contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,8 +1,12 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/components/logger'
+require 'contrast/framework/manager'
+require 'contrast/extension/extension'
+require 'contrast/extension/assess/kernel'
+require 'contrast/extension/assess/marshal'
 
 module Contrast
   module Agent
@@ -11,45 +15,117 @@ module Contrast
         # Some modules diverge from our generic instrumentation and require custom instrumentation
         # after they've been loaded
         module AfterLoadPatcher
-          include Contrast::Components::Interface
-          access_component :logging
-
-          AFTER_LOAD_PATCHES = Set.new([
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                                             'contrast/rails_extensions/assess/action_controller_inheritance'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('ActiveRecord::Scoping::Named::ClassMethods',
-                                                                                               'contrast/rails_extensions/assess/active_record_named'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('ActiveRecord::AttributeMethods::Read::ClassMethods',
-                                                                                               'contrast/rails_extensions/assess/active_record'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('Sinatra::Base',
-                                                                                               'contrast/sinatra_extensions/inventory/sinatra_base')
-                                       ])
+          include Contrast::Components::Logger::InstanceMethods
 
           # After initialization run a catchup check to instrument any already loaded modules we care about
           def catchup_after_load_patches
-            applied = []
-            AFTER_LOAD_PATCHES.each do |after_load_patch|
+            apply_require_patches!
+            apply_direct_patches!
+            apply_load_patches!
+          end
+
+          private
+
+          # These patches need to be applied directly, not from our policy, so
+          # do so and do so only once. This should be the new standard so that
+          # there are no require time side effects of loading our core
+          # extensions.
+          def apply_direct_patches!
+            @_apply_direct_patches ||= begin
+              paths = %w[
+                array
+                basic_object
+                module
+                fiber_track
+                hash
+                kernel
+                marshal_module
+                regexp
+                string
+                string_interpolation
+              ].cs__freeze
+              paths.each do |p|
+                path_part = "cs__assess_#{ p }"
+                Contrast::Extension::Assess::InstrumentHelper.instrument("#{ path_part }/#{ path_part }")
+              end
+              # apply Kernel#exec alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Kernel, :exec, false)
+                apply_kernel_exec_alias_patch
+              end
+              # apply Marshal load alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Marshal, :load, false)
+                apply_marshal_load_alias_patch
+              end
+              apply_array_join_prepend_patch if Contrast::Agent::Assess.cs__object_method_prepended?(Array, :join, true)
+              true
+            end
+          end
+
+          def apply_load_patches!
+            after_load_patches.each do |after_load_patch|
               next unless after_load_patch.target_defined?
+              next if ::Contrast::AGENT.skip_instrumentation?(after_load_patch.module_name)
 
-              logger.debug("Detected loading of #{ after_load_patch.module_name } - applying instrumentation")
+              logger.trace('Catching up on already loaded afterload patch - applying instrumentation',
+                           module: after_load_patch.module_name)
               after_load_patch.instrument!
-              applied << after_load_patch
+            rescue NameError => e
+              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name,
+                                                                     method: after_load_patch.method_to_instrument)
+            rescue StandardError => e
+              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name,
+                                                                 method: after_load_patch.method_to_instrument)
+            end
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # These patches need to be applied directly, not from our policy, and
+          # are applied as a result of requiring the file as they alias methods
+          # directly, allowing us to control things like scope and exception
+          # handling
+          def apply_require_patches!
+            @_apply_require_patches ||= begin
+              require('contrast/extension/thread')
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
             end
-            AFTER_LOAD_PATCHES.subtract(applied)
+          end
+
+          def after_load_patches
+            @_after_load_patches ||= Contrast::Agent.framework_manager.find_after_load_patches
           end
 
           # Use for any checks after we've initialized
           def load_patches_for_module module_name
-            return if AFTER_LOAD_PATCHES.empty?
+            return if after_load_patches.empty?
 
