contrast-agent 3.14.0 → 4.2.0

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to collect dependencies of the application for reporting
+      class DependencyAnalysis
+        include Singleton
+        include Contrast::Agent::Inventory::Dependencies
+        include Contrast::Components::Interface
+
+        access_component :analysis
+
+        # Report the dependencies of this application
+        #
+        # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
+        #   Gem::Specification that have been loaded for this application.
+        def library_pb_list
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.enabled?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.analyze_libraries?
+
+          loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
+            next unless spec
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            reported_lib_list << Contrast::Api::Dtm::Library.build(digest, spec)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,104 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Interface
+        include Contrast::Agent::Inventory::Dependencies
+
+        access_component :analysis, :config, :logging
+
+        def initialize
+          return unless enabled?
+
+          @gemdigest_cache = Contrast::Agent::Inventory::GemfileDigestCache.new
+        end
+
+        # This method is invoked once, along with the rest of our catchup code
+        # to report libraries and their associated files that have already been loaded pre-contrast
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            @gemdigest_cache.use_cache(digest) do |existing_files|
+              loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+              loaded_files_from_gem.each do |file_path|
+                logger.trace('Recording loaded file for inventory analysis', line: file_path)
+                existing_files << adjust_path_for_reporting(file_path, spec)
+              end
+            end
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific
+        # file being required to the gem it belongs to
+        #
+        # @param path [String] the result of TracePoint#path from the :end
+        #   event in which the Module was defined
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @gemdigest_cache.get(digest) << report_path
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages filed of the Activity message using the
+        # data stored in the @gemdigest_cache
+        #
+        # @param activity [Contrast::Api::Dtm::Activity] the message to which
+        #   to append the usage data
+        def generate_library_usage activity
+          return unless enabled?
+          return if @gemdigest_cache.empty?
+
+          @gemdigest_cache.generate_usage_data(activity)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..-1] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/gemfile_digest_cache.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # Keeps a map of gem digest to files for reporting file usage
+      class GemfileDigestCache
+        extend Forwardable
+        def_delegator :@gem_spec_digest_to_files,
+                      :empty?
+
+        def initialize
+          @gem_spec_digest_to_files = {}
+        end
+
+        def generate_usage_data activity
+          return unless activity
+
+          @gem_spec_digest_to_files.each_pair do |digest, files|
+            usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
+            activity.library_usages[usage.hash_code] = usage if activity
+          end
+          @gem_spec_digest_to_files.clear
+        end
+
+        def use_cache digest
+          yield get(digest)
+        end
+
+        def get digest
+          @gem_spec_digest_to_files[digest] = Set.new unless @gem_spec_digest_to_files.key?(digest)
+          @gem_spec_digest_to_files[digest]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/middleware.rb

@@ -13,7 +13,6 @@ require 'contrast/agent/request_handler'
 require 'contrast/agent/static_analysis'
 
 require 'contrast/utils/timer'
-require 'contrast/utils/freeze_util'
 
 module Contrast
   module Agent
@@ -95,8 +94,7 @@ module Contrast
         if CONFIG.invalid?
           AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif CONFIG.disabled?
-          AGENT.disable!
+        elsif AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
           AGENT.enable!

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -15,7 +15,7 @@ module Contrast
           access_component :scope
           attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
@@ -71,10 +71,10 @@ module Contrast
 
           def module_lookup
             @_module_lookup ||= begin
-                                  Module.cs__const_get module_name
-                                rescue StandardError => _e
-                                  nil
-                                end
+              Module.cs__const_get module_name
+            rescue StandardError => _e
+              nil
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -30,20 +30,20 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-                                    Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
-                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
+              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+              Contrast::Extension::Assess::StringPropagator.instrument_string
+              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
 
-                                    Contrast::Extension::Protect::Kernel.instrument
-                                    true
-                                  end
+              Contrast::Extension::Protect::Kernel.instrument
+              true
+            end
           end
 
           def apply_load_patches!
@@ -65,13 +65,13 @@ module Contrast
           # handling
           def apply_require_patches!
             @_apply_require_patches ||= begin
-                                          require 'contrast/extension/thread'
-                                          require 'contrast/extension/kernel'
-                                          true
-                                        rescue LoadError, StandardError => e
-                                          logger.error('failed instrumenting apply_require_patches!', e)
-                                          false
-                                        end
+              require 'contrast/extension/thread'
+              require 'contrast/extension/kernel'
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
+            end
           end
 
           def after_load_patches

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -61,16 +61,16 @@ module Contrast
           # @return [Integer] count of methods to be patched
           def num_expected_patches
             @_num_expected_patches ||= begin
-                                         instance_methods = Set.new
-                                         singleton_methods = Set.new
-                                         sort_method_names(source_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(propagator_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(trigger_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(inventory_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(protect_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
-                                         instance_methods.length + singleton_methods.length
-                                       end
+              instance_methods = Set.new
+              singleton_methods = Set.new
+              sort_method_names(source_nodes, instance_methods, singleton_methods)
+              sort_method_names(propagator_nodes, instance_methods, singleton_methods)
+              sort_method_names(trigger_nodes, instance_methods, singleton_methods)
+              sort_method_names(inventory_nodes, instance_methods, singleton_methods)
+              sort_method_names(protect_nodes, instance_methods, singleton_methods)
+              sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
+              instance_methods.length + singleton_methods.length
+            end
           end
 
