contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/agent/assess/insulator.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/agent/assess/properties'
-
-module Contrast
-  module Agent
-    module Assess
-      # This is just a wrapper around Properties so that if they are on a frozen
-      # object, they are left mutable for us.
-      class Insulator
-        # Return a new delegator with a properties method, used to track
-        # properties in a manner that won't be serialized.
-        #
-        # @return [SimpleDelegator<Object>]
-        def self.generate
-          delegator = SimpleDelegator.new(nil)
-          delegator.extend(Contrast::Utils::PreventPsychSerialization)
-          delegator
-        end
-
-        # Return the frozen properties delegator, which is a
-        #
-        # @return [SimpleDelegator<Object>]
-        def self.generate_frozen
-          @_generate_frozen ||= begin
-                                  delegator = SimpleDelegator.new(nil)
-                                  delegator.extend(Contrast::Utils::PreventPsychSerialization)
-                                  delegator
-                                end
-        end
-      end
-    end
-  end
-end
-
-# Our patch of the SimpleDelegator class, allowing us to leverage its
-# marshal_dump and marshal_load methods to hide our properties on an object so
-# that they will not be dumped or loaded.
-# We do this to prevent polluting data that may run on applications that are no
-# longer instrumented with Contrast
-class SimpleDelegator
-  # rubocop:disable Naming/MemoizedInstanceVariableName
-  def properties
-    @delegate_properties ||= Contrast::Agent::Assess::Properties.new
-  end
-  # rubocop:enable Naming/MemoizedInstanceVariableName
-end

data/lib/contrast/agent/require_state.rb

@@ -1,61 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    # Thread local way to access the current RequireState. Used as a convenient
-    # wrapper to ensure specific key is used and that we handle the case when
-    # we try to enter a previously unset require scope.
-    # (Note that 'require scopes' track nested requires.  This is distinct
-    # from 'contrast scope', which tracks instrumentation.)
-    module RequireStates
-      class << self
-        KEY = :thread_local_contrast_require_scope
-
-        def enter
-          scope = current_scope
-          unless current_scope
-            scope = RequireState.new
-            Thread.current[KEY] = scope
-          end
-          scope.enter
-        end
-
-        def exit
-          current_scope.exit
-        end
-
-        def current_scope
-          Thread.current[KEY]
-        end
-
-        def status
-          current_scope&.scope.to_s
-        end
-
-        def in_scope?
-          scope = current_scope
-          scope && scope.scope > 1
-        end
-      end
-    end
-
-    # Simple counter class for tracking how deep in nested requires / file
-    # load operations we currently are.
-    class RequireState
-      attr_reader :scope
-
-      def initialize
-        @scope = 0
-      end
-
-      def enter
-        @scope += 1
-      end
-
-      def exit
-        @scope -= 1
-      end
-    end
-  end
-end

