contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/utils/stack_trace_utils.rb

@@ -3,207 +3,111 @@
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/api'
+cs__scoped_require 'contrast/utils/cache'
 
 module Contrast
   module Utils
     # Utilities for converting ruby stack trace into DTMs
     class StackTraceUtils
-      CONTRAST_MARKER = 'contrast/extensions/ruby_core'
-      MONKEYPATCH_MARKER = 'cs__'
-
-      # TODO: RUBY-532
-      CLASSNAME_CACHE = Contrast::Utils::Cache.new
-
       # need lib here to separate from specs
-      AGENT_CLASS_MARKERS = %w[
-        /lib/contrast/
-      ].cs__freeze
-
-      def self.custom_code_context?
-        stack = Kernel.caller(0, 15)
-        i = 0
-        while i < stack.length
-          stack_element = stack[i]
-          if stack_element.include?('contrast')
-            # Noop
-          elsif stack_element.include?('gems')
-            return false
-          else
-            return true
+      AGENT_CLASS_MARKER = '/lib/contrast/'
+
+      class << self
+        # Determine if this method is being invoked by application code or not
+        # based on the immediate caller of the code after Contrast.
+        #
+        # @return [Boolean] true if this code is called with application
+        #   (non-gem) code in the caller
+        def custom_code_context?
+          root_dir = Contrast::Agent.framework_manager.app_root
+
+          stack = Kernel.caller(0, 15)
+          i = 0
+          while i < stack.length
+            stack_element = stack[i]
+            i += 1
+            next if stack_element.include?('/contrast/')
+
+            return stack_element.start_with?(root_dir)
           end
-          i += 1
         end
-      end
-
-      def self.build(
-          skip: 0,
-          depth: 10,
-          ignore: false,
-          ignore_strings: AGENT_CLASS_MARKERS,
-          class_lookup: false,
-          rasp_element: true)
-
-        stack = caller(skip.to_i, depth.to_i)
-        return [] unless stack
-
-        stack = reject_caller_entries(stack, ignore_strings) if ignore
-        stack.map! do |entry|
-          element = rasp_or_assess(rasp_element)
-          element = fill_element(element, entry, class_lookup)
-          element
-        end
-        stack.compact!
-        stack
-      end
 
-      def self.reject_caller_entries stack, ignore_strings
-        return stack unless ignore_strings&.any?
-
-        stack.reject do |entry|
-          ignore_strings.any? { |marker| entry.include?(marker) } ||
-              entry.include?(MONKEYPATCH_MARKER)
+        # Call and translate a caller_locations array to an array of
+        # StackTraceElement for TeamServer to display, excluding any Contrast
+        # code found.
+        #
+        # @return [Array<Contrast::Api::Dtm::StackTraceElement]
+        def build_protect_stack_array
+          stack = caller(2, 20)
+          return [] unless stack
+
+          stack = reject_caller_entries(stack)
+          i = 0
+          stack.map! do |entry|
+            element = Contrast::Api::Dtm::StackTraceElement.new
+            element = fill_protect_element(element, entry, i)
+            i += 1
+            element
+          end
+          stack.compact!
+          stack
         end
-      end
 
-      def self.rasp_or_assess rasp_element
-        if rasp_element
-          Contrast::Api::Dtm::StackTraceElement.new
-        else
-          Contrast::Api::Dtm::TraceStack.new
+        # Translate a caller array to an array of TraceStacks for TeamServer to
+        # display, excluding any Contrast code found.
+        #
+        # @param stack [Array<String>] the output of Kernel.caller
+        # @return [Array<Contrast::Api::Dtm::TraceStack]
+        def build_assess_stack_array stack
+          converted = []
+          return converted unless stack
+
+          i = 0
+          while i < stack.length
+            caller_location = stack[i]
+            i += 1
+            next if caller_location.include?(AGENT_CLASS_MARKER)
+
+            # To play nice with the way that TeamServer is rendering these
+            # values, we only populate the file_name field with exactly what we
+            # want them to display
+            element = Contrast::Api::Dtm::TraceStack.new
+            element.file_name = caller_location
+            converted << element
+          end
+          converted
         end
-      end
 
-      def self.to_dtm_stack stack_locations: nil, rasp_element: true
-        return [] unless stack_locations
+        private
 
-        stack_locations = reject_locations(stack_locations)
-        stack_locations.map! do |caller_location|
-          element = rasp_or_assess(rasp_element)
-          element = fill_loc_element(element, caller_location)
-          element
-        end
-        stack_locations.compact!
-        stack_locations
-      end
-
-      def self.reject_locations stack_locations
-        stack_locations.reject do |entry|
-          class_path = entry.path
-          method = entry.label
-          AGENT_CLASS_MARKERS.any? { |marker| class_path.include?(marker) } ||
-              method.include?(MONKEYPATCH_MARKER)
+        def reject_caller_entries stack
+          stack.reject do |entry|
+            entry = entry.to_s
+            entry.include?(AGENT_CLASS_MARKER)
+          end
         end
-      end
 
