contrast-agent 3.13.2 → 4.1.0

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c

@@ -14,13 +14,15 @@ static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
 
 static int install_hooks() {
     rb_str_concat_literals_original = rb_str_concat_literals;
-    patch_via_funchook(&rb_str_concat_literals_original, &rb_str_concat_literals_hook);
+    patch_via_funchook(&rb_str_concat_literals_original,
+                       &rb_str_concat_literals_hook);
 
     return 0;
 }
 
 void Init_cs__assess_string_interpolation26(void) {
-    string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
+    string_propagator =
+        rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
     track_interpolation = rb_intern("track_interpolation");
     install_hooks();
 }

data/ext/cs__assess_yield_track/cs__assess_yield_track.c

@@ -8,7 +8,7 @@
 static VALUE rb_yield_hook(VALUE val, const VALUE self) {
     VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
 
-    if(method == split_method && RB_TYPE_P(val, T_STRING)) {
+    if (method == split_method && RB_TYPE_P(val, T_STRING)) {
         rb_funcall(split_class, propagate_yield, 1, val);
     }
     VALUE result = rb_yield_original(val);
@@ -25,6 +25,6 @@ void Init_cs__assess_yield_track(void) {
     VALUE base = rb_define_class_under(assess_propagator, "Base", rb_cObject);
     split_class = rb_define_class_under(assess_propagator, "Split", base);
     propagate_yield = rb_intern("propagate_yield");
-    split_method =  ID2SYM(rb_intern("split"));
+    split_method = ID2SYM(rb_intern("split"));
     install_yield_hooks();
 }

data/ext/cs__common/cs__common.c

@@ -2,8 +2,8 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__common.h"
-#include <ruby.h>
 #include <dlfcn.h>
+#include <ruby.h>
 
 /* Globals */
 /* These are defined w/ `extern` in the header */
@@ -18,7 +18,7 @@ VALUE rb_sym_in_scope;
 VALUE rb_sym_skip_contrast_analysis;
 VALUE rb_sym_skip_assess_analysis;
 VALUE rb_sym_method;
-VALUE rb_sym_cs_tracked;
+VALUE rb_sym_hash_get, rb_sym_hash_set, rb_sym_hash_tracked;
 /* end globals */
 
 void patch_via_funchook(void *original_function, void *hook_function) {
@@ -27,19 +27,24 @@ void patch_via_funchook(void *original_function, void *hook_function) {
 
     void *funchook_lib_handle;
     void *funchook_reference, *(*funchook_create)(void);
-    int prepareResult, (*funchook_prepare)(void*, void**, void*);
-    int installResult, (*funchook_install)(void*, int);
+    int prepareResult, (*funchook_prepare)(void *, void **, void *);
+    int installResult, (*funchook_install)(void *, int);
 
-    funchook_lib_handle = dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
+    funchook_lib_handle =
+        dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
 
     /* Load the funchook methods we need */
-    funchook_create  = (void* (*)(void))dlsym(funchook_lib_handle, "funchook_create");
-    funchook_prepare = (int (*)(void*, void**, void*))dlsym(funchook_lib_handle, "funchook_prepare");
-    funchook_install = (int (*)(void*, int))dlsym(funchook_lib_handle, "funchook_install");
+    funchook_create =
+        (void *(*)(void))dlsym(funchook_lib_handle, "funchook_create");
+    funchook_prepare = (int (*)(void *, void **, void *))dlsym(
+        funchook_lib_handle, "funchook_prepare");
+    funchook_install =
+        (int (*)(void *, int))dlsym(funchook_lib_handle, "funchook_install");
 
-    funchook_reference = (void*)(*funchook_create)();
+    funchook_reference = (void *)(*funchook_create)();
 
-    prepareResult = (*funchook_prepare)(funchook_reference, (void**)original_function, hook_function);
+    prepareResult = (*funchook_prepare)(
+        funchook_reference, (void **)original_function, hook_function);
     installResult = (*funchook_install)(funchook_reference, 0);
 }
 
