contrast-agent 3.16.0 → 4.3.1

data/lib/contrast/agent/assess/property/tagged.rb

@@ -79,6 +79,10 @@ module Contrast
           # range       : 5-10
           # result      : 0-05
           #
+          # Note that we disable Lint/DuplicateBranch in this branch in order
+          # list out all tag range cases in the proper order to make this
+          # easier to understand
+          #
           # @param range [Range] the span to check, inclusive to exclusive
           # @return [Hash{String => Contrast::Agent::Assess::Tag}] the hash of
           #   key to tags
@@ -101,10 +105,10 @@ module Contrast
                   finish = range.size - start
                   add << Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
                   # the tag spans the requested range.
-                when Contrast::Agent::Assess::Tag::WITHOUT
+                when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
                   add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
                   # part of the tag is being selected
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN
+                when Contrast::Agent::Assess::Tag::HIGH_SPAN # rubocop:disable Lint/DuplicateBranch
                   add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
                 end
               end
@@ -173,14 +177,6 @@ module Contrast
             tags.fetch(label, nil) if tracked?
           end
 
-          # Convert the tags of this object into the TraceTaintRange required
-          # to be sent to the service
-          #
-          # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
-          def tags_to_dtm
-            Contrast::Api::Dtm::TraceTaintRange.build_for_event(tags)
-          end
-
           # Remove all tags within the given ranges.
           # This does not delete an entire tag if part of that tag is
           # outside this range, meaning we may reduce sizes of tags
@@ -301,9 +297,19 @@ module Contrast
             end
           end
 
-          # Shift the tag ranges covering the given range
-          # We assume this is for a insertion, meaning we
-          # have to move tags to the right
+          # Shift the tag ranges covering the given range to account for new
+          # data being added. We assume this is for a insertion, meaning we
+          # have to move tags out of the range and to the right. For example,
+          # given current tags:     0-15
+          # when we insert a range: 5-10
+          # then the result is:     0-5, 10-20
+          #
+          # Note that we disable Lint/DuplicateBranch in this branch in order
+          # list out all tag range cases in the proper order to make this
+          # easier to understand
+          #
+          # @param range [Range] the range of new information that's been
+          #   inserted
           def shift_tags_for_insertion range
             return unless tracked?
 
@@ -325,13 +331,13 @@ module Contrast
                 when Contrast::Agent::Assess::Tag::WITHIN
                   tag.shift(length)
                   # the tag spans the range. leave the part below alone
-                when Contrast::Agent::Assess::Tag::WITHOUT
+                when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
                   new_tag = tag.clone
                   new_tag.update_start(range.begin)
                   new_tag.shift(length)
                   add << new_tag
                   tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE
+                when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
                   tag.shift(length)
                 end
               end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -85,10 +85,11 @@ module Contrast
             #
             # @param trace_point [TracePoint] the TracePoint event created on
             #   the :end of a Module being loaded
-            def parse trace_point
+            # @param ast [RubyVM::AbstractSyntaxTree::Node] the abstract syntax
+            #   tree of the Module defined in the TracePoint end event
+            def parse trace_point, ast
               return if disabled?
 
-              ast = RubyVM::AbstractSyntaxTree.parse_file(trace_point.path)
               parse_ast(trace_point.self, ast)
             rescue StandardError => e
               logger.error('Unable to parse AST for hardcoded keys', e, module: trace_point.self)

data/lib/contrast/agent/assess/rule/redos.rb

@@ -33,7 +33,7 @@ module Contrast
               # (2) regexp must evaluate against user input
               return unless trigger_node.violated?(string)
 
-              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, args)
+              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, *args)
             end
 
             protected

data/lib/contrast/agent/assess/tracker.rb

@@ -14,7 +14,20 @@ module Contrast
         PROPERTIES_HASH = Contrast::Agent::Assess::Finalizers::Hash.new
 
         class << self
+          # Retrieve the properties of the given Object, iff they exist.
+          #
+          # @param source [Object] the thing for which to look up properties.
+          # @return [Contrast::Agent::Assess::Properties, nil]
           def properties source
+            PROPERTIES_HASH[source]
+          end
+
+          # Retrieve the properties of the given Object, returning a new
+          # instance if one does not already exist and the source is trackable.
+          #
+          # @param source [Object] the thing for which to look up properties.
+          # @return [Contrast::Agent::Assess::Properties, nil]
+          def properties! source
             return unless trackable?(source)
 
