contrast-agent 3.14.0 → 4.2.0

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,7 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/assess/tracker'
 require 'contrast/components/interface'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Utils
@@ -23,6 +25,16 @@ module Contrast
             _tracked?(obj, 0)
           end
 
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def trackable? obj
+            _trackable?(obj, 0)
+          end
+
           private
 
           # Sometimes things are nested inside of each other, such as an Array
@@ -49,10 +61,8 @@ module Contrast
               obj.any? do |ele|
                 _tracked?(ele, idx) unless obj == ele
               end
-            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-              obj.cs__tracked?
             else
-              false
+              Contrast::Agent::Assess::Tracker.tracked?(obj)
             end
           rescue StandardError => e
             # This is used to ask if a ton of objects are tracked. They may not
@@ -61,6 +71,41 @@ module Contrast
             logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if trackable
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   trackable.
+          def _trackable? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _trackable?(k, idx)
+                return true if _trackable?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _trackable?(ele, idx) unless obj == ele
+              end
+            else
+              Contrast::Agent::Assess::Tracker.trackable?(obj)
+            end
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine trackable', e, module: obj.cs__class)
+            false
+          end
         end
       end
     end

data/lib/contrast/utils/duck_utils.rb

@@ -62,16 +62,6 @@ module Contrast
           # otherwise, don't risk it
           false
         end
-
-        # This method will return true if the object being checked has been patched
-        # to have the cs__properties field. We check the cs__tracked? method since it
-        # is side effect free (ie doesn't cause the properties object to be created).
-        def trackable? object
-          return true if object.cs__respond_to?(:cs__tracked?)
-          return false unless object.is_a?(Delegator)
-
-          object.cs__delegator_respond_to?(:cs__tracked?)
-        end
       end
     end
   end

data/lib/contrast/utils/env_configuration_item.rb

@@ -10,10 +10,11 @@ module Contrast
       END_UNDERSCORE   = /(_+)$/.cs__freeze
       REPEATING_UNDERSCORE = /_{3,}/.cs__freeze
 
-      attr_reader :value, :dot_path_array
+      attr_reader :value, :dot_path_array, :key
 
       def initialize key, value
         key = EnvConfigurationItem.resolve_corrected_path(key)
+        @key = key
         @dot_path_array = key.downcase.split(Contrast::Utils::ObjectShare::DOUBLE_UNDERSCORE)
         @value = value
 

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/assess/policy/trigger_method'
 require 'contrast/components/interface'
 
 module Contrast
@@ -9,7 +10,7 @@ module Contrast
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
       include Contrast::Components::Interface
-      access_component :analysis, :app_context, :logging
+      access_component :analysis, :app_context, :logging, :scope
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -23,28 +24,26 @@ module Contrast
       # @param call_location [Thread::Backtrace::Location] the location where
       #   the bad configuration was set
       def cs__report_finding rule_id, user_provided_options, call_location
-        finding = Contrast::Api::Dtm::Finding.new
-        finding.rule_id = rule_id
-        path = call_location.path
-        # just get the file name, not the full path
-        path = path.split(Contrast::Utils::ObjectShare::SLASH).last
-        session_id = user_provided_options[:key].to_s if user_provided_options
+        with_contrast_scope do
+          finding = Contrast::Api::Dtm::Finding.new
+          finding.rule_id = rule_id
+          path = call_location.path
+          # just get the file name, not the full path
+          path = path.split(Contrast::Utils::ObjectShare::SLASH).last
+          session_id = user_provided_options[:key].to_s if user_provided_options
 
-        finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
-        finding.properties[CS__SESSION_ID] = Contrast::Utils::StringUtils.force_utf8(session_id)
-        finding.properties[CS__PATH] = Contrast::Utils::StringUtils.force_utf8(path)
-        file_path = call_location.absolute_path
-        snippet = file_snippet(file_path, call_location)
-        finding.properties[CS__SNIPPET] = Contrast::Utils::StringUtils.force_utf8(snippet)
+          finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
+          finding.properties[CS__SESSION_ID] = Contrast::Utils::StringUtils.force_utf8(session_id)
+          finding.properties[CS__PATH] = Contrast::Utils::StringUtils.force_utf8(path)
+          file_path = call_location.absolute_path
+          snippet = file_snippet(file_path, call_location)
+          finding.properties[CS__SNIPPET] = Contrast::Utils::StringUtils.force_utf8(snippet)
 