@@ -53,33 +58,32 @@ VALUE contrast_patcher() {
     return patcher;
 }
 
-VALUE contrast_register_patch(const char *module_name,
-                               const char *method_name,
-                               VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                               ) {
-  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
+VALUE contrast_register_patch(const char *module_name, const char *method_name,
+                              VALUE(c_fn)(const int, const VALUE *,
+                                          const VALUE)) {
+    return _contrast_register_patch(module_name, method_name, c_fn,
+                                    IMPL_ALIAS_INSTANCE);
 }
 
-
 VALUE contrast_register_singleton_patch(const char *module_name,
                                         const char *method_name,
-                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                                        ) {
-  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
+                                        VALUE(c_fn)(const int, const VALUE *,
+                                                    const VALUE)) {
+    return _contrast_register_patch(module_name, method_name, c_fn,
+                                    IMPL_ALIAS_SINGLETON);
 }
 
-VALUE contrast_register_singleton_prepend_patch(const char *module_name,
-                                                const char *method_name,
-                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                                                ) {
-  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
+VALUE contrast_register_singleton_prepend_patch(
+    const char *module_name, const char *method_name,
+    VALUE(c_fn)(const int, const VALUE *, const VALUE)) {
+    return _contrast_register_patch(module_name, method_name, c_fn,
+                                    IMPL_PREPEND);
 }
 
-static VALUE _contrast_register_patch(const char *module_name,
-                                      const char *method_name,
-                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
-                                      patch_impl patch
-                                      ) {
+static VALUE
+_contrast_register_patch(const char *module_name, const char *method_name,
+                         VALUE(c_fn)(const int, const VALUE *, const VALUE),
+                         patch_impl patch) {
     VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
     VALUE unbound_method = Qnil;
     VALUE rb_str_module_name = rb_str_new_cstr(module_name);
@@ -105,24 +109,27 @@ static VALUE _contrast_register_patch(const char *module_name,
      */
     rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
     VALUE rb_sym_instance_method = rb_intern("instance_method");
-    unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
+    unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1,
+                                rb_str_method_name);
     rb_undef_method(contrast_bind_module, method_name);
 
     /* map impl enum -> ruby symbol */
     VALUE impl = Qnil;
-    switch(patch) {
-      case IMPL_ALIAS_INSTANCE:
+    switch (patch) {
+    case IMPL_ALIAS_INSTANCE:
         impl = ID2SYM(rb_sym_alias_instance);
         break;
-      case IMPL_ALIAS_SINGLETON:
+    case IMPL_ALIAS_SINGLETON:
         impl = ID2SYM(rb_sym_alias_singleton);
         break;
-      case IMPL_PREPEND:
+    case IMPL_PREPEND:
         impl = ID2SYM(rb_sym_prepend);
         break;
     }
 
-    VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
+    VALUE underlying_method_name =
+        rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3,
+                   rb_str_module_name, unbound_method, impl);
     return SYM2ID(underlying_method_name);
 }
 
@@ -137,13 +144,15 @@ void Init_cs__common(void) {
     rb_sym_skip_contrast_analysis = rb_intern("skip_contrast_analysis?");
     rb_sym_skip_assess_analysis = rb_intern("skip_assess_analysis?");
     rb_sym_method = rb_intern("__method__");
-    rb_sym_cs_tracked = rb_intern("cs__tracked?");
+    rb_sym_hash_get = rb_intern("[]");
+    rb_sym_hash_set = rb_intern("[]=");
+    rb_sym_hash_tracked = rb_intern("tracked?");
 
     /* Used for returning unbound C functions */
     rb_sym_register_c_patch = rb_intern("register_c_patch");
-    rb_sym_alias_instance   = rb_intern("alias_instance");
-    rb_sym_alias_singleton  = rb_intern("alias_singleton");
-    rb_sym_prepend          = rb_intern("prepend");
+    rb_sym_alias_instance = rb_intern("alias_instance");
+    rb_sym_alias_singleton = rb_intern("alias_singleton");
+    rb_sym_prepend = rb_intern("prepend");
 
     /* Ensure definition of core Contrast instrumentation modules */
     contrast = rb_define_module("Contrast");

data/ext/cs__common/cs__common.h

@@ -4,12 +4,11 @@
 #include <ruby.h>
 
 typedef enum {
-  IMPL_ALIAS_INSTANCE,
-  IMPL_ALIAS_SINGLETON,
-  IMPL_PREPEND
+    IMPL_ALIAS_INSTANCE,
+    IMPL_ALIAS_SINGLETON,
+    IMPL_PREPEND
 } patch_impl;
 
