contrast-agent 3.14.0 → 4.2.0

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -22,7 +22,7 @@ module Contrast
               end
 
               def tracked_value? value
-                Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?) && value.cs__tracked?
+                Contrast::Agent::Assess::Tracker.tracked?(value)
               end
 
               def propagate _propagation_node, _preshift, _target

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -12,19 +12,22 @@ module Contrast
           class Center < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 sources = propagation_node.sources
                 source1 = find_source(sources[0], preshift)
 
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
-                  target.cs__properties.cleanup_tags
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
+                  properties.cleanup_tags
                   return
                 end
 
                 # find original in the target, copy tags to the new position in target
                 original_start_index = target[0..target.length / 2 + 1].rindex(source1)
                 original_start_index ||= 1
-                target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 
                 return unless sources[1]
 
@@ -54,12 +57,13 @@ module Contrast
               end
 
               def iterate_tags target, propagation_node, source, start, stop
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
                 while start < stop
-                  target.cs__copy_from(source, start, propagation_node.untags)
+                  properties.copy_from(source, target, start, propagation_node.untags)
                   start += source.length
                   next unless start > stop
 
-                  target.cs__properties.tags_at(start - source.length).each do |tag|
+                  properties.tags_at(start - source.length).each do |tag|
                     tag.update_end(stop)
                   end
                 end

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -31,12 +31,15 @@ module Contrast
                     next unless value
                     next if known_tainted&.include?(key)
 
+                    properties = Contrast::Agent::Assess::Tracker.properties(value)
+                    next unless properties
+
                     # TODO: RUBY-540 handle sanitization, handle nested objects
                     Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                    value.cs__properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                    properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
                     next unless tracked_value?(value)
 
-                    tainted_columns[key] = value.cs__properties
+                    tainted_columns[key] = properties
                   end
                 end
 
@@ -45,7 +48,6 @@ module Contrast
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  class_type.send(:include, Contrast::Extension::Assess::AssessExtension) unless class_type < Contrast::Extension::Assess::AssessExtension
                   ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -16,7 +16,10 @@ module Contrast
               # Unlike additive propagation, this currently only supports one source
               # We assume that insert changes the preshift target
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
+                source = find_source(propagation_node.sources[1], preshift)
 
                 patcher_target = propagation_node.targets[0]
                 preshift_target = case patcher_target
@@ -38,10 +41,10 @@ module Contrast
                 overflow = insert_point...(insert_point + source.length)
 
                 # handle shifting the inserted range
-                target.cs__properties.shift_tags([overflow])
+                properties.shift_tags([overflow])
 
-                target.cs__copy_from(source, insert_point, propagation_node.untags)
-                target.cs__properties.cleanup_tags
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -14,8 +14,11 @@ module Contrast
               # Keep means the tags just pass from the source to the target
               # as is.
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -67,18 +67,15 @@ module Contrast
               def square_bracket_single argument_index, preshift, return_value, propagation_node
                 original_start_index = preshift.object.begin(argument_index)
                 original_end_index = preshift.object.end(argument_index)
-                original_properties = preshift.object.cs__properties
+                original_properties = Contrast::Agent::Assess::Tracker.properties(preshift.object)
                 applicable_tags = original_properties.tags_at_range(original_start_index...original_end_index)
                 return if applicable_tags.empty?
 
+                return_properties = Contrast::Agent::Assess::Tracker.properties(return_value)
                 applicable_tags.each do |tag_name, tag_ranges|
-                  return_value.cs__properties.set_tags(tag_name, tag_ranges)
+                  return_properties.set_tags(tag_name, tag_ranges)
                 end
-                preshift.object.cs__properties.events.each do |event|
-                  return_value.cs__properties.add_event(event)
-                end
-                return_value.cs__properties.build_event(
-                    propagation_node, return_value, preshift.object, return_value, preshift.args)
+                return_properties.build_event(propagation_node, return_value, preshift.object, return_value, preshift.args)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -15,23 +15,25 @@ module Contrast
               # String has some silly methods like next. Basically, this flips a
               # character in a predictable manner
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 # this means the char that was shifted overflowed and created new
                 # chars (i.e 'z' "wraps" to create 'aa' )
                 unless target.length == source.length
-                  target.cs__copy_from(source, 0, propagation_node.untags)
+                  properties.copy_from(source, target, 0, propagation_node.untags)
 
                   first_difference = (0...source.length).find { |i| source[i] != target[i] } || source.length
 