-        hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
-        finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
-        finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-
-        activity = Contrast::Api::Dtm::Activity.new
-        activity.findings << finding
-
-        Contrast::Agent.messaging_queue.send_event_eventually(activity)
+          hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
+          finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
+          finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
+        end
       rescue StandardError => e
         logger.error('Unable to build a finding', e, rule: rule_id)
       end

data/lib/contrast/utils/inventory_util.rb

@@ -3,7 +3,6 @@
 
 require 'contrast/utils/timer'
 require 'contrast/utils/object_share'
-require 'contrast/utils/gemfile_reader'
 require 'contrast/components/interface'
 
 module Contrast
@@ -25,12 +24,6 @@ module Contrast
       DEFAULT = 'default'
       LOCALHOST = 'localhost'
 
-      def self.inventory_class class_path
-        Contrast::Utils::GemfileReader.instance.map_class(class_path)
-      rescue StandardError => e
-        logger.error('Unable to inventory module', e, path: class_path)
-      end
-
       def self.active_record_config
         return @_active_record_config if instance_variable_defined?(:@_active_record_config)
 

data/lib/contrast/utils/sha256_builder.rb

@@ -52,18 +52,6 @@ module Contrast
         parent_dir = File.dirname(gems_dir)
         File.join(parent_dir, Contrast::Utils::ObjectShare::CACHE)
       end
-
-      def self.files path
-        instance.files(path)
-      end
-
-      def self.sha256 path
-        instance.sha256(path)
-      end
-
-      def self.build_from_spec spec
-        instance.build_from_spec(spec)
-      end
     end
   end
 end

data/lib/contrast/utils/string_utils.rb

@@ -11,7 +11,7 @@ module Contrast
       access_component :logging
 
       UTF8 = 'utf-8'
-      HTTP_PREFIX = 'HTTP-'
+      HTTP_PREFIX = 'HTTP_'
 
       # Convenience method. We assume that we're working on Strings or tags
       # String representations of things. To that end, we'll to_s anything
@@ -69,6 +69,10 @@ module Contrast
       # Given a string return a normalized version of that string.
       # Keys are memoized so that the normalization process doesn't need
       # to happen every time.
+      #
+      # @param str [String] the String to normalize
+      # @return [String] a copy of the given String, upper cased, trimmed,
+      #   dashes replaced with underscore, and HTTP trimmed
       def self.normalized_key str
         return nil unless str
 
@@ -77,10 +81,11 @@ module Contrast
         if @_normalized_keys.key?(str)
           @_normalized_keys[str]
         else
-          up = str.upcase.strip
-          up = up.gsub(/[_-]/, '-')
-          up = up[5..-1] if up.start_with?(HTTP_PREFIX)
-          @_normalized_keys[str] = up
+          upped = str.upcase
+          stripped = upped.strip! || upped
+          trimmed = stripped.tr!('-', '_') || stripped
+          cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..-1] : trimmed
+          @_normalized_keys[str] = cut
         end
       end
     end

data/resources/assess/policy.json

@@ -1,14 +1,4 @@
 {
-  "tracked_classes": [
-    "ActionDispatch::Http::UploadedFile",
-    "Fiber",
-    "Symbol",
-    "Pathname",
-    "File",
-    "MatchData",
-    "URI::Generic",
-    "Rack::File::Iterator"
-  ],
   "sources":[
     {
       "class_name":"Rack::Request",
@@ -285,7 +275,7 @@
       "instance_method": true,
       "method_visibility": "public",
       "method_name":"insert",
-      "source":"P1",
+      "source":"O,P1",
       "target":"O",
       "action":"INSERT"
     }, {
@@ -624,7 +614,6 @@
       "action":"CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
       "patch_method": "captures_tagger"
-
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -650,7 +639,9 @@
       "method_name": "gsub",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
-      "patch_method": "gsub_tagger"
+      "patch_method": "gsub_tagger",
+      "source": "O,P",
+      "target": "R"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -658,7 +649,9 @@
       "method_name": "gsub!",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
-      "patch_method": "gsub_tagger"
+      "patch_method": "gsub_tagger",
+      "source": "O,P",
+      "target": "O"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -666,7 +659,9 @@
       "method_name": "sub",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
-      "patch_method": "sub_tagger"
+      "patch_method": "sub_tagger",
+      "source": "O,P",
+      "target": "R"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -674,7 +669,9 @@
       "method_name": "sub!",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
-      "patch_method": "sub_tagger"
+      "patch_method": "sub_tagger",
+      "source": "O,P",
+      "target": "O"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -682,7 +679,9 @@
       "method_name": "tr",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
-      "patch_method": "tr_tagger"
+      "patch_method": "tr_tagger",
+      "source": "O,P",
+      "target": "R"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -690,7 +689,9 @@
       "method_name": "tr!",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
-      "patch_method": "tr_tagger"
+      "patch_method": "tr_tagger",
+      "source": "O,P",
+      "target": "O"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -698,7 +699,9 @@
       "method_name": "tr_s",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
-      "patch_method": "tr_s_tagger"
+      "patch_method": "tr_s_tagger",
+      "source": "O,P",
+      "target": "R"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -706,7 +709,9 @@
       "method_name": "tr_s!",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
-      "patch_method": "tr_s_tagger"
+      "patch_method": "tr_s_tagger",
+      "source": "O,P",
+      "target": "O"
     }, {
       "class_name": "String",
       "instance_method": true,
@@ -714,7 +719,9 @@
       "method_name": "[]",
       "action": "CUSTOM",
       "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Select",
-      "patch_method": "select_tagger"
+      "patch_method": "select_tagger",
+      "source": "O",
+      "target": "R"
     }, {
       "class_name":"CGI::Util",
       "method_name":"escapeHTML",
@@ -976,7 +983,9 @@
       "method_name": "sprintf",
       "action": "CUSTOM",
       "patch_class": "Contrast::Extension::Assess::KernelPropagator",
-      "patch_method": "sprintf_tagger"
+      "patch_method": "sprintf_tagger",
+      "source": "O,P",
+      "target": "R"
     }, {
       "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
       "instance_method": true,

