contrast-agent 3.8.5 → 3.9.0

data/lib/contrast/framework/platform_version.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    # Used to map version strings from frameworks to ApplicationUpdate dtm
+    class PlatformVersion
+      attr_reader :major, :minor, :patch
+      def initialize major, minor, patch
+        @major = major || ''
+        @minor = minor || ''
+        @patch = patch || ''
+      end
+
+      def self.from_string platform_version_string
+        version_array = platform_version_string.split(Contrast::Utils::ObjectShare::PERIOD)
+        new(version_array[0], version_array[1], version_array[2])
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails_support.rb

@@ -0,0 +1,88 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    # Used when Rails is present to define framework specific behavior
+    class RailsSupport < BaseSupport
+      class << self
+        RAILS_VIEWS = [
+          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
+        ].cs__freeze
+
+        RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
+
+        def detection_class
+          'Rails'
+        end
+
+        def version
+          Rails.version
+        end
+
+        def application_name
+          # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
+          # and instead we need to use parent_module_name
+          return Rails.application.cs__class.parent_module_name if Gem::Version.new(Rails.version) >= RAILS_MODULE_NAME_VERSION
+
+          Rails.application.cs__class.parent_name
+        end
+
+        def server_type
+          'rails'
+        end
+
+        def scan_views
+          scan_view_directories(RAILS_VIEWS)
+        end
+
+        def collect_routes
+          routes = Rails.application.routes.routes.map do |route|
+            route_to_coverage(route)
+          end
+          routes
+        end
+
+        def current_route request
+          return unless Rails.cs__respond_to?(:application)
+
+          # returns array of arrays [[match_data, path_parameters, route]], sorted by
+          # precedence
+          # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
+          # path_parameters: hash of various things
+          # route: ActionDispatch::Journey::Route
+          full_routes = Rails.application.routes.router.send(:find_routes, request.rack_request)
+          return if full_routes.empty?
+
+          full_route = full_routes[0] # [match_data, path_parameters, route]
+          return unless full_route
+
+          route = full_route[2] # route w/ highest precedence
+          return unless route
+
+          route_to_coverage(route)
+        end
+
+        private
+
+        # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+        def route_to_coverage route
+          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
+          route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
+
+          verb = source_or_string(route.verb)
+          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+          url = source_or_string(route.path.spec)
+          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
+          route_coverage
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra_application_helper.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    # This module is to help perform sometimes necessary tasks specific to Sinatra
+    module SinatraApplicationHelper
+      SINATRA_VIEWS = [
+        Contrast::Framework::ViewTechnologiesDescriptor.new('public/stylesheets', 'scss', %w[SASS]),
+        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html', %w[HTML5]),
+        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.erb', %w[HTML5 ERB]),
+        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.haml', %w[HTML5 HAML]),
+        Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
+      ].cs__freeze
+
+      def app_class
+        @_app_class ||= begin
+                          return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
+
+                          sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
+                          result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+                          result_layer
+                        end
+      end
+
+      def scannable_view_dirs
+        @_scannable_view_dirs ||= begin
+                                    views = SINATRA_VIEWS.dup
+                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'erb', %w[HTML5 ERB]) if view_directory
+                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'haml', %w[HTML5 HAML]) if view_directory
+                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(public_directory, 'html', %w[HTML5]) if public_directory
+                                    views
+                                  end
+      end
+
+      def view_directory
+        @_view_directory ||= begin
+                               app_class&.settings&.views
+                             end
+      end
+
+      def public_directory
+        @_public_directory ||= begin
+                                 app_class&.settings&.public_dir
+                               end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra_support.rb

@@ -0,0 +1,94 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/sinatra_application_helper'
+
+module Contrast
+  module Framework
+    # Used when Sinatra is present to define framework specific behavior
+    class SinatraSupport < BaseSupport
+      extend Contrast::Framework::SinatraApplicationHelper
+      class << self
+        def detection_class
+          'Sinatra'
+        end
+
+        def version
+          Sinatra::VERSION
+        end
+
+        def application_name
+          return unless app_class
+
+          app_class.cs__class.cs__name
+        end
+
+        def server_type
+          'sinatra'
+        end
+
+        def scan_views
+          return unless app_class
+
+          scan_view_directories(scannable_view_dirs)
+        end
+
+        # Iterate over every class that extends Sinatra::Base, pull out its routes
+        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+        # Contrast::Api::Dtm::RouteCoverage
+        def collect_routes
+          routes = []
+          controllers = sinatra_controllers
+          controllers.each do |clazz|
+            class_routes = sinatra_class_routes(clazz)
+            next unless class_routes
+
+            class_routes.each_pair do |method, list|
+              # item: [ Mustermann::Sinatra, [], Proc]
+              list.each do |item|
+                routes << route_to_coverage(clazz, method, item[0])
+              end
+            end
+          end
+          routes
+        end
+
+        # TODO: RUBY-763
+        def current_route _request
+          nil
+        end
+
+        private
+
+        # Iterate over every class that extends Sinatra::Base, pull out its routes
+        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+        # Contrast::Api::Dtm::RouteCoverage
+        def sinatra_controllers
+          return [] unless defined?(Sinatra) && defined?(Sinatra::Base)
+
+          Contrast::Utils::ClassUtil.descendants(Sinatra::Base)
+        end
+
+        def sinatra_class_routes controller
+          controller.instance_variable_get(:@routes)
+        rescue StandardError
+          logger.debug(nil, "#{ controller } has no route instances")
+          nil
+        end
+
+        # TODO: RUBY-763
+        # given clazz, method, and Mustermann::Sinatra, build a
+        # Contrast::Api::Dtm::RouteCoverage
+        def route_to_coverage clazz, method, pattern
+          safe_pattern = source_or_string(pattern)
+
+          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
+          route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
+          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
+          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+          route_coverage
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    # Used to define common locations and extensions for specific technologies
+    class ViewTechnologiesDescriptor
+      attr_reader :path, :extension, :technology_names
+      def initialize path, extension, technology_names
+        @path = path
+        @extension = extension
+        @technology_names = technology_names
+      end
+
+      def empty?
+        Dir["#{ path }/**/*#{ extension }"].empty?
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/object'
-
 module Contrast
   module Utils
     module Assess
@@ -11,13 +9,13 @@ module Contrast
         def self.tracked? obj
           return false if obj.nil?
 
