contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/extensions/ruby_core/assess/assess_extension.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/frozen_properties'
 cs__scoped_require 'contrast/agent/assess/insulator'
 
 module Contrast
@@ -86,6 +85,7 @@ module Contrast
             existing = cs__properties.fetch_tag(key)
             if existing
               existing.concat(new_tags)
+              Contrast::Utils::TagUtil.size_aware_merge(self, existing)
             else
               cs__properties.set_tags(key, new_tags)
             end
@@ -99,33 +99,38 @@ module Contrast
         # If the return already had that tag, the existing tag
         # range is recycled to save us an object.
         def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.quacks_to?(
-              ret,
-              :cs__tracked?)
+          return unless Contrast::Utils::DuckUtils.trackable?(ret)
 
-          splat_source = Contrast::Utils::DuckUtils.quacks_to?(
-              source,
-              :cs__tracked?)
+          length = Contrast::Utils::StringUtils.ret_length(ret)
+          return if length.zero?
+
+          cs__splat_from_source(ret, length, source)
+          cs__splat_from_ret(ret, length)
+        end
+
+        def cs__splat_from_source ret, ret_length, source
+          splat_source = Contrast::Utils::DuckUtils.trackable?(source)
           splat_source &&= source.cs__tracked?
-          if splat_source
-            length = Contrast::Utils::StringUtils.ret_length(ret)
-            source.cs__properties.tag_keys.each do |key|
-              existing = ret.cs__properties.fetch_tag(key)
-              # if the tag already exists, drop all but the first range
-              # then change that range to cover the entire return
-              if existing
-                existing.drop(existing.length - 1)
-                range = existing[0]
-                range.repurpose(0, length)
-              else
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                ret.cs__properties.add_tag(key, span)
-              end
+          return unless splat_source
+
+          source.cs__properties.tag_keys.each do |key|
+            existing = ret.cs__properties.fetch_tag(key)
+            # if the tag already exists, drop all but the first range
+            # then change that range to cover the entire return
+            if existing
+              existing.drop(existing.length - 1)
+              range = existing[0]
+              range.repurpose(0, ret_length)
+            else
+              span = Contrast::Agent::Assess::AdjustedSpan.new(0, ret_length)
+              ret.cs__properties.add_tag(key, span)
             end
           end
+        end
+
+        def cs__splat_from_ret ret, length
           return unless ret.cs__tracked?
 
-          length ||= Contrast::Utils::StringUtils.ret_length(ret)
           ret.cs__properties.tag_keys.each do |key|
             next unless key
 

data/lib/contrast/extensions/ruby_core/assess/erb.rb

@@ -1,18 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-
 # This module is used to track propagation through ERB template rendering
 module ERBPropagator
   class << self
-    include Contrast::Components::Interface
-    access_component :logging
-
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
 
-      logger.debug('ERBPropagator - running propagation')
       used_binding = preshift.args[0]
       binding_variable_set = used_binding.local_variables
 
@@ -25,7 +19,6 @@ module ERBPropagator
         start_index = ret.index(bound_variable_value)
         next if start_index.nil?
 
-        logger.debug('ERBPropagator - found bound_variable in erb template result')
         ret.cs__copy_from(bound_variable_value, start_index)
       end
       ret.cs__properties.build_event(
@@ -35,7 +28,6 @@ module ERBPropagator
           ret,
           preshift.args,
           1)
-      logger.debug('ERBPropgator - Finished erb result propagation')
       ret
     end
   end

data/lib/contrast/extensions/ruby_core/assess/exec_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/at_exit_hook'
 
 module Contrast
   module CoreExtensions
@@ -10,8 +10,6 @@ module Contrast
       # violates the design of most methods we track in that we have to apply
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
-        include Contrast::Components::Interface
-        access_component :contrast_service
         def apply_trigger source
           current_context = Contrast::Agent::REQUEST_TRACKER.current
           return unless current_context
@@ -27,12 +25,12 @@ module Contrast
               current_context,
               trigger_node,
               source,
-              self,
-              '',
-              1,
+              Kernel,
+              nil,
               source)
-          # Exec replaces the current process, if we occur in a forked process our appendage of this finding will not make it to TS
-          CONTRAST_SERVICE.send_message(current_context.activity)
+          # Exec replaces the current process, if we occur in a forked process
+          # our appendage of this finding will not make it to TS
+          Contrast::Agent::AtExitHook.on_exit
         end
 
         private

data/lib/contrast/extensions/ruby_core/assess/fiber.rb

@@ -1,124 +1,112 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
 
-cs__scoped_require 'fiber'
-
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
 # Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
 # order to track what happens within Enumerator#next.
-# TODO: RUBY-531 move these out of Fiber class
-class Fiber
-  include Contrast::CoreExtensions::Assess::AssessExtension
-  include Contrast::Components::Interface
-
-  access_component :analysis, :scope
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This Class provides us with a way to invoke Regexp propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Fiber Class or exposing our methods there.
+      class FiberPropagator
+        include Contrast::Components::Interface
 
