contrast-agent 3.9.0 → 3.11.0

data/ext/cs__assess_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -2,6 +2,7 @@
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_regexp.h"
+#include "../cs__common/cs__common.h"
 #include <ruby.h>
 
 void contrast_alias_method(const VALUE target, const char *to,
@@ -21,17 +22,21 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
         rb_hash_aset(infohash, rb_sym_result, result);
         rb_hash_aset(infohash, rb_sym_string, argv[0]);
         rb_hash_aset(infohash, rb_sym_back_ref, rb_backref_get());
-        rb_funcall(regexp, rb_sym_assess_track_regexp, 1, infohash);
+        rb_funcall(regexp_propagator, rb_sym_assess_track_regexp, 1, infohash);
     }
 
     return result;
 }
 
 void Init_cs__assess_regexp(void) {
-    rb_sym_assess_regexp_equal_squiggle =
-        rb_intern("cs__patched_equal_squiggle");
-    rb_sym_assess_track_regexp = rb_intern("cs__regexp_tagger");
-
+    regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
+    rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
+
+    /* These are the keys we use to define our hash of
+     * Regexp info.  rb_global_variable doesn't make
+     * them global in the $global sense, but marks them
+     * so they don't get swept by the GC.
+     */
     rb_sym_result = ID2SYM(rb_intern("result"));
     rb_global_variable(&rb_sym_result);
     rb_sym_regexp = ID2SYM(rb_intern("regexp"));
@@ -41,8 +46,7 @@ void Init_cs__assess_regexp(void) {
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
 
-    VALUE regexp_class = rb_define_class("Regexp", rb_cObject);
-    contrast_alias_method(regexp_class, "cs__patched_equal_squiggle", "=~");
-    rb_define_method(regexp_class, "=~", contrast_assess_regexp_equal_squiggle,
-                     -1);
+    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
+                                                                  "=~",
+                                                                  contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -6,6 +6,7 @@ static VALUE rb_sym_string;
 static VALUE rb_sym_back_ref;
 static VALUE rb_sym_assess_regexp_equal_squiggle;
 static VALUE rb_sym_assess_track_regexp;
+static VALUE regexp_propagator;
 
 /*
  * argc - number of arguments

data/ext/cs__assess_regexp/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string/cs__assess_string.c

@@ -5,7 +5,8 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_string_uminus(const VALUE obj) {
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj) {
     VALUE dup, tracked;
     if (!OBJ_FROZEN(obj)) {
         tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -25,14 +26,10 @@ static VALUE contrast_assess_string_uminus(const VALUE obj) {
 }
 
 void Init_cs__assess_string(void) {
-    VALUE string_class;
-
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
-    rb_sym_assess_string_uminus = rb_intern("cs__patched_minus_at");
 
-    string_class = rb_define_class("String", rb_cObject);
-    /* -@ */
-    contrast_alias_method(string_class, "cs__patched_minus_at", "-@");
-    rb_define_method(string_class, "-@", contrast_assess_string_uminus, 0);
+    rb_sym_assess_string_uminus = contrast_register_patch("String",
+                                                          "-@",
+                                                          &contrast_assess_string_uminus);
 }

data/ext/cs__assess_string/cs__assess_string.h

@@ -14,6 +14,7 @@ static VALUE rb_sym_freeze;
  * String#freeze, which will leave our properties alone.
  * -HM
  */
-static VALUE contrast_assess_string_uminus(const VALUE obj);
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                              const VALUE obj);
 
 void Init_cs__assess_string(void);

data/ext/cs__assess_string/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c

@@ -9,7 +9,7 @@
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
     VALUE result = rb_str_concat_literals_original(num, strary);
     VALUE rb_params = rb_ary_new_from_values((int)num, strary);
-    rb_funcall(string_class, track_interpolation, 2, rb_params, result);
+    rb_funcall(string_propagator, track_interpolation, 2, rb_params, result);
     return result;
 }
 
@@ -25,7 +25,7 @@ static int install_hooks() {
 }
 
 void Init_cs__assess_string_interpolation26(void) {
-    string_class = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
+    string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
     track_interpolation = rb_intern("track_interpolation");
     install_hooks();
 }

data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h

@@ -1,10 +1,10 @@
 #include <ruby.h>
 
-static VALUE string_class;
+static VALUE string_propagator;
 static VALUE track_interpolation;
 
-void *rb_str_concat_literals(size_t num, const VALUE *strary);
-void *(*rb_str_concat_literals_original)(size_t, const VALUE *);
+VALUE *rb_str_concat_literals(size_t num, const VALUE *strary);
+VALUE (*rb_str_concat_literals_original)(size_t, const VALUE *);
 
 static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary);
 

data/ext/cs__assess_string_interpolation26/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_yield_track/cs__assess_yield_track.h

@@ -4,7 +4,7 @@
 static VALUE split_class;
 static VALUE propagate_yield, split_method;
 
-static VALUE *(*rb_yield_original)(VALUE val);
+static VALUE (*rb_yield_original)(VALUE val);
 static VALUE rb_yield_hook(VALUE val, const VALUE self);
 
 static int install_yield_hooks();

data/ext/cs__assess_yield_track/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__common/cs__common.c

