contrast-agent 3.8.5 → 3.9.0

data/lib/contrast/agent/feature_state.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/settings_state'
-cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/extensions/ruby_core/module'
 cs__scoped_require 'contrast/utils/boolean_util'
 
 module Contrast

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -5,7 +5,7 @@ cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
 cs__scoped_require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/core_extensions/inventory/datastores'
+cs__scoped_require 'contrast/extensions/ruby_core/inventory/datastores'
 
 module Contrast
   module Agent

data/lib/contrast/agent/logger_manager.rb

@@ -3,7 +3,7 @@
 
 cs__scoped_require 'logger'
 
-cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/extensions/ruby_core/module'
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
@@ -60,7 +60,7 @@ module Contrast
       private
 
       def default_progname
-        "Contrast #{ APP_CONTEXT.name }"
+        'Contrast Agent'
       end
 
       def build path: STDOUT_STR, progname: default_progname, level_const: DEFAULT_LEVEL

data/lib/contrast/agent/middleware.rb

@@ -4,16 +4,14 @@
 cs__scoped_require 'ipaddr'
 cs__scoped_require 'json'
 cs__scoped_require 'rack'
-cs__scoped_require 'contrast/core_extensions/object'
+
 cs__scoped_require 'contrast/security_exception'
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/utils/operating_environment'
 cs__scoped_require 'contrast/agent/service_heartbeat'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/heap_dump_util'
 
-cs__scoped_require 'contrast/utils/path_util'
 cs__scoped_require 'contrast/utils/timer'
 cs__scoped_require 'contrast/utils/freeze_util'
 cs__scoped_require 'contrast/utils/service_sender_util'

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,16 +1,19 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/utils/class_util'
+
 module Contrast
   module Agent
     module Patching
       module Policy
         # Used to handle tracking patches that need to apply special instrumentation when a module is loaded
         class AfterLoadPatch
-          attr_reader :applied, :module_name, :instrumentation_file_path
-          def initialize module_name, instrumentation_file_path
+          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil
             @applied = false
             @module_name = module_name
+            @method_to_instrument = method_to_instrument
             @instrumentation_file_path = instrumentation_file_path
           end
 
@@ -18,18 +21,51 @@ module Contrast
             @applied
           end
 
+          # Modules can be re-opened, so the first load may not
+          # necessarily define the method we're looking for:
+          #
+          # patching MyMod#instrumentable:
+          #
+          # file1:
+          #   module MyMod
+          #     def unrelated        <-- false lead
+          #     end
+          #   end
+          #
+          # file2:
+          #   module MyMod
+          #     def instrumentable   <-- actual target
+          #     end
+          #   end
+          def blocked_by_method?
+            return true  unless target_defined? # bc no methods are loaded
+            return false unless method_to_instrument
+
+            !module_lookup.instance_methods.include? method_to_instrument
+          end
+
           def applies? loaded_module_name
-            loaded_module_name == module_name
+            (loaded_module_name == module_name) && !blocked_by_method?
           end
 
           def target_defined?
-            Module.cs__truly_defined?(module_name)
+            Contrast::Utils::ClassUtil.truly_defined?(module_name)
           end
 
           def instrument!
             cs__scoped_require instrumentation_file_path
             @applied = true
           end
+
+          private
+
+          def module_lookup
+            @_module_lookup ||= begin
+                                  Module.cs__const_get module_name
+                                rescue StandardError => _e
+                                  nil
+                                end
+          end
         end
       end
     end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -12,18 +12,42 @@ module Contrast
         # after they've been loaded
         module AfterLoadPatcher
           include Contrast::Components::Interface
-          access_component :logging
+          access_component :logging, :agent
 
           AFTER_LOAD_PATCHES = Set.new([
                                          Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
                                              'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                                             'contrast/rails_extensions/assess/action_controller_inheritance'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('ActiveRecord::Scoping::Named::ClassMethods',
-                                                                                               'contrast/rails_extensions/assess/active_record_named'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('ActiveRecord::AttributeMethods::Read::ClassMethods',
-                                                                                               'contrast/rails_extensions/assess/active_record'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new('Sinatra::Base',
-                                                                                               'contrast/sinatra_extensions/inventory/sinatra_base')
+                                             'contrast/extensions/framework/rails/active_record_time_zone_inherited',
+                                             method_to_instrument: :inherited),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'ActionController::Railties::Helper::ClassMethods',
+                                             'contrast/extensions/framework/rails/action_controller_railties_helper_inherited',
+                                             method_to_instrument: :inherited),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'ActiveRecord::Scoping::Named::ClassMethods',
+                                             'contrast/extensions/framework/rails/active_record_named'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'ActiveRecord::AttributeMethods::Read::ClassMethods',
+                                             'contrast/extensions/framework/rails/active_record'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'Sinatra::Base',
+                                             'contrast/extensions/framework/sinatra/base'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'Rails::Application::Configuration',
+                                             'contrast/extensions/framework/rails/configuration',
+                                             method_to_instrument: :session_store),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'Rack::Request',
+                                             'contrast/extensions/framework/rack/request'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'Rack::Response',
+                                             'contrast/extensions/framework/rack/response'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'ActionController::Live::Buffer',
+                                             'contrast/extensions/framework/rails/buffer'),
+                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                                             'Rack::Session::Cookie',
+                                             'contrast/extensions/framework/rack/cookie')
                                        ])
 
