contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -15,8 +15,10 @@ module Contrast
               # opposite of append. :-P
               def propagate propagation_node, preshift, target
                 sources = propagation_node.sources
+                # source1 is the copy of the thing being prepended to
                 source1 = find_source(sources[0], preshift)
 
+                # source2 is the copy of the thing being prepended
                 source2 = sources[1] ? find_source(sources[1], preshift) : source1
 
                 original_start_index = target.rindex(source1) || 0
@@ -28,6 +30,8 @@ module Contrast
                 else
                   # find original in the target, copy tags to the new position in target
                   target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  # then we add the tags from the thing prepended to the start
+                  # of the target
                   start = 0
                   while start < original_start_index
                     target.cs__copy_from(source2, start, propagation_node.untags)
@@ -39,6 +43,7 @@ module Contrast
                     end
                   end
                 end
+                # and finally merge the tags if any overlap.
                 target.cs__properties.cleanup_tags
               end
             end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/preshift'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'contrast/agent/assess/policy/preshift'
+require 'contrast/components/interface'
+require 'contrast/utils/thread_tracker'
 
 module Contrast
   module Agent
@@ -139,7 +139,7 @@ module Contrast
               def instrument_string_split
                 if @_instrument_string_split.nil?
                   @_instrument_string_split = begin
-                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
+                                                require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
                                                 true
                                               rescue StandardError => e
                                                 logger.error('Error loading split rb_yield patch', e)

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/duck_utils'
+require 'contrast/components/interface'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Agent
@@ -73,10 +73,11 @@ module Contrast
                 return false unless args
 
                 # if it's a string, just ask if it's tracked
-                if args.is_a?(String)
+                case args
+                when String
                   Contrast::Utils::DuckUtils.quacks_to?(args, :cs__tracked?) && args.cs__tracked?
                   # if it's a hash, ask if it has a tracked string
-                elsif args.is_a?(Hash)
+                when Hash
                   args.values.any? { |value| value.is_a?(String) && Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?) && value.cs__tracked? }
                   # this should never happen
                 else

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/module_data'
-cs__scoped_require 'contrast/agent/rewriter'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/module_data'
+require 'contrast/agent/rewriter'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,20 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the origination of traces. A Source is any method
-# that returns an untrusted value. In general, these sources are request methods
-# as the request object is user controlled.
-#
-# Going forward, we may add in Dynamic sources (determined at runtime) based on
-# database configs or other variables (used for Stored XSS or other persisted
-# vulnerability detection rules)
-cs__scoped_require 'set'
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/policy/source_validation/source_validation'
-
-cs__scoped_require 'contrast/components/interface'
+require 'set'
+require 'contrast/agent/assess/policy/source_validation/source_validation'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/source_method'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/source_validation/cross_site_validator'
+require 'contrast/agent/assess/policy/source_validation/cross_site_validator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/events/event_factory'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/events/event_factory'
+require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/trigger/reflected_xss'
-cs__scoped_require 'contrast/agent/assess/policy/trigger/xpath'
-cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/assess/policy/trigger/reflected_xss'
+require 'contrast/agent/assess/policy/trigger/xpath'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
+require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
+require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/properties.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/agent/assess/property/evented'
-cs__scoped_require 'contrast/agent/assess/property/tagged'
+require 'base64'
+require 'set'
+require 'contrast/agent/assess/property/evented'
+require 'contrast/agent/assess/property/tagged'
+require 'contrast/utils/prevent_serialization'
 
 module Contrast
   module Agent
@@ -21,6 +21,8 @@ module Contrast
         include Contrast::Agent::Assess::Property::Evented
         include Contrast::Agent::Assess::Property::Tagged
 
+        attr_accessor :dupped_from
+
         # CONTRAST-36937
         # Creating these on Properties is expensive. We want to delay this for
         # as long as possible.
@@ -39,6 +41,12 @@ module Contrast
 
           properties[name] = value
         end
+
+        def dup
+          ret = super
+          ret.dupped_from = __id__
+          ret
+        end
       end
     end
   end

data/lib/contrast/agent/assess/property/evented.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/events/event_factory'
-cs__scoped_require 'contrast/agent/assess/events/source_event'
+require 'contrast/agent/assess/events/event_factory'
+require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/property/tagged.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/tag'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/tag_util'
+require 'contrast/agent/assess/tag'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/tag_util'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/rule.rb