-
 static VALUE cs__send_method;
 static VALUE cs__alias_method_sym;
 
@@ -24,7 +23,7 @@ extern VALUE rb_sym_in_scope;
 extern VALUE rb_sym_skip_contrast_analysis;
 extern VALUE rb_sym_skip_assess_analysis;
 extern VALUE rb_sym_method;
-extern VALUE rb_sym_cs_tracked;
+extern VALUE rb_sym_hash_get, rb_sym_hash_set, rb_sym_hash_tracked;
 
 static VALUE patcher;
 static VALUE rb_sym_instance_method;
@@ -38,27 +37,23 @@ void patch_via_funchook(void *original_function, void *hook_function);
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 
-VALUE contrast_register_patch(const char *module_name,
-                              const char *method_name,
-                              VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                              );
+VALUE contrast_register_patch(const char *module_name, const char *method_name,
+                              VALUE(c_fn)(const int, const VALUE *,
+                                          const VALUE));
 
 VALUE contrast_register_singleton_patch(const char *module_name,
                                         const char *method_name,
-                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                                        );
-
-VALUE contrast_register_singleton_prepend_patch(const char *module_name,
-                                                const char *method_name,
-                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
-                                                );
+                                        VALUE(c_fn)(const int, const VALUE *,
+                                                    const VALUE));
 
-static VALUE _contrast_register_patch(const char *module_name,
-                                      const char *method_name,
-                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
-                                      patch_impl patch_impl
-                                      );
+VALUE contrast_register_singleton_prepend_patch(
+    const char *module_name, const char *method_name,
+    VALUE(c_fn)(const int, const VALUE *, const VALUE));
 
+static VALUE
+_contrast_register_patch(const char *module_name, const char *method_name,
+                         VALUE(c_fn)(const int, const VALUE *, const VALUE),
+                         patch_impl patch_impl);
 
 VALUE contrast_patcher();
 

data/ext/cs__contrast_patch/cs__contrast_patch.c

@@ -34,7 +34,6 @@ VALUE contrast_patch_call_original(const VALUE *args) {
     method = args[3];
     method_id = SYM2ID(method);
 
-
     /* It looks like we can find the last Ruby block given so long as we don't
      * change Ruby method scope (always call this function from C, not Ruby),
      * which is the point of this C call.
@@ -111,7 +110,8 @@ VALUE contrast_call_super(const VALUE *args) {
 }
 
 VALUE contrast_run_patches(const VALUE *wrapped_args) {
-    VALUE impl, method, method_policy, object, original_args, original_ret, preshift, transformed_ret;
+    VALUE impl, method, method_policy, object, original_args, original_ret,
+        preshift, transformed_ret;
     int argc;
     VALUE *argv;
     VALUE rescue_args[6];
@@ -168,17 +168,17 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
      */
 
     switch (impl) {
-        case IMPL_ALIAS_INSTANCE:
-        case IMPL_ALIAS_SINGLETON:
-            original_ret = rb_rescue2(
-                contrast_patch_call_original, original_args,
-                contrast_patch_call_rescue, (VALUE)rescue_args, rb_eException, 0);
-            break;
-        case IMPL_PREPEND:
-            original_ret = rb_rescue2(contrast_call_super, original_args,
-                                      contrast_patch_call_rescue,
-                                      (VALUE)rescue_args, rb_eException, 0);
-            break;
+    case IMPL_ALIAS_INSTANCE:
+    case IMPL_ALIAS_SINGLETON:
+        original_ret = rb_rescue2(contrast_patch_call_original, original_args,
+                                  contrast_patch_call_rescue,
+                                  (VALUE)rescue_args, rb_eException, 0);
+        break;
+    case IMPL_PREPEND:
+        original_ret = rb_rescue2(contrast_call_super, original_args,
+                                  contrast_patch_call_rescue,
+                                  (VALUE)rescue_args, rb_eException, 0);
+        break;
     };
 
     /* If you're here, the original method did not throw an exception
@@ -302,16 +302,17 @@ VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
     }
 