           # After initialization run a catchup check to instrument any already loaded modules we care about
@@ -31,6 +55,7 @@ module Contrast
             applied = []
             AFTER_LOAD_PATCHES.each do |after_load_patch|
               next unless after_load_patch.target_defined?
+              next if AGENT.skip_instrumentation?(after_load_patch.module_name)
 
               logger.debug("Detected loading of #{ after_load_patch.module_name } - applying instrumentation")
               after_load_patch.instrument!

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -31,20 +31,33 @@ module Contrast
           end
 
           def empty?
-            return false if source_node
-            return false if propagation_node
-            return false if trigger_node
-            return false if inventory_node
-            return false if protect_node
-            return false if deadzone_node
+            nodes.none?
+          end
+
+          def scopes_to_enter
+            @_scopes_to_enter ||= method_scopes
+          end
 
-            true
+          def scopes_to_exit
+            @_scopes_to_exit ||= method_scopes.reverse
           end
 
           def requires_custom_patch?
             !!@trigger_node&.custom_patch?
           end
 
+          private
+
+          def nodes
+            @_nodes ||= [source_node, propagation_node, trigger_node, inventory_node, protect_node, deadzone_node].compact
+          end
+
+          def method_scopes
+            # Implicitly, the scope precedence is the node order
+            # defined by #nodes.
+            @_method_scopes ||= nodes.flat_map(&:method_scope).tap(&:compact!).tap(&:uniq!)
+          end
+
           class << self
             # Given a Contrast::Agent::Patching::Policy::ModulePolicy, parse
             # out its information for the given method in order to construct a

data/lib/contrast/agent/patching/policy/patch.rb

@@ -3,28 +3,27 @@
 
 cs__scoped_require 'monitor'
 # base
-cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/extensions/ruby_core/module'
 cs__scoped_require 'contrast/agent/patching/policy/method_policy'
 cs__scoped_require 'contrast/agent/patching/policy/patch_status'
 cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/scope_util'
 
 # assess
 cs__scoped_require 'contrast/agent/assess/policy/policy'
 cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
 cs__scoped_require 'contrast/agent/assess/policy/source_method'
 cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
-cs__scoped_require 'contrast/core_extensions/assess'
+cs__scoped_require 'contrast/extensions/ruby_core/assess'
 
 # inventory
 cs__scoped_require 'contrast/agent/inventory/policy/policy'
-cs__scoped_require 'contrast/core_extensions/inventory'
+cs__scoped_require 'contrast/extensions/ruby_core/inventory'
 
 # protect
 cs__scoped_require 'contrast/agent/protect/policy/policy'
-cs__scoped_require 'contrast/core_extensions/protect'
-cs__scoped_require 'contrast/core_extensions/protect/kernel'
+cs__scoped_require 'contrast/extensions/ruby_core/protect'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
 
 module Contrast
   module Agent
@@ -39,7 +38,6 @@ module Contrast
             include Contrast::Agent::Assess::Policy::SourceMethod
             include Contrast::Agent::Assess::Policy::PropagationMethod
             include Contrast::Agent::Assess::Policy::TriggerMethod
-            extend Contrast::Utils::ScopeUtil
 
             include Contrast::Components::Interface
             access_component :logging, :analysis, :agent, :scope
@@ -50,6 +48,18 @@ module Contrast
               Contrast::Agent::Protect::Policy::Policy
             ].cs__freeze
 
+            def enter_method_scope! method_policy
+              method_policy.scopes_to_enter.each do |scope|
+                enter_scope!(scope)
+              end
+            end
+
+            def exit_method_scope! method_policy
+              method_policy.scopes_to_exit.each do |scope|
+                exit_scope!(scope)
+              end
+            end
+
             # THIS IS CALLED FROM C. Do not change the signature lightly.
             #
             # This method functions to call the infilter methods from our
@@ -68,18 +78,20 @@ module Contrast
             def apply_pre_patch method_policy, method, exception, object, args
               apply_protect(method_policy, method, exception, object, args)
               apply_inventory(method_policy, method, exception, object, args)
-            # We were told to block something, so we gotta. Don't catch this
-            # one, let it get back to our Middleware or even all the way out to
-            # the framework
             rescue Contrast::SecurityException => e
-              # This can be C's responsibility, but it's a lot of code.
-              # Rewrite this to make C do it, once we have better macroing.
-              exit_contrast_scope!
+              # We were told to block something, so we gotta. Don't catch this
+              # one, let it get back to our Middleware or even all the way out to
+              # the framework
               raise e
-            # Anything else was our bad and we gotta catch that to allow for
-            # normal application flow
             rescue StandardError => e
+              # Anything else was our bad and we gotta catch that to allow for
+              # normal application flow
               logger.error(e, 'Unable to apply pre patch to method.')
+            rescue Exception => e # rubocop:disable Lint/RescueException
+              # This is something like NoMemoryError that we can't
+              # hope to handle.  Nonetheless, shouldn't leak scope.
+              exit_contrast_scope!
+              raise e
             end
 
