contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/extension/assess/fiber.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
+
+# In order to instrument some difficult methods like String#gsub, as it
+# returns an enumerator, we need to instrument methods on Fiber.
+# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
+# order to track what happens within Enumerator#next.
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Fiber Class or exposing our methods there.
+      class FiberPropagator
+        extend Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Scope::InstanceMethods
+
+        # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
+        FIBER_NEW_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_new',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_new'
+        }.cs__freeze
+        FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
+        private_constant :FIBER_NEW_NODE_HASH
+        private_constant :FIBER_NEW_NODE
+
+        FIBER_YIELD_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_yield',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_yield'
+        }.cs__freeze
+        FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
+        private_constant :FIBER_YIELD_NODE_HASH
+        private_constant :FIBER_YIELD_NODE
+
+        class << self
+          def track_rb_fiber_yield fiber, _method, results
+            return unless ::Contrast::ASSESS.enabled?
+
+            # results will be nil if StopIteration was raised,
+            # otherwise an Array of the yielded arguments
+            return unless results.cs__is_a?(Array)
+
+            with_contrast_scope do
+              results.each do |result|
+                next unless (result_properties = Contrast::Agent::Assess::Tracker.properties!(result))
+
+                result_properties.splat_from(fiber, result)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_YIELD_NODE, result, fiber, result, [])
+                result_properties.build_event(event_data)
+              end
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber#yield', e)
+          end
+
+          def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
+            return unless ::Contrast::ASSESS.enabled?
+            return unless underlying.is_a?(String) && !underlying.empty?
+
+            with_contrast_scope do
+              properties = Contrast::Agent::Assess::Tracker.properties!(fiber)
+              return unless properties
+
+              properties.splat_from(underlying, fiber)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_NEW_NODE, fiber, underlying, fiber, [])
+              properties.build_event(event_data)
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber.new', e)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/hash.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Hash propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds.
+      class HashPropagator
+        include Contrast::Components::Logger::InstanceMethods
+
+        class << self
+          def cs__duplicate_and_freeze object
+            return object unless object.is_a?(String) && !object.cs__frozen?
+
+            # Copy the object, then freeze it, so that it looks the same
+            # externally, but will have our finalizer on it.
+            copy = object.dup
+            Contrast::Agent::Assess::Tracker.pre_freeze(copy)
+            copy&.cs__freeze
+          rescue StandardError
+            # we'll rescue this error, but we can't log it here as that will
+            # result in a seg fault
+            object
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/kernel.rb