data/lib/contrast/extension/assess/assess_extension.rb

@@ -1,147 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/insulator'
-
-module Contrast
-  module Extension
-    module Assess
-      # This module is responsible for maintaining the data we need to
-      # construct a trace event for the object in which it is included. Rather
-      # than have this code all over the place, any class that wants to use
-      # dataflow features should be sent
-      # 'include Contrast::Extension::Assess::AssessExtension'
-      module AssessExtension
-        # Lazily build properties object. Only objects that have been tracked
-        # will have the @_cs__properties, but all will respond to the
-        # cs__properties method call. You should only call this method if you
-        # either intend to start tracking an object or you have already checked
-        # cs__tracked? and it is true.
-        def cs__properties
-          # If this object was tracked before being frozen, it'll have
-          # mutable properties we need inside of the insulator @_cs__properties
-          if cs__frozen?
-            if instance_variable_defined?(:@_cs__properties)
-              @_cs__properties.properties
-            else
-              Contrast::Agent::Assess::Insulator.generate_frozen.properties
-            end
-          else
-            @_cs__properties ||= Contrast::Agent::Assess::Insulator.generate
-            @_cs__properties.properties
-          end
-        end
-
-        def cs__properties?
-          instance_variable_defined?(:@_cs__properties)
-        end
-
-        # This is a way to check if we are already tracking an object without
-        # adding tracking to it. If the object already has been tracked we will
-        # return the tracking state of its properties. If the object hasn't
-        # already been tracked we will return false without starting to track
-        # it
-        def cs__tracked?
-          cs__properties? && cs__properties.tracked?
-        end
-
-        def cs__reset_properties
-          return unless cs__properties?
-
-          @_cs__properties = nil
-        end
-
-        # copy tags and info from object to self if object support methods
-        # obj: the object from which to copy tags and events
-        # shift: how far to shift the tags, negative moves left
-        # skip_tags: array of tags to skip copying
-        def cs__copy_from obj, shift = 0, skip_tags = nil
-          return if obj.equal?(self)
-          return unless Contrast::Utils::DuckUtils.quacks_to?(obj,
-                                                              :cs__tracked?)
-          return unless obj.cs__tracked?
-          return if cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
-
-          # This was fun to find...
-          # the clone and dup methods don't apply to instance variables in the
-          # cloned/ duped thing, so the arrays in the properties were the same.
-          # The most infinite of infinite loops ensued.
-          # DO NOT TAKE THIS OUT!
-          cs__reset_properties if obj.cs__properties == cs__properties
-
-          obj.cs__properties.events.each do |event|
-            cs__properties.events << event
-          end
-
-          obj.cs__properties.tag_keys.each do |key|
-            next if skip_tags&.include?(key)
-
-            new_tags = []
-            value = obj.cs__properties.fetch_tag(key)
-            value.each do |tag|
-              new_tags << tag.copy_modified(shift)
-            end
-            existing = cs__properties.fetch_tag(key)
-            if existing
-              existing.concat(new_tags)
-              Contrast::Utils::TagUtil.size_aware_merge(self, existing)
-            else
-              cs__properties.set_tags(key, new_tags)
-            end
-          end
-        end
-
-        # Some propagation occurred, but we're not sure what the
-        # exact transformation was. To be safe, we just explode
-        # all the tags from the source to the return.
-        #
-        # If the return already had that tag, the existing tag
-        # range is recycled to save us an object.
-        def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.trackable?(ret)
-
-          length = Contrast::Utils::StringUtils.ret_length(ret)
-          return if length.zero?
-
-          cs__splat_from_source(ret, length, source)
-          cs__splat_from_ret(ret, length)
-        end
-
-        def cs__splat_from_source ret, ret_length, source
-          splat_source = Contrast::Utils::DuckUtils.trackable?(source)
-          splat_source &&= source.cs__tracked?
-          return unless splat_source
-
-          source.cs__properties.tag_keys.each do |key|
-            existing = ret.cs__properties.fetch_tag(key)
-            # if the tag already exists, drop all but the first range
-            # then change that range to cover the entire return
-            if existing
-              existing.drop(existing.length - 1)
-              range = existing[0]
-              range.repurpose(0, ret_length)
-            else
-              ret.cs__properties.add_tag(key, 0...ret_length)
-            end
-          end
-        end
-
-        def cs__splat_from_ret ret, length
-          return unless ret.cs__tracked?
-
-          ret.cs__properties.tag_keys.each do |key|
-            next unless key
-
-            existing = ret.cs__properties.fetch_tag(key)
-            next unless existing
-
-            existing.each do |range|
-              range.update_end(length) if range.end_idx > length
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/freeze_util.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/duck_utils'
-
-module Contrast
-  module Utils
-    # This utility allows us to act on frozen objects, creating an unfrozen
-    # duplicate in those cases where that is possible.
-    class FreezeUtil
-      class << self
-        # Make every attempt to duplicate the frozen object so that it can
-        # be tracked.
-        #
-        # @param original [Object] something frozen, usually a String
-        # @return [Object] the original or an unfrozen copy
-        def unfreeze_dup original
-          return original unless original.cs__frozen?
-
-          copy = original.dup
-          if Contrast::Utils::DuckUtils.iterable_hash?(copy)
-            copy.each_key do |key|
-              value = original[key]
-              copy[key] = value.dup
-            end
-          end
-          copy
-        end
-      end
-    end
-  end
-end