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_element element, str, class_lookup
-        return element if str.nil? || str.strip.empty?
-
-        path, line, method = str.split(':')
-        element.line_number = line.to_i
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        declaring_class = best_classname(path, element.file_name) if class_lookup
-        element.declaring_class = Contrast::Utils::StringUtils.force_utf8(declaring_class)
-        method_name = find_method_name(method)
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(method_name)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
-
-      def self.best_classname path, file
-        name = first_class(path)
-        name || look_like_classname(file)
-      end
-
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_loc_element element, caller_location
-        return element unless caller_location
-
-        lineno = caller_location.lineno
-        element.line_number = lineno.to_i
-        path = caller_location.path
-        path = Contrast::Utils::StringUtils.force_utf8(path)
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        element.declaring_class = path
-        label = caller_location.label
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(label)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
+        # In Contrast UI - there are many ways to render the stacktraces. For
+        # Protect, there are two ways we're concerned about, one for the first
+        # element and then all others.
+        # 1 for protect first frame - We need the method specifically for this rendering
+        # 1 for protect Nth frames
+        def fill_protect_element element, caller_location, index
+          return element unless caller_location
+
+          if index.zero?
+            element.method_name = caller_location.split('`')[-1].delete_suffix!('\'')
+            element.file_name = caller_location.split(':')[0]
+          else
+            element.file_name = caller_location
+          end
 
-      def self.filename_from_path path
-        file_idx = path.rindex(Contrast::Utils::ObjectShare::SLASH)
-        if file_idx
-          txt_idx = file_idx + 1
-          path[txt_idx, path.length - txt_idx]
-        else
-          path
+          element
+        rescue StandardError
+          # NOOP
+          nil
         end
       end
-
-      # Bit of a HACK: Given a path to a file, assume that the first line in the
-      # form `class Name` is the class that was loaded. True most of the time.
-      #
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /\s*class\s+([_[:alpha:]][_[:alnum:]]*)/m
-      CLASS_MARKER = ' class '
-      CLASS_END_MARKER = Contrast::Utils::ObjectShare::NEW_LINE
-      def self.first_class path
-        return nil if path.nil? || path.empty?
-
-        name = CLASSNAME_CACHE[path]
-        return name if name
-
-        text = File.read(path)
-        name = parse_string(text, CLASS_MARKER, CLASS_END_MARKER)
-        CLASSNAME_CACHE[path] = name if name
-        name
-      end
-
-      RB_MARKER = '.rb'
-      # Convert a file to look like a classname
-      # If the file ends w/ '.rb', trim that off
-      # If the file doesn't start with a capital letter,
-      # capitalize it
-      def self.look_like_classname file
-        file = file.to_s
-        file[0].capitalize + (file.end_with?(RB_MARKER) ? file.slice(1..-4) : file.slice(1..-1))
-      end
-
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /[`]([^']*)[']/
-      METHOD_MARKER = Contrast::Utils::ObjectShare::TICK
-      METHOD_END_MARKER = Contrast::Utils::ObjectShare::COMMA
-      def self.find_method_name method
-        parse_string(method, METHOD_MARKER, METHOD_END_MARKER)
-      end
-
-      def self.parse_string string, start_marker, end_marker
-        return nil unless string
-
-        start_idx = string.index(start_marker)
-        return nil unless start_idx
-
-        start_idx += start_marker.length # account for marker length
-        end_idx = string.index(end_marker, start_idx)
-        end_idx ||= string.length
-        len = end_idx - start_idx
-        string[start_idx, len]
-      end
     end
   end
 end

data/lib/contrast/utils/string_utils.rb

@@ -1,10 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
+      include Contrast::Components::Interface
+      access_component :logging
+
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP-'
 
@@ -17,6 +22,17 @@ module Contrast
         string.nil? ? 0 : string.to_s.length
       end
 
+      def self.present? str
+        !str.nil? && !str.to_s.empty?
+      end
+
+      def self.protobuf_format data, truncate: true
+        data = data&.to_s
+        data = Contrast::Utils::StringUtils.force_utf8(data)
+        data = Contrast::Utils::StringUtils.truncate(data) if truncate
+        data
+      end
+
       # Protobuf has a very strict typing. Nil is not a String and will throw
       # an exception if you try to set it. Use this to be safe.
       # Uses the object share to avoid creating several new strings per request
@@ -31,7 +47,7 @@ module Contrast
         str.to_s[0..255]
       end
 
