contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -0,0 +1,25 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/agent/assess/events/source_event'
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # This module returns the event type appropriate to the given Node
+        module EventFactory
+          def self.build policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+            case policy_node
+            when Contrast::Agent::Assess::Policy::SourceNode
+              Contrast::Agent::Assess::Events::SourceEvent.new(policy_node, tagged, object, ret, args, source_type, source_name)
+            when Contrast::Agent::Assess::Policy::PolicyNode
+              Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/events/source_event.rb

@@ -0,0 +1,83 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # This class holds the data about an event in the application
+        # We'll use it to build an event that TeamServer can consume if
+        # the object to which this event belongs ends in a trigger.
+        class SourceEvent < Contrast::Agent::Assess::ContrastEvent
+          attr_reader :source_name, :source_type, :request
+
+          def initialize policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+            super(policy_node, tagged, object, ret, args)
+            @source_type = source_type
+            @source_name = source_name
+            @request = Contrast::Agent::REQUEST_TRACKER.current&.request
+          end
+
+          def find_parent_ids _policy_node, _object, _ret, _args
+            nil
+          end
+
+          # Convert this event into a DTM that TeamServer can consume
+          def to_dtm_event
+            event = super
+            event.field_name = Contrast::Utils::StringUtils.force_utf8(source_name)
+            event_source_dtm = build_event_source_dtm
+            event.event_sources << event_source_dtm if event_source_dtm
+            event.object_id = event_id.to_i
+            event
+          end
+
+          def forced_source_type
+            @_forced_source_type ||= Contrast::Utils::StringUtils.force_utf8(source_type)
+          end
+
+          def forced_source_name
+            @_forced_source_name ||= Contrast::Utils::StringUtils.force_utf8(source_name)
+          end
+
+          # Probably only for source events, but we'll go
+          # with source_type instead. java & .net support source_type
+          # in propagation events, so we'll future proof this
+          def build_event_source_dtm
+            # You can have a source w/o a name, but not w/o a type
+            return unless source_type
+
+            dtm = Contrast::Api::Dtm::TraceEventSource.new
+            dtm.type = forced_source_type
+            dtm.name = forced_source_name
+            dtm
+          end
+
+          # We have to do a little work to figure out what our TS appropriate
+          # target is. To break this down, the logic is as follows:
+          # 1) If I have a highlight, it means that I have a P target that is
+          #    not in integer form (it was a named / keyword type for which I had
+          #    to find the index). I need to address this so that TS can process
+          #    it.
+          # 2) I'll set the event's source and target to TS values.
+          # 3) Return the highlight or the first source/target as the taint
+          #    target.
+          def determine_taint_target event
+            return unless @policy_node&.targets&.any?
+
+            event.source = @policy_node.source_string if @policy_node.source_string
+            event.target = if @highlight
+                             "P#{ @highlight }"
+                           else
+                             @policy_node.target_string
+                           end
+            @highlight || @policy_node.targets[0]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/insulator.rb

@@ -45,9 +45,5 @@ class SimpleDelegator
   def properties
     @delegate_properties ||= Contrast::Agent::Assess::Properties.new
   end
-
-  def frozen_properties
-    @delegate_frozen_properties ||= Contrast::Agent::Assess::FrozenProperties.new
-  end
   # rubocop:enable Naming/MemoizedInstanceVariableName
 end

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -5,6 +5,7 @@ cs__scoped_require 'contrast/agent/assess/policy/policy'
 cs__scoped_require 'contrast/agent/patching/policy/patcher'
 cs__scoped_require 'contrast/agent/patching/policy/method_policy'
 cs__scoped_require 'contrast/agent/patching/policy/module_policy'
+cs__scoped_require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -38,8 +39,9 @@ module Contrast
               with_contrast_scope { patcher.patch_specific_module(mod) }
             rescue StandardError => e
               logger.warn(
+                  'Unable to patch assess during eval',
                   e,
-                  "Unable to patch assess into #{ mod.cs__name } on eval")
+                  module: mod.cs__name)
             end
 