-                  target.cs__properties.tags_at(first_difference).each do |tag|
+                  properties.tags_at(first_difference).each do |tag|
                     tag.shift_end(target.length - source.length)
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -14,6 +14,9 @@ module Contrast
               # For the source, prepend its tags to the target. It's basically the
               # opposite of append. :-P
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 sources = propagation_node.sources
                 # source1 is the copy of the thing being prepended to
                 source1 = find_source(sources[0], preshift)
@@ -26,25 +29,25 @@ module Contrast
                 # tags from the object(since nothing from args was added to
                 # return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
                   # find original in the target, copy tags to the new position in target
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
                   # then we add the tags from the thing prepended to the start
                   # of the target
                   start = 0
                   while start < original_start_index
-                    target.cs__copy_from(source2, start, propagation_node.untags)
+                    properties.copy_from(source2, target, start, propagation_node.untags)
                     start += source2.length
                     next unless start > original_start_index
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
+                    properties.tags_at(start - source2.length).each do |tag|
                       tag.update_end(original_start_index)
                     end
                   end
                 end
                 # and finally merge the tags if any overlap.
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -17,15 +17,19 @@ module Contrast
               # Once the tag is applied, remove the section that was removed by the delete.
               # Unlike additive propagation, this currently only supports one source
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
-
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
                 source_chars = source.is_a?(String) ? source.chars : source.string.chars
                 handle_removal(source_chars, target)
               end
 
               def handle_removal source_chars, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source_idx = 0
 
                 target_chars = target.chars
@@ -60,7 +64,7 @@ module Contrast
                 remove_ranges << (source_idx...source_chars.length) if source_idx != source_chars.length
 
                 # handle deleting the removed ranges
-                target.cs__properties.delete_tags_at_ranges(remove_ranges)
+                properties.delete_tags_at_ranges(remove_ranges)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -14,9 +14,12 @@ module Contrast
               # Replace means we're replacing the target w/ the source. Anything
               # on the source should be passed to the target.
               def propagate propagation_node, preshift, target
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__properties.clear_tags
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.clear_tags
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -13,13 +13,15 @@ module Contrast
           class Reverse < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 length = target.length
-                target.cs__properties.tag_keys.each do |key|
-                  tags = target.cs__properties.fetch_tag(key)
+                properties.tag_keys.each do |key|
+                  tags = properties.fetch_tag(key)
                   tags.each do |tag|
                     new_end = length - tag.start_idx
                     new_start = new_end - tag.length
@@ -27,7 +29,7 @@ module Contrast
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -14,6 +14,9 @@ module Contrast
           class Select
             class << self
               def select_tagger patcher, preshift, ret, _block
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
+
                 source = preshift.object
                 args = preshift.args
 
@@ -21,12 +24,15 @@ module Contrast
                 # Additionally, an empty string is returned when the starting index for
                 # a character range is at the end of the string. Let's just skip that
                 # and only track a string that has length
-                return unless source.cs__tracked? && ret && !ret.empty?
+                unless ret &&
+                      !ret.empty? &&
+                      Contrast::Agent::Assess::Tracker.tracked?(source)
 
-                source.cs__properties.events.each do |event|
-                  ret.cs__properties.events << event
+                  return
                 end
-                ret.cs__properties.build_event(
+
+                source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                properties.build_event(
                     patcher,
                     ret,
                     source,
@@ -36,10 +42,10 @@ module Contrast
                 range = determine_select_range(source, args)
                 return unless range
 
-                tags = source.cs__properties.tags_at_range(range)
-                ret.cs__properties.clear_tags
+                tags = source_properties.tags_at_range(range)
+                properties.clear_tags
                 tags.each_pair do |key, value|
-                  ret.cs__properties.set_tags(key, value)
+                  properties.set_tags(key, value)
                 end
                 ret
               end

