contrast-agent 3.13.2 → 4.1.0

data/service_executables/VERSION

@@ -1 +1 @@
-2.9.5
+2.15.1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 3.13.2
+  version: 4.1.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-07-29 00:00:00.000000000 Z
+date: 2020-11-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: amazing_print
@@ -56,6 +56,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: debase
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: debride
   requirement: !ruby/object:Gem::Requirement
@@ -126,6 +140,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: flay
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement
@@ -258,42 +286,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.93.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.93.1
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.5.2
+        version: 1.8.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.5.2
+        version: 1.8.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.43.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.43.2
+- !ruby/object:Gem::Dependency
+  name: ruby-debug-ide
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -438,22 +480,16 @@ dependencies:
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 description: This gem instantiates a Rack middleware for rack-based web applications
   in order to provide Interactive Application Security Testing and Protection.
 email:
@@ -462,20 +498,20 @@ executables:
 - contrast_service
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_active_record_named/extconf.rb
-- ext/cs__assess_string_interpolation26/extconf.rb
 - ext/cs__assess_module/extconf.rb
-- ext/cs__protect_kernel/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
 - ext/cs__assess_hash/extconf.rb
-- ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
 - ext/cs__assess_string/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__protect_kernel/extconf.rb
+- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
+- ext/cs__assess_fiber_track/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_yield_track/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -674,7 +710,8 @@ files:
 - lib/contrast/agent/assess/contrast_event.rb
 - lib/contrast/agent/assess/events/event_factory.rb
 - lib/contrast/agent/assess/events/source_event.rb
-- lib/contrast/agent/assess/insulator.rb
+- lib/contrast/agent/assess/finalizers/freeze.rb
+- lib/contrast/agent/assess/finalizers/hash.rb
 - lib/contrast/agent/assess/policy/dynamic_source_factory.rb
 - lib/contrast/agent/assess/policy/patcher.rb
 - lib/contrast/agent/assess/policy/policy.rb
@@ -717,6 +754,7 @@ files:
 - lib/contrast/agent/assess/properties.rb
 - lib/contrast/agent/assess/property/evented.rb
 - lib/contrast/agent/assess/property/tagged.rb
+- lib/contrast/agent/assess/property/updated.rb
 - lib/contrast/agent/assess/rule.rb
 - lib/contrast/agent/assess/rule/base.rb
 - lib/contrast/agent/assess/rule/provider.rb
@@ -725,12 +763,18 @@ files:
 - lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb
 - lib/contrast/agent/assess/rule/redos.rb
 - lib/contrast/agent/assess/tag.rb
+- lib/contrast/agent/assess/tracker.rb
 - lib/contrast/agent/at_exit_hook.rb
 - lib/contrast/agent/class_reopener.rb
 - lib/contrast/agent/deadzone/policy/deadzone_node.rb
 - lib/contrast/agent/deadzone/policy/policy.rb
 - lib/contrast/agent/disable_reaction.rb
 - lib/contrast/agent/exclusion_matcher.rb
+- lib/contrast/agent/inventory.rb
+- lib/contrast/agent/inventory/dependencies.rb
+- lib/contrast/agent/inventory/dependency_analysis.rb
+- lib/contrast/agent/inventory/dependency_usage_analysis.rb
+- lib/contrast/agent/inventory/gemfile_digest_cache.rb
 - lib/contrast/agent/inventory/policy/datastores.rb
 - lib/contrast/agent/inventory/policy/policy.rb
 - lib/contrast/agent/inventory/policy/trigger_node.rb
@@ -779,7 +823,6 @@ files:
 - lib/contrast/agent/request.rb
 - lib/contrast/agent/request_context.rb
 - lib/contrast/agent/request_handler.rb
-- lib/contrast/agent/require_state.rb
 - lib/contrast/agent/response.rb
 - lib/contrast/agent/rewriter.rb
 - lib/contrast/agent/rule_set.rb
@@ -809,6 +852,8 @@ files:
 - lib/contrast/api/decorators/application_update.rb
 - lib/contrast/api/decorators/http_request.rb
 - lib/contrast/api/decorators/input_analysis.rb
+- lib/contrast/api/decorators/library.rb
+- lib/contrast/api/decorators/library_usage_update.rb
 - lib/contrast/api/decorators/message.rb
 - lib/contrast/api/decorators/rasp_rule_sample.rb
 - lib/contrast/api/decorators/route_coverage.rb
@@ -857,13 +902,13 @@ files:
 - lib/contrast/configuration.rb
 - lib/contrast/extension/assess.rb
 - lib/contrast/extension/assess/array.rb
-- lib/contrast/extension/assess/assess_extension.rb
 - lib/contrast/extension/assess/erb.rb
 - lib/contrast/extension/assess/eval_trigger.rb
 - lib/contrast/extension/assess/exec_trigger.rb
 - lib/contrast/extension/assess/fiber.rb
 - lib/contrast/extension/assess/hash.rb
 - lib/contrast/extension/assess/kernel.rb
+- lib/contrast/extension/assess/marshal.rb
 - lib/contrast/extension/assess/regexp.rb
 - lib/contrast/extension/assess/string.rb
 - lib/contrast/extension/delegator.rb
@@ -896,18 +941,16 @@ files:
 - lib/contrast/logger/application.rb
 - lib/contrast/logger/format.rb
 - lib/contrast/logger/log.rb
+- lib/contrast/logger/request.rb
 - lib/contrast/logger/time.rb
 - lib/contrast/security_exception.rb
 - lib/contrast/tasks/config.rb
 - lib/contrast/tasks/service.rb
 - lib/contrast/utils/assess/sampling_util.rb
 - lib/contrast/utils/assess/tracking_util.rb
-- lib/contrast/utils/boolean_util.rb
 - lib/contrast/utils/class_util.rb
 - lib/contrast/utils/duck_utils.rb
 - lib/contrast/utils/env_configuration_item.rb
-- lib/contrast/utils/freeze_util.rb
-- lib/contrast/utils/gemfile_reader.rb
 - lib/contrast/utils/hash_digest.rb
 - lib/contrast/utils/heap_dump_util.rb
 - lib/contrast/utils/invalid_configuration_util.rb

