contrast-agent 3.15.0 → 3.16.0

data/lib/contrast/extension/assess/erb.rb

@@ -14,6 +14,7 @@ module ERBPropagator
       binding_variable_set = used_binding.local_variables
 
       erb_pre_result = preshift.object.src
+      parent_events = []
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
         next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
@@ -23,6 +24,8 @@ module ERBPropagator
         next if start_index.nil?
 
         properties.copy_from(bound_variable_value, ret, start_index)
+        parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
+        parent_events << parent_event if parent_event
       end
       properties.build_event(
           patcher,
@@ -31,6 +34,8 @@ module ERBPropagator
           ret,
           preshift.args,
           1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
       ret
     end
   end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -45,9 +45,9 @@ module Contrast
 
           def instrument_basic_object_track
             @_instrument_basic_object_track ||= begin
-                                               require 'cs__assess_basic_object/cs__assess_basic_object'
-                                               true
-                                             end
+              require 'cs__assess_basic_object/cs__assess_basic_object'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading basic object track patch', e)
             false
@@ -55,9 +55,9 @@ module Contrast
 
           def instrument_module_track
             @_instrument_module_track ||= begin
-                                               require 'cs__assess_module/cs__assess_module'
-                                               true
-                                             end
+              require 'cs__assess_module/cs__assess_module'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading module track patch', e)
             false

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -27,7 +27,7 @@ module Contrast
               source,
               Kernel,
               nil,
-              source)
+              [source])
           # Exec replaces the current process, if we occur in a forked process
           # our appendage of this finding will not make it to TS
           Contrast::Agent::AtExitHook.on_exit

data/lib/contrast/extension/assess/fiber.rb

@@ -99,9 +99,9 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
-                true
-              end
+              require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading fiber track patch', e)
             false

data/lib/contrast/extension/assess/hash.rb

@@ -26,9 +26,9 @@ module Contrast
 
           def instrument_hash_track
             @_instrument_hash_track ||= begin
-                                            require 'cs__assess_hash/cs__assess_hash'
-                                            true
-                                          end
+              require 'cs__assess_hash/cs__assess_hash'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false

data/lib/contrast/extension/assess/kernel.rb

@@ -45,7 +45,8 @@ module Contrast
             format_string = preshift.args[0]
             args = preshift.args[1]
 
-            track_sprintf(ret, format_string, args)
+            parent_events = []
+            track_sprintf(ret, format_string, args, parent_events)
 
             properties.build_event(
                 patcher,
@@ -54,32 +55,31 @@ module Contrast
                 ret,
                 preshift.args,
                 1)
+
+            properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret
           end
 
-          def track_sprintf result, format_string, args
-            handle_sprintf_value(format_string, result)
+          def track_sprintf result, format_string, args, parent_events
+            handle_sprintf_value(format_string, result, parent_events)
             case args
             when String
-              handle_sprintf_value(args, result)
+              handle_sprintf_value(args, result, parent_events)
             when Hash
-              handle_sprintf_hash(args, result)
+              handle_sprintf_hash(args, result, parent_events)
             when Array
-              handle_sprintf_array args, result
+              handle_sprintf_array(args, result, parent_events)
             end
-
-            result
           rescue StandardError => e
             logger.error(
                 'Unable to track dataflow through sprintf', e)
-            result
           end
 
           def instrument_kernel_track
             @_instrument_fiber_variables ||= begin
-                                               require 'cs__assess_kernel/cs__assess_kernel'
-                                               true
-                                             end
+              require 'cs__assess_kernel/cs__assess_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel track patch', e)
             false
@@ -87,28 +87,26 @@ module Contrast
 
           private
 
-          def handle_sprintf_value value, result
+          def handle_sprintf_value value, result, parent_events
             properties = Contrast::Agent::Assess::Tracker.properties(result)
             return unless properties
 
             value_properties = Contrast::Agent::Assess::Tracker.properties(value)
             return unless value_properties
 
-            value_properties.events.each do |event|
-              properties.events << event
-            end
+            parent_events << value_properties.event if value_properties.event
             properties.splat_from(value, result)
           end
 
