contrast-agent 3.9.0 → 3.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc76e7cc9a47ace8f43df83fca283ee52dc8f4eb48bee2bca660981616c43124
-  data.tar.gz: c07ab0d747605fa69730f4409543ccd9ce7be5624f5d959ec27bd1dd227551db
+  metadata.gz: 9ef521f3316b8c5e911a3781bb0dc0c228b01a6166ad1f6a2abb429e67941878
+  data.tar.gz: 16305c60287b244efb6d0a1fb23a979b405e4960deaa2a84e45b1da994c21c14
 SHA512:
-  metadata.gz: 609dd7c247d30d0ec1a7567736d3d5377a422c1ba7e52ae9c52409a192e2f90f5054ef4f34b35e39d78bf5d05197449e791f2af5dc333b4d164fa9ccbfc015c1
-  data.tar.gz: c5336c941c6aece474c548549587e93fe61561ce8d4ef0576d5aefe875b0895a9f8e5c26afe2b41912f638eab9976c9357e268eee84c7cd6d4145aa507deaa86
+  metadata.gz: 228c42ed0e8453f3b2720818d7127729991e8d2cad7e480fc616f0975481e7810ff0ebfae44ebe406c62ff51398307e6cadd685a0805b34a7cb699641278c064
+  data.tar.gz: e9d180bb7004a818d346bb2d5f4ea5b57d1d6fef58284569fdb80dcbaf44cb215d4ae3b86c7984c683387011af9bf20f9428947820bf9e13fa67cc9084d6d8b8

data/.simplecov

@@ -1,4 +1,7 @@
-SimpleCov.minimum_coverage 92.30
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+SimpleCov.minimum_coverage line: 92.30
 SimpleCov.start do
   add_filter '/spec/'
-end
+end

data/ext/build_funchook.rb

@@ -12,11 +12,11 @@ unless find_header('funchook.h', ext_path)
 
   possible_gem_paths = Gem.path # .path and .paths diverge in their return type - .path returns strings, .paths returns PathSupports
   possible_gem_paths.each do |base_path|
-    contrast_gem_dir_search = File.join(base_path, '**', '*', 'contrast-agent-*')
+    contrast_gem_dir_search = File.join(base_path, 'extensions', '**', '*', 'contrast-agent-*')
     extension_paths = Dir[contrast_gem_dir_search]
     extension_paths.map! do |extension_path|
       target_path = File.join(extension_path, 'shared_libraries')
-      FileUtils.mkdir_p(target_path)
+      FileUtils.mkdir_p(target_path) unless File.exist?(target_path)
       target_path
     end
     bundler_install_target_paths += extension_paths
@@ -31,15 +31,15 @@ unless find_header('funchook.h', ext_path)
   end
 
   SOURCE_PATHS = [
-      File.join('include', 'funchook.h'),
-      File.join('src', 'libfunchook.dylib'),
-      File.join('src', 'libfunchook.so')
+    File.join('include', 'funchook.h'),
+    File.join('src', 'libfunchook.dylib'),
+    File.join('src', 'libfunchook.so')
   ].freeze
 
   TARGET_PATHS = ([
-      File.expand_path(File.join(File.expand_path(__dir__), '..', 'shared_libraries')),
-      File.expand_path(__dir__)
-  ] + (bundler_install_target_paths)).freeze
+    File.expand_path(File.join(File.expand_path(__dir__), '..', 'shared_libraries')),
+    File.expand_path(__dir__)
+  ] + bundler_install_target_paths).freeze
 
   puts 'Copying required files'
 
@@ -51,11 +51,16 @@ unless find_header('funchook.h', ext_path)
     end
 
     TARGET_PATHS.each do |target_path|
+      unless File.writable?(target_path)
+        puts "Unable to copy into #{ target_path } - directory not writable"
+        next
+      end
       puts "Copying #{ source_file_path } into #{ target_path }"
       FileUtils.cp(source_file_path, target_path)
+    rescue StandardError
+      puts "Error while copying #{ source_file } to #{ target_path }"
     end
   end
 end
 
