/assess/regexp'
+      require 'contrast/extension/assess/array'
+      require 'contrast/extension/assess/erb'
+      require 'contrast/extension/assess/eval_trigger'
+      require 'contrast/extension/assess/fiber'
+      require 'contrast/extension/assess/hash'
+      require 'contrast/extension/assess/kernel'
+      require 'contrast/extension/assess/regexp'
+      require 'contrast/extension/assess/marshal'
     end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/patch'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -35,37 +35,44 @@ module Contrast
           # operation happens in C, we have to do it here rather than rely on the
           # patch of our String append or concat methods.
           def cs__track_join ary, separator, ret
-            return unless ary
+            return ret unless ary
             return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
 
             with_contrast_scope do
+              properties = Contrast::Agent::Assess::Tracker.properties(ret)
+              return ret unless properties
+
               shift = 0
               separator_length = separator.nil? ? 0 : separator.to_s.length
+              parent_events = []
               ary.each do |obj|
                 if obj # skip nil here
-                  ret.cs__copy_from(obj, shift)
+                  properties.copy_from(obj, ret, shift)
                   shift += obj.to_s.length
+                  parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
+                  parent_events << parent_event if parent_event
                 end
                 shift += separator_length
               end
-              return ret unless ret.cs__tracked?
+              return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
-              ret.cs__properties.cleanup_tags
-              ret.cs__properties.build_event(
+              properties.cleanup_tags
+              properties.build_event(
                   ARRAY_JOIN_NODE,
                   ret,
                   ary,
                   ret,
                   [separator])
+              properties.event.instance_variable_set(:@_parent_events, parent_events)
               ret
             end
           end
 
           def instrument_array_track
             @_instrument_array_track ||= begin
-                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
-                                           true
-                                         end
+              require 'cs__assess_array/cs__assess_array'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading assess track patch', e)
             false

data/lib/contrast/extension/assess/erb.rb

@@ -7,27 +7,35 @@ module ERBPropagator
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
 
+      properties = Contrast::Agent::Assess::Tracker.properties(ret)
+      return unless properties
+
       used_binding = preshift.args[0]
       binding_variable_set = used_binding.local_variables
 
       erb_pre_result = preshift.object.src
+      parent_events = []
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
-        next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
+        next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
         next unless erb_pre_result.include?(bound_var_symbol.to_s)
 
         start_index = ret.index(bound_variable_value)
         next if start_index.nil?
 
-        ret.cs__copy_from(bound_variable_value, start_index)
+        properties.copy_from(bound_variable_value, ret, start_index)
+        parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
+        parent_events << parent_event if parent_event
       end
-      ret.cs__properties.build_event(
+      properties.build_event(
           patcher,
           ret,
           preshift.object,
           ret,
           preshift.args,
           1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
       ret
     end
   end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -45,9 +45,9 @@ module Contrast
 
           def instrument_basic_object_track
             @_instrument_basic_object_track ||= begin
-                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
-                                               true
-                                             end
+              require 'cs__assess_basic_object/cs__assess_basic_object'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading basic object track patch', e)
             false
@@ -55,9 +55,9 @@ module Contrast
 
           def instrument_module_track
             @_instrument_module_track ||= begin
-                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
-                                               true
-                                             end
+              require 'cs__assess_module/cs__assess_module'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading module track patch', e)
             false

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/at_exit_hook'
 
 module Contrast
   module Extension
@@ -27,7 +27,7 @@ module Contrast
               source,
               Kernel,
               nil,
-              source)
+              [source])
           # Exec replaces the current process, if we occur in a forked process
           # our appendage of this finding will not make it to TS
           Contrast::Agent::AtExitHook.on_exit

data/lib/contrast/extension/assess/fiber.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -54,7 +54,6 @@ module Contrast
         class << self
           def track_rb_fiber_yield fiber, _method, results
             return unless ASSESS.enabled?
-            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
 
             # results will be nil if StopIteration was raised,
             # otherwise an Array of the yielded arguments
@@ -62,11 +61,11 @@ module Contrast
 
             with_contrast_scope do
               results.each do |result|
-                next unless Contrast::Utils::DuckUtils.trackable?(result)
-                next if result.cs__frozen?
+                result_properties = Contrast::Agent::Assess::Tracker.properties(result)
+                next unless result_properties
 
-                fiber.cs__splat_tags(result)
-                result.cs__properties.build_event(
+                result_properties.splat_from(fiber, result)
+                result_properties.build_event(
                     FIBER_YIELD_NODE,
                     result,
                     fiber,
@@ -80,13 +79,14 @@ module Contrast
 
           def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
             return unless ASSESS.enabled?
-            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
-            return unless Contrast::Utils::DuckUtils.trackable?(underlying)
             return unless underlying.is_a?(String) && !underlying.empty?
 
