contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/components/logger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/logger/log'
+require 'contrast/logger/log'
 
 module Contrast
   module Components

data/lib/contrast/components/scope.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'fiber'
-cs__scoped_require 'monitor'
-cs__scoped_require 'contrast/agent/scope'
+require 'fiber'
+require 'monitor'
+require 'contrast/agent/scope'
 
 # This is the Scope component.
 #

data/lib/contrast/config.rb

@@ -10,24 +10,24 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/config/base_configuration'
-cs__scoped_require 'contrast/config/default_value'
+require 'contrast/config/base_configuration'
+require 'contrast/config/default_value'
 
-cs__scoped_require 'contrast/config/logger_configuration'
+require 'contrast/config/logger_configuration'
 
-cs__scoped_require 'contrast/config/heap_dump_configuration'
-cs__scoped_require 'contrast/config/service_configuration'
-cs__scoped_require 'contrast/config/exception_configuration'
-cs__scoped_require 'contrast/config/assess_rules_configuration'
-cs__scoped_require 'contrast/config/protect_rule_configuration'
-cs__scoped_require 'contrast/config/protect_rules_configuration'
-cs__scoped_require 'contrast/config/sampling_configuration'
+require 'contrast/config/heap_dump_configuration'
+require 'contrast/config/service_configuration'
+require 'contrast/config/exception_configuration'
+require 'contrast/config/assess_rules_configuration'
+require 'contrast/config/protect_rule_configuration'
+require 'contrast/config/protect_rules_configuration'
+require 'contrast/config/sampling_configuration'
 
-cs__scoped_require 'contrast/config/ruby_configuration'
-cs__scoped_require 'contrast/config/agent_configuration'
-cs__scoped_require 'contrast/config/application_configuration'
-cs__scoped_require 'contrast/config/server_configuration'
-cs__scoped_require 'contrast/config/assess_configuration'
-cs__scoped_require 'contrast/config/inventory_configuration'
-cs__scoped_require 'contrast/config/protect_configuration'
-cs__scoped_require 'contrast/config/root_configuration'
+require 'contrast/config/ruby_configuration'
+require 'contrast/config/agent_configuration'
+require 'contrast/config/application_configuration'
+require 'contrast/config/server_configuration'
+require 'contrast/config/assess_configuration'
+require 'contrast/config/inventory_configuration'
+require 'contrast/config/protect_configuration'
+require 'contrast/config/root_configuration'

data/lib/contrast/config/base_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'forwardable'
-cs__scoped_require 'contrast/utils/object_share'
+require 'forwardable'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Config

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
+require 'set'
 
 module Contrast
   module Config

data/lib/contrast/configuration.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'yaml'
-cs__scoped_require 'fileutils'
+require 'yaml'
+require 'fileutils'
 
-cs__scoped_require 'contrast/config'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/config'
+require 'contrast/utils/object_share'
+require 'contrast/components/interface'
 
 module Contrast
   # This is how we read in the local settings for the Agent, both ENV/ CMD line

data/lib/contrast/extension/assess.rb

@@ -12,37 +12,38 @@ module Contrast
     #   therein.
     #   Removing it requires a C refactor to handle the namespace.
     module Assess
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/patching/policy/patcher'
 
-      cs__scoped_require 'contrast/utils/tag_util'
+      require 'contrast/utils/tag_util'
 
       # provider rules - have to come before policy
-      cs__scoped_require 'contrast/agent/assess/rule/provider'
+      require 'contrast/agent/assess/rule/provider'
 
