contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/properties.rb

@@ -1,11 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/contrast_event'
+require 'base64'
+require 'set'
+require 'contrast/agent/assess/property/evented'
+require 'contrast/agent/assess/property/tagged'
+require 'contrast/agent/assess/property/updated'
 
 module Contrast
   module Agent
@@ -17,7 +17,11 @@ module Contrast
       # to properly convey the events that lead up to the state of the tracked
       # user input.
       class Properties
-        include Contrast::Utils::PreventSerialization
+        include Contrast::Agent::Assess::Property::Evented
+        include Contrast::Agent::Assess::Property::Tagged
+        include Contrast::Agent::Assess::Property::Updated
+
+        attr_accessor :dupped_from
 
         # CONTRAST-36937
         # Creating these on Properties is expensive. We want to delay this for
@@ -26,18 +30,6 @@ module Contrast
           @_properties ||= {}
         end
 
-        def events
-          @_events ||= []
-        end
-
-        def tracked?
-          tags? && tags.any?
-        end
-
-        def tagged? label
-          tags? && tags.key?(label)
-        end
-
         def add_properties hash
           return unless hash
 
@@ -50,341 +42,10 @@ module Contrast
           properties[name] = value
         end
 
-        def any_tags_between? start, finish
-          return false unless tags?
-
-          range = Contrast::Agent::Assess::Tag.new(start + finish, start)
-          tags.each_value do |tag_array|
-            return true if tag_array.any? { |tag| tag.overlaps?(range) }
-          end
-          false
-        end
-
-        # Find all of the ranges that span a given index. This is used
-        # in propagation when we need to shift tags about. For instance, in
-        # the append method when we need to see if any tag at the end needs
-        # to be expanded out to the size of the new String.
-        #
-        # Note: Tags do not know their key, so this is only the range covered
-        def tags_at idx
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          at = []
-          tags.each_value do |tag_array|
-            tag_array.each do |tag|
-              if tag.covers?(idx)
-                at << tag
-              elsif tag.above?(idx)
-                break
-              end
-            end
-          end
-          at
-        end
-
-        # given a range, select all tags in that range the selected tags are
-        # shifted such that the start index of the new tag (0) aligns with the
-        # given start index in the range
-        #
-        # current tags: 5-15
-        # range       : 5-10
-        # result      : 0-05
-        def tags_at_range range
-          return Contrast::Utils::ObjectShare::EMPTY_HASH unless tags?
-
-          at = Hash.new { |h, k| h[k] = [] }
-          length = range.stop - range.start
-          tags.each_pair do |key, value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # BELOW and ABOVE are applicable to this check and are removed.
-              case comparison
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # the tag exists in the requested range, figure out the boundaries
-              when Contrast::Agent::Assess::Tag::WITHIN
-                start = tag.start_idx - range.start
-                finish = length - start
-                add << Contrast::Agent::Assess::Tag.new(finish, start)
-              # the tag spans the requested range.
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                add << Contrast::Agent::Assess::Tag.new(length)
-              # part of the tag is being selected
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                add << Contrast::Agent::Assess::Tag.new(length)
-              end
-            end
-            next if add.empty?
-
-            at[key] = add
-          end
-          at
-        end
-
-        # Given a tag name and range object, add a new tag to this
-        # collection. If the given range touches an existing tag,
-        # we'll combine the two, adjusting the existing one and
-        # dropping this new one.
-        def add_tag label, range
-          length = range.stop - range.start
-          tag = Contrast::Agent::Assess::Tag.new(length, range.start)
-          existing = fetch_tag(label)
-          tags[label] = Contrast::Utils::TagUtil.ordered_merge(existing, tag)
-        end
-
-        def set_tags label, tag_ranges
-          tags[label] = tag_ranges
-        end
-
-        # Remove all tags with a given label
-        def delete_tags label
-          return unless tags?
-
-          tags.delete(label)
-        end
-
-        # Reset the tag hash
-        def clear_tags
-          return unless tags?
-
-          tags.clear
-        end
-
-        # Returns a list of all current tag labels, most likely to be used for
-        # a splat operation
-        def tag_keys
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          tags.keys
-        end
-
-        # Calls merge to combine touching or overlapping tags
-        # Deletes empty tags
-        def cleanup_tags
-          return unless tags?
-
-          Contrast::Utils::TagUtil.merge_tags(tags)
-          tags.delete_if { |_, value| value.empty? }
-        end
-
-        # We'll use this as a helper method to retrieve tags from the hash.
-        # Because the hash auto-populates an empty array when we try to access
-        # a tag in it, we cannot use the [] method without side effect. To get
-        # around this, we'll use a fetch work around.
-        def fetch_tag label
-          return unless tags?
-
-          tags.fetch(label, nil)
-        end
-
-        # Convert the tags of this object into the TraceTaintRange requried to
-        # be sent to the service
-        def tags_to_dtm
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags?
-
-          ranges = []
-          tags.each_pair do |key, value|
-            next if value.empty?
-
-            value.each do |tag|
-              range = Contrast::Api::Dtm::TraceTaintRange.new
-              range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(key)
-              range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
-              ranges << range
-            end
-          end
-          ranges
-        end
-
-        # Remove all tags within the given ranges.
-        # This does not delete an entire tag if part of that tag is
-        # outside this range, meaning we may reduce sizes of tags
