contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/extension/protect.rb

@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -30,9 +30,9 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
-                                               true
-                                             end
+              require 'cs__protect_kernel/cs__protect_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel protect patch', e)
             false

data/lib/contrast/extension/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -46,7 +46,7 @@ module Contrast
         #
         # By default, and hopefully in all cases, we won't need these patches,
         # so we're allowing nil here rather than raising an exception.
-        def before_load_patches; end
+        def before_load_patches!; end
 
         # Some Frameworks require specific patching for their classes to handle
         # functionality like routing. To accommodate this, this method provides

data/lib/contrast/framework/manager.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/rack/support'
-cs__scoped_require 'contrast/framework/rails/support'
-cs__scoped_require 'contrast/framework/sinatra/support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/framework/platform_version'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
@@ -39,9 +39,9 @@ module Contrast
       # configuration.
       def before_load_patches!
         @_before_load_patches ||= begin
-                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
-                                    true
-                                  end
+          SUPPORTED_FRAMEWORKS.each(&:before_load_patches!)
+          true
+        end
       end
 
       # Return all the After Load Patches for all the Frameworks we know, even
@@ -128,10 +128,9 @@ module Contrast
       # @param method_name [Symbol] the method to call on each FrameworkSupport class
       # @return [Array]
       def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
+        @_frameworks.flat_map do |framework|
           framework.send(method_name)
         end.compact
-        data
       end
 
       # This returns a single object from the first framework to successfully respond

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -24,20 +24,20 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::Rack::Session::Cookie.class_eval do
-                                   alias_method :cs__patched_initialize, :initialize
-                                   def initialize app, options = {}
-                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
-                                     cs__patched_initialize(app, options)
-                                   end
-                                 end
-                                 true
-                               end
+                ::Rack::Session::Cookie.class_eval do
+                  alias_method :cs__patched_initialize, :initialize
+                  def initialize app, options = {}
+                    Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                    cs__patched_initialize(app, options)
+                  end
+                end
+                true
+              end
             end
 
             def analyze options
               return unless AGENT.enabled?
-              return if PROTECT.enabled?
+              return if ASSESS.forcibly_disabled?
 
               apply_session_timeout(options)
               apply_httponly(options)
@@ -67,12 +67,10 @@ module Contrast
                   options,
                   safe_default: false)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SECURE_RULE_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SECURE_RULE_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to secure session', e)
@@ -88,12 +86,10 @@ module Contrast
                                                 safe_default: false,
                                                 comparison_type: :greater_than)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__SESSION_TIMEOUT_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__SESSION_TIMEOUT_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -105,12 +101,10 @@ module Contrast
             def apply_httponly options
               return unless vulnerable_setting?(:httponly, true, options)
 
-              with_contrast_scope do
-                cs__report_finding(
-                    CS__HTTPONLY_NAME,
-                    options,
-                    caller_locations(10, 9)[0])
-              end
+              cs__report_finding(
+                  CS__HTTPONLY_NAME,
+                  options,
+                  caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to httponly', e)

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rack/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -19,19 +19,19 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::ActionController::Live::Buffer.class_eval do
-                                   # normally pre->in->post filters are applied however, in a streamed response
-                                   # we can run into a case where it's pre -> in -> post -> more infilters
-                                   # in order to submit anything found during the infilters after the response has
-                                   # been written we need to explicitly send them
-                                   alias_method :cs__close, :close
-                                   def close
-                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
-                                     cs__close
-                                   end
-                                 end
-                                 true
-                               end
+                ::ActionController::Live::Buffer.class_eval do
+                  # normally pre->in->post filters are applied however, in a streamed response
+                  # we can run into a case where it's pre -> in -> post -> more infilters
+                  # in order to submit anything found during the infilters after the response has
+                  # been written we need to explicitly send them
+                  alias_method :cs__close, :close
+                  def close
+                    Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                    cs__close
+                  end
+                end
+                true
+              end
             end
           end
         end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/components/interface'
+require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
   module Framework
@@ -12,7 +12,7 @@ module Contrast
         module AssessConfiguration
           include Contrast::Components::Interface
 