@@ -0,0 +1,124 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/extension/assess/exec_trigger'
+require 'contrast/components/logger'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/agent/patching/policy/patch'
+
+module Contrast
+  module Extension
+    module Assess
+      # This module provides us with a way to invoke Kernel propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Kernel Module or exposing our methods there.
+      module KernelPropagator
+        class << self
+          extend Contrast::Components::Logger::InstanceMethods
+          include Contrast::Components::Logger::InstanceMethods
+          include Contrast::Extension::Assess::ExecTrigger
+
+          # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+          # in, the entire result will be tracked out. We're going to take this
+          # approach for now b/c it's fast and easy. I don't super love it, and by
+          # that I mean I hate it.
+          #
+          # To actually track this, we'd have to find the index of the new things
+          # being added, then remove the tags at the range of the format marker,
+          # which is some arbitrary length thing, and add the new tags from the
+          # inserted string, shifted down by the length of the aforementioned
+          # marker.
+          #
+          # marker is in the format %[flags][width][.precision]type, type being a
+          # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+          #
+          # also, b/c Ruby hates us, there are things called absolute markers,
+          # (digit)$, that go in the flags section. These cannot be mixed w/ the
+          # order assumed type
+          #
+          # oh, and there's also %<name>type and %{name}... b/c of course there is
+          # -HM
+          def sprintf_tagger patcher, preshift, ret, _block
+            return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+            format_string = preshift.args[0]
+            args = preshift.args[1]
+
+            parent_events = []
+            track_sprintf(ret, format_string, args, parent_events)
+            event_data = Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                        ret,
+                                                                        preshift.object,
+                                                                        ret,
+                                                                        preshift.args)
+            properties.build_event(event_data, 1)
+
+            properties.event.instance_variable_set(:@_parent_events, parent_events)
+            ret
+          end
+
+          def track_sprintf result, format_string, args, parent_events
+            handle_sprintf_value(format_string, result, parent_events)
+            case args
+            when String
+              handle_sprintf_value(args, result, parent_events)
+            when Hash
+              handle_sprintf_hash(args, result, parent_events)
+            when Array
+              handle_sprintf_array(args, result, parent_events)
+            end
+          rescue StandardError => e
+            logger.error('Unable to track dataflow through sprintf', e)
+          end
+
+          private
+
+          def handle_sprintf_value value, result, parent_events
+            properties = Contrast::Agent::Assess::Tracker.properties(result)
+            return unless properties
+
+            value_properties = Contrast::Agent::Assess::Tracker.properties(value)
+            return unless value_properties
+
+            parent_events << value_properties.event if value_properties.event
+            properties.splat_from(value, result)
+          end
+
+          def handle_sprintf_array args, result, parent_events
+            args.each do |value|
+              handle_sprintf_value(value, result, parent_events)
+            end
+          end
+
+          def handle_sprintf_hash args, result, parent_events
+            args.each_value do |value|
+              handle_sprintf_value(value, result, parent_events)
+            end
+          end
+        end
+      end
+
+      # Used for Kernel exec aliasing since we have no other way of accessing the
+      # Kernel#exec under C if we alias it there.
+      module ContrastKernel
+        # Method to replace the call to Kernel#exec when applying alias patch.
+        # It will invoke  Contrast::Extension::Assess::KernelPropagator before
+        # calling the original method.
+        #
+        # @param source [String, Proc] Potentially untrusted shell command to execute.
+        # @return nil - This method will invoke the Kernel#exec which will
+        def cs__kernel_exec source
+          # Check if in contrast scope and we have source.
+          unless Contrast::Agent::Patching::Policy::Patch.in_contrast_scope? || source.nil?
+            Contrast::Agent::Patching::Policy::Patch.with_contrast_scope do
+              Contrast::Extension::Assess::KernelPropagator.apply_trigger(source)
+            end
+          end
+          # Call this in the end else any code bellow this call won't be executed.
+          Kernel.exec(source)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/marshal.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Marshal class
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      # This module is used for our Marshal.load patches
+      class MarshalPropagator
+        extend Contrast::Components::Scope::InstanceMethods
+
+        class << self
+          extend Contrast::Components::Logger::InstanceMethods
+          include Contrast::Components::Logger::InstanceMethods
+
+          def cs__load_protect arg
+            return if in_contrast_scope?
+
+            with_contrast_scope do
+              Contrast::Agent::Protect::Policy::AppliesDeserializationRule.prepended_invoke(arg)
+            end
+            nil
+          end
+
+          def cs__load_assess source, ret
+            with_contrast_scope do
+              return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
+              args = [source]
+              # source might not be all the args passed in, but it is the one we care
+              # about. we could pass in all the args in the last param here if it
+              # becomes an issue in rendering on TS
+              finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load),
+                                                                                     source, self, ret, *args)
+              Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+              properties.copy_from(source, ret)
+
+              node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(node, ret, self, ret, args)
+              properties.build_event(event_data)
+            rescue StandardError => e
+              logger.error('Unable to run Assess for Marshal.load', e)
+            end
+          end
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+
+      # Used for aliasing
+      module ContrastMarshal
+        def cs__marshal_load source
+          # Do the protect
+          Contrast::Extension::Assess::MarshalPropagator.cs__load_protect(source) if source
+          # call the original
+          result = Marshal.load(source) # rubocop:disable Security/MarshalLoad
+          # Do the assess
+          tracked = Contrast::Agent::Assess::Tracker::PROPERTIES_HASH.tracked?(source) if source
+          skip = Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis? if tracked
+          Contrast::Extension::Assess::MarshalPropagator.cs__load_assess(source, result) if skip
+          # return original
+          result
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/regexp.rb