     /* Otherwise, invoke Contrast analysis. */
-     VALUE wrapped_args[7];
-     wrapped_args[0] = impl;
-     wrapped_args[1] = (VALUE)original_args;
-     wrapped_args[2] = method;
-     wrapped_args[3] = method_policy;
-     wrapped_args[4] = object;
-     wrapped_args[5] = INT2NUM(argc);
-     wrapped_args[6] = (VALUE)argv;
-
-    return rb_ensure(contrast_run_patches, (VALUE)wrapped_args, contrast_ensure_function, method_policy);
+    VALUE wrapped_args[7];
+    wrapped_args[0] = impl;
+    wrapped_args[1] = (VALUE)original_args;
+    wrapped_args[2] = method;
+    wrapped_args[3] = method_policy;
+    wrapped_args[4] = object;
+    wrapped_args[5] = INT2NUM(argc);
+    wrapped_args[6] = (VALUE)argv;
+
+    return rb_ensure(contrast_run_patches, (VALUE)wrapped_args,
+                     contrast_ensure_function, method_policy);
 
 call_original:
 
@@ -351,8 +352,9 @@ VALUE contrast_patch_define_method(const VALUE self, const VALUE clazz,
         rb_funcall(method_policy, rb_sym_instance_method, 0);
     char *cStr;
     VALUE str;
-    rb_funcall(patch_status, rb_sym_set_info_for, 5, clazz, original_method_name,
-               method_policy, is_instance_method, cs_method);
+    rb_funcall(patch_status, rb_sym_set_info_for, 5, clazz,
+               original_method_name, method_policy, is_instance_method,
+               cs_method);
 
     /* Some methods we patch rely on a specific C level patch,
      * in those cases we should still add the method to the info_for hash

data/ext/cs__contrast_patch/cs__contrast_patch.h

@@ -1,5 +1,5 @@
-#include <ruby.h>
 #include "../cs__common/cs__common.h"
+#include <ruby.h>
 
 /* Calls to Contrast modules */
 /* Contrast::Agent::Patching::Policy::PatchStatus */
@@ -140,8 +140,7 @@ VALUE contrast_call_super(const VALUE *args);
  *          instance (specifically for frozen sources)
  */
 VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
-                              const patch_impl impl,
-                              const VALUE object);
+                              const patch_impl impl, const VALUE object);
 
 VALUE contrast_alias_instance_patch(const int argc, const VALUE *argv,
                                     const VALUE object);
@@ -149,7 +148,6 @@ VALUE contrast_alias_instance_patch(const int argc, const VALUE *argv,
 VALUE contrast_alias_singleton_patch(const int argc, const VALUE *argv,
                                      const VALUE object);
 
-
 VALUE contrast_prepend_patch(const int argc, const VALUE *argv,
                              const VALUE object);
 
@@ -169,12 +167,12 @@ VALUE contrast_prepend_patch(const int argc, const VALUE *argv,
  *   - prepending Foo with Foo::ContrastPrepend
  *
  * originalModule - Module; the actual Module being prepended
- * methodPolicy - :MethodPolicy; the method policy that apply to the method being redefined
+ * methodPolicy - :MethodPolicy; the method policy that apply to the method
+ * being redefined
  *
  * return - Boolean; if the prepend occurred or not
  */
-VALUE contrast_patch_prepend(const VALUE self,
-                             const VALUE originalModule,
+VALUE contrast_patch_prepend(const VALUE self, const VALUE originalModule,
                              const VALUE methodPolicy);
 