-          access_component :agent, :analysis, :logging, :scope
+          access_component :agent, :analysis, :logging
 
           CS__SESSION_TIMEOUT_NAME = 'session-timeout'
           SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
@@ -23,7 +23,7 @@ module Contrast
             include Contrast::Utils::InvalidConfigurationUtil
 
             def analyze_session_store *args
-              return if PROTECT.enabled?
+              return if ASSESS.forcibly_disabled?
 
               apply_httponly_disabled(*args)
               apply_secure_cookie_disabled(*args)
@@ -52,9 +52,7 @@ module Contrast
               return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -68,9 +66,7 @@ module Contrast
               return unless vulnerable_setting?(:secure, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable secure cookies', e)
@@ -84,9 +80,7 @@ module Contrast
               return unless vulnerable_setting?(:httponly, true, args)
 
               rails_session_settings = args[1]
-              with_contrast_scope do
-                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
-              end
+              cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to disable httponly in session cookie', e)

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+require 'contrast/framework/rails/patch/assess_configuration'
 module Contrast
   module Framework
     module Rails
@@ -13,16 +13,16 @@ module Contrast
         class RailsApplicationConfiguration
           def self.instrument
             @_instrument ||= begin
-                               ::Rails::Application::Configuration.class_eval do
-                                 alias_method :cs__patched_session_store, :session_store
-                                 def session_store *args
-                                   ret = cs__patched_session_store(*args)
-                                   Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
-                                   ret
-                                 end
-                               end
-                               true
-                             end
+              ::Rails::Application::Configuration.class_eval do
+                alias_method :cs__patched_session_store, :session_store
+                def session_store *args
+                  ret = cs__patched_session_store(*args)
+                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                  ret
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework
@@ -11,7 +11,7 @@ module Contrast
         # Extension point allowing for the registration of Patches required to
         # support the Rails framework.
         module Support
-          # (See BaseSupport#before_load_patches)
+          # (See BaseSupport#before_load_patches!)
           def before_load_patches!
             return unless defined?(::Rails)
 
@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -15,17 +15,17 @@ module Contrast
         class ActionControllerRailtiesHelperInherited
           def self.instrument
             @_instrument ||= begin
-                               ::ActionController::Railties::Helpers.class_eval do
-                                 alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass
-                                   klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass)
-                                 ensure
-                                   klass&.instance_variable_set(:@cs__defining_class, false)
-                                 end
-                               end
-                               true
-                             end
+              ::ActionController::Railties::Helpers.class_eval do
+                alias_method :cs__patched_helper_inherited, :inherited
+                def inherited klass # rubocop:disable Lint/MissingSuper
+                  klass&.instance_variable_set(:@cs__defining_class, true)
+                  cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                ensure
+                  klass&.instance_variable_set(:@cs__defining_class, false)
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -17,20 +17,20 @@ module Contrast
         class ActiveRecordAttributeMethodsRead
           def self.instrument
             @_instrument ||= begin
-                           ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
-                             alias_method :cs__patched_define_method_attribute, :define_method_attribute
+              ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
+                alias_method :cs__patched_define_method_attribute, :define_method_attribute
 
-                             def define_method_attribute *args, &block
-                               ret = cs__patched_define_method_attribute(*args, &block)
-                               method_name = args[0]
-                               Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-                               ret
-                             end
+                def define_method_attribute *args, &block
+                  ret = cs__patched_define_method_attribute(*args, &block)
+                  method_name = args[0]
+                  Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+                  ret
+                end
 
-                             protected :cs__patched_define_method_attribute, :define_method_attribute
-                           end
-                           true
-                         end
+                protected :cs__patched_define_method_attribute, :define_method_attribute
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -58,9 +58,9 @@ module Contrast
 
             def instrument
               @_instrument_named_track ||= begin
-                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
-                                                 true
-                                               end
+                require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                true
+              end
             rescue StandardError, LoadError => e
               logger.error('Error loading active record named track patch', e)
               false