contrast-agent 3.13.2 → 3.14.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/exe/contrast_service +1 -7
- data/ext/cs__assess_active_record_named/cs__active_record_named.c +8 -7
- data/ext/cs__assess_array/cs__assess_array.c +6 -5
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +5 -5
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -1
- data/ext/cs__assess_hash/cs__assess_hash.c +18 -17
- data/ext/cs__assess_hash/cs__assess_hash.h +2 -1
- data/ext/cs__assess_kernel/cs__assess_kernel.c +7 -8
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +4 -5
- data/ext/cs__assess_module/cs__assess_module.c +6 -6
- data/ext/cs__assess_regexp/cs__assess_regexp.c +4 -4
- data/ext/cs__assess_string/cs__assess_string.c +20 -4
- data/ext/cs__assess_string/cs__assess_string.h +4 -1
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +4 -2
- data/ext/cs__assess_yield_track/cs__assess_yield_track.c +2 -2
- data/ext/cs__common/cs__common.c +44 -37
- data/ext/cs__common/cs__common.h +15 -20
- data/ext/cs__contrast_patch/cs__contrast_patch.c +27 -25
- data/ext/cs__contrast_patch/cs__contrast_patch.h +5 -7
- data/ext/cs__protect_kernel/cs__protect_kernel.c +11 -12
- data/ext/cs__protect_kernel/cs__protect_kernel.h +2 -2
- data/lib/contrast-agent.rb +1 -1
- data/lib/contrast.rb +13 -23
- data/lib/contrast/agent.rb +39 -39
- data/lib/contrast/agent/assess.rb +11 -12
- data/lib/contrast/agent/assess/contrast_event.rb +11 -9
- data/lib/contrast/agent/assess/events/event_factory.rb +2 -2
- data/lib/contrast/agent/assess/events/source_event.rb +2 -2
- data/lib/contrast/agent/assess/finalizers/finalize.rb +21 -0
- data/lib/contrast/agent/assess/finalizers/freeze.rb +13 -0
- data/lib/contrast/agent/assess/finalizers/hash.rb +53 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
- data/lib/contrast/agent/assess/policy/patcher.rb +5 -5
- data/lib/contrast/agent/assess/policy/policy.rb +9 -9
- data/lib/contrast/agent/assess/policy/policy_node.rb +2 -2
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +3 -3
- data/lib/contrast/agent/assess/policy/preshift.rb +15 -5
- data/lib/contrast/agent/assess/policy/propagation_method.rb +25 -22
- data/lib/contrast/agent/assess/policy/propagation_node.rb +2 -2
- data/lib/contrast/agent/assess/policy/propagator.rb +18 -18
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +5 -0
- data/lib/contrast/agent/assess/policy/propagator/split.rb +4 -4
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +5 -4
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +5 -5
- data/lib/contrast/agent/assess/policy/source_method.rb +5 -14
- data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +1 -1
- data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger_method.rb +5 -5
- data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -3
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +2 -2
- data/lib/contrast/agent/assess/properties.rb +13 -5
- data/lib/contrast/agent/assess/property/evented.rb +2 -2
- data/lib/contrast/agent/assess/property/tagged.rb +4 -4
- data/lib/contrast/agent/assess/rule.rb +2 -2
- data/lib/contrast/agent/assess/rule/base.rb +3 -4
- data/lib/contrast/agent/assess/rule/provider.rb +3 -3
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -2
- data/lib/contrast/agent/at_exit_hook.rb +1 -1
- data/lib/contrast/agent/class_reopener.rb +7 -6
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
- data/lib/contrast/agent/deadzone/policy/policy.rb +2 -2
- data/lib/contrast/agent/disable_reaction.rb +1 -1
- data/lib/contrast/agent/exclusion_matcher.rb +1 -1
- data/lib/contrast/agent/inventory/policy/datastores.rb +2 -2
- data/lib/contrast/agent/inventory/policy/policy.rb +3 -3
- data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
- data/lib/contrast/agent/middleware.rb +33 -32
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +4 -4
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -5
- data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
- data/lib/contrast/agent/patching/policy/patch.rb +15 -15