-        # or split them.
-        #
-        # If shift is true, it is assumed the characters at those ranges were
-        # removed. If shift is false, it is assumed those ranges were replaced
-        # by the same number of characters and no shift is needed.
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-15
-        def delete_tags_at_ranges ranges, shift = true
-          return unless tags?
-
-          # Stage one - delete the tags w/o changing their
-          # location.
-          ranges.each do |range|
-            remove_tags(range)
-          end
-
-          return unless shift
-
-          # the amount we've already removed from the string
-          shift = 0
-          # Stage two - shift the tags to the left to account
-          # for the sections that were deleted.
-          ranges.each do |range|
-            shift_tags_for_deletion(range, shift)
-            shift += (range.stop - range.start)
-          end
-
-          # Clean up and merge any touching tags
-          Contrast::Utils::TagUtil.merge_tags(tags)
-        end
-
-        # Shift all the tags in this object by the given ranges.
-        # This method assumes the ranges are sorted, meaning
-        # the leftmost (lowest) range is first
-        #
-        # current tags: 0-15
-        # range:        5-10
-        # result:       0-5, 10-20
-        def shift_tags ranges
-          return unless tags?
-
-          ranges.each do |range|
-            shift_tags_for_insertion(range)
-          end
-        end
-
-        # Add an event to these properties. It will be used to build
-        # a trace if this object ends up in a trigger.
-        def add_event event
-          events << event
-          self
-        end
-
-        def build_event policy_node, tagged, object, ret, args, invoked = 0, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args, invoked, source_type, source_name)
-          add_event(event)
-          report_sources(tagged, event)
-        end
-
-        private
-
-        def report_sources tagged, event
-          return unless tagged && !tagged.to_s.empty?
-          return unless event&.source_type
-
-          current_request = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_request
-          return if current_request.observed_route.sources.any? { |source| source.type == event.forced_source_type && source.name == event.forced_source_name }
-
-          event_source_dtm = event.build_event_source_dtm
-          return unless event_source_dtm
-
-          current_request.observed_route.sources << event_source_dtm
-        end
-
-        # Because of the auto-fill thing, we should not allow direct access to
-        # the tags hash. Instead, the methods above should be used to do
-        # operations like add, delete, and fetch.
-        #
-        # CONTRAST-22914
-        # please do NOT expose this w/ an attr_reader / accessor. there are
-        # helper methods in this class that safely access the hash. the tags
-        # method is private to avoid the side effect of a direct lookup with
-        # `[]` adding an empty array to the hash.
-        def tags
-          @_tags ||= Hash.new { |h, k| h[k] = [] }
-        end
-
-        # Creating Tags is expensive and we check for Tags all the time on
-        # untracked things. ALWAYS!!! call this method before checking if
-        # an object has tags
-        def tags?
-          instance_variable_defined?(:@_tags)
-        end
-
-        # Remove the tag ranges covering the given range
-        def remove_tags range
-          return unless tags?
-
-          full_delete = []
-          tags.each_pair do |key, value|
-            remove = []
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              # ABOVE and BELOW are not affected by this check
-              case comparison
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::WITHIN
-                remove << tag
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.stop)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                tag.update_start(range.stop)
-              end
-            end
-            value.delete_if { |tag| remove.include?(tag) }
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-            full_delete << key if value.empty?
-          end
-          full_delete.each { |key| tags.delete(key) }
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a deletion, meaning we
-        # have to move tags to the left
-        def shift_tags_for_deletion range, shift
-          return unless tags?
-
-          tags.each_value do |value|
-            value.each do |tag|
-              comparison = tag.compare_range(range.start - shift, range.stop - shift)
-              length = range.stop - range.start
-              case comparison
-              # this is really the only thing we need to shift
-              when Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(0 - length)
-              end
-            end
-          end
-        end
-
-        # Shift the tag ranges covering the given range
-        # We assume this is for a insertion, meaning we
-        # have to move tags to the right
-        def shift_tags_for_insertion range
-          return unless tags?
-
-          tags.each_value do |value|
-            add = []
-            value.each do |tag|
-              comparison = tag.compare_range(range.start, range.stop)
-              length = range.stop - range.start
-              # BELOW is not affected by this check
-              case comparison
-              # part of the tag is being inserted on
-              when Contrast::Agent::Assess::Tag::LOW_SPAN
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              # the tag exists in the inserted range. it is partially shifted
-              when Contrast::Agent::Assess::Tag::WITHIN
-                tag.shift(length)
-              # the tag spans the range. leave the part below alone
-              when Contrast::Agent::Assess::Tag::WITHOUT
-                new_tag = tag.clone
-                new_tag.update_start(range.start)
-                new_tag.shift(length)
-                add << new_tag
-                tag.update_end(range.start)
-              when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE
-                tag.shift(length)
-              end
-            end
-            Contrast::Utils::TagUtil.ordered_merge(value, add)
-          end
+        def dup
+          ret = super
+          ret.dupped_from = __id__
+          ret
         end
       end
     end

