contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'singleton'
-cs__scoped_require 'contrast/components/interface'
+require 'singleton'
+require 'contrast/components/sampling'
 
 module Contrast
   module Utils
@@ -11,15 +11,15 @@ module Contrast
       class SamplingUtil
         include Singleton
 
-        include Contrast::Components::Interface
-        access_component :sampling
+        extend Contrast::Components::Sampling::InstanceMethods
 
         def initialize
           @requests = {}
         end
 
         def update
-          @enabled            = self.class.sampling_control[:enabled]
+          self.class.reset_sampling_control
+          @enabled            = self.class.sampling_enabled?
           @baseline           = self.class.sampling_control[:baseline]
           @request_frequency  = self.class.sampling_control[:request_frequency]
           @response_frequency = self.class.sampling_control[:response_frequency]
@@ -28,18 +28,14 @@ module Contrast
           true
         end
 
-        def reset
-          @requests.clear
-        end
-
         def sample? request
-          history = request_history(request)
-          history.hit
-
           # if sampling isn't enabled, we record all requests and take a
           # default amount of responses
           return [true, true] unless @enabled
 
+          history = request_history(request)
+          history.hit
+
           # if we've exceeded this sample window, reset it
           if history.elapsed >= @window_ms
             history.reset_window
@@ -64,20 +60,18 @@ module Contrast
 
         # RequestHistory tracks one requests history per time window
         class RequestHistory
-          attr_accessor :window_start, :total_hit, :window_hit
+          attr_reader :window_start, :window_hit
 
           def initialize
             @window_start = Contrast::Utils::Timer.now_ms
-            @total_hit = 0
             @window_hit = 0
           end
 
           def elapsed
-            Contrast::Utils::Timer.now_ms - @window_start
+            Contrast::Utils::Timer.now_ms - window_start
           end
 
           def hit cnt = 1
-            @total_hit += cnt
             @window_hit += cnt
           end
 

data/lib/contrast/utils/assess/source_method_utils.rb

@@ -0,0 +1,74 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module will include all methods for some internal validations in the SourceMethod module
+      # and some other module methods from the same place, so we can ease the main module
+      module SourceMethodUtils
+        # Find the name of the source
+        #
+        # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+        #   event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        # @return [String, nil] the human readable name of the target to which this source event applies, or nil if
+        #   none provided by the node
+        def determine_source_name source_node, object, ret, *args
+          return source_node.get_property('dynamic_source_name') if source_node.type == 'UNTRUSTED_DATABASE'
+
+          source_node_source = source_node.sources[0]
+          case source_node_source
+          when nil
+            nil
+          when Contrast::Utils::ObjectShare::RETURN_KEY
+            ret
+          when Contrast::Utils::ObjectShare::OBJECT_KEY
+            object
+          else
+            args[source_node_source]
+          end
+        end
+
+        # Determine if we should analyze this method invocation for a Source or not. We should if we have enough
+        # information to build the context of this invocation, we're not disabled, and we can't immediately
+        # determine the invocation was done safely.
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
+        #   method being called
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        # @return [boolean] if the invocation of this method should be analyzed
+        def analyze? method_policy, object, ret, args
+          return false unless method_policy&.source_node
+          return false unless ::Contrast::ASSESS.enabled?
+          return false unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+
+          !safe_invocation?(method_policy.source_node, object, ret, args)
+        end
+
+        # Determine if the method was invoked safely.
+        #
+        # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+        #   event
+        # @param _object [Object] the Object on which the method was invoked
+        # @param _ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        # @return [boolean] if the invocation of this method was safe
+        def safe_invocation? source_node, _object, _ret, args
+          # According the the Rack Specification https://github.com/rack/rack/blob/master/SPEC.rdoc, any header
+          # from the Request will start with HTTP_. As such, only Headers with that key should be considered for
+          # tracking, as the others have come from the Framework or Middleware stashing in the ENV. Rails, for
+          # instance, uses action_dispatch. to store several values. Technically, you can't call
+          # Rack::Request#get_header without a parameter, and that parameter should be a String, but trust no one.
+          source_node.id == 'Assess:Source:Rack::Request::Env#get_header' &&
+              args&.any? &&
+              !args[0].to_s.start_with?('HTTP_')
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/split_utils.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module extends the Split class which is specifically for String#split & String#grapheme_clusters
+      # propagation it propagates tag ranges from a string to elements within an untracked array
+      module SplitUtils
+        private
+
+        # Quick hook to the String#split propagation node in our Assess policy
+        #
+        # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
+        def split_node
+          @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+            node.class_name == 'String' && node.method_name == :split && node.instance_method?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,37 +1,113 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/object'
+require 'contrast/agent/assess/tracker'
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Utils
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
-        def self.tracked? obj
-          return false if obj.nil?
+        extend Contrast::Components::Logger::InstanceMethods
 