           private

data/lib/contrast/agent/patching/policy/patch.rb

@@ -365,12 +365,18 @@ module Contrast
                 unless target_module.instance_methods(false).include? underlying_method_name
                   # alias_method may be private
                   target_module.send(:alias_method, underlying_method_name, method_name)
+                  # TODO: RUBY-1052
+                  # rubocop:disable Kernel/DefineMethod
                   target_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                  # rubocop:enable Kernel/DefineMethod
                 end
                 target_module.send(visibility, method_name) # e.g., module.private(:my_method)
               when :prepend
                 prepending_module = Module.new
+                # TODO: RUBY-1052
+                # rubocop:disable Kernel/DefineMethod
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                # rubocop:enable Kernel/DefineMethod
                 prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -77,19 +77,21 @@ module Contrast
             # This method is called by TracePointHook to instrument a specific class during a require
             # or eval of dynamic class definition
             def patch_specific_module mod
-              mod_name = mod.cs__name
-              return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
-              return if AGENT.skip_instrumentation?(mod_name)
+              with_contrast_scope do
+                mod_name = mod.cs__name
+                return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
+                return if AGENT.skip_instrumentation?(mod_name)
 
-              load_patches_for_module(mod_name)
+                load_patches_for_module(mod_name)
 
-              return unless all_module_names.any? { |name| name == mod_name }
+                return unless all_module_names.any? { |name| name == mod_name }
 
-              module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
-              patch_into_module(module_data)
-              all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
-            rescue StandardError => e
-              logger.error('Unable to patch module', e, module: mod_name)
+                module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
+                patch_into_module(module_data)
+                all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
+              rescue StandardError => e
+                logger.error('Unable to patch module', e, module: mod_name)
+              end
             end
 
             # We did it, team. We found a patcher(s) that applies to the given
@@ -186,7 +188,7 @@ module Contrast
               clazz = module_data.mod
 
               status.patching!
-              patched = include_module(module_data)
+              patched = false
 
               counts = 0
               # Monkey patch any methods in this class that have matching nodes in the policy
@@ -219,17 +221,6 @@ module Contrast
                                module_data.mod).patch_status)
             end
 
-            # Includes the given module with the
-            # Contrast::Extension::Assess::AssessExtension
-            # @param module_data [Contrast::Agent::ModuleData] the module, and
-            #   its name, that's being patched into
-            def include_module module_data
-              return false unless Contrast::Agent::Assess::Policy::Policy.instance.tracked_classes.include?(module_data.name)
-
-              module_data.mod.send(:include, Contrast::Extension::Assess::AssessExtension)
-              true
-            end
-
             # Get all of the instance methods on the given module, excluding
             # those from super classes. this list will always include the
             # initialize method

data/lib/contrast/agent/patching/policy/policy.rb

@@ -37,13 +37,12 @@ module Contrast
 
           access_component :analysis, :logging
 
-          attr_reader :sources, :propagators, :triggers, :providers, :tracked_classes
+          attr_reader :sources, :propagators, :triggers, :providers
 
           SOURCES_KEY =          'sources'
           PROPAGATION_KEY =      'propagators'
           RULES_KEY = 'rules'
           TRIGGERS_KEY = 'triggers'
-          TRACKED_CLASSES_KEY = 'tracked_classes'
 
           def self.policy_json
             File.join(policy_folder, 'policy.json').cs__freeze
@@ -54,7 +53,6 @@ module Contrast
             @propagators = []
             @triggers = []
             @providers = {}
-            @tracked_classes = []
 
             json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
             from_hash_string(json)
@@ -114,7 +112,6 @@ module Contrast
           def module_names
             @_module_names ||= begin
               m = Set.new
-              tracked_classes.each { |tracked| m << tracked }
               sources.each { |source| m << source.class_name }
               propagators.each { |propagator| m << propagator.class_name }
               triggers.each { |trigger| m << trigger.class_name }
@@ -127,12 +124,26 @@ module Contrast
           end
 
           def find_source_node class_name, method_name, instance_method
-            sources.find { |source| source.class_name == class_name && source.method_name == method_name && source.instance_method == instance_method }
+            sources.find do |source|
+              source.class_name == class_name &&
+                  source.method_name == method_name &&
+                  source.instance_method == instance_method
+            end
+          end
+
+          def find_propagator_node class_name, method_name, instance_method
+            propagators.find do |propagator|
+              propagator.class_name == class_name &&
+                  propagator.method_name == method_name &&
+                  propagator.instance_method == instance_method
+            end
           end
 
           def find_node rule_id, class_name, method_name, instance_method
             find_triggers_by_rule(rule_id).find do |node|
-              node.class_name == class_name && node.method_name == method_name && node.instance_method == instance_method
+              node.class_name == class_name &&
+                  node.method_name == method_name &&
+                  node.instance_method == instance_method
             end
           end
         end

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -30,11 +30,9 @@ module Contrast
               Contrast::Agent::Protect::Policy::AppliesDeserializationRule.apply_deserialization_command_check(command)
               return if skip_analysis?
 
-              begin
-                clazz = object.is_a?(Module) ? object : object.cs__class
-                class_name = clazz.cs__name
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
-              end
+              clazz = object.is_a?(Module) ? object : object.cs__class
+              class_name = clazz.cs__name
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
             end
 
             protected