- data/lib/contrast/agent/patching/policy/patcher.rb +30 -22
- data/lib/contrast/agent/patching/policy/policy.rb +6 -6
- data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
- data/lib/contrast/agent/patching/policy/trigger_node.rb +2 -2
- data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +3 -3
- data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +2 -2
- data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +2 -2
- data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +3 -3
- data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +2 -2
- data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +3 -3
- data/lib/contrast/agent/protect/policy/policy.rb +8 -8
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
- data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
- data/lib/contrast/agent/protect/rule.rb +18 -18
- data/lib/contrast/agent/protect/rule/base.rb +4 -3
- data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +5 -5
- data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
- data/lib/contrast/agent/protect/rule/no_sqli.rb +1 -1
- data/lib/contrast/agent/protect/rule/path_traversal.rb +4 -5
- data/lib/contrast/agent/protect/rule/sqli.rb +2 -2
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
- data/lib/contrast/agent/protect/rule/xss.rb +1 -1
- data/lib/contrast/agent/protect/rule/xxe.rb +3 -5
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +2 -2
- data/lib/contrast/agent/railtie.rb +1 -1
- data/lib/contrast/agent/reaction_processor.rb +2 -2
- data/lib/contrast/agent/request.rb +11 -9
- data/lib/contrast/agent/request_context.rb +10 -6
- data/lib/contrast/agent/response.rb +6 -6
- data/lib/contrast/agent/rewriter.rb +5 -6
- data/lib/contrast/agent/service_heartbeat.rb +2 -2
- data/lib/contrast/agent/static_analysis.rb +3 -3
- data/lib/contrast/agent/thread.rb +1 -1
- data/lib/contrast/agent/thread_watcher.rb +2 -2
- data/lib/contrast/agent/tracepoint_hook.rb +1 -1
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/api.rb +4 -4
- data/lib/contrast/api/communication.rb +9 -9
- data/lib/contrast/api/communication/messaging_queue.rb +2 -2
- data/lib/contrast/api/communication/response_processor.rb +1 -1
- data/lib/contrast/api/communication/socket_client.rb +5 -5
- data/lib/contrast/api/communication/speedracer.rb +1 -1
- data/lib/contrast/api/communication/tcp_socket.rb +1 -1
- data/lib/contrast/api/communication/unix_socket.rb +1 -1
- data/lib/contrast/api/decorators.rb +14 -14
- data/lib/contrast/api/decorators/address.rb +7 -6
- data/lib/contrast/api/decorators/application_settings.rb +3 -2
- data/lib/contrast/api/decorators/application_update.rb +5 -4
- data/lib/contrast/api/decorators/http_request.rb +13 -12
- data/lib/contrast/api/decorators/input_analysis.rb +3 -2
- data/lib/contrast/api/decorators/message.rb +3 -2
- data/lib/contrast/api/decorators/rasp_rule_sample.rb +2 -1
- data/lib/contrast/api/decorators/route_coverage.rb +3 -2
- data/lib/contrast/api/decorators/server_features.rb +3 -2
- data/lib/contrast/api/decorators/trace_event.rb +3 -2
- data/lib/contrast/api/decorators/trace_event_object.rb +6 -5
- data/lib/contrast/api/decorators/trace_event_signature.rb +5 -4
- data/lib/contrast/api/decorators/trace_taint_range.rb +4 -3
- data/lib/contrast/api/decorators/user_input.rb +4 -4
- data/lib/contrast/common_agent_configuration.rb +2 -2
- data/lib/contrast/components/agent.rb +2 -2
- data/lib/contrast/components/app_context.rb +1 -1
- data/lib/contrast/components/config.rb +4 -4
- data/lib/contrast/components/contrast_service.rb +1 -1
- data/lib/contrast/components/interface.rb +15 -15
- data/lib/contrast/components/logger.rb +1 -1
- data/lib/contrast/components/scope.rb +3 -3
- data/lib/contrast/config.rb +18 -18
- data/lib/contrast/config/base_configuration.rb +2 -2
- data/lib/contrast/config/protect_rule_configuration.rb +1 -1
- data/lib/contrast/configuration.rb +5 -5
- data/lib/contrast/extension/assess.rb +22 -21