-          if Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(obj)
+        class << self
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def tracked? obj
+            _tracked?(obj, 0)
+          end
+
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def trackable? obj
+            _trackable?(obj, 0)
+          end
+
+          private
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def _tracked? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              handle_hash(obj, idx)
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              handle_enumerable(obj, idx)
+            else
+              Contrast::Agent::Assess::Tracker.tracked?(obj)
+            end
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine tracking', e, module: obj.cs__class)
+            false
+          end
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if trackable
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   trackable.
+          def _trackable? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              handle_hash(obj, idx)
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              handle_enumerable(obj, idx)
+            else
+              Contrast::Agent::Assess::Tracker.trackable?(obj)
+            end
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine trackable', e, module: obj.cs__class)
+            false
+          end
+
+          def handle_hash obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
             obj.each_pair do |k, v|
-              return true if tracked?(k)
-              return true if tracked?(v)
+              return true if send(caller_method, k, idx)
+              return true if send(caller_method, v, idx)
             end
             false
-          elsif Contrast::Utils::DuckUtils.quacks_like_tracked_enumerable?(obj)
+          end
+
+          def handle_enumerable obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
             obj.any? do |ele|
-              tracked?(ele) unless obj == ele
+              send(caller_method, ele, idx) unless obj == ele
             end
-          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-            obj.cs__tracked?
-          else
-            false
           end
-        rescue StandardError => e
-          # This is used to ask if a ton of objects are tracked. They may not
-          # all be iterable. Bad things could happen in some cases, like when
-          # checking a closed statement for SQL injection trigger events
-          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
-          false
         end
       end
     end