@@ -29,6 +29,79 @@ VALUE contrast_patcher() {
     return patcher;
 }
 
+VALUE contrast_register_patch(const char *module_name,
+                               const char *method_name,
+                               VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                               ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
+}
+
+
+VALUE contrast_register_singleton_patch(const char *module_name,
+                                        const char *method_name,
+                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                        ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
+}
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                                ) {
+  return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
+}
+
+static VALUE _contrast_register_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
+                                      patch_impl patch
+                                      ) {
+    VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
+    VALUE unbound_method = Qnil;
+    VALUE rb_str_module_name = rb_str_new_cstr(module_name);
+    VALUE rb_str_method_name = rb_str_new_cstr(method_name);
+
+    /* We register the c function as an instance method on an
+     * anonymous module, and then unbind it.  This creates
+     * an UnboundMethod object that we register.  This
+     * UnboundMethod object can then be bound to a class
+     * with define_method:
+     *
+     * my_method = get_patch_from_c_somehow()
+     *
+     * class MyClass
+     *   define_method('name', my_method.bind(self))
+     * end
+     *
+     * MyClass.new.name # calls my_method
+     */
+    /* This is an anonymous module, upon which we define C functions
+     * as Ruby functions.  We immediately unbind and undef them.
+     * This module doesn't do anything.
+     */
+    rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
+    VALUE rb_sym_instance_method = rb_intern("instance_method");
+    unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
+    rb_undef_method(contrast_bind_module, method_name);
+
+    /* map impl enum -> ruby symbol */
+    VALUE impl = Qnil;
+    switch(patch) {
+      case IMPL_ALIAS_INSTANCE:
+        impl = ID2SYM(rb_sym_alias_instance);
+        break;
+      case IMPL_ALIAS_SINGLETON:
+        impl = ID2SYM(rb_sym_alias_singleton);
+        break;
+      case IMPL_PREPEND:
+        impl = ID2SYM(rb_sym_prepend);
+        break;
+    }
+
+    VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
+    return SYM2ID(underlying_method_name);
+}
+
 void Init_cs__common(void) {
     cs__send_method = rb_intern("send");
     cs__alias_method_sym = ID2SYM(rb_intern("alias_method"));
@@ -42,6 +115,12 @@ void Init_cs__common(void) {
     rb_sym_method = rb_intern("__method__");
     rb_sym_cs_tracked = rb_intern("cs__tracked?");
 
+    /* Used for returning unbound C functions */
+    rb_sym_register_c_patch = rb_intern("register_c_patch");
+    rb_sym_alias_instance   = rb_intern("alias_instance");
+    rb_sym_alias_singleton  = rb_intern("alias_singleton");
+    rb_sym_prepend          = rb_intern("prepend");
+
     /* Ensure definition of core Contrast instrumentation modules */
     contrast = rb_define_module("Contrast");
     agent = rb_define_module_under(contrast, "Agent");

data/ext/cs__common/cs__common.h

@@ -3,6 +3,13 @@
 
 #include <ruby.h>
 
+typedef enum {
+  IMPL_ALIAS_INSTANCE,
+  IMPL_ALIAS_SINGLETON,
+  IMPL_PREPEND
+} patch_impl;
+
+
 static VALUE cs__send_method;
 static VALUE cs__alias_method_sym;
 
@@ -19,10 +26,37 @@ extern VALUE rb_sym_method;
 extern VALUE rb_sym_cs_tracked;
 
 static VALUE patcher;
+static VALUE rb_sym_instance_method;
+static VALUE rb_sym_register_c_patch;
+static VALUE rb_sym_alias_instance;
+static VALUE rb_sym_alias_singleton;
+static VALUE rb_sym_prepend;
 
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 
+VALUE contrast_register_patch(const char *module_name,
+                              const char *method_name,
+                              VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                              );
+
+VALUE contrast_register_singleton_patch(const char *module_name,
+                                        const char *method_name,
+                                        VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                        );
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, const VALUE*, const VALUE)
+                                                );
+
+static VALUE _contrast_register_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, const VALUE*, const VALUE),
+                                      patch_impl patch_impl
+                                      );
+
+
 VALUE contrast_patcher();
 
 void Init_cs__common(void);

data/ext/cs__common/extconf.rb

@@ -1,19 +1,20 @@
-require 'mkmf'
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
 
+require 'mkmf'
 require_relative '../../lib/contrast/agent/version'
+
 installed_path = __dir__
 
-origin =  if (darwin = !(/darwin/ =~ RUBY_PLATFORM).nil?)
-            "@loader_path"
+origin =  if !(/darwin/ =~ RUBY_PLATFORM).nil?
+            '@loader_path'
           else
-            "\\$${ORIGIN}"
+            '\$${ORIGIN}'
           end
 
-options = " -Wl,-rpath,#{origin}/../../shared_libraries"
+options = " -Wl,-rpath,#{ origin }/../../shared_libraries"
 