             # Exposed so that methods can be dynamically patched on creation at
@@ -74,8 +76,9 @@ module Contrast
               end
             rescue StandardError => e
               logger.warn(
+                  'Unable to patch assess during define_method_attribute',
                   e,
-                  "Unable to patch assess into #{ class_name }##{ method_name } on define_method_attribute")
+                  module: mod.cs__name)
             end
           end
         end

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -44,11 +44,6 @@ module Contrast
             end
           end
 
-          def source_string= value
-            @source_string = value
-            generate_sources
-          end
-
           def target_string= value
             @target_string = value
             generate_targets
@@ -150,8 +145,6 @@ module Contrast
           end
 
           ALL_TYPE = 'A'
-          CREATION_TYPE = 'CREATION'
-          TRIGGER_TYPE = 'TRIGGER'
           TO_MARKER = '2'
           # Convert our action, built from our source and target, into
           # the TS appropriate action. That's a single source to single

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -15,7 +15,7 @@ module Contrast
         # or Keys.
         module PolicyScanner
           include Contrast::Components::Interface
-          access_component :analysis, :logging
+          access_component :analysis
 
           class << self
             def scan trace_point

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -51,7 +51,7 @@ module Contrast
 
             preshift
           rescue StandardError => e
-            logger.error(e, 'Unable to build preshift for method.')
+            logger.error('Unable to build preshift for method.', e)
             nil
           end
 

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -34,7 +34,6 @@ module Contrast
           REVERSE_ACTION = 'REVERSE'
           SPLAT_ACTION = 'SPLAT'
           SPLIT_ACTION = 'SPLIT'
-          TAG_ACTION = 'TAG'
           DB_WRITE_ACTION = 'DB_WRITE'
           CUSTOM_ACTION = 'CUSTOM'
 
@@ -56,6 +55,19 @@ module Contrast
               arg
             end
 
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
+            #   the policy that governs the patches to this method
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+            #   of the state of the code just prior to the invocation of the
+            #   patched method.
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method
+            #   was invoked
+            # @param block [Block] the Block passed to the original method
+            # @return [Object, nil] the tracked Return or nil if no changes
+            #   were made; will replace the return of the original function if
+            #   not nil
             def apply_propagation method_policy, preshift, object, ret, args, block
               return unless method_policy.propagation_node
               return unless preshift
@@ -63,7 +75,7 @@ module Contrast
               propagation_node = method_policy.propagation_node
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, 0, args, block)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
             end
 
             PROPAGATION_ACTIONS = {
@@ -80,12 +92,32 @@ module Contrast
                 SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
             }.cs__freeze
 
-            # I lied above. We had to figure out what the target of the propagation was.
-            # Now that we know, we'll actually do things to it.
-            def apply_propagator propagation_node, preshift, target, object, ret, invoked, args, block
-              context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless context && propagation_node && valid_target?(target, propagation_node)
-              return unless valid_length?(target, propagation_node.action)
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
+            # I lied above. We had to figure out what the target of the
+            # propagation was. Now that we know, we'll actually do things to
+            # it. Note that the return of this method will replace the original
+            # return of the patched function unless it is nil, so be sure
+            # you're returning what you intend.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+            #   the node that governs this propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
+            #   of the state of the code just prior to the invocation of the
+            #   patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method
+            #   was invoked
+            # @param block [Block] the Block passed to the original method
+            # @return [Object, nil] the tracked Return or nil if no changes
+            #   were made; will replace the return of the original function if
+            #   not nil
+            def apply_propagator propagation_node, preshift, target, object, ret, args, block
+              return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
@@ -93,18 +125,15 @@ module Contrast
                 Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
-                logger.debug(
-                    nil,
-                    "Propagator #{ propagation_node.id } detected: propagated to #{ target.__id__ }")
               elsif Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
               end
             rescue StandardError => e
-              logger.warn(e, "Unable to apply propagator #{ propagation_node.id }")
+              logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
             end
 