-          def handle_sprintf_array args, result
+          def handle_sprintf_array args, result, parent_events
             args.each do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
 
-          def handle_sprintf_hash args, result
+          def handle_sprintf_hash args, result, parent_events
             args.each_value do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
         end

data/lib/contrast/extension/assess/marshal.rb

@@ -24,6 +24,7 @@ module Contrast
             # optimization here and return when it is not tracked
             return unless Contrast::Agent::Assess::Tracker.tracked?(source)
 
+            args = [source]
             # source might not be all the args passed in, but it is the one we care
             # about. we could pass in all the args in the last param here if it
             # becomes an issue in rendering on TS
@@ -33,18 +34,21 @@ module Contrast
                 source,
                 self,
                 ret,
-                source)
+                args)
             properties = Contrast::Agent::Assess::Tracker.properties(ret)
             properties.copy_from(source, ret)
+
+            node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
+            properties.build_event(node, ret, self, ret, args)
           rescue StandardError => e
             logger.error('Unable to determine if a trigger occurred in Marshal.load', e)
           end
 
           def instrument_marshal_load
             @_instrument_marshal_load ||= begin
-                                            require 'cs__assess_marshal_module/cs__assess_marshal_module'
-                                            true
-                                          end
+              require 'cs__assess_marshal_module/cs__assess_marshal_module'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading marshal load patch', e)
             false

data/lib/contrast/extension/assess/regexp.rb

@@ -71,9 +71,9 @@ module Contrast
 
           def instrument_regexp_track
             @_instrument_regexp_track ||= begin
-                                               require 'cs__assess_regexp/cs__assess_regexp'
-                                               true
-                                             end
+              require 'cs__assess_regexp/cs__assess_regexp'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading regexp track patch', e)
             false

data/lib/contrast/extension/assess/string.rb

@@ -39,12 +39,16 @@ module Contrast
               properties = Contrast::Agent::Assess::Tracker.properties(result)
               return unless properties
 
+              parent_events = []
               offset = 0
               inputs.each do |input|
                 properties.copy_from(input, result, offset)
                 offset += input.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
+                parent_events << parent_event if parent_event
               end
               properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.event.instance_variable_set(:@_parent_events, parent_events)
             end
           rescue StandardError => e
             logger.error('Unable to track interpolation', e)
@@ -52,9 +56,9 @@ module Contrast
 
           def instrument_string
             @_instrument_string ||= begin
-                                      require 'cs__assess_string/cs__assess_string'
-                                      true
-                                    end
+              require 'cs__assess_string/cs__assess_string'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
@@ -63,14 +67,12 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation? && Funchook.available?
-                                                      require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
-                                                    end
-                                                    true
-                                                  rescue StandardError, LoadError => e
-                                                    logger.error('Error loading interpolation patch', e)
-                                                    false
-                                                  end
+                require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26' if AGENT.patch_interpolation? && Funchook.available?
+                true
+              rescue StandardError, LoadError => e
+                logger.error('Error loading interpolation patch', e)
+                false
+              end
             end
             @_instrument_string_interpolation
           end

data/lib/contrast/extension/protect/kernel.rb

@@ -30,9 +30,9 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               require 'cs__protect_kernel/cs__protect_kernel'
-                                               true
-                                             end
+              require 'cs__protect_kernel/cs__protect_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel protect patch', e)
             false

data/lib/contrast/framework/base_support.rb

@@ -46,7 +46,7 @@ module Contrast
         #
         # By default, and hopefully in all cases, we won't need these patches,
         # so we're allowing nil here rather than raising an exception.
-        def before_load_patches; end
+        def before_load_patches!; end
 
         # Some Frameworks require specific patching for their classes to handle
         # functionality like routing. To accommodate this, this method provides

data/lib/contrast/framework/manager.rb

@@ -39,9 +39,9 @@ module Contrast
       # configuration.
       def before_load_patches!
         @_before_load_patches ||= begin
-                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
-                                    true
-                                  end
+          SUPPORTED_FRAMEWORKS.each(&:before_load_patches!)
+          true
+        end
       end
 