-if try_link('int main() {return 0;}', options)
-  $LDFLAGS << options
-end
+$LDFLAGS << options if try_link('int main() {return 0;}', options)
 
 $LIBPATH << installed_path
 

data/ext/cs__contrast_patch/cs__contrast_patch.h

@@ -1,10 +1,5 @@
 #include <ruby.h>
-
-typedef enum {
-  IMPL_ALIAS_INSTANCE,
-  IMPL_ALIAS_SINGLETON,
-  IMPL_PREPEND
-} patch_impl;
+#include "../cs__common/cs__common.h"
 
 /* Calls to Contrast modules */
 /* Contrast::Agent::Patching::Policy::PatchStatus */

data/ext/cs__contrast_patch/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__protect_kernel/cs__protect_kernel.c

@@ -9,12 +9,23 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
                                    const VALUE self) {
     VALUE ret;
     if (rb_block_given_p()) {
+        /* We call our hook, but it's a little complicated.
+         * We wrap the fork block with our own lambda in 
+         * order to instrument it.  There are no public
+         * methods in the Ruby C API to set the prevailing
+         * block, so we have to use rb_funcall_with_block.
+         * Also, rb_funcall_with_block does a public call,
+         * and our method is private.
+         * So we (as a hack) temporarily set it to public.
+         */
         VALUE wrapper;
         wrapper =
             rb_funcall_with_block(rb_mKernel, rb_sym_protect_kernel_wrapper, 0,
-                                  NULL, rb_block_proc());
+                                   NULL, rb_block_proc());
+        rb_funcall(rb_mKernel, rb_intern("public"), 1, ID2SYM(rb_sym_protect_kernel_fork));
         ret = rb_funcall_with_block(self, rb_sym_protect_kernel_fork, argc,
                                     argv, wrapper);
+        rb_funcall(rb_mKernel, rb_intern("private"), 1, ID2SYM(rb_sym_protect_kernel_fork));
     } else {
         ret = rb_funcall2(self, rb_sym_protect_kernel_fork, argc, argv);
     }
@@ -22,16 +33,14 @@ static VALUE contrast_protect_fork(const int argc, const VALUE *argv,
 }
 
 void Init_cs__protect_kernel(void) {
-
-    rb_sym_protect_kernel_fork = rb_intern("cs__protect_kernel_fork");
     rb_sym_protect_kernel_wrapper = rb_intern("cs__protect_build_wrapper");
 
-    VALUE singleton = rb_singleton_class(rb_mKernel);
-    contrast_alias_method(rb_mKernel, "cs__protect_kernel_fork", "fork");
-    contrast_alias_method(singleton, "cs__protect_kernel_fork", "fork");
-    rb_define_module_function(rb_mKernel, "fork", contrast_protect_fork, -1);
-    // Kernel#fork, as opposed to Kernel.fork, is private. Restore that.
-    rb_funcall(rb_mKernel, rb_intern("public"), 1,
-               ID2SYM(rb_intern("cs__protect_kernel_fork")));
-    rb_funcall(rb_mKernel, rb_intern("private"), 1, ID2SYM(rb_intern("fork")));
+    rb_sym_protect_kernel_fork = contrast_register_patch("Kernel",
+                                                         "fork",
+                                                         &contrast_protect_fork);
+
+    rb_sym_protect_kernel_fork = contrast_register_singleton_patch("Kernel",
+                                                                   "fork",
+                                                                   &contrast_protect_fork);
+
 }

data/ext/cs__protect_kernel/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/extconf_common.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-require 'mkmf'
+# frozen_string_literal: true
 
+require 'mkmf'
 require_relative '../lib/contrast/agent/version'
 
 def name
@@ -8,7 +9,7 @@ def name
 end
 
 def make!
-  create_makefile "#{name}/#{name}"
+  create_makefile "#{ name }/#{ name }"
 end
 
 def ext_path
@@ -18,23 +19,24 @@ def ext_path
 end
 
 def rpath_root
-  if (darwin = !(/darwin/ =~ RUBY_PLATFORM).nil?)
-    "@loader_path"
+  if (/darwin/ =~ RUBY_PLATFORM).nil?
+    '\$${ORIGIN}'
   else
-    "\\$${ORIGIN}"
+    '@loader_path'
   end
 end
 
 def funchook_rpath!
-  options = " -Wl,-rpath,#{rpath_root}/../../shared_libraries"
+  options = " -Wl,-rpath,#{ rpath_root }/../../shared_libraries"
   raise unless try_link('int main() {return 0;}', options)
+
   $LDFLAGS << options
-  $LDFLAGS << " -L#{__dir__}/../shared_libraries"
+  $LDFLAGS << " -L#{ __dir__ }/../shared_libraries"
 
   find_header('funchook.h', ext_path)
   have_header('funchook.h')
 
-  find_library('funchook', 'funchook_create', "../shared_libraries")
+  find_library('funchook', 'funchook_create', '../shared_libraries')
   find_library('funchook', 'funchook_install')
   find_library('funchook', 'funchook_prepare')
   have_library('funchook', 'funchook_create')