- data/lib/contrast/extension/assess/array.rb +4 -4
- data/lib/contrast/extension/assess/assess_extension.rb +27 -29
- data/lib/contrast/extension/assess/eval_trigger.rb +3 -3
- data/lib/contrast/extension/assess/exec_trigger.rb +1 -1
- data/lib/contrast/extension/assess/fiber.rb +3 -3
- data/lib/contrast/extension/assess/hash.rb +5 -3
- data/lib/contrast/extension/assess/kernel.rb +7 -6
- data/lib/contrast/extension/assess/marshal.rb +62 -0
- data/lib/contrast/extension/assess/regexp.rb +3 -3
- data/lib/contrast/extension/assess/string.rb +5 -5
- data/lib/contrast/extension/inventory.rb +4 -4
- data/lib/contrast/extension/kernel.rb +1 -1
- data/lib/contrast/extension/module.rb +1 -1
- data/lib/contrast/extension/protect.rb +3 -3
- data/lib/contrast/extension/protect/kernel.rb +2 -2
- data/lib/contrast/extension/protect/psych.rb +2 -2
- data/lib/contrast/framework/manager.rb +7 -8
- data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
- data/lib/contrast/framework/rack/patch/support.rb +1 -1
- data/lib/contrast/framework/rack/support.rb +2 -2
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +2 -2
- data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
- data/lib/contrast/framework/rails/patch/support.rb +3 -3
- data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +2 -2
- data/lib/contrast/framework/rails/rewrite/active_record_named.rb +2 -2
- data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +2 -2
- data/lib/contrast/framework/rails/support.rb +62 -14
- data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
- data/lib/contrast/framework/sinatra/patch/support.rb +1 -1
- data/lib/contrast/framework/sinatra/support.rb +2 -2
- data/lib/contrast/funchook/funchook.rb +1 -1
- data/lib/contrast/logger/application.rb +2 -2
- data/lib/contrast/logger/format.rb +22 -9
- data/lib/contrast/logger/log.rb +10 -8
- data/lib/contrast/logger/request.rb +30 -0
- data/lib/contrast/tasks/config.rb +1 -1
- data/lib/contrast/tasks/service.rb +2 -2
- data/lib/contrast/utils/assess/sampling_util.rb +2 -2
- data/lib/contrast/utils/assess/tracking_util.rb +1 -1
- data/lib/contrast/utils/boolean_util.rb +1 -1
- data/lib/contrast/utils/class_util.rb +2 -2
- data/lib/contrast/utils/freeze_util.rb +1 -1
- data/lib/contrast/utils/gemfile_reader.rb +5 -5
- data/lib/contrast/utils/hash_digest.rb +2 -1
- data/lib/contrast/utils/heap_dump_util.rb +2 -2
- data/lib/contrast/utils/invalid_configuration_util.rb +1 -1
- data/lib/contrast/utils/inventory_util.rb +4 -4
- data/lib/contrast/utils/io_util.rb +1 -1
- data/lib/contrast/utils/os.rb +1 -1
- data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
- data/lib/contrast/utils/sha256_builder.rb +2 -2
- data/lib/contrast/utils/stack_trace_utils.rb +2 -2
- data/lib/contrast/utils/string_utils.rb +1 -1
- data/ruby-agent.gemspec +5 -5
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +22 -19
- data/lib/contrast/agent/assess/insulator.rb +0 -49
- data/lib/contrast/agent/require_state.rb +0 -61
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c3ef67bfca5c3d772078af285e4b3fa1ab314b06af04355db1aa50cce0d284e8
|
4
|
+
data.tar.gz: 5eb0fe6b5dba8f64b5947c1c7cade90718b18224b62b5e02eed470613e6fbe6d
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: caf748a141fe652cbb1cb3e658969820b22ca4e58a11cdc46ee9bc94932c00e031b186b96e8c44b884d6f658951e8936a75444aa4d52cb9d0d5e563ab29ef26b
|
7
|
+
data.tar.gz: b3235852bb77977f244beed747b032bfa6e80eb86ebdcfab622a8dba7acc7a939f87e08022a07e795d2c455ec3d3107771e5cdae0d5b893a4c6019f09945db43
|
data/exe/contrast_service
CHANGED
@@ -3,19 +3,13 @@
|
|
3
3
|
# frozen_string_literal: true
|
4
4
|
|
5
5
|
def mac?
|
6
|
-
RUBY_PLATFORM.
|
7
|
-
end
|
8
|
-
|
9
|
-
def windows?
|
10
|
-
RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
|
6
|
+
RUBY_PLATFORM.include?('darwin')
|
11
7
|
end
|
12
8
|
|
13
9
|
def path
|
14
10
|
base_path = "#{ File.dirname(__FILE__) }/.."
|
15
11
|
if mac?
|
16
12
|
"#{ base_path }/service_executables/mac/contrast-service"
|
17
|
-
elsif windows?