-            patch = AFTER_LOAD_PATCHES.find { |after_load_patch| after_load_patch.applies?(module_name) }
+            patch = after_load_patches.find { |after_load_patch| after_load_patch.applies?(module_name) }
             return unless patch
 
-            logger.debug("Detected loading of #{ module_name } - applying instrumentation")
-
+            logger.trace('Detected loading of afterload patch - applying instrumentation', module: module_name)
             patch.instrument!
-            AFTER_LOAD_PATCHES.subtract([patch]) if patch.applied?
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # Applies the Kernel#exec alias patch
+          def apply_kernel_exec_alias_patch
+            Kernel.extend(Contrast::Extension::Assess::ContrastKernel)
+            Marshal.alias_method(:cs__kernel_exec, :exec)
+            Marshal.alias_method(:exec, :cs__kernel_exec)
+          end
+
+          # Applies the Marshal#load alias patch
+          def apply_marshal_load_alias_patch
+            Marshal.extend(Contrast::Extension::Assess::ContrastMarshal)
+            Marshal.alias_method(:cs__marshal_load, :load)
+            Marshal.alias_method(:load, :cs__marshal_load)
+          end
+
+          # Prepend Contrast::Extension::Assess::ContrastArray to pick up the ContrastArray#join method
+          def apply_array_join_prepend_patch
+            Array.prepend(Contrast::Extension::Assess::ContrastArray)
           end
         end
       end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -1,29 +1,45 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/patching/policy/method_policy_extend'
+
 module Contrast
   module Agent
     module Patching
       module Policy
         # This class is used to map each method to the trigger node that applies to it
         class MethodPolicy
-          attr_accessor :source_node, :propagation_node, :trigger_node,
-                        :inventory_node, :protect_node, :deadzone_node,
-                        :method_name, :method_visibility, :instance_method
-          def initialize(source_node: nil, propagation_node: nil,
-                         trigger_node: nil, inventory_node: nil,
-                         protect_node: nil, deadzone_node: nil,
-                         method_name: nil, method_visibility: nil,
-                         instance_method: nil)
-            @method_name = method_name
-            @method_visibility = method_visibility
-            @instance_method = instance_method
-            @source_node = source_node
-            @propagation_node = propagation_node
-            @trigger_node = trigger_node
-            @inventory_node = inventory_node
-            @protect_node = protect_node
-            @deadzone_node = deadzone_node
+          extend Contrast::Agent::Patching::Policy::MethodPolicyExtend
+          attr_reader   :deadzone_node, :inventory_node, :propagation_node, :protect_node, :trigger_node
+          attr_accessor :source_node, :method_name, :method_visibility, :instance_method
+
+          # Initialize new method policy with:
+          #
+          # @param method_policy [Hash]
+          #  {
+          #   source_node       [ Contrast::Agent::Assess::Policy::SourceNode      ]
+          #   propagation_node  [ Contrast::Agent::Assess::Policy::PropagationNode ]
+          #   trigger_node      [ Contrast::Agent::Assess::Policy::TriggerNode     ]
+          #   inventory_node    [ Contrast::Agent::Inventory::Policy::TriggerNode   ]
+          #   protect_node      [ Contrast::Agent::Protect::Policy::TriggerNode     ]
+          #   deadzone_node     [ Contrast::Agent::Deadzone::Policy::DeadzoneNode   ]
+          #   method_name       [ Symbol                                            ]
+          #                       the name of the method for this policy
+          #   method_visibility [ Symbol                                            ]
+          #                       Public, Private Protected
+          #   instance_method   [ Boolean                                           ]
+          #                       true if this method is an instance method
+          #  }
+          def initialize method_policy
+            @method_name = method_policy[:method_name]
+            @method_visibility = method_policy[:method_visibility]
+            @instance_method = method_policy[:instance_method]
+            @source_node = method_policy[:source_node]
+            @propagation_node = method_policy[:propagation_node]
+            @trigger_node = method_policy[:trigger_node]
+            @inventory_node = method_policy[:inventory_node]
+            @protect_node = method_policy[:protect_node]
+            @deadzone_node = method_policy[:deadzone_node]
           end
 
           def private_method?
@@ -31,61 +47,34 @@ module Contrast
           end
 
           def empty?
-            return false if source_node
-            return false if propagation_node
-            return false if trigger_node
-            return false if inventory_node
-            return false if protect_node
-            return false if deadzone_node
+            nodes.none?
+          end
 
