contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-cs__scoped_require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/api/decorators/trace_taint_range_tags'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -10,25 +10,25 @@ module Contrast
         # functionality. Any class under this namespace should be required
         # here, providing a single point of require for this functionality.
         module Propagator
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/base'
+          require 'contrast/agent/assess/policy/propagator/base'
 
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/append'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/center'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/custom'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/match_data'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/replace'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/reverse'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/select'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/splat'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/split'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/substitution'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/append'
+          require 'contrast/agent/assess/policy/propagator/center'
+          require 'contrast/agent/assess/policy/propagator/custom'
+          require 'contrast/agent/assess/policy/propagator/database_write'
+          require 'contrast/agent/assess/policy/propagator/insert'
+          require 'contrast/agent/assess/policy/propagator/keep'
+          require 'contrast/agent/assess/policy/propagator/match_data'
+          require 'contrast/agent/assess/policy/propagator/next'
+          require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/remove'
+          require 'contrast/agent/assess/policy/propagator/replace'
+          require 'contrast/agent/assess/policy/propagator/reverse'
+          require 'contrast/agent/assess/policy/propagator/select'
+          require 'contrast/agent/assess/policy/propagator/splat'
+          require 'contrast/agent/assess/policy/propagator/split'
+          require 'contrast/agent/assess/policy/propagator/substitution'
+          require 'contrast/agent/assess/policy/propagator/trim'
         end
       end
     end

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -16,6 +16,9 @@ module Contrast
               # copy tags from the param to the target in chunks of param size or less
               # if param is appended in space less than param length
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 sources = propagation_node.sources
                 source1 = find_source(sources[0], preshift)
                 # Some appends have two args. If they don't this is probably something
@@ -25,25 +28,25 @@ module Contrast
                 # if the object and the return are the same length just copy the tags
                 # from the object(since nothing from args was added to return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
                   # find original in the target, copy tags to the new position in
                   # target
                   original_start_index = target.index(source1)
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 
                   start = original_start_index + source1.length
                   while start < target.length
-                    target.cs__copy_from(source2, start, propagation_node.untags)
+                    properties.copy_from(source2, target, start, propagation_node.untags)
                     start += source2.length
                     next unless start > target.length
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
+                    properties.tags_at(start - source2.length).each do |tag|
                       tag.update_end(target.length)
                     end
                   end
                 end
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -22,7 +22,7 @@ module Contrast
               end
 
               def tracked_value? value
-                Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?) && value.cs__tracked?
+                Contrast::Agent::Assess::Tracker.tracked?(value)
               end
 
               def propagate _propagation_node, _preshift, _target

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -12,19 +12,22 @@ module Contrast
           class Center < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 sources = propagation_node.sources
                 source1 = find_source(sources[0], preshift)
 
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
-                  target.cs__properties.cleanup_tags
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
+                  properties.cleanup_tags
                   return
                 end
 
                 # find original in the target, copy tags to the new position in target
                 original_start_index = target[0..target.length / 2 + 1].rindex(source1)
                 original_start_index ||= 1
-                target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 
                 return unless sources[1]
 
@@ -54,12 +57,13 @@ module Contrast
               end
 
               def iterate_tags target, propagation_node, source, start, stop
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
                 while start < stop
-                  target.cs__copy_from(source, start, propagation_node.untags)
+                  properties.copy_from(source, target, start, propagation_node.untags)
                   start += source.length
                   next unless start > stop
 
-                  target.cs__properties.tags_at(start - source.length).each do |tag|
+                  properties.tags_at(start - source.length).each do |tag|
                     tag.update_end(stop)
                   end
                 end

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
+require 'contrast/extension/module'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -31,12 +31,15 @@ module Contrast
                     next unless value
                     next if known_tainted&.include?(key)
 
+                    properties = Contrast::Agent::Assess::Tracker.properties(value)
+                    next unless properties
+
                     # TODO: RUBY-540 handle sanitization, handle nested objects
                     Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                    value.cs__properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                    properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
                     next unless tracked_value?(value)
 
-                    tainted_columns[key] = value.cs__properties
+                    tainted_columns[key] = properties
                   end
                 end
 
@@ -45,7 +48,6 @@ module Contrast
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  class_type.send(:include, Contrast::Extension::Assess::AssessExtension) unless class_type < Contrast::Extension::Assess::AssessExtension
                   ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -16,7 +16,10 @@ module Contrast
               # Unlike additive propagation, this currently only supports one source
               # We assume that insert changes the preshift target
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
+                source = find_source(propagation_node.sources[1], preshift)
 
                 patcher_target = propagation_node.targets[0]
                 preshift_target = case patcher_target
@@ -38,10 +41,10 @@ module Contrast
                 overflow = insert_point...(insert_point + source.length)
 
                 # handle shifting the inserted range
-                target.cs__properties.shift_tags([overflow])
+                properties.shift_tags([overflow])
 
-                target.cs__copy_from(source, insert_point, propagation_node.untags)
-                target.cs__properties.cleanup_tags
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -14,8 +14,11 @@ module Contrast
               # Keep means the tags just pass from the source to the target
               # as is.
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -12,7 +12,8 @@ module Contrast
           class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def square_bracket_tagger propagation_node, preshift, ret, _block
-                if ret.is_a?(Array)
+                case ret
+                when Array
                   ret.each_with_index do |return_value, index|
                     next unless return_value
 
@@ -24,7 +25,7 @@ module Contrast
                                              end
                     square_bracket_single(target_matchdata_index, preshift, return_value, propagation_node)
                   end
-                elsif ret.is_a?(String)
+                when String
                   target_matchdata_index = preshift.args[0]
                   square_bracket_single(target_matchdata_index, preshift, ret, propagation_node)
                 end
@@ -66,18 +67,15 @@ module Contrast
               def square_bracket_single argument_index, preshift, return_value, propagation_node
                 original_start_index = preshift.object.begin(argument_index)
                 original_end_index = preshift.object.end(argument_index)
-                original_properties = preshift.object.cs__properties
+                original_properties = Contrast::Agent::Assess::Tracker.properties(preshift.object)
                 applicable_tags = original_properties.tags_at_range(original_start_index...original_end_index)
                 return if applicable_tags.empty?
 