|
18
|
-
"#{ base_path }/service_executables/windows/contrast-service.exe"
|
19
13
|
else
|
20
14
|
"#{ base_path }/service_executables/linux/contrast-service"
|
21
15
|
end
|
@@ -2,8 +2,8 @@
|
|
2
2
|
* https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
|
3
3
|
|
4
4
|
#include "cs__active_record_named.h"
|
5
|
-
#include <ruby.h>
|
6
5
|
#include "../cs__common/cs__common.h"
|
6
|
+
#include <ruby.h>
|
7
7
|
|
8
8
|
VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
|
9
9
|
const VALUE self) {
|
@@ -19,7 +19,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
|
|
19
19
|
*/
|
20
20
|
VALUE new_body, ret;
|
21
21
|
VALUE new_args[3];
|
22
|
-
new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
|
22
|
+
new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
|
23
|
+
argv[0], argv[1]);
|
23
24
|
new_args[0] = argv[0];
|
24
25
|
if (NIL_P(new_body)) {
|
25
26
|
new_args[1] = argv[1];
|
@@ -36,10 +37,10 @@ void Init_cs__assess_active_record_named(void) {
|
|
36
37
|
framework = rb_define_module_under(contrast, "Framework");
|
37
38
|
rails = rb_define_module_under(framework, "Rails");
|
38
39
|
rewrite = rb_define_module_under(rails, "Rewrite");
|
39
|
-
active_record_named =
|
40
|
+
active_record_named =
|
41
|
+
rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
|
40
42
|
rb_sym_assess_rewrite = rb_intern("rewrite");
|
41
|
-
rb_sym_assess_scope
|
42
|
-
|
43
|
-
|
43
|
+
rb_sym_assess_scope =
|
44
|
+
contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
|
45
|
+
"scope", contrast_assess_active_record_scope);
|
44
46
|
}
|
45
|
-
|
@@ -23,15 +23,16 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
|
|
23
23
|
/* Finally, default to empty String. Implicit since nil.to_s is ''*/
|
24
24
|
|
25
25
|
result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
|
26
|
-
result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
|
26
|
+
result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
|
27
|
+
ary, sep, result);
|
27
28
|
|
28
29
|
return result;
|
29
30
|
}
|
30
31
|
|
31
32
|
void Init_cs__assess_array(void) {
|
32
|
-
array_propagator =
|
33
|
+
array_propagator =
|
34
|
+
rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
|
33
35
|
rb_sym_assess_track_array_join = rb_intern("cs__track_join");
|
34
|
-
rb_sym_assess_array_join =
|
35
|
-
|
36
|
-
contrast_assess_array_join);
|
36
|
+
rb_sym_assess_array_join =
|
37
|
+
contrast_register_patch("Array", "join", contrast_assess_array_join);
|
37
38
|
}
|
@@ -7,7 +7,8 @@
|
|
7
7
|
|
8
8
|
void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
|
9
9
|
VALUE ret) {
|
10
|
-
rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
|
10
|
+
rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
|
11
|
+
source, ret);
|
11
12
|
}
|
12
13
|
|
13
14
|
VALUE
|
@@ -36,7 +37,8 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
|
|
36
37
|
}
|
37
38
|
|
38
39
|
void Init_cs__assess_basic_object(void) {
|
39
|
-
basic_eval_trigger =
|
40
|
+
basic_eval_trigger =
|
41
|
+
rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
|
40
42
|
instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
|
41
43
|
|
42
44
|
/* We don't keep a reference to the underlying method.
|
@@ -45,8 +47,6 @@ void Init_cs__assess_basic_object(void) {
|
|
45
47
|
* but if someone else patched BasicObject#instance_eval,
|
46
48
|
* IDK if this is intentional... noting it. -ajm
|
47
49
|
*/
|
48
|
-
contrast_register_patch("BasicObject",
|
49
|
-
"instance_eval",
|
50
|
+
contrast_register_patch("BasicObject", "instance_eval",
|
50
51
|
contrast_assess_basic_object_instance_eval);
|
51
|
-
|
52
52
|
}
|
@@ -73,7 +73,8 @@ int install_fiber_hooks() {
|
|
73
73
|
}
|
74
74
|
|
75
75
|
void Init_cs__assess_fiber_track(void) {
|
76
|
-
fiber_propagator =
|
76
|
+
fiber_propagator =
|
77
|
+
rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
|
77
78
|
track_rb_fiber_new = rb_intern("track_rb_fiber_new");
|
78
79
|
track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
|
79
80
|
rb_sym_next = rb_intern("next");
|
@@ -12,23 +12,24 @@
|
|
12
12
|
* This method instruments that unique bracket-construction style
|
13
13
|
* of initializing a hash.
|
14
14
|
*/
|
15
|
-
static VALUE contrast_assess_hash_bracket_constructor(const int argc,
|
16
|
-
|
15
|
+
static VALUE contrast_assess_hash_bracket_constructor(const int argc,
|
16
|
+
VALUE *argv,
|
17
|
+
const VALUE hash) {
|
17
18
|
VALUE result;
|
18
19
|
|
19
20
|
/* Array of Arrays: Hash[ [ [key, value], ... ] ] -> new_hash */
|
20
21
|
if (RB_TYPE_P(argv[0], T_ARRAY)) {
|
21
22
|
int i;
|
22
23
|
for (i = 0; i < argc; i++) {
|
23
|
-
argv[i] =
|
24
|
-
|
24
|
+
argv[i] = rb_funcall(hash_propagator,
|
25
|
+
rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
|
25
26
|
}
|
26
27
|
/* Hash[ key, value, ... ] -> new_hash */
|
27
28
|
} else if (argc > 1) {
|
28
29
|
int i;
|
29
30
|
for (i = 0; i < argc; i += 2) {
|
30
|
-
argv[i] =
|
31
|
-
|
31
|
+
argv[i] = rb_funcall(hash_propagator,
|
32
|
+
rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
|
32
33
|
}
|
33
34
|
}
|
34
35
|
|
@@ -36,7 +37,8 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *arg
|
|
36
37
|
* String keys
|
37
38
|
* # Hash[ object ] -> new_hash
|
38
39
|
*/
|
39
|
-
result =
|
40
|
+
result =
|
41
|
+
rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
|
40
42
|
|
41
43
|
return result;
|
42
44
|
}
|
@@ -61,8 +63,9 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
|
|
61
63
|
* We haven't revisited this approach since we started more extensively
|
62
64
|
* hooking public C functions.)