-      def self.force_utf8 str, logger = nil
+      def self.force_utf8 str
         return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
 
         str = str.to_s
@@ -45,7 +61,7 @@ module Contrast
         # We were unable to switch the String to a UTF-8 format.
         # Return non-nil so as not to throw an exception later when trying
         # to do regexp or other compares on the String
-        logger&.debug "Unable to change '#{ str }' to valid UTF-8: #{ e.message }"
+        logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
         Contrast::Utils::ObjectShare::EMPTY_STRING
       end

data/lib/contrast/utils/tag_util.rb

@@ -37,7 +37,9 @@ module Contrast
               tag.update_end(0)
             when Contrast::Agent::Assess::Tag::HIGH_SPAN
               tag.update_start(range.end_idx)
-            when Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/EmptyWhen
+            when Contrast::Agent::Assess::Tag::ABOVE
+              # The tag's above where we are, it doesn't cover us but a later
+              # one may
             end
           end
           return false unless tag.length <= 0
@@ -89,6 +91,14 @@ module Contrast
           end
         end
 
+        def size_aware_merge target_object, tags
+          max_size = target_object.to_s.length
+          tags = merge_tags(tags)
+          tags.each do |tag|
+            tag.update_end(max_size) if tag.extends_beyond_string_size?(max_size)
+          end
+        end
+
         private
 
         # Add one new element to the given array

data/lib/contrast/utils/thread_tracker.rb

@@ -41,11 +41,11 @@ module Contrast
       end
 
       # logger may be nil so use this utility method instead
-      def log key, msg = nil
+      def log key
         return unless @logger
         return unless @logger.debug?
 
-        @logger.debug("Thread Tracker[#{ key }] :: #{ Process.pid }.#{ Thread.current.object_id } => #{ msg }")
+        @logger.debug('Accessing object in Thread Tracker', name: key, p_id: Process.pid, thread_id: Thread.current.object_id)
       rescue StandardError
         false # NOOP
       end

data/lib/contrast/utils/timer.rb

@@ -21,23 +21,11 @@ module Contrast
         result
       end
 
-      def ms key
-        events[key.to_s] || 0
-      end
-
-      def abs key
-        start_ms + (events[key.to_s] || 0)
-      end
-
       def to_s
         pairs = events.to_a.map { |pair| "#{ pair[0] }=#{ pair[1] }ms" }
         start_at.strftime('%Y-%m-%d %H:%M:%S.%L') + pairs.join(Contrast::Utils::ObjectShare::SPACE)
       end
 
-      def diff_s start_ms
-        (now_ms - start_ms) / 1000
-      end
-
       def now_ms
         (Time.now.to_f * 1000).to_i
       end
@@ -45,34 +33,6 @@ module Contrast
       def self.now_ms
         (Time.now.to_f * 1000).to_i
       end
-
-      def self.earliest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].min
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def self.latest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].max
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def now_sec
-        now_ms / 1000
-      end
-
-      def elapsed_ms
-        now_ms - start_ms
-      end
     end
   end
 end

data/resources/assess/policy.json

@@ -1,6 +1,7 @@
 {
   "tracked_classes": [
     "ActionDispatch::Http::UploadedFile",
+    "Fiber",
     "Symbol",
     "Pathname",
     "File",
@@ -149,7 +150,25 @@
       "source":"O",
       "target":"R",
       "action":"KEEP"
-    }, {
+    },     {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "to_s",
+      "source": "O",
+      "target": "R",
+      "action": "KEEP"
+    },
+    {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "to_str",
+      "source": "O",
+      "target": "R",
+      "action": "KEEP"
+    },
+    {
       "class_name": "String",
       "instance_method": true,
       "method_visibility": "public",
@@ -245,22 +264,6 @@
       "source":"O",
       "target":"R",
       "action":"KEEP"
-    }, {
-      "class_name":"String",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"to_s",
-      "source":"O",
-      "target":"R",
-      "action":"KEEP"
-    }, {
-      "class_name":"String",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"to_str",
-      "source":"O",
-      "target":"R",
-      "action":"KEEP"
     }, {
       "class_name":"String",
       "instance_method": true,
@@ -598,7 +601,9 @@
       "method_name":"to_a",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "to_a_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -606,7 +611,9 @@
       "method_name":"[]",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "square_bracket_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -614,7 +621,10 @@
       "method_name":"captures",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "captures_tagger"
+
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -622,7 +632,9 @@
       "method_name":"values_at",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "values_at_tagger"
     }, {
       "class_name":"String",
       "instance_method": true,