contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Agent
@@ -59,7 +59,7 @@ module Contrast
           end
 
           def instrument!
-            cs__scoped_require instrumentation_file_path
+            require instrumentation_file_path
             if instrumenting_module
               mod = Module.cs__const_get(instrumenting_module)
               with_contrast_scope { mod.instrument } if mod

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
-cs__scoped_require 'contrast/framework/manager'
+require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/components/interface'
+require 'contrast/framework/manager'
 
 module Contrast
   module Agent
@@ -36,6 +36,7 @@ module Contrast
                                     Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
                                     Contrast::Extension::Assess::HashPropagator.instrument_hash_track
                                     Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+                                    Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
                                     Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
                                     Contrast::Extension::Assess::StringPropagator.instrument_string
                                     Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
@@ -64,8 +65,8 @@ module Contrast
           # handling
           def apply_require_patches!
             @_apply_require_patches ||= begin
-                                          cs__scoped_require 'contrast/extension/thread'
-                                          cs__scoped_require 'contrast/extension/kernel'
+                                          require 'contrast/extension/thread'
+                                          require 'contrast/extension/kernel'
                                           true
                                         rescue LoadError, StandardError => e
                                           logger.error('failed instrumenting apply_require_patches!', e)

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,26 +1,26 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-cs__scoped_require 'contrast/components/interface'
+require 'monitor'
+require 'contrast/components/interface'
 
-cs__scoped_require 'contrast/agent'
-cs__scoped_require 'contrast/logger/log'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent'
+require 'contrast/logger/log'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/trigger_node'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/propagation_method'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 module Contrast
   module Agent
@@ -371,7 +371,7 @@ module Contrast
               when :prepend
                 prepending_module = Module.new
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                prepending_module.send(visibility, :method_name)
+                prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
               end
@@ -414,4 +414,4 @@ module Contrast
   end
 end
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -1,36 +1,36 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
+require 'monitor'
 
 # base
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/policy_scanner'
-cs__scoped_require 'contrast/agent/assess/policy/rewriter_patch'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/policy_scanner'
+require 'contrast/agent/assess/policy/rewriter_patch'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # deadzone
-cs__scoped_require 'contrast/agent/deadzone/policy/policy'
+require 'contrast/agent/deadzone/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # patch
-cs__scoped_require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patch'
 
 # after load patched
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patcher'
+require 'contrast/agent/patching/policy/after_load_patcher'
 
 module Contrast
   module Agent
@@ -247,6 +247,14 @@ module Contrast
               instance_methods.concat(mod.private_instance_methods(false)) if private
               # initialize is an exception to the inheritance rule.
               instance_methods << :initialize unless instance_methods.include?(:initialize)
+              # Object owns these, but we don't want to patch every :dup or
+              # :clone, just the ones on String, so we'll special case this.
+              # This breaks the norm, where we usually instrument the lowest
+              # method possible.
+              if mod == String
+                instance_methods << :clone
+                instance_methods << :dup
+              end
               instance_methods
             end
 
@@ -298,10 +306,10 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/extension/assess'
-cs__scoped_require 'contrast/extension/inventory'
-cs__scoped_require 'contrast/extension/protect'
-cs__scoped_require 'contrast/extension/protect/kernel'
+require 'contrast/extension/module'
+require 'contrast/extension/assess'
+require 'contrast/extension/inventory'
+require 'contrast/extension/protect'
+require 'contrast/extension/protect/kernel'
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'singleton'
+require 'json'
+require 'singleton'
 
-cs__scoped_require 'contrast'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast'
+require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/extension/module'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
-cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/path_traversal'
+require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/sqli'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/xxe'
+require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/policy.rb

@@ -1,16 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/agent/protect/policy/applies_command_injection_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_no_sqli_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_path_traversal_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_sqli_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_xxe_rule'
-cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
+require 'contrast/agent/protect/policy/applies_command_injection_rule'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/applies_no_sqli_rule'
+require 'contrast/agent/protect/policy/applies_path_traversal_rule'
+require 'contrast/agent/protect/policy/applies_sqli_rule'
+require 'contrast/agent/protect/policy/applies_xxe_rule'
+require 'contrast/agent/protect/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/rule_applicator.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/trigger_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule.rb

@@ -15,39 +15,39 @@ module Contrast
 end
 
 # The classes required for All Rasp Rules
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base_service'
 
 # The classes required for the XSS Rasp Rule
-cs__scoped_require 'contrast/agent/protect/rule/xss'
+require 'contrast/agent/protect/rule/xss'
 
 # The classes required for the SQLI
-cs__scoped_require 'contrast/agent/protect/rule/default_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
+require 'contrast/agent/protect/rule/default_scanner'
+require 'contrast/agent/protect/rule/sqli'
+require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
 
 # The classes required for Path Traversal
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
+require 'contrast/agent/protect/rule/path_traversal'
 
 # The classes required for Command Injection
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/rule/cmd_injection'
 
 # The classes required for XXE
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/agent/protect/rule/xxe/entity_wrapper'
+require 'contrast/agent/protect/rule/xxe'
+require 'contrast/agent/protect/rule/xxe/entity_wrapper'
 
 # The classes required for Untrusted Deserialization
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/rule/deserialization'
 
 # The classes required for the NoSQLi
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
 
 # The classes required for Http Method Tampering
-cs__scoped_require 'contrast/agent/protect/rule/http_method_tampering'
+require 'contrast/agent/protect/rule/http_method_tampering'
 
 # The classes required for Unsafe File Upload
-cs__scoped_require 'contrast/agent/protect/rule/unsafe_file_upload'
+require 'contrast/agent/protect/rule/unsafe_file_upload'

data/lib/contrast/agent/protect/rule/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -184,9 +184,10 @@ module Contrast
           end
 
           def update_successful_attack_response context, ia_result, result, attack_string = nil
-            if mode == Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
+            case mode
+            when Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
               result.response = Contrast::Api::Dtm::AttackResult::ResponseType::MONITORED
-            elsif mode == Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
+            when Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
               result.response = Contrast::Api::Dtm::AttackResult::ResponseType::BLOCKED
             end