|
63
65
|
*/
|
64
|
-
if(argc > 0) {
|
65
|
-
argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
|
66
|
+
if (argc > 0) {
|
67
|
+
argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
|
68
|
+
1, argv[0]);
|
66
69
|
}
|
67
70
|
/* This is the underlying assignment, w/ our instrumented key. */
|
68
71
|
result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
|
@@ -71,17 +74,15 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
|
|
71
74
|
}
|
72
75
|
|
73
76
|
void Init_cs__assess_hash(void) {
|
74
|
-
hash_propagator =
|
77
|
+
hash_propagator =
|
78
|
+
rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
|
75
79
|
rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
|
76
80
|
|
77
81
|
VALUE hash_class = rb_define_class("Hash", rb_cObject);
|
78
82
|
|
79
|
-
rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
|
80
|
-
|
81
|
-
contrast_assess_hash_bracket_constructor);
|
82
|
-
|
83
|
-
rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
|
84
|
-
"[]=",
|
85
|
-
contrast_assess_hash_bracket_set);
|
83
|
+
rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
|
84
|
+
"Hash", "[]", contrast_assess_hash_bracket_constructor);
|
86
85
|
|
86
|
+
rb_sym_assess_hash_bracket_equals = contrast_register_patch(
|
87
|
+
"Hash", "[]=", contrast_assess_hash_bracket_set);
|
87
88
|
}
|
@@ -13,7 +13,8 @@ static VALUE hash_propagator;
|
|
13
13
|
* ahead of time should avoid this, similar to the behavior of the -@ Strings
|
14
14
|
* -HM
|
15
15
|
*/
|
16
|
-
static VALUE contrast_assess_hash_bracket_constructor(const int argc,
|
16
|
+
static VALUE contrast_assess_hash_bracket_constructor(const int argc,
|
17
|
+
VALUE *argv,
|
17
18
|
const VALUE hash);
|
18
19
|
|
19
20
|
static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
|
@@ -18,8 +18,9 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
|
|
18
18
|
rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
|
19
19
|
}
|
20
20
|
|
21
|
-
/* maybe this should be rb_funcall2. this works right now because *argv ==
|
22
|
-
* exec shouldn't ever be called with != 1 argc, so not a huge
|
21
|
+
/* maybe this should be rb_funcall2. this works right now because *argv ==
|
22
|
+
* argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
|
23
|
+
* problem */
|
23
24
|
return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
|
24
25
|
}
|
25
26
|
|
@@ -27,12 +28,10 @@ void Init_cs__assess_kernel(void) {
|
|
27
28
|
kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
|
28
29
|
exec_apply_trigger = rb_intern("apply_trigger");
|
29
30
|
|
30
|
-
rb_sym_assess_kernel_exec =
|
31
|
-
|
32
|
-
contrast_patched_kernel_exec);
|
31
|
+
rb_sym_assess_kernel_exec =
|
32
|
+
contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
|
33
33
|
|
34
34
|
/* should return the same value as above */
|
35
|
-
rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
|
36
|
-
|
37
|
-
contrast_patched_kernel_exec);
|
35
|
+
rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
|
36
|
+
"Kernel", "exec", contrast_patched_kernel_exec);
|
38
37
|
}
|
@@ -9,7 +9,6 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
|
|
9
9
|
const VALUE *argv) {
|
10
10
|
VALUE result;
|
11
11
|
VALUE source_string;
|
12
|
-
|
13
12
|
result = rb_call_super(argc, argv);
|
14
13
|
|
15
14
|
if (argc >= 1) {
|
@@ -27,7 +26,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
|
|
27
26
|
rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
|
28
27
|
rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
|
29
28
|
2, source_string, result);
|
30
|
-
rb_funcall(contrast_patcher(), rb_sym_exit_scope,
|
29
|
+
rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
|
31
30
|
}
|
32
31
|
}
|
33
32
|
}
|
@@ -36,9 +35,9 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
|
|
36
35
|
}
|
37
36
|
|
38
37
|
void Init_cs__assess_marshal_module(void) {
|
38
|
+
marshal_module = rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
|
39
39
|
rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
|
40
40
|
|
41
|
-
contrast_register_singleton_prepend_patch(
|
42
|
-
|
43
|
-
&contrast_assess_marshal_module_load);
|
41
|
+
contrast_register_singleton_prepend_patch(
|
42
|
+
"Marshal", "load", &contrast_assess_marshal_module_load);
|
44
43
|
}
|
@@ -21,7 +21,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
|
|
21
21
|
/* If this method ever throws an exception, the scope-leave
|
22
22
|
* needs to be moved within a rescue call.