       # tagging / dataflow
-      cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-      cs__scoped_require 'contrast/agent/assess/policy/source_node'
-      cs__scoped_require 'contrast/agent/assess/policy/source_method'
-      cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-      cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-      cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
-      cs__scoped_require 'contrast/agent/assess/policy/policy'
-      cs__scoped_require 'contrast/agent/assess/policy/patcher'
+      require 'contrast/agent/assess/policy/policy_node'
+      require 'contrast/agent/assess/policy/source_node'
+      require 'contrast/agent/assess/policy/source_method'
+      require 'contrast/agent/assess/policy/propagation_node'
+      require 'contrast/agent/assess/policy/propagation_method'
+      require 'contrast/agent/assess/policy/trigger_node'
+      require 'contrast/agent/assess/policy/trigger_method'
+      require 'contrast/agent/assess/policy/policy'
+      require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/extension/assess/assess_extension'
+      require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extension/assess/string'
+      require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extension/assess/array'
-      cs__scoped_require 'contrast/extension/assess/erb'
-      cs__scoped_require 'contrast/extension/assess/eval_trigger'
-      cs__scoped_require 'contrast/extension/assess/fiber'
-      cs__scoped_require 'contrast/extension/assess/hash'
-      cs__scoped_require 'contrast/extension/assess/kernel'
-      cs__scoped_require 'contrast/extension/assess/regexp'
+      require 'contrast/extension/assess/array'
+      require 'contrast/extension/assess/erb'
+      require 'contrast/extension/assess/eval_trigger'
+      require 'contrast/extension/assess/fiber'
+      require 'contrast/extension/assess/hash'
+      require 'contrast/extension/assess/kernel'
+      require 'contrast/extension/assess/regexp'
+      require 'contrast/extension/assess/marshal'
     end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/patch'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -63,7 +63,7 @@ module Contrast
 
           def instrument_array_track
             @_instrument_array_track ||= begin
-                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
+                                           require 'cs__assess_array/cs__assess_array'
                                            true
                                          end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/assess_extension.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/insulator'
+require 'contrast/agent/assess/properties'
+require 'contrast/agent/assess/finalizers/finalize'
 
 module Contrast
   module Extension
@@ -13,28 +13,17 @@ module Contrast
       # dataflow features should be sent
       # 'include Contrast::Extension::Assess::AssessExtension'
       module AssessExtension
+        def cs__transfer_properties dup
+          Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[dup] ||= Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[self].dup
+        end
+
         # Lazily build properties object. Only objects that have been tracked
         # will have the @_cs__properties, but all will respond to the
         # cs__properties method call. You should only call this method if you
         # either intend to start tracking an object or you have already checked
         # cs__tracked? and it is true.
         def cs__properties
-          # If this object was tracked before being frozen, it'll have
-          # mutable properties we need inside of the insulator @_cs__properties
-          if cs__frozen?
-            if instance_variable_defined?(:@_cs__properties)
-              @_cs__properties.properties
-            else
-              Contrast::Agent::Assess::Insulator.generate_frozen.properties
-            end
-          else
-            @_cs__properties ||= Contrast::Agent::Assess::Insulator.generate
-            @_cs__properties.properties
-          end
-        end
-
-        def cs__properties?
-          instance_variable_defined?(:@_cs__properties)
+          Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[self] ||= Contrast::Agent::Assess::Properties.new
         end
 
         # This is a way to check if we are already tracking an object without
@@ -43,13 +32,11 @@ module Contrast
         # already been tracked we will return false without starting to track
         # it
         def cs__tracked?
-          cs__properties? && cs__properties.tracked?
+          !!Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[self]&.tracked?
         end
 
         def cs__reset_properties
-          return unless cs__properties?
-
-          @_cs__properties = nil
+          Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH[self] = nil
         end
 
         # copy tags and info from object to self if object support methods
@@ -61,14 +48,9 @@ module Contrast
           return unless Contrast::Utils::DuckUtils.quacks_to?(obj,
                                                               :cs__tracked?)
           return unless obj.cs__tracked?
-          return if cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
+          return unless cs__properties
 
