contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -1,36 +1,36 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
+require 'monitor'
 
 # base
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/policy_scanner'
-cs__scoped_require 'contrast/agent/assess/policy/rewriter_patch'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/policy_scanner'
+require 'contrast/agent/assess/policy/rewriter_patch'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # deadzone
-cs__scoped_require 'contrast/agent/deadzone/policy/policy'
+require 'contrast/agent/deadzone/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # patch
-cs__scoped_require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patch'
 
 # after load patched
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patcher'
+require 'contrast/agent/patching/policy/after_load_patcher'
 
 module Contrast
   module Agent
@@ -77,19 +77,21 @@ module Contrast
             # This method is called by TracePointHook to instrument a specific class during a require
             # or eval of dynamic class definition
             def patch_specific_module mod
-              mod_name = mod.cs__name
-              return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
-              return if AGENT.skip_instrumentation?(mod_name)
+              with_contrast_scope do
+                mod_name = mod.cs__name
+                return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
+                return if AGENT.skip_instrumentation?(mod_name)
 
-              load_patches_for_module(mod_name)
+                load_patches_for_module(mod_name)
 
-              return unless all_module_names.any? { |name| name == mod_name }
+                return unless all_module_names.any? { |name| name == mod_name }
 
-              module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
-              patch_into_module(module_data)
-              all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
-            rescue StandardError => e
-              logger.error('Unable to patch module', e, module: mod_name)
+                module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
+                patch_into_module(module_data)
+                all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
+              rescue StandardError => e
+                logger.error('Unable to patch module', e, module: mod_name)
+              end
             end
 
             # We did it, team. We found a patcher(s) that applies to the given
@@ -186,7 +188,7 @@ module Contrast
               clazz = module_data.mod
 
               status.patching!
-              patched = include_module(module_data)
+              patched = false
 
               counts = 0
               # Monkey patch any methods in this class that have matching nodes in the policy
@@ -219,17 +221,6 @@ module Contrast
                                module_data.mod).patch_status)
             end
 
-            # Includes the given module with the
-            # Contrast::Extension::Assess::AssessExtension
-            # @param module_data [Contrast::Agent::ModuleData] the module, and
-            #   its name, that's being patched into
-            def include_module module_data
-              return false unless Contrast::Agent::Assess::Policy::Policy.instance.tracked_classes.include?(module_data.name)
-
-              module_data.mod.send(:include, Contrast::Extension::Assess::AssessExtension)
-              true
-            end
-
             # Get all of the instance methods on the given module, excluding
             # those from super classes. this list will always include the
             # initialize method
@@ -247,6 +238,14 @@ module Contrast
               instance_methods.concat(mod.private_instance_methods(false)) if private
               # initialize is an exception to the inheritance rule.
               instance_methods << :initialize unless instance_methods.include?(:initialize)
+              # Object owns these, but we don't want to patch every :dup or
+              # :clone, just the ones on String, so we'll special case this.
+              # This breaks the norm, where we usually instrument the lowest
+              # method possible.
+              if mod == String
+                instance_methods << :clone
+                instance_methods << :dup
+              end
               instance_methods
             end
 
@@ -298,10 +297,10 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/extension/assess'
-cs__scoped_require 'contrast/extension/inventory'
-cs__scoped_require 'contrast/extension/protect'
-cs__scoped_require 'contrast/extension/protect/kernel'
+require 'contrast/extension/module'
+require 'contrast/extension/assess'
+require 'contrast/extension/inventory'
+require 'contrast/extension/protect'
+require 'contrast/extension/protect/kernel'
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'singleton'
+require 'json'
+require 'singleton'
 
-cs__scoped_require 'contrast'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast'
+require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -37,13 +37,12 @@ module Contrast
 
           access_component :analysis, :logging
 
-          attr_reader :sources, :propagators, :triggers, :providers, :tracked_classes
+          attr_reader :sources, :propagators, :triggers, :providers
 
           SOURCES_KEY =          'sources'
           PROPAGATION_KEY =      'propagators'
           RULES_KEY = 'rules'
           TRIGGERS_KEY = 'triggers'
-          TRACKED_CLASSES_KEY = 'tracked_classes'
 
           def self.policy_json
             File.join(policy_folder, 'policy.json').cs__freeze
@@ -54,7 +53,6 @@ module Contrast
             @propagators = []
             @triggers = []
             @providers = {}
-            @tracked_classes = []
 
             json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
             from_hash_string(json)
@@ -114,7 +112,6 @@ module Contrast
           def module_names
             @_module_names ||= begin
               m = Set.new
-              tracked_classes.each { |tracked| m << tracked }
               sources.each { |source| m << source.class_name }
               propagators.each { |propagator| m << propagator.class_name }
               triggers.each { |trigger| m << trigger.class_name }
@@ -127,12 +124,26 @@ module Contrast
           end
 
           def find_source_node class_name, method_name, instance_method
-            sources.find { |source| source.class_name == class_name && source.method_name == method_name && source.instance_method == instance_method }
+            sources.find do |source|
+              source.class_name == class_name &&
+                  source.method_name == method_name &&
+                  source.instance_method == instance_method
+            end
+          end
+
+          def find_propagator_node class_name, method_name, instance_method
+            propagators.find do |propagator|
+              propagator.class_name == class_name &&
+                  propagator.method_name == method_name &&
+                  propagator.instance_method == instance_method
+            end
           end
 
           def find_node rule_id, class_name, method_name, instance_method
             find_triggers_by_rule(rule_id).find do |node|
-              node.class_name == class_name && node.method_name == method_name && node.instance_method == instance_method
+              node.class_name == class_name &&
+                  node.method_name == method_name &&
+                  node.instance_method == instance_method
             end
           end
         end