-
 have_header('funchook.h', ext_path)

data/ext/cs__assess_active_record_named/cs__active_record_named.c

@@ -3,6 +3,7 @@
 
 #include "cs__active_record_named.h"
 #include <ruby.h>
+#include "../cs__common/cs__common.h"
 
 VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
                                           const VALUE self) {
@@ -32,16 +33,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
 
 void Init_cs__assess_active_record_named(void) {
     rb_sym_assess_rewrite = rb_intern("_cs__rewrite");
-    rb_sym_assess_scope = rb_intern("cs__patched_scope");
-
-    VALUE active_record_module = rb_define_module("ActiveRecord");
-    VALUE scoping_module =
-        rb_define_module_under(active_record_module, "Scoping");
-    VALUE named_module = rb_define_module_under(scoping_module, "Named");
-    VALUE class_methods_module =
-        rb_define_module_under(named_module, "ClassMethods");
-
-    contrast_alias_method(class_methods_module, "cs__patched_scope", "scope");
-    rb_define_method(class_methods_module, "scope",
-                     contrast_assess_active_record_scope, -1);
+    rb_sym_assess_scope   = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
+                                                    "scope",
+                                                    contrast_assess_active_record_scope);
 }
+

data/ext/cs__assess_active_record_named/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_array/cs__assess_array.c

@@ -29,10 +29,8 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
 }
 
 void Init_cs__assess_array(void) {
-    rb_sym_assess_array_join = rb_intern("cs__patched_join");
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
-
-    VALUE array_class = rb_define_class("Array", rb_cObject);
-    contrast_alias_method(array_class, "cs__patched_join", "join");
-    rb_define_method(array_class, "join", contrast_assess_array_join, -1);
+    rb_sym_assess_array_join = contrast_register_patch("Array",
+                                                       "join",
+                                                       contrast_assess_array_join);
 }

data/ext/cs__assess_array/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -43,8 +43,14 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
 void Init_cs__assess_basic_object(void) {
     instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
 
-    contrast_alias_method(rb_cBasicObject, "cs__patched_instance_eval",
-                          "instance_eval");
-    rb_define_method(rb_cBasicObject, "instance_eval",
-                     contrast_assess_basic_object_instance_eval, -1);
+    /* We don't keep a reference to the underlying method.
+     * Instead, we call rb_obj_instance_eval directly.
+     * This should work an overwhelming majority of the time,
+     * but if someone else patched BasicObject#instance_eval,
+     * IDK if this is intentional... noting it.  -ajm
+     */
+    contrast_register_patch("BasicObject",
+                            "instance_eval",
+                            contrast_assess_basic_object_instance_eval);
+
 }

data/ext/cs__assess_basic_object/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -2,6 +2,7 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_fiber_track.h"
+#include "../cs__common/cs__common.h"
 #include <funchook.h>
 #include <ruby.h>
 
@@ -44,7 +45,7 @@ VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
         VALUE enumerator_method = ID2SYM(enum_ptr->meth);
         /* e.g.: 1..100, #each_value.  Should reflect #inspect on the enum. */
 
-        rb_funcall(fiber_class, track_rb_fiber_new, 5, fiber, obj,
+        rb_funcall(fiber_propagator, track_rb_fiber_new, 5, fiber, obj,
                    enumerator_method, underlying, calling_method);
     }
 
@@ -56,7 +57,7 @@ VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
     VALUE yielding_fiber = rb_fiber_current();
 
     /* propagate from yielding_fiber -> result */
-    rb_funcall(fiber_class, track_rb_fiber_yield, 3, yielding_fiber,
+    rb_funcall(fiber_propagator, track_rb_fiber_yield, 3, yielding_fiber,
                calling_method, *argv);
 
     return rb_fiber_yield_original(argc, argv);
@@ -78,7 +79,7 @@ int install_fiber_hooks() {
 }
 
 void Init_cs__assess_fiber_track(void) {
-    fiber_class = rb_define_class("Fiber", rb_cObject);
+    fiber_propagator = rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
     track_rb_fiber_new = rb_intern("track_rb_fiber_new");
     track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
     rb_sym_next = rb_intern("next");