data/lib/contrast/agent/assess/property/evented.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/finding_event'
+
+module Contrast
+  module Agent
+    module Assess
+      module Property
+        # This module serves to hold the functionality required for the
+        # management of our dataflow events.
+        #
+        # @attr_reader event [Contrast::Agent::Assess::ContrastEvent] the
+        #   latest event to track
+        module Evented
+          attr_reader :event
+
+          # Create a new event and add it to the event set.
+          #
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
+          # @param source_type [String] the type of this source, from the
+          #   source_node, or a KEY_TYPE if invoked for a map
+          # @param source_name [String, nil] the name of this source, i.e.
+          #   the key used to accessed if from a map or nil if a type like
+          #   BODY
+          def build_event event_data, source_type = nil, source_name = nil
+            @event = Contrast::Agent::Reporting::FindingEvent.new(event_data, source_type, source_name)
+            report_sources(event_data.tagged, @event)
+          end
+
+          private
+
+          # Append the sources of the given event to the current request
+          # context's observed route
+          #
+          # @param tagged [Object] The Target of the Event
+          # @param event [Contrast::Agent::Reporting::FindingEvent]
+          def report_sources tagged, event
+            return unless tagged && !tagged.to_s.empty?
+            return unless event.source_type
+            return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
+
+            event.event_sources&.each do |event_source|
+              if current_request.observed_route.sources.any? do |source|
+                source.source_type == event_source.source_type && source.source_name == event_source.source_name
+              end
+
+                next
+              end
+
+              current_request.observed_route.sources << event_source
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/property/tagged.rb

