contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target exactly as is. The target's preexisting tags
+          # are unaffected beyond any merging of overlapping tags.
+          class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # This patch method is used to track through the MatchData#[] and
+              # MatchData#match methods, since the last was introduced after
+              # Ruby 3.1.0, but shares similar functionality, except it does not
+              # support ranges.
+              def square_bracket_tagger propagation_node, preshift, ret, _block
+                case ret
+                when Array
+                  idx = 0
+                  while idx < ret.length
+                    return_value = ret[idx]
+                    index = idx
+                    idx += 1
+                    next unless return_value
+
+                    square_bracket_single(target_matchdata_index(preshift, index), preshift, return_value,
+                                          propagation_node)
+                  end
+                when String
+                  target_matchdata_index = preshift.args[0]
+                  square_bracket_single(target_matchdata_index, preshift, ret, propagation_node)
+                end
+
+                ret
+              end
+
+              def captures_tagger propagation_node, preshift, ret, _block
+                return unless ret
+
+                idx = 0
+                while idx < ret.length
+                  return_value = ret[idx]
+                  index = idx
+                  idx += 1
+                  next unless return_value
+
+                  targetted_index = index + 1
+                  square_bracket_single(targetted_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def to_a_tagger propagation_node, preshift, ret, _block
+                idx = 0
+                while idx < ret.length
+                  return_value = ret[idx]
+                  index = idx
+                  idx += 1
+                  next unless return_value
+
+                  square_bracket_single(index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def values_at_tagger propagation_node, preshift, ret, _block
+                idx = 0
+                while idx < ret.length
+                  return_value = ret[idx]
+                  return_index = idx
+                  idx += 1
+                  next unless return_value
+
+                  original_group_arg_index = preshift.args[return_index]
+                  square_bracket_single(original_group_arg_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              private
+
+              def target_matchdata_index preshift, index
+                if preshift.args[0].is_a?(Range)
+                  arg_range = preshift.args[0]
+                  arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
+                else
+                  preshift.args[index]
+                end
+              end
+
+              def square_bracket_single argument_index, preshift, return_value, propagation_node
+                original_start_index = preshift.object.begin(argument_index)
+                original_end_index = preshift.object.end(argument_index)
+                return unless (original_properties = Contrast::Agent::Assess::Tracker.properties(preshift.object))
+
+                applicable_tags = original_properties.tags_at_range(original_start_index...original_end_index)
+                return if applicable_tags.empty?
+                return unless (return_properties = Contrast::Agent::Assess::Tracker.properties!(return_value))
+
+                applicable_tags.each do |tag_name, tag_ranges|
+                  return_properties.set_tags(tag_name, tag_ranges)
+                end
+                event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                            return_value,
+                                                                            preshift.object,
+                                                                            return_value,
+                                                                            preshift.args)
+                return_properties.build_event(event_data)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -15,23 +15,24 @@ module Contrast
               # String has some silly methods like next. Basically, this flips a
               # character in a predictable manner
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 # this means the char that was shifted overflowed and created new
                 # chars (i.e 'z' "wraps" to create 'aa' )
                 unless target.length == source.length
-                  target.cs__copy_from(source, 0, propagation_node.untags)
+                  properties.copy_from(source, target, 0, propagation_node.untags)
 
                   first_difference = (0...source.length).find { |i| source[i] != target[i] } || source.length
 
-                  target.cs__properties.tags_at(first_difference).each do |tag|
+                  properties.tags_at(first_difference).each do |tag|
                     tag.shift_end(target.length - source.length)
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,9 +14,13 @@ module Contrast
               # For the source, prepend its tags to the target. It's basically the
               # opposite of append. :-P
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 sources = propagation_node.sources
+                # source1 is the copy of the thing being prepended to
                 source1 = find_source(sources[0], preshift)
 
+                # source2 is the copy of the thing being prepended
                 source2 = sources[1] ? find_source(sources[1], preshift) : source1
 