@@ -14,5 +14,5 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/agent/assess/rule/base'
-cs__scoped_require 'contrast/agent/assess/rule/provider'
+require 'contrast/agent/assess/rule/base'
+require 'contrast/agent/assess/rule/provider'

data/lib/contrast/agent/assess/rule/base.rb

@@ -1,10 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-
-cs__scoped_require 'zlib'
-cs__scoped_require 'digest'
+require 'digest'
+require 'zlib'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/rule/provider.rb

@@ -16,6 +16,6 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'
+require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+require 'contrast/agent/assess/rule/provider/hardcoded_key'
+require 'contrast/agent/assess/rule/provider/hardcoded_password'

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -56,7 +56,7 @@ module Contrast
             # characters are probably more likely to appear together in a
             # default placeholder than in a password. Note this is opposite of
             # the behavior in Java
-            PROPERTY_NAME_PATTERN = /^[a-z]+[\.\_][\.\_a-z]*[a-z]+$/.cs__freeze
+            PROPERTY_NAME_PATTERN = /^[a-z]+[._][._a-z]*[a-z]+$/.cs__freeze
             def probably_property_name? value
               value.match?(PROPERTY_NAME_PATTERN)
             end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
 
 module Contrast
   module Agent

data/lib/contrast/agent/at_exit_hook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/class_reopener.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ripper'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/logger/log'
+require 'ripper'
+require 'contrast/extension/module'
+require 'contrast/components/interface'
+require 'contrast/logger/log'
 
 # This method is left purposefully at the top level namespace. Moving it
 # elsewhere will break functionality as it executes evaluations against the
@@ -164,9 +164,10 @@ module Contrast
           next unless defined
 
           current = current ? current.cs__const_get(chunk) : Module.cs__const_get(chunk)
-          if current.is_a?(Class)
+          case current
+          when Class
             name_space << [chunk, Class]
-          elsif current.is_a?(Module)
+          when Module
             name_space << [chunk, Module]
           end
         end

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/deadzone/policy/deadzone_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/deadzone/policy/deadzone_node'
+require 'contrast/agent/patching/policy/policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/disable_reaction.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/inventory_util'
+require 'contrast/components/interface'
+require 'contrast/utils/inventory_util'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/inventory/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/agent/inventory/policy/datastores'
+require 'contrast/agent/inventory/policy/datastores'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/middleware.rb

@@ -1,19 +1,19 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ipaddr'
-cs__scoped_require 'json'
-cs__scoped_require 'rack'
+require 'ipaddr'
+require 'json'
+require 'rack'
 
-cs__scoped_require 'contrast/security_exception'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/heap_dump_util'
-cs__scoped_require 'contrast/agent/request_handler'
-cs__scoped_require 'contrast/agent/static_analysis'
+require 'contrast/security_exception'
+require 'contrast/utils/object_share'
+require 'contrast/components/interface'
+require 'contrast/utils/heap_dump_util'
+require 'contrast/agent/request_handler'
+require 'contrast/agent/static_analysis'
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/freeze_util'
+require 'contrast/utils/timer'
+require 'contrast/utils/freeze_util'
 
 module Contrast
   module Agent
@@ -116,32 +116,33 @@ module Contrast
 
         # make the context available for the lifecycle of this request
         Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
+          logger.request_start
           request_handler = Contrast::Agent::RequestHandler.new(context)
 
-          logger.debug_with_time('HTTP request cycle') do
-            # prefilter sequence
-            with_contrast_scope do
-              context.service_extract_request
-              request_handler.ruleset.prefilter
-            end
+          # prefilter sequence
+          with_contrast_scope do
+            context.service_extract_request
+            request_handler.ruleset.prefilter
+          end
+
+          response = application_code(env) # pass request down the Rack chain with original env
+
+          # postfilter sequence
+          with_contrast_scope do
+            context.extract_after(response) # update context with final response information
 
-            response = application_code(env) # pass request down the Rack chain with original env
-
-            # postfilter sequence
-            with_contrast_scope do
-              context.extract_after(response) # update context with final response information
-
-              if Contrast::Agent.framework_manager.streaming?(env)
-                context.reset_activity
-                request_handler.stream_safe_postfilter
-              else
-                request_handler.ruleset.postfilter
-                # return response stored in the context in case any postfilter rules updated the response data
-                response = context.response&.rack_response || response
-                request_handler.send_activity_messages
-              end
+            if Contrast::Agent.framework_manager.streaming?(env)
+              context.reset_activity
+              request_handler.stream_safe_postfilter
+            else
+              request_handler.ruleset.postfilter
+              # return response stored in the context in case any postfilter rules updated the response data
+              response = context.response&.rack_response || response
+              request_handler.send_activity_messages
             end
           end
+        ensure
+          logger.request_end
         end
 
         response