-            true
+          def scopes_to_enter
+            @_scopes_to_enter ||= method_scopes
+          end
+
+          def scopes_to_exit
+            @_scopes_to_exit ||= method_scopes.reverse
           end
 
           def requires_custom_patch?
             !!@trigger_node&.custom_patch?
           end
 
-          class << self
-            # Given a Contrast::Agent::Patching::Policy::ModulePolicy, parse
-            # out its information for the given method in order to construct a
-            # Contrast::Agent::Patching::Policy::MethodPolicy
-            #
-            # @param method_name [Symbol] the name of the method for this policy
-            # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy]
-            #   the entire policy for this module
-            # @param instance_method [Boolean] true if this method is an
-            #   instance method
-            # @return [Contrast::Agent::Patching::Policy::MethodPolicy]
-            def build_method_policy method_name, module_policy, instance_method
-              source_node =      find_method_node(module_policy.source_nodes, method_name, instance_method)
-              propagation_node = find_method_node(module_policy.propagator_nodes, method_name, instance_method)
-              trigger_node =     find_method_node(module_policy.trigger_nodes, method_name, instance_method)
-              protect_node =     find_method_node(module_policy.protect_nodes, method_name, instance_method)
-              inventory_node =   find_method_node(module_policy.inventory_nodes, method_name, instance_method)
-              deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
-              method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node, inventory_node, deadzone_node)
-              MethodPolicy.new(method_name: method_name,
-                               method_visibility: method_visibility,
-                               instance_method: instance_method,
-                               source_node: source_node,
-                               propagation_node: propagation_node,
-                               trigger_node: trigger_node,
-                               protect_node: protect_node,
-                               inventory_node: inventory_node,
-                               deadzone_node: deadzone_node)
-            end
-
-            def find_method_node nodes, method_name, is_instance_method
-              return nil unless nodes
+          private
 
-              nodes.find do |node|
-                node.instance_method? == is_instance_method && node.method_name == method_name
-              end
-            end
+          def nodes
+            @_nodes ||= [
+              source_node, propagation_node, trigger_node, inventory_node, protect_node,
+              deadzone_node
+            ].compact
+          end
 
-            def find_visibility *nodes
-              nodes.find { |node| node }&.method_visibility
-            end
+          def method_scopes
+            # Implicitly, the scope precedence is the node order
+            # defined by #nodes.
+            @_method_scopes ||= nodes.flat_map(&:method_scope).tap(&:compact!).tap(&:uniq!)
           end
         end
       end