                 original_start_index = target.rindex(source1) || 0
@@ -24,22 +28,25 @@ module Contrast
                 # tags from the object(since nothing from args was added to
                 # return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
                   # find original in the target, copy tags to the new position in target
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
+                  # then we add the tags from the thing prepended to the start
+                  # of the target
                   start = 0
                   while start < original_start_index
-                    target.cs__copy_from(source2, start, propagation_node.untags)
+                    properties.copy_from(source2, target, start, propagation_node.untags)
                     start += source2.length
                     next unless start > original_start_index
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
+                    properties.tags_at(start - source2.length).each do |tag|
                       tag.update_end(original_start_index)
                     end
                   end
                 end
-                target.cs__properties.cleanup_tags
+                # and finally merge the tags if any overlap.
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Rack::Protection offers several protections against vulnerabilities. Of these, some apply to dataflow and
+          # need to be accounted for in order to properly tag data. Others apply to configurations and may be used to
+          # suppress configuration vulnerabilities in the future.
+          class RackProtection < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # Our custom instrumentation for the Rack::Protection::EscapedParams#escape_string method
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def escaped_params propagation_node, preshift, ret, _block
+                Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                apply_escaper_tags(preshift.object, ret)
+                ret
+              end
+
+              private
+
+              # Rack::Protection::EscapedParams can be configured such that it only applies certain escape. We need
+              # to account for the configuration of the individual escapes when applying tags.
+              #
+              # @param escaper [Rack::Protection::EscapedParams] the instance of Rack::Protection::EscapedParams
+              #   applying the escape_string
+              # @param ret [String] the result of the escape
+              def apply_escaper_tags escaper, ret
+                # I don't know how this could not be an instance of Rack::Protection::EscapedParams, but I don't want
+                # to chance it.
+                return unless escaper.cs__is_a?(Rack::Protection::EscapedParams)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties(ret))
+
+                tags = []
+                untags = []
+                if escaper.instance_variable_get(:@html)
+                  tags << 'HTML_ENCODED'
+                  untags << 'HTML_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@javascript)
+                  tags << 'JAVASCRIPT_ENCODED'
+                  untags << 'JAVASCRIPT_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@url)
+                  tags << 'URL_ENCODED'
+                  untags << 'URL_DECODED'
+                end
+
+                length = Contrast::Utils::StringUtils.ret_length(ret)
+                tags.each do |tag|
+                  properties.add_tag(tag, 0...length)
+                end
+
+                untags.each do |tag|
+                  properties.delete_tags(tag)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,66 +6,78 @@ module Contrast
     module Assess
       module Policy
         module Propagator
-          # Propagation that results in all the tags of the source being
-          # applied to the totality of the target and then those sections
-          # which have been removed from the target are removed from the
-          # tags. The target's preexisting tags are also updated by this
-          # removal.
+          # Propagation that results in all the tags of the source being applied to the totality of the target and then
+          # those sections which have been removed from the target are removed from the tags. The target's preexisting
+          # tags are also updated by this removal.
           class Remove < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # For the source, append its tags to the target.
-              # Once the tag is applied, remove the section that was removed by the delete.
-              # Unlike additive propagation, this currently only supports one source
-              def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+              # For the source, append its tags to the target. Once the tag is applied, remove the section that was
+              # removed by the delete. Unlike additive propagation, this currently only supports one source.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
-
-                source_chars = source.is_a?(String) ? source.chars : source.string.chars
-                handle_removal(source_chars, target)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object (clearing empty spaces, \n..) so we will always return 'O' key
+                           # which is the object itself. Because preshift is disabled for this methods
+                           # we use it's parameter to pass in the original object( in this case just a unchained
+                           # source), preshift = object. To see list of methods in which this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
+                properties.copy_from(source, target, 0, propagation_node.untags)
+                handle_removal(propagation_node, source, target)
               end
 
-              def handle_removal source_chars, target
-                source_idx = 0
+              def handle_removal propagation_node, source, target
+                return unless source
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source_string = source.is_a?(String) ? source : source.to_s
+                # If the lengths are the same, we should just copy the tags because nothing was removed, but a new
+                # instance could have been created. copy_from will handle the case where the source is the target.
+                if source_string.length == target.length
+                  properties.copy_from(source, target, 0, propagation_node.untags)
+                  return
+                end
 
-                target_chars = target.chars
+                source_idx = 0
                 target_idx = 0
 
                 remove_ranges = []
-                current_range = nil
+                start = nil
 
-                # loop over the target, the result of the delete
-                # every range of characters that it differs from the source
-                # represents a section that was deleted. these sections
-                # need to have their tags updated
-                target_len = target_chars.length
-                while target_idx < target_len
-                  target_char = target_chars[target_idx]
-                  source_char = source_chars[source_idx]
+                # loop over the target, the result of the delete every range of characters that it differs from the
+                # source represents a section that was deleted. these sections need to have their tags updated
+                while target_idx < target.length
+                  target_char = target[target_idx]
+                  source_char = source_string[source_idx]
                   if target_char == source_char
                     target_idx += 1
-                    if current_range
-                      current_range.stop = source_idx
-                      remove_ranges << current_range
-                      current_range = nil
+                    if start
+                      remove_ranges << (start...source_idx)
+                      start = nil
                     end
                   else
-                    current_range ||= Contrast::Agent::Assess::AdjustedSpan.new(source_idx)
+                    start ||= source_idx
                   end
                   source_idx += 1
                 end
 