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -0,0 +1,132 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/assess/event_limit_utils'
+
+module Contrast
+  module Utils
+    module Assess
+      # This module will include all methods for some internal validations/appliers in the TriggerMethod module
+      # and some other module methods from the same place, so we can ease the main module
+      module TriggerMethodUtils
+        extend Contrast::Utils::Assess::EventLimitUtils
+        # A request is reportable if it is not from ActionController::Live
+        #
+        # @param env [Hash] the env of the Request
+        # @return [Boolean]
+        def reportable? env
+          !(defined?(ActionController::Live) &&
+            env &&
+            env['action_controller.instance'].cs__class.included_modules.include?(ActionController::Live))
+        end
+
+        # Find the request for this finding. This assumes, for now, that if there is an active request, then that
+        # is the request to report. Otherwise, we'll use the first request found in the events of the
+        # source_object if the non request tracking flag is set.
+        #
+        # @param source [Object,nil] some Object used as the source of a trigger event
+        # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
+        def find_request source
+          return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless ::Contrast::ASSESS.non_request_tracking?
+          return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
+
+          find_event_request(properties.event)
+        end
+
+        # Finds the first request along the left most tree of parent events
+        #
+        # @param event [Contrast::Agent::Reporting::FindingEvent]
+        # @return [Contrast::Agent::Request, nil]
+        def find_event_request event
+          return event.request if event&.source_type
+
+          idx = 0
+          while idx <= event.parent_events.length
+            found = find_event_request(event.parent_events[idx])
+            return found if found
+
+            idx += 1
+          end
+
+          event.request
+        end
+
+        # ===== APPLIERS =====
+        # This is our method that actually checks the taint on the object our trigger_node targets.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+        #   trigger event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_trigger trigger_node, source, object, ret, *args
+          return unless trigger_node
+          return if trigger_node.rule_disabled?
+          return if trigger_node.dataflow? && source.nil?
+
+          if trigger_node.regexp_rule?
+            apply_regexp_rule(trigger_node, source, object, ret, *args)
+          elsif trigger_node.custom_trigger?
+            trigger_node.apply_custom_trigger(trigger_node, source, object, ret, *args)
+          elsif trigger_node.dataflow?
+            apply_dataflow_rule(trigger_node, source, object, ret, *args)
+          else # trigger rule - just calling the method is dangerous
+            finding = build_finding(trigger_node, source, object, ret, *args)
+            Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
+          end
+        rescue StandardError => e
+          logger.warn('Unable to apply trigger', e, node_id: trigger_node.id)
+        end
+
+        # This is our method that actually checks the taint on the object our trigger_node targets for our Regexp
+        # based rules.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this trigger
+        #   event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_regexp_rule trigger_node, source, object, ret, *args
+          return unless source.is_a?(String)
+          return if trigger_node.good_value && source.match?(trigger_node.good_value)
+          return if trigger_node.bad_value && source !~ trigger_node.bad_value
+
+          finding = build_finding(trigger_node, source, object, ret, *args)
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
+        end
+
+        # This is our method that actually checks the taint on the object our trigger_node targets for our Dataflow
+        # based rules.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+        #   trigger event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_dataflow_rule trigger_node, source, object, ret, *args
+          return unless source && Contrast::Agent::Assess::Tracker.tracked?(source)
+
+          if Contrast::Agent::Assess::Tracker.trackable?(source)
+            return unless trigger_node.violated?(source)
+
+            finding = build_finding(trigger_node, source, object, ret, *args)
+            report_finding(finding) if finding
+          elsif Contrast::Utils::DuckUtils.iterable_hash?(source)
+            source.each_pair do |key, value|
+              apply_dataflow_rule(trigger_node, key, object, ret, *args)
+              apply_dataflow_rule(trigger_node, value, object, ret, *args)
+            end
+          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(source)
+            source.each do |value|
+              apply_dataflow_rule(trigger_node, value, object, ret, *args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/class_util.rb

@@ -1,57 +1,144 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/object'
+require 'contrast/extension/module'
+require 'contrast/utils/object_share'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Utils
-    # Utility methods for exploring the complete space of objects
+    # Utility methods for exploring the complete space of Objects
     class ClassUtil
-      def self.ancestors_of clazz
-        arr = []
-        ObjectSpace.each_object(Module) do |obj|
-          next unless obj <= clazz
+      @lru_cache = LRUCache.new(300)
+      @string_cache = LRUCache.new(300)
+      class << self
+        # some classes have had things prepended to them, like Marshal in Rails 5 and higher. Their
+        # ActiveSupport::MarshalWithAutoloading will break our alias patching approach, as will any other prepend on
+        # something that we touch. Prepend and Alias are inherently incompatible monkey patching approaches. As such,
+        # we need to know if something has been prepended to.
+        #
+        # @param mod [Module] the Module to check to see if it has had something prepended
+        # @param ancestors [Array<Module>] the array of ancestors for the mod
+        # @return [Boolean] if the mod has been prepended or not
+        def prepended? mod, ancestors = nil
+          ancestors ||= mod.ancestors
+          ancestors[0] != mod
+        end
+
+        # return true if the given method is overwritten by one of the ancestors in the ancestor change that comes
+        # before the given module
+        #
+        # @param mod [Module] the Module to check to see if it has had something prepended
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that holds the method we
+        #   need to check
+        # @return [Boolean] if this method specifically was prepended
+        def prepended_method? mod, method_policy
+          target_module = determine_target_class(mod, method_policy.instance_method)
+          ancestors = target_module.ancestors
+          return false unless prepended?(target_module, ancestors)
+
+          ancestors.each do |ancestor|
+            break if ancestor == target_module
 