 /*

data/ext/cs__protect_kernel/cs__protect_kernel.c

@@ -10,7 +10,7 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
     VALUE ret;
     if (rb_block_given_p()) {
         /* We call our hook, but it's a little complicated.
-         * We wrap the fork block with our own lambda in 
+         * We wrap the fork block with our own lambda in
          * order to instrument it.  There are no public
          * methods in the Ruby C API to set the prevailing
          * block, so we have to use rb_funcall_with_block.
@@ -20,12 +20,14 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
          */
         VALUE wrapper;
         wrapper =
-            rb_funcall_with_block(kernel_protect, rb_sym_protect_kernel_wrapper, 0,
-                                   NULL, rb_block_proc());
-        rb_funcall(rb_mKernel, rb_intern("public"), 1, ID2SYM(rb_sym_protect_kernel_fork));
+            rb_funcall_with_block(kernel_protect, rb_sym_protect_kernel_wrapper,
+                                  0, NULL, rb_block_proc());
+        rb_funcall(rb_mKernel, rb_intern("public"), 1,
+                   ID2SYM(rb_sym_protect_kernel_fork));
         ret = rb_funcall_with_block(self, rb_sym_protect_kernel_fork, argc,
                                     argv, wrapper);
-        rb_funcall(rb_mKernel, rb_intern("private"), 1, ID2SYM(rb_sym_protect_kernel_fork));
+        rb_funcall(rb_mKernel, rb_intern("private"), 1,
+                   ID2SYM(rb_sym_protect_kernel_fork));
     } else {
         ret = rb_funcall2(self, rb_sym_protect_kernel_fork, argc, argv);
     }
@@ -37,12 +39,9 @@ void Init_cs__protect_kernel(void) {
     kernel_protect = rb_define_module_under(core_protect, "Kernel");
     rb_sym_protect_kernel_wrapper = rb_intern("build_wrapper");
 
-    rb_sym_protect_kernel_fork = contrast_register_patch("Kernel",
-                                                         "fork",
-                                                         &contrast_protect_fork);
-
-    rb_sym_protect_kernel_fork = contrast_register_singleton_patch("Kernel",
-                                                                   "fork",
-                                                                   &contrast_protect_fork);
+    rb_sym_protect_kernel_fork =
+        contrast_register_patch("Kernel", "fork", &contrast_protect_fork);
 
+    rb_sym_protect_kernel_fork = contrast_register_singleton_patch(
+        "Kernel", "fork", &contrast_protect_fork);
 }

data/ext/cs__protect_kernel/cs__protect_kernel.h

@@ -6,7 +6,7 @@ static VALUE kernel_protect;
 static VALUE rb_sym_protect_kernel_fork;
 static VALUE rb_sym_protect_kernel_wrapper;
 
-static VALUE
-contrast_protect_fork(const int argc, const VALUE *argv, const VALUE self);
+static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
+                                   const VALUE self);
 
 void Init_cs__protect_kernel(void);

data/lib/contrast-agent.rb

@@ -5,4 +5,4 @@
 # want to go through the trouble of renaming to contrast_agent.gem, which we
 # shouldn't do until we're ready to go to RubyGems
 
-require_relative './contrast' # rubocop:disable  Kernel/RequireRelative
+require_relative './contrast'

data/lib/contrast.rb

@@ -1,6 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+# Used to prevent deprecation warnings from flooding stdout
+ENV['PB_IGNORE_DEPRECATIONS'] = 'true'
+
 # Top-level namespace for Contrast Security agent
 module Contrast
 end
@@ -22,38 +25,25 @@ class Object
   alias_method :cs__singleton_class, :singleton_class
 end
 
-require_relative './contrast/agent/require_state' # rubocop:disable  Kernel/RequireRelative
-
-# We have to do this here BEOFRE we require anything b/c we can't use the
-# Contrast require methods without it.
-module Kernel
-  def cs__scoped_require path
-    Contrast::Agent::RequireStates.enter
-    require(path) # rubocop:disable  Kernel/Require
-  ensure
-    Contrast::Agent::RequireStates.exit
-  end
-end
-
 # component interface for class creation
 # config gets built as a consequence of this require
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 # This needs to be required very early, after component interfaces, and before instrumentation attempts
-cs__scoped_require 'contrast/funchook/funchook'
+require 'contrast/funchook/funchook'
 
 # shared configuration support
-cs__scoped_require 'contrast/config'
-cs__scoped_require 'contrast/configuration'
+require 'contrast/config'
+require 'contrast/configuration'
 
-cs__scoped_require 'contrast/agent/version'
+require 'contrast/agent/version'
 
 # errors and exceptions
-cs__scoped_require 'contrast/security_exception'
+require 'contrast/security_exception'
 
 # shared utils
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/preflight_util'
+require 'contrast/utils/timer'
+require 'contrast/utils/preflight_util'
 
-cs__scoped_require 'contrast/utils/assess/sampling_util'
-cs__scoped_require 'contrast/agent'
+require 'contrast/utils/assess/sampling_util'
+require 'contrast/agent'