-                # once we're done looping over the target, anything left
-                # over is extra from the source that was deleted. tags
-                # applying to it need to be removed.
-                if source_idx != source_chars.length
-                  remove_ranges << Contrast::Agent::Assess::AdjustedSpan.new(
-                      source_idx,
-                      source_chars.length)
-                end
+                # once we're done looping over the target, anything left over is extra from the source that was
+                # deleted. tags applying to it need to be removed.
+                remove_ranges << (source_idx...source_string.length) if source_idx != source_string.length
 
                 # handle deleting the removed ranges
-                target.cs__properties.delete_tags_at_ranges(remove_ranges)
+                properties.delete_tags_at_ranges(remove_ranges)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,9 +14,11 @@ module Contrast
               # Replace means we're replacing the target w/ the source. Anything
               # on the source should be passed to the target.
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__properties.clear_tags
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.clear_tags
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,13 +13,14 @@ module Contrast
           class Reverse < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 length = target.length
-                target.cs__properties.tag_keys.each do |key|
-                  tags = target.cs__properties.fetch_tag(key)
+                properties.tag_keys.each do |key|
+                  tags = properties.fetch_tag(key)
                   tags.each do |tag|
                     new_end = length - tag.start_idx
                     new_start = new_end - tag.length
@@ -27,7 +28,7 @@ module Contrast
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -12,9 +12,6 @@ module Contrast
           # in a 'get it work' state. hopefully, we'll be in
           # a 'get it right' state soon.
           class Select
-            include Contrast::Components::Interface
-            access_component :logging
-
             class << self
               def select_tagger patcher, preshift, ret, _block
                 source = preshift.object
@@ -24,57 +21,69 @@ module Contrast
                 # Additionally, an empty string is returned when the starting index for
                 # a character range is at the end of the string. Let's just skip that
                 # and only track a string that has length
-                return unless source.cs__tracked? && ret && !ret.empty?
+                return unless ret && !ret.empty? && Contrast::Agent::Assess::Tracker.tracked?(source)
 
-                source.cs__properties.events.each do |event|
-                  ret.cs__properties.events << event
-                end
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
 
                 range = determine_select_range(source, args)
                 return unless range
 
-                tags = source.cs__properties.tags_at_range(range)
-                ret.cs__properties.clear_tags
+                tags = source_properties.tags_at_range(range)
+                properties.clear_tags
                 tags.each_pair do |key, value|
-                  ret.cs__properties.set_tags(key, value)
+                  properties.set_tags(key, value)
                 end
                 ret
               end
 
               private
 
+              def handle_integer args, arg, source
+                length = args[1] || 1
+                # (void) negative range
+                arg += source.length if arg.negative?
+                arg...(arg + length)
+              end
+
+              def handle_string arg, source
+                idx = source.index(arg)
+                idx...(idx + arg.length)
+              end
+
+              def handle_regexp args, arg, source
+                match_data = arg.match(source)
+                # nil has the same meaning as 0. use full match
+                group = args[1] || 0
+                match_data.begin(group)...match_data.end(group)
+              end
+
+              def handle_range arg, source
+                start = arg.begin
+                finish = arg.end
+
+                # (void) negative range
+                start += source.length if start.negative?
+                finish += source.length if finish.negative?
+                finish += 1 unless arg.exclude_end?
+
+                start...finish
+              end
+
               def determine_select_range source, args
                 arg = args[0]
                 case arg
                 when Integer
-                  length = args[1] || 1
-                  # (void) negative range
-                  arg += source.length if arg.negative?
-                  Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+                  handle_integer(args, arg, source)
                 when String
-                  idx = source.index(arg)
-                  Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+                  handle_string(arg, source)
                 when Regexp
-                  match_data = arg.match(source)
-                  # nil has the same meaning as 0. use full match
-                  group = args[1] || 0
-                  Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+                  handle_regexp(args, arg, source)
                 when Range
-                  start = arg.begin
-                  finish = arg.end
-
-                  # (void) negative range
-                  start += source.length if start.negative?
-                  finish += source.length if finish.negative?
-                  finish += 1 unless arg.exclude_end?
-
-                  Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+                  handle_range(arg, source)
                 end
               end
             end