|
23
23
|
*/
|
24
|
-
rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
|
24
|
+
rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
|
25
|
+
ret, method);
|
25
26
|
}
|
26
27
|
|
27
28
|
rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
|
@@ -57,7 +58,8 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
|
|
57
58
|
}
|
58
59
|
|
59
60
|
void Init_cs__assess_module(void) {
|
60
|
-
module_eval_trigger =
|
61
|
+
module_eval_trigger =
|
62
|
+
rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
|
61
63
|
trigger_check_method = rb_intern("eval_trigger_check");
|
62
64
|
|
63
65
|
rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
|
@@ -69,11 +71,9 @@ void Init_cs__assess_module(void) {
|
|
69
71
|
* See similar comments in basic_object C ext patch.
|
70
72
|
*/
|
71
73
|
|
72
|
-
contrast_register_patch("Module",
|
73
|
-
"class_eval",
|
74
|
+
contrast_register_patch("Module", "class_eval",
|
74
75
|
contrast_assess_module_class_eval);
|
75
76
|
|
76
|
-
contrast_register_patch("Module",
|
77
|
-
"module_eval",
|
77
|
+
contrast_register_patch("Module", "module_eval",
|
78
78
|
contrast_assess_module_module_eval);
|
79
79
|
}
|
@@ -29,7 +29,8 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
|
|
29
29
|
}
|
30
30
|
|
31
31
|
void Init_cs__assess_regexp(void) {
|
32
|
-
regexp_propagator =
|
32
|
+
regexp_propagator =
|
33
|
+
rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
|
33
34
|
rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
|
34
35
|
|
35
36
|
/* These are the keys we use to define our hash of
|
@@ -46,7 +47,6 @@ void Init_cs__assess_regexp(void) {
|
|
46
47
|
rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
|
47
48
|
rb_global_variable(&rb_sym_back_ref);
|
48
49
|
|
49
|
-
rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
|
50
|
-
|
51
|
-
contrast_assess_regexp_equal_squiggle);
|
50
|
+
rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
|
51
|
+
"Regexp", "=~", contrast_assess_regexp_equal_squiggle);
|
52
52
|
}
|
@@ -6,7 +6,7 @@
|
|
6
6
|
#include <ruby.h>
|
7
7
|
|
8
8
|
static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
|
9
|
-
|
9
|
+
const VALUE obj) {
|
10
10
|
VALUE dup, tracked;
|
11
11
|
if (!OBJ_FROZEN(obj)) {
|
12
12
|
tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
|
@@ -17,6 +17,7 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
|
|
17
17
|
* string.c, but we ignore any other monkey patches on String#-@
|
18
18
|
*/
|
19
19
|
dup = rb_funcall(obj, rb_sym_dup, 0);
|
20
|
+
rb_funcall(obj, rb_intern("cs__transfer_properties"), 1, dup);
|
20
21
|
rb_funcall(dup, rb_sym_freeze, 0);
|
21
22
|
return dup;
|
22
23
|
}
|
@@ -25,11 +26,26 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
|
|
25
26
|
return rb_funcall(obj, rb_sym_assess_string_uminus, 0);
|
26
27
|
}
|
27
28
|
|
29
|
+
static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
|
30
|
+
const VALUE obj) {
|
31
|
+
if (!OBJ_FROZEN(obj)) {
|
32
|
+
// Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
|
33
|
+
rb_funcall(properties_hash, rb_intern("pre_freeze"), 1, obj);
|
34
|
+
}
|
35
|
+
return rb_funcall(obj, rb_sym_assess_string_freeze, 0);
|
36
|
+
}
|
37
|
+
|
28
38
|
void Init_cs__assess_string(void) {
|
29
39
|
rb_sym_dup = rb_intern("dup");
|
30
40
|
rb_sym_freeze = rb_intern("freeze");
|
31
41
|
|
32
|
-
|
33
|
-
|
34
|
-
|
42
|
+
// Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
|
43
|
+
VALUE finalizers = rb_define_module_under(assess, "Finalizers");
|
44
|
+
VALUE finalize = rb_define_module_under(finalizers, "Finalize");
|
45
|
+
properties_hash = rb_const_get(finalize, rb_intern("PROPERTIES_HASH"));
|
46
|
+
|
47
|
+
rb_sym_assess_string_uminus =
|
48
|
+
contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
|
49
|
+