@@ -0,0 +1,246 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/tag'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/tag_util'
+require 'contrast/utils/assess/property/tagged_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Property
+        # This module serves to hold the functionality required for the
+        # management of our dataflow tags.
+        module Tagged
+          include Contrast::Utils::Assess::TaggedUtils
+          # Is any tag present?
+          # Creating Tags is expensive and we check for Tags all the time on
+          # untracked things. ALWAYS!!! call this method before checking if an
+          # object has tags
+          # @return [Boolean]
+          def tracked?
+            instance_variable_defined?(:@_tags) && tags.any?
+          end
+
+          # Remove all tags within the given ranges.
+          # This does not delete an entire tag if part of that tag is
+          # outside this range, meaning we may reduce sizes of tags
+          # or split them.
+          #
+          # If shift is true, it is assumed the characters at those ranges were
+          # removed. If shift is false, it is assumed those ranges were replaced
+          # by the same number of characters and no shift is needed.
+          #
+          # current tags: 0-15
+          # range:        5-10
+          # result:       0-5, 10-15
+          #
+          # @param ranges [Array<Range>] the ranges to delete
+          # @param shift [Boolean] move remaining tags to the left to account
+          #   for the deletion
+          def delete_tags_at_ranges ranges, shift: true
+            return unless tracked?
+
+            # Stage one - delete the tags w/o changing their
+            # location.
+            ranges.each do |range|
+              remove_tags(range)
+            end
+            return unless shift
+
+            # the amount we've already removed from the string
+            shift = 0
+            # Stage two - shift the tags to the left to account
+            # for the sections that were deleted.
+            ranges.each do |range|
+              shift_tags_for_deletion(range, shift)
+              shift += (range.end - range.begin)
+            end
+
+            # Clean up and merge any touching tags
+            Contrast::Utils::TagUtil.merge_tags(tags)
+          end
+
+          # Shift all the tags in this object by the given ranges.
+          # This method assumes the ranges are sorted, meaning
+          # the leftmost (lowest) range is first
+          #
+          # current tags: 0-15
+          # range:        5-10
+          # result:       0-5, 10-20
+          def shift_tags ranges
+            return unless tracked?
+
+            ranges.each do |range|
+              shift_tags_for_insertion(range)
+            end
+          end
+
+          # Remove the tag ranges covering the given range
+          # and appends any trailing value that might
+          # exist after removal of range
+          def remove_tags range
+            return unless tracked?
+
+            full_delete = []
+            tags.each_pair do |key, value|
+              remove = []
+              add = []
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin, range.end)
+                # ABOVE and BELOW are not affected by this check
+                tags_remove_comparison(comparison, tag, remove, add, range)
+              end
+              value.delete_if { |tag| remove.include?(tag) }
+              Contrast::Utils::TagUtil.ordered_merge(value, add)
+              full_delete << key if value.empty?
+            end
+            full_delete.each { |key| tags.delete(key) }
+          end
+
+          # This method is for the tags comparison
+          # the idea is to move the whole case here
+          # @param comparison [String] indicates type of removal is to occur
+          # @param tag Contrast::Agent::Assess::Tag
+          # @param remove [String] holds removed Tag if exists
+          # @param add [String] holds trailing Tag if exists
+          # @param range [Range] start and stop for idx for removal
+          def tags_remove_comparison comparison, tag, remove, add, range
+            case comparison
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::WITHIN
+              remove << tag
+            when Contrast::Agent::Assess::Tag::WITHOUT
+              new_tag = tag.clone
+              new_tag.update_start(range.end)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN
+              tag.update_start(range.end)
+            end
+          end
+
+          # Shift the tag ranges covering the given range
+          # We assume this is for a deletion, meaning we
+          # have to move tags to the left
+          # @param range [Range] the range to delete
+          # @param shift [Boolean] move remaining tags to the left to account
+          #   for the deletion
+          def shift_tags_for_deletion range, shift
+            return unless tracked?
+
+            tags.each_value do |value|
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin - shift, range.end - shift)
+                # this is really the only thing we need to shift
+                next unless comparison == Contrast::Agent::Assess::Tag::ABOVE
+
+                length = range.end - range.begin
+                tag.shift(0 - length)
+              end
+            end
+          end
+
+          # Shift the tag ranges covering the given range to account for new
+          # data being added. We assume this is for a insertion, meaning we
+          # have to move tags out of the range and to the right. For example,
+          # given current tags:     0-15
+          # when we insert a range: 5-10
+          # then the result is:     0-5, 10-20
+          #
+          # Note that we disable Lint/DuplicateBranch in this branch in order
+          # list out all tag range cases in the proper order to make this
+          # easier to understand
+          #
+          # @param range [Range] the range of new information that's been
+          #   inserted
+          def shift_tags_for_insertion range
+            return unless tracked?
+
+            tags.each_value do |value|
+              add = []
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin, range.end)
+                length = range.end - range.begin
+                # BELOW is not affected by this check
+                shift_tags_comparison(comparison, add, tag, length, range)
+              end
+              Contrast::Utils::TagUtil.ordered_merge(value, add)
+            end
+          end
+
+          def shift_tags_comparison comparison, add, tag, length, range
+            case comparison
+              # part of the tag is being inserted on
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+              # the tag exists in the inserted range. it is partially shifted
+            when Contrast::Agent::Assess::Tag::WITHIN
+              tag.shift(length)
+              # the tag spans the range. leave the part below alone
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
+              tag.shift(length)
+            end
+          end
+
+          private
+
+          # Because of the auto-fill thing, we should not allow direct access to
+          # the tags hash. Instead, the methods above should be used to do
+          # operations like add, delete, and fetch.
+          #
+          # CONTRAST-22914
+          # please do NOT expose this w/ an attr_reader / accessor. there are
+          # helper methods in this class that safely access the hash. the tags
+          # method is private to avoid the side effect of a direct lookup with
+          # `[]` adding an empty array to the hash.
+          def tags
+            @_tags ||= Hash.new { |h, k| h[k] = [] }
+          end
+
+          # Given a tag, compare it to a given range and, if any part of that tag is within the range, return a new tag
+          # covering the union of the original tag and the range. This new tag will start at the
+          # max(tag.start, range.start) and end at min(tag.end, range.end)
+          #
+          # @param tag [Contrast::Agent::Assess::Tag] the Tag that may be in this range
+          # @param range [Range] the span to check, inclusive to exclusive
+          # @return [Contrast::Agent::Assess::Tag, nil] a new tag, truncated to only span within the given range or nil
+          #   if no overlap exists
+          def resize_to_range tag, range
+            comparison = tag.compare_range(range.begin, range.end)
+            # BELOW and ABOVE are not applicable to this check and result in nil
+            case comparison
+              # part of the tag is being selected
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+              # the tag exists in the requested range, figure out the boundaries
+            when Contrast::Agent::Assess::Tag::WITHIN
+              start = tag.start_idx - range.begin
+              finish = range.size - start
+              Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
+              # the tag spans the requested range.
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+              # part of the tag is being selected
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN # rubocop:disable Lint/DuplicateBranch
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+            end
+          end
+        end
+      end
+    end
+  end
+end