             PROPERTIES_HASH[source] ||= Contrast::Agent::Assess::Properties.new
@@ -33,30 +46,15 @@ module Contrast
           end
 
           # Copy the properties from one object to the next, assuming the
-          # target does not already have its own properties.
+          # target does not already have its own properties. This should only
+          # ever be called when building PreShift for those objects sources
+          # which are already tracked.
           #
           # @param source [Object] the instance from which to copy properties
           # @param target [Object] the instance to which to copy properties
           def copy source, target
             PROPERTIES_HASH[target] ||= properties(source).dup
           end
-
-          # Duplicate the given object, returning the duplicate after copying
-          # the properties of the original and storing them as the properties
-          # of the duplicate.
-          #
-          # @param source [Object] the thing to duplicate
-          # @return [Object] the duplicate of the original, or the original if
-          #   it does not respond to duplication
-          def duplicate source
-            return source unless source
-
-            duplicate = source.dup
-            PROPERTIES_HASH[duplicate] ||= PROPERTIES_HASH[source].dup
-            duplicate
-          rescue StandardError
-            source
-          end
         end
       end
     end

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -19,6 +19,13 @@ module Contrast
           def feature
             'Deadzone'
           end
+
+          # Deadzone means place the code inside of the contrast scope so that
+          # none of our code executes. As such, all DeadZone nodes have that as
+          # their method scope
+          def method_scope
+            :contrast
+          end
         end
       end
     end

data/lib/contrast/agent/inventory.rb

@@ -0,0 +1,15 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Namespace used for inventory behavior
+    module Inventory
+    end
+  end
+end
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependency_usage_analysis'
+require 'contrast/agent/inventory/dependency_analysis'

data/lib/contrast/agent/inventory/dependencies.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # this module is included in classes that need access to the applications dependencies
+      module Dependencies
+        CONTRAST_AGENT = 'contrast-agent'
+
+        # the #clone is necessary here, as a require in another thread could
+        # potentially result in adding a key to the loaded_specs hash during
+        # iteration.  (as in RUBY-330)
+        # this takes care of filtering out contrast-only dependencies
+        def loaded_specs
+          specs = Gem.loaded_specs.clone
+          specs.delete_if { |name, _v| contrast?(name) }
+        end
+
+        private
+
+        def contrast_gems
+          @_contrast_gems ||= find_contrast_gems
+        end
+
+        def contrast? name
+          contrast_gems.include?(name)
+        end
+
+        # Go through all dependents, given as a pair from the DependencyList: `dependency`
+        # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
+        # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
+        # then contrast depends on it. If its array of dependents is 1, then contrast is the
+        # only dependency in that list. Since only contrast depends on it, we should ignore it.
+        def find_contrast_gems
+          ignore = Set.new([CONTRAST_AGENT])
+          contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
+            dependency.name == CONTRAST_AGENT
+          end
+          contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
+
+          Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
+            ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
+          end
+          ignore
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to collect dependencies of the application for reporting
+      class DependencyAnalysis
+        include Singleton
+        include Contrast::Agent::Inventory::Dependencies
+        include Contrast::Components::Interface
+
+        access_component :analysis
+
+        # Report the dependencies of this application
+        #
+        # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
+        #   Gem::Specification that have been loaded for this application.
+        def library_pb_list
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.enabled?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.analyze_libraries?
+
+          loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
+            next unless spec
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            reported_lib_list << Contrast::Api::Dtm::Library.build(digest, spec)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,104 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Interface
+        include Contrast::Agent::Inventory::Dependencies
+
+        access_component :analysis, :config, :logging
+
+        def initialize
+          return unless enabled?
+
+          @gemdigest_cache = Contrast::Agent::Inventory::GemfileDigestCache.new
+        end
+
+        # This method is invoked once, along with the rest of our catchup code
+        # to report libraries and their associated files that have already been loaded pre-contrast
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            @gemdigest_cache.use_cache(digest) do |existing_files|
+              loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+              loaded_files_from_gem.each do |file_path|
+                logger.trace('Recording loaded file for inventory analysis', line: file_path)
+                existing_files << adjust_path_for_reporting(file_path, spec)
+              end
+            end
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific
+        # file being required to the gem it belongs to
+        #
+        # @param path [String] the result of TracePoint#path from the :end
+        #   event in which the Module was defined
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @gemdigest_cache.get(digest) << report_path
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages filed of the Activity message using the
+        # data stored in the @gemdigest_cache
+        #
+        # @param activity [Contrast::Api::Dtm::Activity] the message to which
+        #   to append the usage data
+        def generate_library_usage activity
+          return unless enabled?
+          return if @gemdigest_cache.empty?
+
+          @gemdigest_cache.generate_usage_data(activity)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..-1] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/gemfile_digest_cache.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # Keeps a map of gem digest to files for reporting file usage
+      class GemfileDigestCache
+        extend Forwardable
+        def_delegator :@gem_spec_digest_to_files,
+                      :empty?
+
+        def initialize
+          @gem_spec_digest_to_files = {}
+        end
+
+        def generate_usage_data activity
+          return unless activity
+
+          @gem_spec_digest_to_files.each_pair do |digest, files|
+            usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
+            activity.library_usages[usage.hash_code] = usage if activity
+          end
+          @gem_spec_digest_to_files.clear
+        end
+
+        def use_cache digest
+          yield get(digest)
+        end
+
+        def get digest
+          @gem_spec_digest_to_files[digest] = Set.new unless @gem_spec_digest_to_files.key?(digest)
+          @gem_spec_digest_to_files[digest]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/middleware.rb