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -2,15 +2,15 @@
 #include <ruby.h>
 
 static VALUE rb_sym_next;
-static VALUE fiber_class;
+static VALUE fiber_propagator;
 static VALUE track_rb_fiber_new;
 static VALUE track_rb_fiber_yield;
 
 VALUE rb_fiber_new(VALUE (*func)(ANYARGS), VALUE obj);
-VALUE *(*rb_fiber_new_original)(VALUE (*func)(ANYARGS), VALUE obj);
+VALUE (*rb_fiber_new_original)(VALUE (*func)(ANYARGS), VALUE obj);
 
 VALUE rb_fiber_yield(int argc, const VALUE *argv);
-VALUE *(*rb_fiber_yield_original)(int argc, const VALUE *argv);
+VALUE (*rb_fiber_yield_original)(int argc, const VALUE *argv);
 
 /* If you call `#next` on an enumerator object, that enumerator object
  * instantiates a fiber and runs its given proc inside of that fiber.

data/ext/cs__assess_fiber_track/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -5,7 +5,14 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
+/* Hashes can be constructed thusly):
+ *   irb(main):001:0> Hash[:a, :b]
+ *   => {:a=>:b}
+ *
+ * This method instruments that unique bracket-construction style
+ * of initializing a hash.
+ */
+static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
                                               const VALUE hash) {
     VALUE result;
 
@@ -14,14 +21,14 @@ static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
         int i;
         for (i = 0; i < argc; i++) {
             argv[i] =
-                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
         /* Hash[ key, value, ... ]         -> new_hash */
     } else if (argc > 1) {
         int i;
         for (i = 0; i < argc; i += 2) {
             argv[i] =
-                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+                rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
     }
 
@@ -29,36 +36,52 @@ static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
      * String keys
      * # Hash[ object ]                  -> new_hash
      */
-    result = rb_funcall2(hash, rb_sym_assess_hash_brackets, argc, argv);
+    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
 
     return result;
 }
 
+/* Hashes, when keyed with a string, will dup & freeze that string.
+ * This is resource-efficient, but inconvenient for instrumentation.
+ */
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
                                               const VALUE hash) {
     VALUE result;
-    VALUE key;
-
-    key = rb_funcall2(hash, rb_sym_assess_hash_bracket_set, argc, argv);
-    argv[0] = key;
+    /* Current name (assess_hash_bracket_set).
+     * It doesn't set anything on the hash.
+     * It takes the arg that /would/ have been the key, and preemptively
+     * calls #dup and then #freeze, and then gives you that key.
+     *
+     * We intentionally don't enter Contrast scope for this patch.
+     * #dup instruments the string, and #freeze gets the hash to accept
+     * the key directly, without calling its own #dup/#freeze.
+     * (That naturally happens in C-land, our instrumentation is in Ruby,
+     * so our patches to #dup don't take effect within Hash#[]= unless we
+     * specifically do this instrumentation.
+     * We haven't revisited this approach since we started more extensively
+     * hooking public C functions.)
+     */
+    if(argc > 0) {
+        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[0]);
+    }
+    /* This is the underlying assignment, w/ our instrumented key. */
     result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
 
     return result;
 }
 
 void Init_cs__assess_hash(void) {
+    hash_propagator = rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
     rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
-    rb_sym_assess_hash_brackets = rb_intern("cs__patched_[]");
-    rb_sym_assess_hash_bracket_set = rb_intern("cs__bracket_set");
-    rb_sym_assess_hash_bracket_equals = rb_intern("cs__patched_[]=");
 
     VALUE hash_class = rb_define_class("Hash", rb_cObject);
-    array_class = rb_define_class("Array", rb_cObject);
 
-    VALUE singleton = rb_singleton_class(hash_class);
-    contrast_alias_method(singleton, "cs__patched_[]", "[]");
-    rb_define_method(singleton, "[]", contrast_assess_hash_bracket_get, -1);
+    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch("Hash",
+                                                                               "[]",
+                                                                               contrast_assess_hash_bracket_constructor);
+
+    rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
+                                                                "[]=",
+                                                                contrast_assess_hash_bracket_set);
 