data/lib/contrast/agent/patching/policy/method_policy_extend.rb

@@ -0,0 +1,113 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Patching
+      module Policy
+        # This class is used to map each method to the trigger node that applies to it
+        module MethodPolicyExtend
+          # Given a Contrast::Agent::Patching::Policy::ModulePolicy, parse
+          # out its information for the given method in order to construct a
+          # Contrast::Agent::Patching::Policy::MethodPolicy
+          #
+          # @param method_name [Symbol] the name of the method for this policy
+          # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy]
+          #   the entire policy for this module
+          # @param instance_method [Boolean] true if this method is an
+          #   instance method
+          # @return [Contrast::Agent::Patching::Policy::MethodPolicy]
+          def build_method_policy method_name, module_policy, instance_method
+            source_node =      find_method_node(module_policy.source_nodes, method_name, instance_method)
+            propagation_node = find_method_node(module_policy.propagator_nodes, method_name, instance_method)
+            trigger_node =     find_method_node(module_policy.trigger_nodes, method_name, instance_method)
+            protect_node =     find_method_node(module_policy.protect_nodes, method_name, instance_method)
+            inventory_node =   find_method_node(module_policy.inventory_nodes, method_name, instance_method)
+            deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
+            method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
+                                                inventory_node, deadzone_node)
+            method_policy = MethodPolicy.new({
+                                                 method_name: method_name,
+                                                 method_visibility: method_visibility,
+                                                 instance_method: instance_method,
+                                                 source_node: source_node,
+                                                 propagation_node: propagation_node,
+                                                 trigger_node: trigger_node,
+                                                 protect_node: protect_node,
+                                                 inventory_node: inventory_node,
+                                                 deadzone_node: deadzone_node
+                                             })
+
+            return method_policy unless check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node,
+                                                                         protect_node, inventory_node, deadzone_node)
+
+            create_new_node(module_policy, method_policy) if module_policy.deadzone_nodes&.any?
+            method_policy
+          end
+
+          def find_method_node nodes, method_name, is_instance_method
+            return unless nodes
+
+            nodes.find do |node|
+              node.instance_method? == is_instance_method && node.method_name == method_name
+            end
+          end
+
+          def find_visibility *nodes
+            nodes.find { |node| node }&.method_visibility
+          end
+
+          def check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node, protect_node,
+                                               inventory_node, deadzone_node)
+            return false unless source_node.nil? && propagation_node.nil? && trigger_node.nil? && protect_node.nil? &&
+                inventory_node.nil? && deadzone_node.nil?
+
+            true
+          end
+
+          private
+
+          def create_new_node module_policy, method_policy
+            return if module_policy.deadzone_nodes.empty?
+
+            module_policy.deadzone_nodes.map do |node|
+              next unless node.method_name.nil?
+
+              klass = Module.cs__const_get(node.class_name)
+              next unless it_defined?(klass, method_policy.method_name)
+
+              new_node = set_new_node(method_policy, klass, node)
+              method_policy.instance_variable_set(:@method_visibility, new_node.method_visibility)
+              method_policy.instance_variable_set(:@deadzone_node, node)
+              module_policy.deadzone_nodes << new_node
+              break unless method_policy.deadzone_node.nil?
+            end
+          end
+
+          # Helper method for creating new node
+          #
+          # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
+          #   used to map each method to the trigger node that applies to it
+          # @param klass [String] classname
+          # @param node [Contrast::Agent::Patching::Policy::PolicyNode]
+          # @return @_set_new_node [Contrast::Agent::Deadzone::Policy::DeadzoneNode]
+          def set_new_node method_policy, klass, node
+            new_node = {}
+            new_node['instance_method'] = method_policy.instance_method
+            new_node['method_visibility'] =
+              klass.private_method_defined?(method_policy.method_name) ? 'private' : 'public'
+            new_node['method_name'] = method_policy.method_name
+            new_node['class_name'] = node.class_name
+            @_set_new_node = Contrast::Agent::Deadzone::Policy::DeadzoneNode.new(new_node)
+          end
+
+          def it_defined? klass, method_name
+            klass.instance_methods(false).include?(method_name) ||
+                klass.private_instance_methods(false).include?(method_name) ||
+                klass.singleton_methods(false).include?(method_name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -12,20 +12,24 @@ module Contrast
         # rather than new.
         class ModulePolicy
           class << self
-            # Given the name of a module, create a :ModulePolicy for it using
-            # the Policy of each supported feature
+            # Given the name of a module, create a :ModulePolicy for it using the Policy of each supported feature.
             #
-            # @param module_name [String] the name of the module to which the
-            #   policy applies
+            # @param module_name [String] the name of the module to which the policy applies.
             # @return [Contrast::Agent::Patching::Policy::ModulePolicy]
             def create_module_policy module_name
               module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.new
-              module_policy.source_nodes =      nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.sources, module_name)
-              module_policy.propagator_nodes =  nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.propagators, module_name)
-              module_policy.trigger_nodes =     nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.triggers, module_name)
-              module_policy.protect_nodes =     nodes_for_module(Contrast::Agent::Protect::Policy::Policy.instance.triggers, module_name)
-              module_policy.inventory_nodes =   nodes_for_module(Contrast::Agent::Inventory::Policy::Policy.instance.triggers, module_name)
-              module_policy.deadzone_nodes =    nodes_for_module(Contrast::Agent::Deadzone::Policy::Policy.instance.deadzones, module_name)
+              module_policy.source_nodes =      nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.sources, module_name)
+              module_policy.propagator_nodes =  nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.propagators, module_name)
+              module_policy.trigger_nodes =     nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.triggers, module_name)
+              module_policy.protect_nodes =     nodes_for_module(
+                  Contrast::Agent::Protect::Policy::Policy.instance.triggers, module_name)
+              module_policy.inventory_nodes =   nodes_for_module(
+                  Contrast::Agent::Inventory::Policy::Policy.instance.triggers, module_name)
+              module_policy.deadzone_nodes =    nodes_for_module(
+                  Contrast::Agent::Deadzone::Policy::Policy.instance.deadzones, module_name)
               module_policy
             end
 