       # Return all the After Load Patches for all the Frameworks we know, even

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -24,15 +24,15 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::Rack::Session::Cookie.class_eval do
-                                   alias_method :cs__patched_initialize, :initialize
-                                   def initialize app, options = {}
-                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
-                                     cs__patched_initialize(app, options)
-                                   end
-                                 end
-                                 true
-                               end
+                ::Rack::Session::Cookie.class_eval do
+                  alias_method :cs__patched_initialize, :initialize
+                  def initialize app, options = {}
+                    Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                    cs__patched_initialize(app, options)
+                  end
+                end
+                true
+              end
             end
 
             def analyze options

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -19,19 +19,19 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                 ::ActionController::Live::Buffer.class_eval do
-                                   # normally pre->in->post filters are applied however, in a streamed response
-                                   # we can run into a case where it's pre -> in -> post -> more infilters
-                                   # in order to submit anything found during the infilters after the response has
-                                   # been written we need to explicitly send them
-                                   alias_method :cs__close, :close
-                                   def close
-                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
-                                     cs__close
-                                   end
-                                 end
-                                 true
-                               end
+                ::ActionController::Live::Buffer.class_eval do
+                  # normally pre->in->post filters are applied however, in a streamed response
+                  # we can run into a case where it's pre -> in -> post -> more infilters
+                  # in order to submit anything found during the infilters after the response has
+                  # been written we need to explicitly send them
+                  alias_method :cs__close, :close
+                  def close
+                    Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                    cs__close
+                  end
+                end
+                true
+              end
             end
           end
         end

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -13,16 +13,16 @@ module Contrast
         class RailsApplicationConfiguration
           def self.instrument
             @_instrument ||= begin
-                               ::Rails::Application::Configuration.class_eval do
-                                 alias_method :cs__patched_session_store, :session_store
-                                 def session_store *args
-                                   ret = cs__patched_session_store(*args)
-                                   Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
-                                   ret
-                                 end
-                               end
-                               true
-                             end
+              ::Rails::Application::Configuration.class_eval do
+                alias_method :cs__patched_session_store, :session_store
+                def session_store *args
+                  ret = cs__patched_session_store(*args)
+                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                  ret
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/patch/support.rb

@@ -11,7 +11,7 @@ module Contrast
         # Extension point allowing for the registration of Patches required to
         # support the Rails framework.
         module Support
-          # (See BaseSupport#before_load_patches)
+          # (See BaseSupport#before_load_patches!)
           def before_load_patches!
             return unless defined?(::Rails)
 

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -15,17 +15,17 @@ module Contrast
         class ActionControllerRailtiesHelperInherited
           def self.instrument
             @_instrument ||= begin
-                               ::ActionController::Railties::Helpers.class_eval do
-                                 alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass # rubocop:disable Lint/MissingSuper
-                                   klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
-                                 ensure
-                                   klass&.instance_variable_set(:@cs__defining_class, false)
-                                 end
-                               end
-                               true
-                             end
+              ::ActionController::Railties::Helpers.class_eval do
+                alias_method :cs__patched_helper_inherited, :inherited
+                def inherited klass # rubocop:disable Lint/MissingSuper
+                  klass&.instance_variable_set(:@cs__defining_class, true)
+                  cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                ensure
+                  klass&.instance_variable_set(:@cs__defining_class, false)
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -17,20 +17,20 @@ module Contrast
         class ActiveRecordAttributeMethodsRead
           def self.instrument
             @_instrument ||= begin
-                           ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
-                             alias_method :cs__patched_define_method_attribute, :define_method_attribute
+              ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
+                alias_method :cs__patched_define_method_attribute, :define_method_attribute
 
-                             def define_method_attribute *args, &block
-                               ret = cs__patched_define_method_attribute(*args, &block)
-                               method_name = args[0]
-                               Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-                               ret
-                             end
+                def define_method_attribute *args, &block
+                  ret = cs__patched_define_method_attribute(*args, &block)
+                  method_name = args[0]
+                  Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+                  ret
+                end
 
-                             protected :cs__patched_define_method_attribute, :define_method_attribute
-                           end
-                           true
-                         end
+                protected :cs__patched_define_method_attribute, :define_method_attribute
+              end
+              true
+            end
           end
         end
       end