+                return_properties = Contrast::Agent::Assess::Tracker.properties(return_value)
                 applicable_tags.each do |tag_name, tag_ranges|
-                  return_value.cs__properties.set_tags(tag_name, tag_ranges)
+                  return_properties.set_tags(tag_name, tag_ranges)
                 end
-                preshift.object.cs__properties.events.each do |event|
-                  return_value.cs__properties.add_event(event)
-                end
-                return_value.cs__properties.build_event(
-                    propagation_node, return_value, preshift.object, return_value, preshift.args)
+                return_properties.build_event(propagation_node, return_value, preshift.object, return_value, preshift.args)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -15,23 +15,25 @@ module Contrast
               # String has some silly methods like next. Basically, this flips a
               # character in a predictable manner
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 # this means the char that was shifted overflowed and created new
                 # chars (i.e 'z' "wraps" to create 'aa' )
                 unless target.length == source.length
-                  target.cs__copy_from(source, 0, propagation_node.untags)
+                  properties.copy_from(source, target, 0, propagation_node.untags)
 
                   first_difference = (0...source.length).find { |i| source[i] != target[i] } || source.length
 
-                  target.cs__properties.tags_at(first_difference).each do |tag|
+                  properties.tags_at(first_difference).each do |tag|
                     tag.shift_end(target.length - source.length)
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -14,9 +14,14 @@ module Contrast
               # For the source, prepend its tags to the target. It's basically the
               # opposite of append. :-P
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 sources = propagation_node.sources
+                # source1 is the copy of the thing being prepended to
                 source1 = find_source(sources[0], preshift)
 
+                # source2 is the copy of the thing being prepended
                 source2 = sources[1] ? find_source(sources[1], preshift) : source1
 
                 original_start_index = target.rindex(source1) || 0
@@ -24,22 +29,25 @@ module Contrast
                 # tags from the object(since nothing from args was added to
                 # return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
                   # find original in the target, copy tags to the new position in target
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
+                  # then we add the tags from the thing prepended to the start
+                  # of the target
                   start = 0
                   while start < original_start_index
-                    target.cs__copy_from(source2, start, propagation_node.untags)
+                    properties.copy_from(source2, target, start, propagation_node.untags)
                     start += source2.length
                     next unless start > original_start_index
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
+                    properties.tags_at(start - source2.length).each do |tag|
                       tag.update_end(original_start_index)
                     end
                   end
                 end
-                target.cs__properties.cleanup_tags
+                # and finally merge the tags if any overlap.
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -17,15 +17,19 @@ module Contrast
               # Once the tag is applied, remove the section that was removed by the delete.
               # Unlike additive propagation, this currently only supports one source
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
-
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
                 source_chars = source.is_a?(String) ? source.chars : source.string.chars
                 handle_removal(source_chars, target)
               end
 
               def handle_removal source_chars, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source_idx = 0
 
                 target_chars = target.chars
@@ -60,7 +64,7 @@ module Contrast
                 remove_ranges << (source_idx...source_chars.length) if source_idx != source_chars.length
 
                 # handle deleting the removed ranges
-                target.cs__properties.delete_tags_at_ranges(remove_ranges)
+                properties.delete_tags_at_ranges(remove_ranges)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -14,9 +14,12 @@ module Contrast
               # Replace means we're replacing the target w/ the source. Anything
               # on the source should be passed to the target.
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__properties.clear_tags
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.clear_tags
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -13,13 +13,15 @@ module Contrast
           class Reverse < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 length = target.length
-                target.cs__properties.tag_keys.each do |key|
-                  tags = target.cs__properties.fetch_tag(key)
+                properties.tag_keys.each do |key|
+                  tags = properties.fetch_tag(key)
                   tags.each do |tag|
                     new_end = length - tag.start_idx
                     new_start = new_end - tag.length
@@ -27,7 +29,7 @@ module Contrast
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -14,6 +14,9 @@ module Contrast
           class Select
             class << self
               def select_tagger patcher, preshift, ret, _block
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
+
                 source = preshift.object
                 args = preshift.args
 
@@ -21,12 +24,15 @@ module Contrast
                 # Additionally, an empty string is returned when the starting index for
                 # a character range is at the end of the string. Let's just skip that
                 # and only track a string that has length
-                return unless source.cs__tracked? && ret && !ret.empty?
+                unless ret &&
+                      !ret.empty? &&
+                      Contrast::Agent::Assess::Tracker.tracked?(source)
 
-                source.cs__properties.events.each do |event|
-                  ret.cs__properties.events << event
+                  return
                 end
-                ret.cs__properties.build_event(
+
+                source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                properties.build_event(
                     patcher,
                     ret,
                     source,
@@ -36,10 +42,10 @@ module Contrast
                 range = determine_select_range(source, args)
                 return unless range
 
-                tags = source.cs__properties.tags_at_range(range)
-                ret.cs__properties.clear_tags
+                tags = source_properties.tags_at_range(range)
+                properties.clear_tags
                 tags.each_pair do |key, value|
-                  ret.cs__properties.set_tags(key, value)
+                  properties.set_tags(key, value)
                 end
                 ret
               end