-          # This was fun to find...
-          # the clone and dup methods don't apply to instance variables in the
-          # cloned/ duped thing, so the arrays in the properties were the same.
-          # The most infinite of infinite loops ensued.
-          # DO NOT TAKE THIS OUT!
-          cs__reset_properties if obj.cs__properties == cs__properties
+          cs__adjust_duplicate(obj)
 
           obj.cs__properties.events.each do |event|
             cs__properties.events << event
@@ -141,6 +123,22 @@ module Contrast
             end
           end
         end
+
+        private
+
+        # Because of how our tracking works now, sometimes the Source and
+        # Target are the same, but their IDs in our map will be different due
+        # to PreShift duplication. To account for this, we have to ensure that
+        # the Object we're copying from does not have the same Properties
+        # that the Object we're copying to does. If they are the same, wipe the
+        # Target so that the copy method can update events and ranges as
+        # necessary.
+        # DO NOT TAKE THIS OUT!
+        def cs__adjust_duplicate obj
+          cs__reset_properties if obj.cs__properties == cs__properties
+          cs__reset_properties if obj.cs__properties.__id__ == cs__properties.dupped_from
+          cs__reset_properties if obj.cs__properties.dupped_from == cs__properties.__id__
+        end
       end
     end
   end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -45,7 +45,7 @@ module Contrast
 
           def instrument_basic_object_track
             @_instrument_basic_object_track ||= begin
-                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               require 'cs__assess_basic_object/cs__assess_basic_object'
                                                true
                                              end
           rescue StandardError, LoadError => e
@@ -55,7 +55,7 @@ module Contrast
 
           def instrument_module_track
             @_instrument_module_track ||= begin
-                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               require 'cs__assess_module/cs__assess_module'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/at_exit_hook'
 
 module Contrast
   module Extension

data/lib/contrast/extension/assess/fiber.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -99,7 +99,7 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
+                require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
                 true
               end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/hash.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -17,7 +17,9 @@ module Contrast
             return object unless object.is_a?(String) && !object.cs__frozen?
             return object unless object.cs__tracked?
 
-            object.dup.cs__freeze
+            ret = object.dup
+            object.cs__transfer_properties(ret)
+            ret.cs__freeze
           rescue StandardError
             # we'll rescue this error, but we can't log it here as that will
             # result in a seg fault
@@ -25,7 +27,7 @@ module Contrast
 
           def instrument_hash_track
             @_instrument_hash_track ||= begin
-                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
+                                            require 'cs__assess_hash/cs__assess_hash'
                                             true
                                           end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/exec_trigger'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/exec_trigger'
 
 module Contrast
   module Extension
@@ -56,11 +56,12 @@ module Contrast
 
           def track_sprintf result, format_string, args
             handle_sprintf_value(format_string, result)
-            if args.is_a?(String)
+            case args
+            when String
               handle_sprintf_value(args, result)
-            elsif args.is_a?(Hash)
+            when Hash
               handle_sprintf_hash(args, result)
-            elsif args.is_a?(Array)
+            when Array
               handle_sprintf_array args, result
             end
 
@@ -73,7 +74,7 @@ module Contrast
 
           def instrument_kernel_track
             @_instrument_fiber_variables ||= begin
-                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               require 'cs__assess_kernel/cs__assess_kernel'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/marshal.rb

@@ -0,0 +1,62 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      # This module is used for our Marshal#load patches
+      class MarshalPropagator
+        include Contrast::Components::Interface
+
+        access_component :logging
+
+        class << self
+          def cs__load_trigger_check source, ret
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                current_context,
+                trigger_node('Marshal', :load),
+                source,
+                self,
+                ret,
+                source)
+            ret.cs__copy_from(source) if ret.cs__respond_to?(:cs__copy_from)
+          rescue StandardError => e
+            logger.error('Unable to determine if a trigger occurred in Marshal.load', e)
+          end
+
+          def instrument_marshal_load
+            @_instrument_marshal_load ||= begin
+                                            require 'cs__assess_marshal_module/cs__assess_marshal_module'
+                                            true
+                                          end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading marshal load patch', e)
+            false
+          end
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end