@@ -42,7 +46,8 @@ module Contrast
             end
           end
 
-          attr_accessor :source_nodes, :propagator_nodes, :trigger_nodes, :inventory_nodes, :protect_nodes, :deadzone_nodes
+          attr_accessor :source_nodes, :propagator_nodes, :trigger_nodes, :inventory_nodes, :protect_nodes,
+                        :deadzone_nodes
 
           def empty?
             return false if source_nodes.any?
@@ -61,43 +66,18 @@ module Contrast
           # @return [Integer] count of methods to be patched
           def num_expected_patches
             @_num_expected_patches ||= begin
-                                         instance_methods = Set.new
-                                         singleton_methods = Set.new
-                                         sort_method_names(source_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(propagator_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(trigger_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(inventory_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(protect_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
-                                         instance_methods.length + singleton_methods.length
-                                       end
-          end
-
-          def collect_class_nodes nodes, clazz_name
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless nodes
-
-            nodes.select { |policy_node| clazz_name == policy_node.class_name }
-          end
-
-          def collect_method_nodes nodes, method, instance_method
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless nodes
-
-            nodes.select do |node|
-              node.instance_method? == instance_method && node.method_name == method
+              instance_methods = Set.new
+              singleton_methods = Set.new
+              sort_method_names(source_nodes, instance_methods, singleton_methods)
+              sort_method_names(propagator_nodes, instance_methods, singleton_methods)
+              sort_method_names(trigger_nodes, instance_methods, singleton_methods)
+              sort_method_names(inventory_nodes, instance_methods, singleton_methods)
+              sort_method_names(protect_nodes, instance_methods, singleton_methods)
+              sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
+              instance_methods.length + singleton_methods.length
             end
           end
 
-          def create_method_policy_subset method, instance_method
-            method_policy = ModulePolicy.new
-            method_policy.source_nodes =     collect_method_nodes(source_nodes, method, instance_method)
-            method_policy.propagator_nodes = collect_method_nodes(propagator_nodes, method, instance_method)
-            method_policy.trigger_nodes =    collect_method_nodes(trigger_nodes, method, instance_method)
-            method_policy.inventory_nodes =  collect_method_nodes(inventory_nodes, method, instance_method)
-            method_policy.protect_nodes =    collect_method_nodes(protect_nodes, method, instance_method)
-            method_policy.deadzone_nodes =   collect_method_nodes(deadzone_nodes, method, instance_method)
-            method_policy
-          end
-
           private
 
           def sort_method_names nodes, instance_methods, singleton_methods