@@ -0,0 +1,71 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Regexp Class or exposing our methods there.
+      class RegexpPropagator
+        extend Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Scope::InstanceMethods
+
+        REGEXP_EQUAL_SQUIGGLE_HASH = {
+            'id' => 'regexp_100',
+            'class_name' => 'Regexp',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => '=~',
+            'action' => 'CUSTOM',
+            'source' => 'P0',
+            'target' => 'R',
+            'patch_class' => 'Contrast::Extension::Assess::RegexpPropagator',
+            'patch_method' => 'track_equal_squiggle'
+        }.cs__freeze
+        REGEXP_EQUAL_SQUIGGLE_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
+        private_constant :REGEXP_EQUAL_SQUIGGLE_HASH
+        private_constant :REGEXP_EQUAL_SQUIGGLE_NODE
+
+        class << self
+          def track_equal_squiggle info_hash
+            return unless ::Contrast::ASSESS.enabled?
+
+            # Because we have a special case for this propagation,
+            # it falls out of regular scoping. As such, any patch to the `=~` method
+            # that goes through normal channels, like that for the redos rule,
+            # will force this to be in a scope of 1 (instead of the normal 0).
+            # As such, a scope of 1 here indicates that,
+            # so we know that we're in the top level call for this method.
+            # normal patch [-alias-]> special case patch [-alias-]> original method
+            # TODO: RUBY-686
+            return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
+
+            target = info_hash[:back_ref]
+            with_contrast_scope do
+              return unless (result = info_hash[:result])
+              return unless (string = info_hash[:string])
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+              properties.splat_from(string, target)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(REGEXP_EQUAL_SQUIGGLE_NODE,
+                                                                          target,
+                                                                          self,
+                                                                          result,
+                                                                          [string])
+              properties.build_event(event_data)
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Regexp#=~', e)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/string.rb

@@ -0,0 +1,84 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Class provides us with a way to invoke String propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # String Class or exposing our methods there.
+      class StringPropagator
+        extend Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Scope::InstanceMethods
+
+        NODE_HASH = {
+            'class_name' => 'String',
+            'instance_method' => true,
+            'method_name' => 'interpolate',
+            'method_visibility' => 'public',
+            'action' => 'CUSTOM',
+            'source' => 'O,P0',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'track_interpolation'
+        }.cs__freeze
+        INTERPOLATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
+
+        class << self
+          # We call this method from C, and the Scope check is happening there. If we are in
+          # Contrast Scope the method won't be invoked.
+          #
+          # @param inputs [Array<String>] Inputs for interpolation.
+          # @param result [String] The result from the interpolation.
+          def track_interpolation inputs, result
+            return unless inputs.any? { |input| Contrast::Agent::Assess::Tracker.tracked?(input) }
+            return unless (properties = Contrast::Agent::Assess::Tracker.properties!(result))
+
+            parent_events = []
+            offset = 0
+            inputs.each do |input|
+              properties.copy_from(input, result, offset)
+              add_dynamic_sources_info(input, result)
+              offset += input.length
+              parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
+              parent_events << parent_event if parent_event
+            end
+            event_data = Contrast::Agent::Assess::Events::EventData.new(INTERPOLATION_NODE,
+                                                                        result,
+                                                                        inputs,
+                                                                        result,
+                                                                        inputs)
+            properties.build_event(event_data)
+            properties.event.instance_variable_set(:@_parent_events, parent_events)
+          rescue StandardError => e
+            logger.error('Unable to track interpolation', e)
+          end
+
+          private
+
+          # When there is a string interpolation on input coming from tainted database,
+          # the Contrast::Agent::Assess::Properties::Updated.copy_from method won't copy
+          # the dynamic source properties needed in the build findings from TS to display
+          # the column and Table information as database source information.
+          #
+          # @param source [Object] the source object with the required properties.
+          # @param target [Object] the result form the interpolation and the object
+          # that needs to keep the source properties, in order to be reporter on
+          # trigger event.
+          # @return updated_properties [Hash<DynamicSourceInfo>, nil]
+          def add_dynamic_sources_info source, target
+            return unless (dynamic_props = Contrast::Agent::Assess::Tracker.properties(source)&.properties)
+
+            Contrast::Agent::Assess::Tracker.properties(target)&.add_properties(dynamic_props)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess.rb