@@ -79,7 +79,7 @@ module Contrast
         Contrast::Utils::HeapDumpUtil.run
 
         if AGENT.enabled?
-          Contrast::Agent::StaticAnalysis.catchup
+          handle_first_request
           call_with_agent(env)
         else
           app.call(env)
@@ -91,17 +91,47 @@ module Contrast
       def setup_agent
         SETTINGS.reset_state
 
+        inform_deprecations
+
         if CONFIG.invalid?
           AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif CONFIG.disabled?
-          AGENT.disable!
+        elsif AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
           AGENT.enable!
         end
       end
 
+      # Some things have to wait until first request to happen, either because
+      # resolution is not complete or because the framework will preload
+      # classes, which confuses some of our instrumentation.
+      def handle_first_request
+        @_handle_first_request ||= begin
+          Contrast::Agent::StaticAnalysis.catchup
+          force_patching
+          true
+        end
+      end
+
+      # TODO: RUBY-1090 remove this method and those it calls.
+      #
+      # These modules are auto-loaded by Rails, meaning they are defined at
+      # startup, but that they don't actually exist. We account for this in
+      # most cases by using the ClassUtil.truly_defined? method, but it appears
+      # to fail for these Modules. In the short term, we can forcing a re-patch
+      # so that their dead zones apply.
+      def force_patching
+        force_patch(ActionDispatch::FileHandler) if defined?(ActionDispatch::FileHandler)
+        force_patch(ActionDispatch::Http::MimeNegotiation) if defined?(ActionDispatch::Http::MimeNegotiation)
+        force_patch(ActionView::Template) if defined?(ActionView::Template)
+      end
+
+      def force_patch mod
+        data = Contrast::Agent::ModuleData.new(mod)
+        Contrast::Agent::Patching::Policy::Patcher.send(:patch_into_module, data, true)
+      end
+
       # This is where we process each request we intercept as a middleware. We make the request context
       # available globally so that it can be accessed from anywhere. A RequestHandler object is made
       # for each request, which handles prefilter and postfilter operations.
@@ -174,6 +204,24 @@ module Contrast
           raise exception
         end
       end
+
+      # As we deprecate support to prepare to remove dead code, we need to
+      # inform our users still relying on the now deprecated and soon to be
+      # removed functionality. This method handles doing that by leveraging the
+      # standard Kernel#warn approach
+      def inform_deprecations
+        # Ruby 2.5 is currently in security maintenance, meaning int is only
+        # receiving updates for security issues. It will move to eol on 31
+        # March 2021. As such, we can remove support for it in Q2. We'll begin
+        # the deprecation warnings now so that customers have time to reach out
+        # if they'll be impacted.
+        # TODO: RUBY-715 remove this part of the method, leaving it empty if
+        #   there are no other deprecations, when we drop 2.5 support.
+        return unless RUBY_VERSION < '2.6.0'
+
+        Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\
+                    'Please contact Customer Support prior if you require continued support.')
+      end
     end
   end
 end