contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/agent/assess/contrast_event.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'contrast/utils/class_util'
-cs__scoped_require 'contrast/utils/duck_utils'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/utils/assess/tracking_util'
+require 'contrast/utils/class_util'
+require 'contrast/utils/duck_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/prevent_serialization'
+require 'contrast/utils/stack_trace_utils'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -52,7 +52,9 @@ module Contrast
             return nil unless original
 
             begin
-              original.dup
+              duplicate = original.dup
+              original.cs__transfer_properties(duplicate)
+              duplicate
             rescue StandardError
               original
             end

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/contrast_event'
-cs__scoped_require 'contrast/agent/assess/events/source_event'
+require 'contrast/agent/assess/contrast_event'
+require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/events/source_event.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/contrast_event'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/agent/assess/contrast_event'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/finalizers/finalize.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/finalizers/hash'
+require 'contrast/agent/assess/finalizers/freeze'
+
+module Contrast
+  module Agent
+    module Assess
+      module Finalizers
+        # Our module for handling finalizing, allowing for the tracking of
+        # Objects without impacting GC and causing a memory leak. Access to any
+        # Finalizers object should run through this module as the Finalizers
+        # have tightly coupled dependencies on each other.
+        module Finalize
+          PROPERTIES_HASH = Contrast::Agent::Assess::Finalizers::Hash.new
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/finalizers/freeze.rb

@@ -0,0 +1,13 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# Our patch of the Object#freeze method, allowing any Object we track to
+# function with our Contrast::Agent::Assess::Finalizers::Hash
+class Object
+  alias_method :cs__patched_object_freeze, :freeze
+
+  def freeze
+    Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
+    cs__patched_object_freeze
+  end
+end

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Finalizers
+        # An extension of Hash that doesn't impact GC of the object being
+        # stored by storing its ID as a Key to lookup and registering a
+        # finalizer on the object to remove its entry from the Hash immediately
+        # after it's GC'd.
+        class Hash < Hash
+          FROZEN_FINALIZED_IDS = Set.new
+
+          def []= key, obj
+            # We can't finalize frozen things, so only act on those that went
+            # through .pre_freeze
+            if key.cs__frozen?
+              return unless FROZEN_FINALIZED_IDS.include?(key.__id__)
+            else
+              ObjectSpace.define_finalizer(key, finalize(key.__id__))
+            end
+            super key.__id__, obj
+          end
+
+          def [] key
+            super key.__id__
+          end
+
+          def finalize key_id
+            proc do
+              FROZEN_FINALIZED_IDS.delete(key_id)
+              delete(key_id)
+            end
+          end
+
+          def pre_freeze key
+            return if key.cs__frozen?
+            return if FROZEN_FINALIZED_IDS.include?(key.__id__)
+            return unless Contrast::Utils::DuckUtils.trackable?(key)
+
+            ObjectSpace.define_finalizer(key, finalize(key.__id__))
+            FROZEN_FINALIZED_IDS << key.__id__
+          rescue StandardError => _e
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,15 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-cs__scoped_require 'contrast/agent/assess/policy/source_node'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'json'
+require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+require 'contrast/agent/assess/rule/provider/hardcoded_key'
+require 'contrast/agent/assess/rule/provider/hardcoded_password'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/assess/policy/source_node'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/agent/assess/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
-cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/assess_extension'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -69,21 +69,31 @@ module Contrast
           end
 
           def append_object_details preshift, initializing, object
-            preshift.object = can_dup?(initializing, object) ? object.dup : object
-            preshift.object.cs__copy_from(object) if object.cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :cs__copy_from)
+            can = can_dup?(initializing, object)
+            preshift.object = can ? object.dup : object
             preshift.object_length = if Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :length)
                                        object.length
                                      else
                                        0
                                      end
+            return unless can
+
+            props = Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[object]
+            return unless props
+
+            Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[preshift.object] ||= props.dup
           end
 
           def append_arg_details preshift, args
             preshift.args = args.dup
             preshift.args.each_with_index do |arg, index|
-              next unless args[index].cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(arg, :cs__copy_from)
+              original_arg = args[index]
+              next if arg.__id__ == original_arg.__id__
+
+              props = Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[original_arg]
+              next unless props
 
-              arg.cs__copy_from(args[index])
+              Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[arg] ||= props.dup
             end
             preshift.arg_lengths = preshift.args.map { |arg| Contrast::Utils::DuckUtils.quacks_to?(arg, :length) ? arg.length : 0 }
           end