-          arr << obj
+            methods = ancestor.instance_methods(false)
+            return true if methods.include?(method_policy.method_name)
+          end
+          false
         end
-        arr
-      end
 
-      # some classes have had things prepended to them, like Marshal in Rails
-      # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
-      # our alias patching approach, as will any other prepend on something
-      # that we touch. Prepend and Alias are inherently incompatible monkey
-      # patching approaches. As such, we need to know if something has been
-      # prepended to.
-      #
-      # return true if the given module is not its first ancestor
-      def self.prepended? mod, ancestors = nil
-        ancestors ||= mod.ancestors
-        ancestors[0] != mod
-      end
+        # Return a String representing the object invoking this method in the form expected by our dataflow events.
+        # After implementing the LRU Cache, we firstly need to check if already had that object cached and if we have
+        # it - we can return it directly; otherwise we'll calculate and store the result before returning.
+        #
+        # Combining of the caches have close performance, but keeping the two with current implementation has
+        # a slight advantage in performance. For now we can keep the things the way they are.
+        #
+        # @param object [Object, nil] the entity to convert to a String
+        # @return [String, Object] the human readable form of the String, as defined by
+        #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
+        def to_contrast_string object
+          # Only treat object like a string if it actually is a string+ some subclasses of String override string
+          # methods we depend on
+          if object.cs__class == String
+            return @string_cache[object] if @string_cache.key?(object)
 
-      def self.determine_target_class mod, is_instance
-        return mod if mod.singleton_class?
+            @string_cache[object] = to_cached_string(object) || object.dup
+          else
+            return @lru_cache[object.__id__] if @lru_cache.key?(object.__id__)
 
-        return mod.cs__singleton_class unless is_instance
+            @lru_cache[object.__id__] = convert_object(object)
+          end
+        end
 
-        mod
-      end
+        def convert_object object
+          if object.nil?
+            Contrast::Utils::ObjectShare::NIL_STRING
+          elsif object.cs__is_a?(Symbol)
+            ":#{ object }"
+          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+            "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
+          elsif use_to_s?(object)
+            object.to_s
+          else
+            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+          end
+        end
+
+        # The method Module.const_defined? can raise an exception if the constant is poorly named. As such, we need to
+        # handle the case where that exception is raised.
+        #
+        # @param name [String] the name of the constant to look up
+        # @return [Boolean]
+        def truly_defined? name
+          return false unless name
 
-      # return true if the given method is overwritten by one of the ancestors
-      # in the ancestor change that comes before the given module
-      def self.prepended_method? mod, method_policy
-        target_module = determine_target_class mod, method_policy.instance_method
-        ancestors = target_module.ancestors
-        return false unless prepended?(target_module, ancestors)
+          Module.cs__const_defined?(name)
+        rescue NameError # account for nonsense / poorly formatted constants
+          false
+        end
+
+        private
+
+        # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list
+        # approach.
+        #
+        # @param object [Object] something that may have a safe to_s method
+        # @return [Boolean] if we should invoke to_s to represent the object
+        def use_to_s? object
+          return true if object.cs__is_a?(Numeric)
+          return true if defined?(Arel::Nodes::SqlLiteral) && object.cs__is_a?(Arel::Nodes::SqlLiteral)
+
+          false
+        end
+
+        # Find the target class based on the instance, or module, provided. If a module, return it.
+        #
+        # @param mod [Module] the Module, or instance of a Module, that we need to check
+        # @param is_instance [Boolean] is the object provided an instance of a class, requiring lookup by class
+        # @return [Module]
+        def determine_target_class mod, is_instance
+          return mod if mod.singleton_class?
+
+          return mod.cs__singleton_class unless is_instance
+
+          mod
+        end
 
-        ancestors.each do |ancestor|
-          break if ancestor == target_module
+        # If the String matches a common String in our ObjectShare, return that rather that for use as the
+        # representation of the String rather than forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast representation.
+        # @return [String, nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
 
-          methods = ancestor.instance_methods(false)
-          return true if methods.include?(method_policy.method_name)
+          nil
         end
-        false
       end
     end
   end