@@ -0,0 +1,47 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    # @deprecated This is one of our earliest designs and is not nearly as
+    #   relevant given the move to C based patching and the lessons learned
+    #   therein.
+    #   Removing it requires a C refactor to handle the namespace.
+    module Assess
+      require 'contrast/agent/patching/policy/patcher'
+
+      require 'contrast/utils/tag_util'
+
+      # provider rules - have to come before policy
+      require 'contrast/agent/assess/rule/provider'
+
+      # tagging / dataflow
+      require 'contrast/agent/assess/policy/policy_node'
+      require 'contrast/agent/assess/policy/source_node'
+      require 'contrast/agent/assess/policy/source_method'
+      require 'contrast/agent/assess/policy/propagation_node'
+      require 'contrast/agent/assess/policy/propagation_method'
+      require 'contrast/agent/assess/policy/trigger_node'
+      require 'contrast/agent/assess/policy/trigger_method'
+      require 'contrast/agent/assess/policy/policy'
+      require 'contrast/agent/assess/policy/patcher'
+
+      # this needs to come first b/c array and others work on strings and
+      # expect them to be trackable
+      require 'contrast/extension/assess/string'
+
+      require 'contrast/extension/assess/array'
+      require 'contrast/extension/assess/erb'
+      require 'contrast/extension/assess/eval_trigger'
+      require 'contrast/extension/assess/fiber'
+      require 'contrast/extension/assess/hash'
+      require 'contrast/extension/assess/kernel'
+      require 'contrast/extension/assess/regexp'
+      require 'contrast/extension/assess/marshal'
+    end
+  end
+end

data/lib/contrast/{core_extensions → extension}/delegator.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'delegate'
+
 # Some developers override various methods on Delegator, which can often
 # involve changing expected method parity/behavior which in turn prevents us
 # from being able to reliably use affected methods. Let's alias these methods

data/lib/contrast/extension/extension.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    module Assess
+      # This is the main instrument helper giving the method of requiring C patches
+      #
+      module InstrumentHelper
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+
+          # Unites the different require methods into one, using only
+          # the provided path for the C patches
+          # parameters
+          # @param path[String] Path to the required patch
+          #
+          def instrument path
+            var_name, extracted_name = gen_name(path)
+            return if instance_variable_get(var_name) == true
+
+            instance_variable_set(var_name, assign_value(path))
+          rescue StandardError, LoadError => e
+            logger.error("Error loading #{ extracted_name&.nil? ? '' : extracted_name } patch", e)
+            false
+          end
+
+          # Some of the requires have some extra conditions for them to require
+          # the C patches, so this method is helping us move the logic by making some
+          # conditions
+          def assign_value path
+            case path
+            when /fiber/, /interpolation/
+              require(path) if Funchook.available?
+            else
+              require(path)
+            end
+            true
+          end
+
+          # Generate the needed instance variable name and return the extracted name
+          def gen_name path
+            extracted_name = path.split(%r{[\s_/]})&.uniq&.delete_if do |s|
+              s.empty? || s == 'cs' || s == 'assess' || s == 'track'
+            end
+            extracted_name = (extracted_name&.length || 0) > 1 ? extracted_name&.join('_') : extracted_name&.pop
+            ["@_instrument_#{ extracted_name }_track", extracted_name]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/inventory.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Extension
+    # Our top level Inventory namespace in the Core Extension section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    # @deprecated This is one of our earliest designs and is not nearly as
+    #   relevant given the move to C based patching and the lessons learned
+    #   therein.
+    module Inventory
+      require 'contrast/security_exception'
+      # patching
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
+    end
+  end
+end

data/lib/contrast/extension/module.rb

@@ -0,0 +1,16 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+# Some developers override various methods on Module, which can often involve
+# changing expected method parity/behavior which in turn prevents us from being
+# able to reliably use affected methods. Let's alias these method so that we
+# always have access to them.
+class Module
+  alias_method :cs__name, :name
+  alias_method :cs__constants, :constants
+  alias_method :cs__const_defined?, :const_defined?
+  alias_method :cs__const_get, :const_get
+  alias_method :cs__const_set, :const_set
+end

data/lib/contrast/extension/object.rb

@@ -0,0 +1,19 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# Some developers override various methods on Object, which can often involve
+# changing expected method parity/behavior which in turn prevents us from being
+# able to reliably use affected methods.
+# We alias these method so that we always have access to them.
+#
+# Because we use these methods in constructing classes (e.g., calling #freeze
+# on constants within class definitions) we do this aliasing ASAP.
+class Object
+  alias_method :cs__class, :class
+  alias_method :cs__freeze, :freeze
+  alias_method :cs__frozen?, :frozen?
+  alias_method :cs__is_a?, :is_a?
+  alias_method :cs__method, :method
+  alias_method :cs__respond_to?, :respond_to?
+  alias_method :cs__singleton_class, :singleton_class
+end