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,24 +1,21 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the continuation of traces. A Propagator is any
-# method that transforms an untrusted value. In general, these methods work on
-# the String class or a holder of Strings
-cs__scoped_require 'set'
+require 'set'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-
-cs__scoped_require 'contrast/agent/assess/policy/propagator'
-
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagator'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # This module contains the logic for determining how to propagate tags
-        # and events from a source to a target
+        # This class is responsible for the continuation of traces. A
+        # Propagator is any method that transforms an untrusted value. In
+        # general, these methods work on the String class or a holder of
+        # Strings
         module PropagationMethod
           include Contrast::Components::Interface
           access_component :logging
@@ -174,15 +171,7 @@ module Contrast
             # If the source of this patcher is not tracked, there's no need to do
             # anything. A copy of nothing is still nothing.
             def can_propagate? propagation_node, preshift, target
-              # We cannot propagate to things that do not have cs__properties.
-              return false unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-
-              # We cannot propagate to frozen things that have not been
-              # previously tracked. We probably shouldn't propagate to frozen
-              # things at all, as they're supposed to be immutable, but third
-              # parties do jenky things, so allow it as long as it is safe to do.
-              return false if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties &&
-                  propagation_node.targets[0] != Contrast::Utils::ObjectShare::RETURN_KEY
+              return false unless appropriate_target?(propagation_node, target)
               return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
               return false unless preshift
 
@@ -197,6 +186,21 @@ module Contrast
               false
             end
 
+            def appropriate_target? propagation_node, target
+              # We cannot propagate to things that do not have cs__properties.
+              return false unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
+
+              # We cannot propagate to frozen things that have not been
+              # previously tracked. We probably shouldn't propagate to frozen
+              # things at all, as they're supposed to be immutable, but third
+              # parties do jenky things, so allow it as long as it is safe to do.
+              return false if target.cs__frozen? &&
+                  !target.cs__tracked? &&
+                  propagation_node.targets[0] != Contrast::Utils::ObjectShare::RETURN_KEY
+
+              true
+            end
+
             # If this patcher has tags, apply them to the entire target
             def apply_tags propagation_node, target
               return unless propagation_node.tags
@@ -263,7 +267,6 @@ module Contrast
                 ret = Contrast::Utils::FreezeUtil.unfreeze_dup(target)
                 target = ret
               end
-              return if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
 
               propagation_class.propagate(propagation_node, preshift, target)
 

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -10,25 +10,25 @@ module Contrast
         # functionality. Any class under this namespace should be required
         # here, providing a single point of require for this functionality.
         module Propagator
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/base'
+          require 'contrast/agent/assess/policy/propagator/base'
 
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/append'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/center'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/custom'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/match_data'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/replace'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/reverse'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/select'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/splat'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/split'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/substitution'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/append'
+          require 'contrast/agent/assess/policy/propagator/center'
+          require 'contrast/agent/assess/policy/propagator/custom'
+          require 'contrast/agent/assess/policy/propagator/database_write'
+          require 'contrast/agent/assess/policy/propagator/insert'
+          require 'contrast/agent/assess/policy/propagator/keep'
+          require 'contrast/agent/assess/policy/propagator/match_data'
+          require 'contrast/agent/assess/policy/propagator/next'
+          require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/remove'
+          require 'contrast/agent/assess/policy/propagator/replace'
+          require 'contrast/agent/assess/policy/propagator/reverse'
+          require 'contrast/agent/assess/policy/propagator/select'
+          require 'contrast/agent/assess/policy/propagator/splat'
+          require 'contrast/agent/assess/policy/propagator/split'
+          require 'contrast/agent/assess/policy/propagator/substitution'
+          require 'contrast/agent/assess/policy/propagator/trim'
         end
       end
     end

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
+require 'contrast/extension/module'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -12,7 +12,8 @@ module Contrast
           class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def square_bracket_tagger propagation_node, preshift, ret, _block
-                if ret.is_a?(Array)
+                case ret
+                when Array
                   ret.each_with_index do |return_value, index|
                     next unless return_value
 
@@ -24,7 +25,7 @@ module Contrast
                                              end
                     square_bracket_single(target_matchdata_index, preshift, return_value, propagation_node)
                   end
-                elsif ret.is_a?(String)
+                when String
                   target_matchdata_index = preshift.args[0]
                   square_bracket_single(target_matchdata_index, preshift, ret, propagation_node)
                 end