             # THIS IS CALLED FROM C. Do not change the signature lightly.
@@ -197,9 +209,6 @@ module Contrast
             rescue Exception => e # rubocop:disable Lint/RescueException
               logger.error(e, 'Unable to assess method call.')
               handle_return(propagated_ret, source_ret, ret)
-              # This will unwind the stack, so we handle our own scope exit.
-              # Move this to C when it's convenient.
-              exit_contrast_scope!
               raise e
             end
 
@@ -257,13 +266,17 @@ module Contrast
               safe_return
             end
 
-            # Given a class, method, and type, return a symbol in the format
-            # <method_start>_<class_name>_<method_name>
-            def build_method_name patcher_class, patcher_method
+            # Given a module and method, construct an expected name for the
+            # alias by which Contrast will reference the original.
+            #
+            # @param patched_class [Module] the module being patched
+            # @param patched_method [Symbol] the method being patched
+            # @return [Symbol]
+            def build_method_name patched_class, patched_method
               (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
-                  patcher_class.cs__name.gsub('::', '_').downcase +
+                  patched_class.cs__name.gsub('::', '_').downcase +
                   Contrast::Utils::ObjectShare::UNDERSCORE +
-                  patcher_method.to_s).to_sym
+                  patched_method.to_s).to_sym
             end
 
             # @param mod [Module] the module in which the patch should be
@@ -302,6 +315,24 @@ module Contrast
             def instrument_with_prepend mod, method_policy
               contrast_prepend_method(mod, method_policy)
             end
+
+            # @return [Boolean]
+            def skip_contrast_analysis?
+              return true if in_contrast_scope?
+              return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+
+              false
+            end
+
+            # Skip if we should skip_contrast_analysis?, sampling says to ignore this
+            # request, or assess has been disabled.
+            #
+            # @return [Boolean]
+            def skip_assess_analysis?
+              return true if skip_contrast_analysis?
+
+              !ASSESS.enabled?
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/patch_status.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/object'
-
 module Contrast
   module Agent
     module Patching

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -7,10 +7,8 @@ cs__scoped_require 'monitor'
 cs__scoped_require 'contrast/agent/patching/policy/patch_status'
 cs__scoped_require 'contrast/agent/patching/policy/method_policy'
 cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/agent/patching/policy/policy_unpatcher'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/class_util'
-cs__scoped_require 'contrast/utils/scope_util'
 
 # assess
 cs__scoped_require 'contrast/agent/assess/policy/policy'
@@ -43,7 +41,6 @@ module Contrast
         # provides a map for which methods our renamed functions need to call
         # and how.
         module Patcher
-          extend Contrast::Utils::ScopeUtil
           extend Contrast::Agent::Patching::Policy::AfterLoadPatcher
 
           include Contrast::Components::Interface
@@ -58,7 +55,6 @@ module Contrast
                 catchup_after_load_patches
                 patch_methods
                 Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations
-                Contrast::Agent::Patching::Policy::PolicyUnpatcher.revert_conflicting_patches
               end
             end
 
@@ -84,7 +80,8 @@ module Contrast
             # or eval of dynamic class definition
             def patch_specific_module mod
               mod_name = mod.cs__name
-              return unless Module.cs__truly_defined?(mod_name)
+              return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
+              return if AGENT.skip_instrumentation?(mod_name)
 
               load_patches_for_module(mod_name)
 
@@ -137,7 +134,7 @@ module Contrast
             # @param name [String] the constant whose value should be retrieved
             # @return [Object, nil]
             def patchable name
-              return unless Module.cs__truly_defined?(name)
+              return unless Contrast::Utils::ClassUtil.truly_defined?(name)
 
               Module.cs__const_get(name)
             end
@@ -156,6 +153,8 @@ module Contrast
               # logger.trace_with_time("\t\tRunning patching") do # TODO: RUBY-547
               patched = []
               all_module_names.each do |patchable_name|
+                next if AGENT.skip_instrumentation?(patchable_name)
+
                 patchable_mod = patchable(patchable_name)
                 next unless patchable_mod
 
@@ -301,10 +300,10 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/core_extensions/module'
-cs__scoped_require 'contrast/core_extensions/assess'
-cs__scoped_require 'contrast/core_extensions/inventory'
-cs__scoped_require 'contrast/core_extensions/protect'
-cs__scoped_require 'contrast/core_extensions/protect/kernel'
+cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extensions/ruby_core/assess'
+cs__scoped_require 'contrast/extensions/ruby_core/inventory'
+cs__scoped_require 'contrast/extensions/ruby_core/protect'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
 
 cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'