-  FIBER_NEW_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_new', # TODO: Why do we patch new here and not initalize? Historically, new has been problematic.
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_new'
-  }.cs__freeze
-  FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
-  private_constant :FIBER_NEW_NODE_HASH
-  private_constant :FIBER_NEW_NODE
+        access_component :analysis, :logging, :scope
 
-  FIBER_YIELD_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_yield',
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_yield'
-  }.cs__freeze
-  FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
-  private_constant :FIBER_YIELD_NODE_HASH
-  private_constant :FIBER_YIELD_NODE
+        FIBER_NEW_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_new', # TODO: Why do we patch new here and not initialize? Historically, new has been problematic.
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_new'
+        }.cs__freeze
+        FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
+        private_constant :FIBER_NEW_NODE_HASH
+        private_constant :FIBER_NEW_NODE
 
-  class << self
-    def track_rb_fiber_yield fiber, _method, results
-      # results will be nil if StopIteration was raised,
-      # otherwise an Array of the yielded arguments
-      return unless results.cs__is_a?(Array)
-      return unless ASSESS.enabled?
+        FIBER_YIELD_NODE_HASH = {
+            'class_name' => 'Fiber',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'c_yield',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_method' => 'track_rb_fiber_yield'
+        }.cs__freeze
+        FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
+        private_constant :FIBER_YIELD_NODE_HASH
+        private_constant :FIBER_YIELD_NODE
 
-      with_contrast_scope do
-        results.each do |result|
-          next unless Contrast::Utils::DuckUtils.trackable?(result)
-          next if result.cs__frozen?
+        class << self
+          def track_rb_fiber_yield fiber, _method, results
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
 
-          cs__splat_tags(result, fiber)
-          result.cs__properties.build_event(
-              FIBER_YIELD_NODE,
-              result,
-              fiber,
-              result,
-              [])
-        end
-      end
-    end
+            # results will be nil if StopIteration was raised,
+            # otherwise an Array of the yielded arguments
+            return unless results.cs__is_a?(Array)
 
-    def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
-      return unless Contrast::Utils::DuckUtils.trackable?(underlying)
-      return unless underlying.is_a?(String) && !underlying.empty?
+            with_contrast_scope do
+              results.each do |result|
+                next unless Contrast::Utils::DuckUtils.trackable?(result)
+                next if result.cs__frozen?
 
-      return unless ASSESS.enabled?
+                fiber.cs__splat_tags(result)
+                result.cs__properties.build_event(
+                    FIBER_YIELD_NODE,
+                    result,
+                    fiber,
+                    result,
+                    [])
+              end
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber#yield', e)
+          end
 
-      with_contrast_scope do
-        cs__splat_tags(fiber, underlying)
-        fiber.cs__properties.build_event(
-            FIBER_NEW_NODE,
-            fiber,
-            underlying,
-            fiber,
-            [])
-      end
-    end
+          def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
+            return unless ASSESS.enabled?
+            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
+            return unless Contrast::Utils::DuckUtils.trackable?(underlying)
+            return unless underlying.is_a?(String) && !underlying.empty?
 
-    def instrument_fiber_track
-      @_instrument_fiber_variables ||= begin
-          cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
-          true
-        end
-    rescue StandardError => e
-      logger.error(e, 'Error loading fiber track patch')
-      false
-    end
+            with_contrast_scope do
+              underlying.cs__splat_tags(fiber)
+              fiber.cs__properties.build_event(
+                  FIBER_NEW_NODE,
+                  fiber,
+                  underlying,
+                  fiber,
+                  [])
+            end
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger.error('Unable to propagate during Fiber.new', e)
+          end
 