-          if Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(obj)
+          if Contrast::Utils::DuckUtils.iterable_hash?(obj)
             obj.each_pair do |k, v|
               return true if tracked?(k)
               return true if tracked?(v)
             end
             false
-          elsif Contrast::Utils::DuckUtils.quacks_like_tracked_enumerable?(obj)
+          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
             obj.any? do |ele|
               tracked?(ele) unless obj == ele
             end

data/lib/contrast/utils/class_util.rb

@@ -1,57 +1,112 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/object'
+cs__scoped_require 'contrast/extensions/ruby_core/module'
 
 module Contrast
   module Utils
-    # Utility methods for exploring the complete space of objects
+    # Utility methods for exploring the complete space of Objects
     class ClassUtil
-      def self.ancestors_of clazz
-        arr = []
-        ObjectSpace.each_object(Module) do |obj|
-          next unless obj <= clazz
+      class << self
+        # Given a module, return all of its descendants
+        #
+        # @param mod [Module] the module whose descendants you want to find.
+        # @return [Array<Module>] those Modules that inherit from the given.
+        def descendants mod
+          ObjectSpace.each_object(mod).to_a
+        end
 
-          arr << obj
+        # some classes have had things prepended to them, like Marshal in Rails
+        # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
+        # our alias patching approach, as will any other prepend on something
+        # that we touch. Prepend and Alias are inherently incompatible monkey
+        # patching approaches. As such, we need to know if something has been
+        # prepended to.
+        #
+        # @param mod [Module] the Module to check to see if it has had something
+        #   prepended
+        # @param ancestors [Array<Module>] the array of ancestors for the mod
+        # @return [Boolean] if the mod has been prepended or not
+        def prepended? mod, ancestors = nil
+          ancestors ||= mod.ancestors
+          ancestors[0] != mod
         end
-        arr
-      end
 
-      # some classes have had things prepended to them, like Marshal in Rails
-      # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
-      # our alias patching approach, as will any other prepend on something
-      # that we touch. Prepend and Alias are inherently incompatible monkey
-      # patching approaches. As such, we need to know if something has been
-      # prepended to.
-      #
-      # return true if the given module is not its first ancestor
-      def self.prepended? mod, ancestors = nil
-        ancestors ||= mod.ancestors
-        ancestors[0] != mod
-      end
+        # return true if the given method is overwritten by one of the ancestors
+        # in the ancestor change that comes before the given module
+        def prepended_method? mod, method_policy
+          target_module = determine_target_class mod, method_policy.instance_method
+          ancestors = target_module.ancestors
+          return false unless prepended?(target_module, ancestors)
 
-      def self.determine_target_class mod, is_instance
-        return mod if mod.singleton_class?
+          ancestors.each do |ancestor|
+            break if ancestor == target_module
 
-        return mod.cs__singleton_class unless is_instance
+            methods = ancestor.instance_methods(false)
+            return true if methods.include?(method_policy.method_name)
+          end
+          false
+        end
 
-        mod
-      end
+        # Return a String representing the object invoking this method in the
+        # form expected by our dataflow events.
+        #
+        # @param object [Object] the entity to convert to a String
+        # @return [String] the human readable form of the String, as defined by
+        #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
+        def to_contrast_string object
+          if object.cs__is_a?(String)
+            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+
+            object.dup
+          elsif object.cs__is_a?(Symbol)
+            ":#{ object }"
+          elsif object.cs__is_a?(Numeric)
+            object.to_s
+          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+            "#{ object.cs__name }@#{ object.__id__ }"
+          else
+            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+          end
+        end
+
+        # The method const_defined? can cause autoload, which is bad for us.
+        # The method autoload? doesn't traverse namespaces. This method lets us
+        # provide a constant, as a String, and parse it to determine if it has
+        # been truly truly defined, meaning it existed before this method was
+        # invoked, not as a result of it.
+        #
+        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop
+        # support for 2.6.X, we should remove this code.
+        # https://bugs.ruby-lang.org/issues/10741
+        # @param name [String] the name of the constant to look up
+        # @return [Boolean]
+        def truly_defined? name
+          return false unless name
+
+          segments = name.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
+          previous_module = Module
+          segments.each do |segment|
+            return false if previous_module.cs__autoload?(segment)
+            return false unless previous_module.cs__const_defined?(segment)
+
+            previous_module = previous_module.cs__const_get(segment)
+          end
+
+          true
+        rescue NameError # account for nonsense / poorly formatted constants
+          false
+        end
+
+        private
 
-      # return true if the given method is overwritten by one of the ancestors
-      # in the ancestor change that comes before the given module
-      def self.prepended_method? mod, method_policy
-        target_module = determine_target_class mod, method_policy.instance_method
-        ancestors = target_module.ancestors
-        return false unless prepended?(target_module, ancestors)
+        def determine_target_class mod, is_instance
+          return mod if mod.singleton_class?
 
-        ancestors.each do |ancestor|
-          break if ancestor == target_module
+          return mod.cs__singleton_class unless is_instance
 
-          methods = ancestor.instance_methods(false)
-          return true if methods.include?(method_policy.method_name)
+          mod
         end
-        false
       end
     end
   end