data/ruby-agent.gemspec

@@ -2,20 +2,6 @@
 # frozen_string_literal: true
 
 require_relative './lib/contrast/agent/version'
-require 'bundler'
-# https://github.com/grpc/grpc/issues/21514#issuecomment-581417788
-module BundlerHack
-  def __materialize__
-    if name == 'google-protobuf'
-      Bundler.settings.temporary(force_ruby_platform: true) do
-        super
-      end
-    else
-      super
-    end
-  end
-end
-Bundler::LazySpecification.prepend(BundlerHack)
 
 lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
@@ -28,6 +14,7 @@ def self.add_authors spec
     donald.propst@contrastsecurity.com
     alex.macdonald@contrastsecurity.com
     mark.petersen@contrastsecurity.com
+    joshua.reed@contrastsecurity.com
   ]
 end
 
@@ -36,11 +23,13 @@ def self.add_dev_dependencies spec
   spec.add_development_dependency 'amazing_print'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'climate_control' # mock ENV
+  spec.add_development_dependency 'debase'
   spec.add_development_dependency 'debride'
   spec.add_development_dependency 'execjs'
   spec.add_development_dependency 'factory_bot'
   spec.add_development_dependency 'fake_ftp'
   spec.add_development_dependency 'fasterer'
+  spec.add_development_dependency 'flay'
   spec.add_development_dependency 'openssl'
   spec.add_development_dependency 'parser', '~> 2.6'
   spec.add_development_dependency 'pry'
@@ -50,9 +39,10 @@ def self.add_dev_dependencies spec
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rspec-benchmark'
   spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
-  spec.add_development_dependency 'rubocop', '0.89.1'
-  spec.add_development_dependency 'rubocop-performance', '1.7.1'
-  spec.add_development_dependency 'rubocop-rspec', '1.42.0'
+  spec.add_development_dependency 'rubocop', '0.93.1'
+  spec.add_development_dependency 'rubocop-performance', '1.8.1'
+  spec.add_development_dependency 'rubocop-rspec', '1.43.2'
+  spec.add_development_dependency 'ruby-debug-ide'
   spec.add_development_dependency 'simplecov', '~> 0.18'
   spec.add_development_dependency 'sinatra', '>= 2'
   spec.add_development_dependency 'sqlite3', '1.3.9'
@@ -71,7 +61,7 @@ def self.add_dependencies spec
   spec.add_dependency 'ougai', '~> 1.8'
   spec.add_dependency 'parser', '~> 2.6'
   spec.add_dependency 'protobuf', '~> 3.10'
-  spec.add_dependency 'rack', '>= 2.0', '< 3.0'
+  spec.add_dependency 'rack', '~> 2.0'
 end
 
 # Enumerate the files required to build the Agent.
@@ -95,6 +85,19 @@ def self.add_files spec
   spec.files += Dir['service_executables/**/*']
   spec.files += Dir['funchook/**/*']
   spec.files += Dir['shared_libraries/**/*']
+
+  # Clean up compiled funchook files that may have been generated during
+  # testing. Only a concern locally, but better than leaving it to chance.
+  spec.files.delete_if do |file|
+    file.end_with?('ext/libfunchook.dylib',
+                   'ext/libfunchook.so',
+                   'ext/funchook.h',
+                   'shared_libraries/libfunchook.dylib',
+                   'shared_libraries/libfunchook.so',
+                   'shared_libraries/funchook.h',
+                   'funchook/src/libfunchook.dylib',
+                   'funchook/src/libfunchook.so')
+  end
 end
 
 def self.add_metadata spec