-    # Some propagation occurred, but we're not sure what the
-    # exact transformation was. To be safe, we just explode
-    # all the tags from the source to the return.
-    #
-    # If the return already had that tag, the existing tag
-    # range is recycled to save us an object.
-    def cs__splat_tags ret, source = self
-      source.cs__properties.tag_keys.each do |key|
-        length = Contrast::Utils::StringUtils.ret_length(ret)
-        existing = ret.cs__properties.fetch_tag(key)
-        # if the tag already exists, drop all but the first range
-        # then change that range to cover the entire return
-        if existing&.any?
-          existing.drop(existing.length - 1)
-          range = existing[0]
-          range.repurpose(0, length)
-        else
-          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-          ret.cs__properties.add_tag(key, span)
+          def instrument_fiber_track
+            @_instrument_fiber_variables ||= begin
+                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+                true
+              end
+          rescue StandardError => e
+            logger.error('Error loading fiber track patch', e)
+            false
+          end
         end
       end
     end
   end
 end
-
-Fiber.instrument_fiber_track

data/lib/contrast/extensions/ruby_core/assess/hash.rb

@@ -1,22 +1,39 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This Class provides us with a way to invoke Hash propagation for those
-# methods which are too complex to fit into one of the standard
-# Contrast::Agent::Assess::Policy::Propagator molds.
-class Hash
-  def self.cs__duplicate_and_freeze object
-    return object unless object.is_a?(String) && !object.cs__frozen?
-    return object unless object.cs__tracked?
+cs__scoped_require 'contrast/components/interface'
 
-    object.dup.cs__freeze
-  rescue StandardError
-    logger.error("Unable to track dataflow through array for #{ object }")
-  end
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This Class provides us with a way to invoke Hash propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds.
+      class HashPropagator
+        include Contrast::Components::Interface
+        access_component :logging
+        class << self
+          def cs__duplicate_and_freeze object
+            return object unless object.is_a?(String) && !object.cs__frozen?
+            return object unless object.cs__tracked?
+
+            object.dup.cs__freeze
+          rescue StandardError
+            # we'll rescue this error, but we can't log it here as that will
+            # result in a seg fault
+          end
 
-  def cs__bracket_set *args
-    Hash.cs__duplicate_and_freeze(args[0])
+          def instrument_hash_track
+            @_instrument_hash_track ||= begin
+                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
+                                            true
+                                          end
+          rescue StandardError => e
+            logger.error('Error loading hash track patch', e)
+            false
+          end
+        end
+      end
+    end
   end
 end
-
-cs__scoped_require 'cs__assess_hash/cs__assess_hash'

data/lib/contrast/extensions/ruby_core/assess/kernel.rb

@@ -52,43 +52,44 @@ module KernelPropagator
     end
 
     def track_sprintf result, format_string, args
-      tracked_inputs = []
-      tracked_inputs << format_string if format_string.cs__tracked?
+      handle_sprintf_value(format_string, result)
       if args.is_a?(String)
-        tracked_inputs << args if args.cs__tracked?
+        handle_sprintf_value(args, result)
       elsif args.is_a?(Hash)
-        args.each_value do |value|
-          next unless Contrast::Utils::DuckUtils.quacks_to?(
-              value,
-              :cs__tracked?)
-          next unless value.cs__tracked?
-
-          tracked_inputs << value
-        end
+        handle_sprintf_hash(args, result)
       elsif args.is_a?(Array)
-        args.each do |value|
-          next unless Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?)
-          next unless value.cs__tracked?
-
-          tracked_inputs << value
-        end
-      end
-      return result if tracked_inputs.empty?
-
-      tracked_inputs.each do |input|
-        input.cs__properties.events.each do |event|
-          result.cs__properties.events << event
-        end
-        input.cs__splat_tags(result)
+        handle_sprintf_array args, result
       end
 
       result
     rescue StandardError => e
       logger.error(
-          e,
-          'Unable to track dataflow through sprintf')
+          'Unable to track dataflow through sprintf', e)
       result
     end
+
+    private
+
+    def handle_sprintf_value value, result
+      return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+
+      value.cs__properties.events.each do |event|
+        result.cs__properties.events << event
+      end
+      value.cs__splat_tags(result)
+    end
+
+    def handle_sprintf_array args, result
+      args.each do |value|
+        handle_sprintf_value(value, result)
+      end
+    end
+
+    def handle_sprintf_hash args, result
+      args.each_value do |value|
+        handle_sprintf_value(value, result)
+      end
+    end
   end
 end