contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/extension/assess/regexp.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -47,8 +47,6 @@ module Contrast
             return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
 
             target = info_hash[:back_ref]
-            return unless Contrast::Utils::DuckUtils.trackable?(target)
-
             with_contrast_scope do
               result = info_hash[:result]
               return unless result
@@ -56,8 +54,11 @@ module Contrast
               string = info_hash[:string]
               return unless string
 
-              string.cs__splat_tags(target)
-              target.cs__properties.build_event(
+              properties = Contrast::Agent::Assess::Tracker.properties(target)
+              return unless properties
+
+              properties.splat_from(string, target)
+              properties.build_event(
                   REGEXP_EQUAL_SQUIGGLE_NODE,
                   target,
                   self,
@@ -70,9 +71,9 @@ module Contrast
 
           def instrument_regexp_track
             @_instrument_regexp_track ||= begin
-                                               cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
-                                               true
-                                             end
+              require 'cs__assess_regexp/cs__assess_regexp'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading regexp track patch', e)
             false

data/lib/contrast/extension/assess/string.rb

@@ -1,15 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
-
-# This patch installs our extension as early as possible. The alternative is to
-# litter our code with Contrast::Utils::DuckUtils.trackable? checks.
-class String
-  include Contrast::Extension::Assess::AssessExtension
-end
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -40,23 +33,32 @@ module Contrast
           def track_interpolation inputs, result
             return unless AGENT.interpolation_enabled?
             return if in_contrast_scope?
-            return unless inputs.any?(&:cs__tracked?)
+            return unless inputs.any? { |input| Contrast::Agent::Assess::Tracker.tracked?(input) }
 
             with_contrast_scope do
+              properties = Contrast::Agent::Assess::Tracker.properties(result)
+              return unless properties
+
+              parent_events = []
               offset = 0
               inputs.each do |input|
-                result.cs__copy_from(input, offset)
+                properties.copy_from(input, result, offset)
                 offset += input.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
+                parent_events << parent_event if parent_event
               end
-              result.cs__properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.event.instance_variable_set(:@_parent_events, parent_events)
             end
+          rescue StandardError => e
+            logger.error('Unable to track interpolation', e)
           end
 
           def instrument_string
             @_instrument_string ||= begin
-                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
-                                      true
-                                    end
+              require 'cs__assess_string/cs__assess_string'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
@@ -65,14 +67,12 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation? && Funchook.available?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
-                                                    end
-                                                    true
-                                                  rescue StandardError, LoadError => e
-                                                    logger.error('Error loading interpolation patch', e)
-                                                    false
-                                                  end
+                require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26' if AGENT.patch_interpolation? && Funchook.available?
+                true
+              rescue StandardError, LoadError => e
+                logger.error('Error loading interpolation patch', e)
+                false
+              end
             end
             @_instrument_string_interpolation
           end

data/lib/contrast/extension/inventory.rb

@@ -11,11 +11,11 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/inventory/policy/policy'
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
     end
   end
 end

data/lib/contrast/extension/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/scope'
+require 'contrast/components/scope'
 
 # This is a reasonable place for the Kernel#catch hook to live.
 # No current plans for component re-design, but if we had some kind of

data/lib/contrast/extension/module.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 # Some developers override various methods on Module, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being

data/lib/contrast/extension/protect.rb

@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -30,9 +30,9 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
-                                               true
-                                             end
+              require 'cs__protect_kernel/cs__protect_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel protect patch', e)
             false

data/lib/contrast/extension/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -46,7 +46,7 @@ module Contrast
         #
         # By default, and hopefully in all cases, we won't need these patches,
         # so we're allowing nil here rather than raising an exception.
-        def before_load_patches; end
+        def before_load_patches!; end
 
         # Some Frameworks require specific patching for their classes to handle
         # functionality like routing. To accommodate this, this method provides

data/lib/contrast/framework/manager.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/rack/support'
-cs__scoped_require 'contrast/framework/rails/support'
-cs__scoped_require 'contrast/framework/sinatra/support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/framework/platform_version'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
@@ -39,9 +39,9 @@ module Contrast
       # configuration.
       def before_load_patches!
         @_before_load_patches ||= begin
-                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
-                                    true
-                                  end
+          SUPPORTED_FRAMEWORKS.each(&:before_load_patches!)
+          true
+        end
       end
 
       # Return all the After Load Patches for all the Frameworks we know, even
@@ -128,10 +128,9 @@ module Contrast
       # @param method_name [Symbol] the method to call on each FrameworkSupport class
       # @return [Array]
       def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
+        @_frameworks.flat_map do |framework|
           framework.send(method_name)
         end.compact
-        data
       end
 
       # This returns a single object from the first framework to successfully respond

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -24,15 +24,15 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::Rack::Session::Cookie.class_eval do
-                                   alias_method :cs__patched_initialize, :initialize
-                                   def initialize app, options = {}
-                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
-                                     cs__patched_initialize(app, options)
-                                   end
-                                 end
-                                 true
-                               end
+                ::Rack::Session::Cookie.class_eval do
+                  alias_method :cs__patched_initialize, :initialize
+                  def initialize app, options = {}
+                    Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                    cs__patched_initialize(app, options)
+                  end
+                end
+                true
+              end
             end
 
             def analyze options
@@ -67,12 +67,10 @@ module Contrast
                   options,
                   safe_default: false)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SECURE_RULE_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SECURE_RULE_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to secure session', e)
@@ -88,12 +86,10 @@ module Contrast
                                                 safe_default: false,
                                                 comparison_type: :greater_than)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SESSION_TIMEOUT_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SESSION_TIMEOUT_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -105,12 +101,10 @@ module Contrast
             def apply_httponly options
               return unless vulnerable_setting?(:httponly, true, options)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__HTTPONLY_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__HTTPONLY_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to httponly', e)

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rack/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -19,19 +19,19 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::ActionController::Live::Buffer.class_eval do
-                                   # normally pre->in->post filters are applied however, in a streamed response
-                                   # we can run into a case where it's pre -> in -> post -> more infilters
-                                   # in order to submit anything found during the infilters after the response has
-                                   # been written we need to explicitly send them
-                                   alias_method :cs__close, :close
-                                   def close
-                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
-                                     cs__close
-                                   end
-                                 end
-                                 true
-                               end
+                ::ActionController::Live::Buffer.class_eval do
+                  # normally pre->in->post filters are applied however, in a streamed response
+                  # we can run into a case where it's pre -> in -> post -> more infilters
+                  # in order to submit anything found during the infilters after the response has
+                  # been written we need to explicitly send them
+                  alias_method :cs__close, :close
+                  def close
+                    Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                    cs__close
+                  end
+                end
+                true
+              end
             end
           end
         end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/components/interface'
+require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
   module Framework
@@ -12,7 +12,7 @@ module Contrast
         module AssessConfiguration
           include Contrast::Components::Interface
 
-          access_component :agent, :analysis, :logging, :scope
+          access_component :agent, :analysis, :logging
 
           CS__SESSION_TIMEOUT_NAME = 'session-timeout'
           SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
@@ -52,9 +52,7 @@ module Contrast
               return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -68,9 +66,7 @@ module Contrast
               return unless vulnerable_setting?(:secure, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable secure cookies', e)
@@ -84,9 +80,7 @@ module Contrast
               return unless vulnerable_setting?(:httponly, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable httponly in session cookie', e)