-    contrast_alias_method(hash_class, "cs__patched_[]=", "[]=");
-    rb_define_method(hash_class, "[]=", contrast_assess_hash_bracket_set, -1);
 }

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -1,11 +1,9 @@
 #include <ruby.h>
 
-static VALUE array_class;
-
 static VALUE rb_sym_assess_hash_dup_and_freeze;
-static VALUE rb_sym_assess_hash_brackets;
-static VALUE rb_sym_assess_hash_bracket_set;
+static VALUE rb_sym_assess_hash_bracket_constructor;
 static VALUE rb_sym_assess_hash_bracket_equals;
+static VALUE hash_propagator;
 
 /*
  * Monkeypatch Ruby Hash with Contrast Security Hash in order ot avoid losing
@@ -15,8 +13,8 @@ static VALUE rb_sym_assess_hash_bracket_equals;
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
  * -HM
  */
-static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
-                                              const VALUE hash);
+static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
+                                                      const VALUE hash);
 
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
                                               const VALUE hash);

data/ext/cs__assess_hash/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -18,19 +18,21 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
         rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
     }
 
-    return rb_funcall(self, rb_intern("cs__assess_kernel_exec"), argc, *argv);
+    /* maybe this should be rb_funcall2.  this works right now because *argv == argv[0].
+     * exec shouldn't ever be called with != 1 argc, so not a huge problem */
+    return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
 }
 
 void Init_cs__assess_kernel(void) {
     kernel_propagator = rb_define_module("KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
-    VALUE singleton = rb_singleton_class(rb_mKernel);
+    rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
+                                                        "exec",
+                                                        contrast_patched_kernel_exec);
 
-    contrast_alias_method(rb_mKernel, "cs__assess_kernel_exec", "exec");
-    rb_define_private_method(rb_mKernel, "exec", contrast_patched_kernel_exec,
-                             -1);
-
-    contrast_alias_method(singleton, "cs__assess_kernel_exec", "exec");
-    rb_define_method(singleton, "exec", contrast_patched_kernel_exec, -1);
+    /* should return the same value as above */
+    rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
+                                                                  "exec",
+                                                                  contrast_patched_kernel_exec);
 }

data/ext/cs__assess_kernel/cs__assess_kernel.h

@@ -2,6 +2,7 @@
 
 static VALUE exec_apply_trigger;
 static VALUE kernel_propagator;
+static VALUE rb_sym_assess_kernel_exec;
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,

data/ext/cs__assess_kernel/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -38,10 +38,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 void Init_cs__assess_marshal_module(void) {
     rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
 
-    marshal_module = rb_define_module("Marshal");
-
-    VALUE contrast_marshal = rb_define_module("MarshalWithContrastAssess");
-    rb_define_method(contrast_marshal, "load",
-                     contrast_assess_marshal_module_load, -1);
-    rb_prepend_module(rb_singleton_class(marshal_module), contrast_marshal);
+    contrast_register_singleton_prepend_patch("Marshal",
+                                              "load",
+                                              &contrast_assess_marshal_module_load);
 }

data/ext/cs__assess_marshal_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_module/cs__assess_module.c

@@ -65,13 +65,17 @@ void Init_cs__assess_module(void) {
 
     trigger_check_method = rb_intern("eval_trigger_check");
 
-    contrast_alias_method(rb_cModule, "cs__patched_class_eval", "class_eval");
-
-    rb_define_method(rb_cModule, "class_eval",
-                     contrast_assess_module_class_eval, -1);
-
-    contrast_alias_method(rb_cModule, "cs__patched_module_eval", "module_eval");
-
-    rb_define_method(rb_cModule, "module_eval",
-                     contrast_assess_module_module_eval, -1);
+    /* Returns of these 2 patches are discarded.
+     * We're calling the underlying via direct C, instead of
+     * whatever method was there before.
+     * See similar comments in basic_object C ext patch.
+     */
+
+    contrast_register_patch("Module",
+                            "class_eval",
+                            contrast_assess_module_class_eval);
+
+    contrast_register_patch("Module",
+                            "module_eval",
+                            contrast_assess_module_module_eval);
 }