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -17,11 +17,11 @@ module Contrast
                 propagation_node.sources.each do |source|
                   case source
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
-                    tracked_inputs << preshift.object if preshift.object.cs__tracked?
+                    tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
                     arg = preshift.args[source]
                     if arg.is_a?(String)
-                      tracked_inputs << arg if arg.cs__tracked?
+                      tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
                     elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
                       arg.each_pair do |key, value|
                         tracked_inputs << key if tracked_value?(key)
@@ -36,19 +36,20 @@ module Contrast
                 end
 
                 splat_tags(tracked_inputs, target)
-                target.cs__properties.cleanup_tags
+                Contrast::Agent::Assess::Tracker.properties(target).cleanup_tags
               end
 
               def splat_tags tracked_inputs, target
                 return if tracked_inputs.empty?
 
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 tracked_inputs.each do |input|
-                  unless input == target
-                    input.cs__properties.events.each do |event|
-                      target.cs__properties.events << event
-                    end
-                  end
-                  input.cs__splat_tags(target)
+                  input_properties = Contrast::Agent::Assess::Tracker.properties(input)
+                  next unless input_properties
+
+                  properties.splat_from(input, target)
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -36,6 +36,8 @@ module Contrast
                              target_id: target.__id__)
                 unless target.is_a?(Array)
                   Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target)
+                  properties = Contrast::Agent::Assess::Tracker.properties(target)
+                  properties.build_event(propagation_node, target, object, ret, args)
                   return
                 end
 
@@ -53,17 +55,17 @@ module Contrast
                 target.each do |elem|
                   elem_length = elem.length
                   range = current_index...(current_index + elem_length)
-                  tags = source.cs__properties.tags_at_range(range)
+                  elem_properties = Contrast::Agent::Assess::Tracker.properties(elem)
+                  next unless elem_properties
 
-                  elem.cs__properties.clear_tags
+                  source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                  tags = source_properties.tags_at_range(range)
+                  elem_properties.clear_tags
                   tags.each_pair do |key, value|
-                    elem.cs__properties.set_tags(key, value)
+                    elem_properties.set_tags(key, value)
                   end
-                  source.cs__properties.events.each do |event|
-                    elem.cs__properties.add_event(event)
-                  end
-                  elem.cs__properties.build_event(propagation_node, elem, preshift.object, target, preshift.args, 0)
-                  elem.cs__properties.add_properties(propagation_node.properties)
+                  elem_properties.build_event(propagation_node, elem, preshift.object, target, preshift.args, 0)
+                  elem_properties.add_properties(propagation_node.properties)
                   current_index = current_index + elem_length + separator_length
                 end
                 nil
@@ -125,8 +127,11 @@ module Contrast
                 index = SPLIT_TRACKER.get(:split_index)&.fetch(depth)
                 return unless index
 
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 true_source = source[index]
-                target.cs__copy_from(true_source)
+                properties.copy_from(true_source, target)
               rescue StandardError => e
                 logger.warn('Unable to track within split context', e)
               ensure
@@ -139,12 +144,12 @@ module Contrast
               def instrument_string_split
                 if @_instrument_string_split.nil?
                   @_instrument_string_split = begin
-                                                require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
-                                                true
-                                              rescue StandardError => e
-                                                logger.error('Error loading split rb_yield patch', e)
-                                                false
-                                              end
+                    require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
+                    true
+                  rescue StandardError => e
+                    logger.error('Error loading split rb_yield patch', e)
+                    false
+                  end
                 end
                 @_instrument_string_split
               end
@@ -191,10 +196,10 @@ module Contrast
               #   String#split node
               def split_node
                 @_split_node ||= begin
-                                   Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                                     node.class_name == 'String' && node.method_name == :split && node.instance_method?
-                                   end
-                                 end
+                  Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+                    node.class_name == 'String' && node.method_name == :split && node.instance_method?
+                  end
+                end
               end
             end
           end