rb_sym_assess_string_freeze = contrast_register_patch(
|
50
|
+
"String", "freeze", &contrast_assess_string_freeze);
|
35
51
|
}
|
@@ -1,6 +1,9 @@
|
|
1
1
|
#include <ruby.h>
|
2
2
|
|
3
3
|
static VALUE rb_sym_assess_string_uminus;
|
4
|
+
static VALUE rb_sym_assess_string_freeze;
|
5
|
+
// Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
|
6
|
+
static VALUE properties_hash;
|
4
7
|
static VALUE rb_sym_dup;
|
5
8
|
static VALUE rb_sym_freeze;
|
6
9
|
|
@@ -15,6 +18,6 @@ static VALUE rb_sym_freeze;
|
|
15
18
|
* -HM
|
16
19
|
*/
|
17
20
|
static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
|
18
|
-
|
21
|
+
const VALUE obj);
|
19
22
|
|
20
23
|
void Init_cs__assess_string(void);
|
@@ -14,13 +14,15 @@ static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
|
|
14
14
|
|
15
15
|
static int install_hooks() {
|
16
16
|
rb_str_concat_literals_original = rb_str_concat_literals;
|
17
|
-
patch_via_funchook(&rb_str_concat_literals_original,
|
17
|
+
patch_via_funchook(&rb_str_concat_literals_original,
|
18
|
+
&rb_str_concat_literals_hook);
|
18
19
|
|
19
20
|
return 0;
|
20
21
|
}
|
21
22
|
|
22
23
|
void Init_cs__assess_string_interpolation26(void) {
|
23
|
-
string_propagator =
|
24
|
+
string_propagator =
|
25
|
+
rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
|
24
26
|
track_interpolation = rb_intern("track_interpolation");
|
25
27
|
install_hooks();
|
26
28
|
}
|
@@ -8,7 +8,7 @@
|
|
8
8
|
static VALUE rb_yield_hook(VALUE val, const VALUE self) {
|
9
9
|
VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
|
10
10
|
|
11
|
-
if(method == split_method && RB_TYPE_P(val, T_STRING)) {
|
11
|
+
if (method == split_method && RB_TYPE_P(val, T_STRING)) {
|
12
12
|
rb_funcall(split_class, propagate_yield, 1, val);
|
13
13
|
}
|
14
14
|
VALUE result = rb_yield_original(val);
|
@@ -25,6 +25,6 @@ void Init_cs__assess_yield_track(void) {
|
|
25
25
|
VALUE base = rb_define_class_under(assess_propagator, "Base", rb_cObject);
|
26
26
|
split_class = rb_define_class_under(assess_propagator, "Split", base);
|
27
27
|
propagate_yield = rb_intern("propagate_yield");
|
28
|
-
split_method =
|
28
|
+
split_method = ID2SYM(rb_intern("split"));
|
29
29
|
install_yield_hooks();
|
30
30
|
}
|
data/ext/cs__common/cs__common.c
CHANGED
@@ -2,8 +2,8 @@
|
|
2
2
|
* https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
|
3
3
|
|
4
4
|
#include "cs__common.h"
|
5
|
-
#include <ruby.h>
|
6
5
|
#include <dlfcn.h>
|
6
|
+
#include <ruby.h>
|
7
7
|
|
8
8
|
/* Globals */
|
9
9
|
/* These are defined w/ `extern` in the header */
|
@@ -27,19 +27,24 @@ void patch_via_funchook(void *original_function, void *hook_function) {
|
|
27
27
|
|
28
28
|
void *funchook_lib_handle;
|
29
29
|
void *funchook_reference, *(*funchook_create)(void);
|
30
|
-
int prepareResult, (*funchook_prepare)(void*, void**, void*);
|
31
|
-
int installResult, (*funchook_install)(void*, int);
|
30
|
+
int prepareResult, (*funchook_prepare)(void *, void **, void *);
|
31
|
+
int installResult, (*funchook_install)(void *, int);
|
32
32
|
|
33
|
-
funchook_lib_handle =
|
33
|
+
funchook_lib_handle =
|
34
|
+
dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
|
34
35
|
|
35
36
|
/* Load the funchook methods we need */
|
36
|
-
funchook_create
|
37
|
-
|
38
|
-
|
37
|
+
funchook_create =
|
38
|
+
(void *(*)(void))dlsym(funchook_lib_handle, "funchook_create");
|
39
|
+
funchook_prepare = (int (*)(void *, void **, void *))dlsym(
|
40
|
+
funchook_lib_handle, "funchook_prepare");
|
41
|
+
funchook_install =
|
42
|
+
(int (*)(void *, int))dlsym(funchook_lib_handle, "funchook_install");
|
39
43
|
|
40
|
-
funchook_reference = (void*)(*funchook_create)();
|
44
|
+
funchook_reference = (void *)(*funchook_create)();
|
41
45
|
|
42
|
-
prepareResult = (*funchook_prepare)(
|
46
|
+