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/extension/module'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
-cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent
@@ -30,11 +30,9 @@ module Contrast
               Contrast::Agent::Protect::Policy::AppliesDeserializationRule.apply_deserialization_command_check(command)
               return if skip_analysis?
 
-              begin
-                clazz = object.is_a?(Module) ? object : object.cs__class
-                class_name = clazz.cs__name
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
-              end
+              clazz = object.is_a?(Module) ? object : object.cs__class
+              class_name = clazz.cs__name
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
             end
 
             protected

data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/path_traversal'
+require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent
@@ -26,7 +26,7 @@ module Contrast
 
               action = properties['action']
               write_marker = write?(action, *args)
-              possible_write = write_marker && possible_write(write_marker)
+              possible_write = write_marker && possible_write?(write_marker)
               path_traversal_rule(path, possible_write, object, method)
 
               # If the action was copy, we need to handle the write half of it.
@@ -48,7 +48,7 @@ module Contrast
 
             private
 
-            def possible_write input
+            def possible_write? input
               input.cs__respond_to?(:to_s) &&
                   input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
             end
@@ -62,7 +62,7 @@ module Contrast
               return true if action == WRITE
 
               write_marker = args.length > 1 ? args[1] : nil
-              write_marker && possible_write(write_marker)
+              write_marker && possible_write?(write_marker)
             end
 
             def path_traversal_rule path, possible_write, object, method
@@ -83,6 +83,7 @@ module Contrast
                   tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
                   gems = ENV['GEM_PATH']
                   tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
+                  tmp.map!(&:downcase)
                   tmp
                 else
                   []

data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/agent/protect/rule/sqli'
+require 'contrast/agent/protect/policy/rule_applicator'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/xxe'
+require 'contrast/agent/protect/policy/rule_applicator'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent
@@ -27,7 +27,7 @@ module Contrast
             def apply_rule__io method, _exception, _properties, object, args
               need_rewind = false
               potential_xml = args[0]
-              return unless potential_xml&.respond_to?(:rewind)
+              return unless potential_xml.cs__respond_to?(:rewind)
 
               xml = potential_xml.read
               need_rewind = true

data/lib/contrast/agent/protect/policy/policy.rb

@@ -1,16 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/agent/protect/policy/applies_command_injection_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_no_sqli_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_path_traversal_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_sqli_rule'
-cs__scoped_require 'contrast/agent/protect/policy/applies_xxe_rule'
-cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
+require 'contrast/agent/protect/policy/applies_command_injection_rule'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/applies_no_sqli_rule'
+require 'contrast/agent/protect/policy/applies_path_traversal_rule'
+require 'contrast/agent/protect/policy/applies_sqli_rule'
+require 'contrast/agent/protect/policy/applies_xxe_rule'
+require 'contrast/agent/protect/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/rule_applicator.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/policy/trigger_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule.rb

@@ -15,39 +15,39 @@ module Contrast
 end
 
 # The classes required for All Rasp Rules
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base_service'
 
 # The classes required for the XSS Rasp Rule
-cs__scoped_require 'contrast/agent/protect/rule/xss'
+require 'contrast/agent/protect/rule/xss'
 
 # The classes required for the SQLI
-cs__scoped_require 'contrast/agent/protect/rule/default_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
+require 'contrast/agent/protect/rule/default_scanner'
+require 'contrast/agent/protect/rule/sqli'
+require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
 
 # The classes required for Path Traversal
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
+require 'contrast/agent/protect/rule/path_traversal'
 
 # The classes required for Command Injection
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/rule/cmd_injection'
 
 # The classes required for XXE
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/agent/protect/rule/xxe/entity_wrapper'
+require 'contrast/agent/protect/rule/xxe'
+require 'contrast/agent/protect/rule/xxe/entity_wrapper'
 
 # The classes required for Untrusted Deserialization
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/rule/deserialization'
 
 # The classes required for the NoSQLi
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
 
 # The classes required for Http Method Tampering
-cs__scoped_require 'contrast/agent/protect/rule/http_method_tampering'
+require 'contrast/agent/protect/rule/http_method_tampering'
 
 # The classes required for Unsafe File Upload
-cs__scoped_require 'contrast/agent/protect/rule/unsafe_file_upload'
+require 'contrast/agent/protect/rule/unsafe_file_upload'