             with_contrast_scope do
-              underlying.cs__splat_tags(fiber)
-              fiber.cs__properties.build_event(
+              properties = Contrast::Agent::Assess::Tracker.properties(fiber)
+              return unless properties
+
+              properties.splat_from(underlying, fiber)
+              properties.build_event(
                   FIBER_NEW_NODE,
                   fiber,
                   underlying,
@@ -99,9 +99,9 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
-                true
-              end
+              require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading fiber track patch', e)
             false

data/lib/contrast/extension/assess/hash.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -15,9 +15,10 @@ module Contrast
         class << self
           def cs__duplicate_and_freeze object
             return object unless object.is_a?(String) && !object.cs__frozen?
-            return object unless object.cs__tracked?
+            return object unless Contrast::Agent::Assess::Tracker.tracked?(object)
 
-            object.dup.cs__freeze
+            ret = Contrast::Agent::Assess::Tracker.duplicate(object)
+            ret.cs__freeze
           rescue StandardError
             # we'll rescue this error, but we can't log it here as that will
             # result in a seg fault
@@ -25,9 +26,9 @@ module Contrast
 
           def instrument_hash_track
             @_instrument_hash_track ||= begin
-                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
-                                            true
-                                          end
+              require 'cs__assess_hash/cs__assess_hash'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/exec_trigger'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/exec_trigger'
 
 module Contrast
   module Extension
@@ -39,43 +39,47 @@ module Contrast
           # oh, and there's also %<name>type and %{name}... b/c of course there is
           # -HM
           def sprintf_tagger patcher, preshift, ret, _block
+            properties = Contrast::Agent::Assess::Tracker.properties(ret)
+            return unless properties
+
             format_string = preshift.args[0]
             args = preshift.args[1]
 
-            track_sprintf(ret, format_string, args)
+            parent_events = []
+            track_sprintf(ret, format_string, args, parent_events)
 
-            ret.cs__properties.build_event(
+            properties.build_event(
                 patcher,
                 ret,
                 preshift.object,
                 ret,
                 preshift.args,
                 1)
+
+            properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret
           end
 
-          def track_sprintf result, format_string, args
-            handle_sprintf_value(format_string, result)
-            if args.is_a?(String)
-              handle_sprintf_value(args, result)
-            elsif args.is_a?(Hash)
-              handle_sprintf_hash(args, result)
-            elsif args.is_a?(Array)
-              handle_sprintf_array args, result
+          def track_sprintf result, format_string, args, parent_events
+            handle_sprintf_value(format_string, result, parent_events)
+            case args
+            when String
+              handle_sprintf_value(args, result, parent_events)
+            when Hash
+              handle_sprintf_hash(args, result, parent_events)
+            when Array
+              handle_sprintf_array(args, result, parent_events)
             end
-
-            result
           rescue StandardError => e
             logger.error(
                 'Unable to track dataflow through sprintf', e)
-            result
           end
 
           def instrument_kernel_track
             @_instrument_fiber_variables ||= begin
-                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
-                                               true
-                                             end
+              require 'cs__assess_kernel/cs__assess_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel track patch', e)
             false
@@ -83,24 +87,26 @@ module Contrast
 
           private
 
-          def handle_sprintf_value value, result
-            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+          def handle_sprintf_value value, result, parent_events
+            properties = Contrast::Agent::Assess::Tracker.properties(result)
+            return unless properties
 
-            value.cs__properties.events.each do |event|
-              result.cs__properties.events << event
-            end
-            value.cs__splat_tags(result)
+            value_properties = Contrast::Agent::Assess::Tracker.properties(value)
+            return unless value_properties
+
+            parent_events << value_properties.event if value_properties.event
+            properties.splat_from(value, result)
           end
 
-          def handle_sprintf_array args, result
+          def handle_sprintf_array args, result, parent_events
             args.each do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
 
-          def handle_sprintf_hash args, result
+          def handle_sprintf_hash args, result, parent_events
             args.each_value do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
         end

data/lib/contrast/extension/assess/marshal.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      # This module is used for our Marshal#load patches
+      class MarshalPropagator
+        include Contrast::Components::Interface
+
+        access_component :logging
+
+        class << self
+          def cs__load_trigger_check source, ret
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+
+            args = [source]
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                current_context,
+                trigger_node('Marshal', :load),
+                source,
+                self,
+                ret,
+                args)
+            properties = Contrast::Agent::Assess::Tracker.properties(ret)
+            properties.copy_from(source, ret)
+
+            node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
+            properties.build_event(node, ret, self, ret, args)
+          rescue StandardError => e
+            logger.error('Unable to determine if a trigger occurred in Marshal.load', e)
+          end
+
+          def instrument_marshal_load
+            @_instrument_marshal_load ||= begin
+              require 'cs__assess_marshal_module/cs__assess_marshal_module'
+              true
+            end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading marshal load patch', e)
+            false
+          end
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end