prepareResult = (*funchook_prepare)(
|
47
|
+
funchook_reference, (void **)original_function, hook_function);
|
43
48
|
installResult = (*funchook_install)(funchook_reference, 0);
|
44
49
|
}
|
45
50
|
|
@@ -53,33 +58,32 @@ VALUE contrast_patcher() {
|
|
53
58
|
return patcher;
|
54
59
|
}
|
55
60
|
|
56
|
-
VALUE contrast_register_patch(const char *module_name,
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
+
VALUE contrast_register_patch(const char *module_name, const char *method_name,
|
62
|
+
VALUE(c_fn)(const int, const VALUE *,
|
63
|
+
const VALUE)) {
|
64
|
+
return _contrast_register_patch(module_name, method_name, c_fn,
|
65
|
+
IMPL_ALIAS_INSTANCE);
|
61
66
|
}
|
62
67
|
|
63
|
-
|
64
68
|
VALUE contrast_register_singleton_patch(const char *module_name,
|
65
69
|
const char *method_name,
|
66
|
-
VALUE(c_fn)(const int, const VALUE*,
|
67
|
-
|
68
|
-
|
70
|
+
VALUE(c_fn)(const int, const VALUE *,
|
71
|
+
const VALUE)) {
|
72
|
+
return _contrast_register_patch(module_name, method_name, c_fn,
|
73
|
+
IMPL_ALIAS_SINGLETON);
|
69
74
|
}
|
70
75
|
|
71
|
-
VALUE contrast_register_singleton_prepend_patch(
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
+
VALUE contrast_register_singleton_prepend_patch(
|
77
|
+
const char *module_name, const char *method_name,
|
78
|
+
VALUE(c_fn)(const int, const VALUE *, const VALUE)) {
|
79
|
+
return _contrast_register_patch(module_name, method_name, c_fn,
|
80
|
+
IMPL_PREPEND);
|
76
81
|
}
|
77
82
|
|
78
|
-
static VALUE
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
) {
|
83
|
+
static VALUE
|
84
|
+
_contrast_register_patch(const char *module_name, const char *method_name,
|
85
|
+
VALUE(c_fn)(const int, const VALUE *, const VALUE),
|
86
|
+
patch_impl patch) {
|
83
87
|
VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
|
84
88
|
VALUE unbound_method = Qnil;
|
85
89
|
VALUE rb_str_module_name = rb_str_new_cstr(module_name);
|
@@ -105,24 +109,27 @@ static VALUE _contrast_register_patch(const char *module_name,
|
|
105
109
|
*/
|
106
110
|
rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
|
107
111
|
VALUE rb_sym_instance_method = rb_intern("instance_method");
|
108
|
-
unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1,
|
112
|
+
unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1,
|
113
|
+
rb_str_method_name);
|
109
114
|
rb_undef_method(contrast_bind_module, method_name);
|
110
115
|
|
111
116
|
/* map impl enum -> ruby symbol */
|
112
117
|
VALUE impl = Qnil;
|
113
|
-
switch(patch) {
|
114
|
-
|
118
|
+
switch (patch) {
|
119
|
+
case IMPL_ALIAS_INSTANCE:
|
115
120
|
impl = ID2SYM(rb_sym_alias_instance);
|
116
121
|
break;
|
117
|
-
|
122
|
+
case IMPL_ALIAS_SINGLETON:
|
118
123
|
impl = ID2SYM(rb_sym_alias_singleton);
|
119
124
|
break;
|
120
|
-
|
125
|
+
case IMPL_PREPEND:
|
121
126
|
impl = ID2SYM(rb_sym_prepend);
|
122
127
|
break;
|
123
128
|
}
|
124
129
|
|
125
|
-
VALUE underlying_method_name =
|
130
|
+
VALUE underlying_method_name =
|
131
|
+
rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3,
|
132
|
+
rb_str_module_name, unbound_method, impl);
|
126
133
|
return SYM2ID(underlying_method_name);
|
127
134
|
}
|
128
135
|
|
@@ -141,9 +148,9 @@ void Init_cs__common(void) {
|
|
141
148
|
|
142
149
|
/* Used for returning unbound C functions */
|
143
150
|
rb_sym_register_c_patch = rb_intern("register_c_patch");
|
144
|
-
rb_sym_alias_instance
|
145
|
-
rb_sym_alias_singleton
|
146
|
-
rb_sym_prepend
|
151
|
+
rb_sym_alias_instance = rb_intern("alias_instance");
|
152
|
+
rb_sym_alias_singleton = rb_intern("alias_singleton");
|
153
|
+
rb_sym_prepend = rb_intern("prepend");
|
147
154
|
|
148
155
|
/* Ensure definition of core Contrast instrumentation modules */
|
149
156
|
contrast = rb_define_module("Contrast");
|