data/lib/contrast/agent/assess/insulator.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/agent/assess/properties'
-
-module Contrast
-  module Agent
-    module Assess
-      # This is just a wrapper around Properties so that if they are on a frozen
-      # object, they are left mutable for us.
-      class Insulator
-        # Return a new delegator with a properties method, used to track
-        # properties in a manner that won't be serialized.
-        #
-        # @return [SimpleDelegator<Object>]
-        def self.generate
-          delegator = SimpleDelegator.new(nil)
-          delegator.extend(Contrast::Utils::PreventPsychSerialization)
-          delegator
-        end
-
-        # Return the frozen properties delegator, which is a
-        #
-        # @return [SimpleDelegator<Object>]
-        def self.generate_frozen
-          @_generate_frozen ||= begin
-                                  delegator = SimpleDelegator.new(nil)
-                                  delegator.extend(Contrast::Utils::PreventPsychSerialization)
-                                  delegator
-                                end
-        end
-      end
-    end
-  end
-end
-
-# Our patch of the SimpleDelegator class, allowing us to leverage its
-# marshal_dump and marshal_load methods to hide our properties on an object so
-# that they will not be dumped or loaded.
-# We do this to prevent polluting data that may run on applications that are no
-# longer instrumented with Contrast
-class SimpleDelegator
-  # rubocop:disable Naming/MemoizedInstanceVariableName
-  def properties
-    @delegate_properties ||= Contrast::Agent::Assess::Properties.new
-  end
-  # rubocop:enable Naming/MemoizedInstanceVariableName
-end

data/lib/contrast/agent/require_state.rb

@@ -1,61 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    # Thread local way to access the current RequireState. Used as a convenient
-    # wrapper to ensure specific key is used and that we handle the case when
-    # we try to enter a previously unset require scope.
-    # (Note that 'require scopes' track nested requires.  This is distinct
-    # from 'contrast scope', which tracks instrumentation.)
-    module RequireStates
-      class << self
-        KEY = :thread_local_contrast_require_scope
-
-        def enter
-          scope = current_scope
-          unless current_scope
-            scope = RequireState.new
-            Thread.current[KEY] = scope
-          end
-          scope.enter
-        end
-
-        def exit
-          current_scope.exit
-        end
-
-        def current_scope
-          Thread.current[KEY]
-        end
-
-        def status
-          current_scope&.scope.to_s
-        end
-
-        def in_scope?
-          scope = current_scope
-          scope && scope.scope > 1
-        end
-      end
-    end
-
-    # Simple counter class for tracking how deep in nested requires / file
-    # load operations we currently are.
-    class RequireState
-      attr_reader :scope
-
-      def initialize
-        @scope = 0
-      end
-
-      def enter
-        @scope += 1
-      end
-
-      def exit
-        @scope -= 1
-      end
-    end
-  end
-end

data/lib/contrast/extension/assess/assess_extension.rb

@@ -1,147 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/insulator'
-
-module Contrast
-  module Extension
-    module Assess
-      # This module is responsible for maintaining the data we need to
-      # construct a trace event for the object in which it is included. Rather
-      # than have this code all over the place, any class that wants to use
-      # dataflow features should be sent
-      # 'include Contrast::Extension::Assess::AssessExtension'
-      module AssessExtension
-        # Lazily build properties object. Only objects that have been tracked
-        # will have the @_cs__properties, but all will respond to the
-        # cs__properties method call. You should only call this method if you
-        # either intend to start tracking an object or you have already checked
-        # cs__tracked? and it is true.
-        def cs__properties
-          # If this object was tracked before being frozen, it'll have
-          # mutable properties we need inside of the insulator @_cs__properties
-          if cs__frozen?
-            if instance_variable_defined?(:@_cs__properties)
-              @_cs__properties.properties
-            else
-              Contrast::Agent::Assess::Insulator.generate_frozen.properties
-            end
-          else
-            @_cs__properties ||= Contrast::Agent::Assess::Insulator.generate
-            @_cs__properties.properties
-          end
-        end
-
-        def cs__properties?
-          instance_variable_defined?(:@_cs__properties)
-        end
-
-        # This is a way to check if we are already tracking an object without
-        # adding tracking to it. If the object already has been tracked we will
-        # return the tracking state of its properties. If the object hasn't
-        # already been tracked we will return false without starting to track
-        # it
-        def cs__tracked?
-          cs__properties? && cs__properties.tracked?
-        end
-
-        def cs__reset_properties
-          return unless cs__properties?
-
-          @_cs__properties = nil
-        end
-
-        # copy tags and info from object to self if object support methods
-        # obj: the object from which to copy tags and events
-        # shift: how far to shift the tags, negative moves left
-        # skip_tags: array of tags to skip copying
-        def cs__copy_from obj, shift = 0, skip_tags = nil
-          return if obj.equal?(self)
-          return unless Contrast::Utils::DuckUtils.quacks_to?(obj,
-                                                              :cs__tracked?)
-          return unless obj.cs__tracked?
-          return if cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
-
-          # This was fun to find...
-          # the clone and dup methods don't apply to instance variables in the
-          # cloned/ duped thing, so the arrays in the properties were the same.
-          # The most infinite of infinite loops ensued.
-          # DO NOT TAKE THIS OUT!
-          cs__reset_properties if obj.cs__properties == cs__properties
-
-          obj.cs__properties.events.each do |event|
-            cs__properties.events << event
-          end
-
-          obj.cs__properties.tag_keys.each do |key|
-            next if skip_tags&.include?(key)
-
-            new_tags = []
-            value = obj.cs__properties.fetch_tag(key)
-            value.each do |tag|
-              new_tags << tag.copy_modified(shift)
-            end
-            existing = cs__properties.fetch_tag(key)
-            if existing
-              existing.concat(new_tags)
-              Contrast::Utils::TagUtil.size_aware_merge(self, existing)
-            else
-              cs__properties.set_tags(key, new_tags)
-            end
-          end
-        end
-
-        # Some propagation occurred, but we're not sure what the
-        # exact transformation was. To be safe, we just explode
-        # all the tags from the source to the return.
-        #
-        # If the return already had that tag, the existing tag
-        # range is recycled to save us an object.
-        def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.trackable?(ret)
-
-          length = Contrast::Utils::StringUtils.ret_length(ret)
-          return if length.zero?
-
-          cs__splat_from_source(ret, length, source)
-          cs__splat_from_ret(ret, length)
-        end
-
-        def cs__splat_from_source ret, ret_length, source
-          splat_source = Contrast::Utils::DuckUtils.trackable?(source)
-          splat_source &&= source.cs__tracked?
-          return unless splat_source
-
-          source.cs__properties.tag_keys.each do |key|
-            existing = ret.cs__properties.fetch_tag(key)
-            # if the tag already exists, drop all but the first range
-            # then change that range to cover the entire return
-            if existing
-              existing.drop(existing.length - 1)
-              range = existing[0]
-              range.repurpose(0, ret_length)
-            else
-              ret.cs__properties.add_tag(key, 0...ret_length)
-            end
-          end
-        end
-
-        def cs__splat_from_ret ret, length
-          return unless ret.cs__tracked?
-
-          ret.cs__properties.tag_keys.each do |key|
-            next unless key
-
-            existing = ret.cs__properties.fetch_tag(key)
-            next unless existing
-
-            existing.each do |range|
-              range.update_end(length) if range.end_idx > length
-            end
-          end
-        end
-      end
-    end
-  end
-end