             # Custom actions tend to be the more complex of our propagations.
@@ -188,34 +217,39 @@ module Contrast
 
             private
 
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            # This is checked right before actual propagation
+            def propagation_possible? propagation_node, target
+              return false unless context_available? && propagation_node && valid_target?(target, propagation_node)
+              return false unless valid_length?(target, propagation_node.action)
+
+              true
+            end
+
+            def handle_hash_propagation propagation_node, preshift, target, object, ret, args, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, invoked, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, key, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
               end
             end
 
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
               target.each do |value|
                 next if target == value # Some Enumerable#each are overriden to return self the first time which leads to infinite propagation
 
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
               end
             end
 
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, invoked, args, _block
-              invoked += 1
+            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
               return unless can_propagate?(propagation_node, preshift, target)
 
               # propagate all the tags from the sources to the target
               propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil)
               unless propagation_class
                 logger.warn(
-                    nil,
-                    "Unknown action type #{ propagation_node.action }. Unable to "\
-                    "propagate for #{ propagation_node.id }.")
+                    'Unknown propgation action receieved. Unable to propagate.',
+                    node_id: propagation_node.id,
+                    action: propagation_node.action)
                 return ret
               end
 
@@ -244,13 +278,11 @@ module Contrast
 
               target.cs__properties.add_properties(propagation_node.properties)
 
-              target.cs__properties.build_event(propagation_node, target, object, ret, args, invoked)
-
-              logger.debug(
-                  nil,
-                  "Propagator #{ propagation_node.id } detected: propagated to "\
-                  "#{ target.__id__ }")
+              target.cs__properties.build_event(propagation_node, target, object, ret, args)
 
+              logger.trace('Propagation detected',
+                           node_id: propagation_node.id,
+                           target_id: target.__id__)
               ret.cs__freeze if restore_frozen_state
               ret
             end

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -17,7 +17,8 @@ module Contrast
           JSON_PATCH_CLASS = 'patch_class'
           JSON_PATCH_METHOD = 'patch_method'
 
-          attr_accessor :action, :untags, :patch_class, :patch_method
+          attr_reader :untags, :patch_method
+          attr_accessor :action, :patch_class
 
           # Most things here carry over from PolicyNode.
           # A couple things are new / have new rules

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -18,6 +18,7 @@ module Contrast
           cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
+          cs__scoped_require 'contrast/agent/assess/policy/propagator/match_data'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
           cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target exactly as is. The target's preexisting tags
+          # are unaffected beyond any merging of overlapping tags.
+          class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              def square_bracket_tagger propagation_node, preshift, ret, _block
+                if ret.is_a?(Array)
+                  ret.each_with_index do |return_value, index|
+                    target_matchdata_index = if preshift.args[0].is_a?(Range)
+                                               arg_range = preshift.args[0]
+                                               arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
+                                             else
+                                               preshift.args[index]
+                                             end
+                    square_bracket_single(target_matchdata_index, preshift, return_value, propagation_node)
+                  end
+                elsif ret.is_a?(String)
+                  target_matchdata_index = preshift.args[0]
+                  square_bracket_single(target_matchdata_index, preshift, ret, propagation_node)
+                end
+
+                ret
+              end
+
+              def captures_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, index|
+                  targetted_index = index + 1
+                  square_bracket_single(targetted_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def to_a_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, index|
+                  square_bracket_single(index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              def values_at_tagger propagation_node, preshift, ret, _block
+                ret.each_with_index do |return_value, return_index|
+                  original_group_arg_index = preshift.args[return_index]
+                  square_bracket_single(original_group_arg_index, preshift, return_value, propagation_node)
+                end
+                ret
+              end
+
+              private
+
+              def square_bracket_single argument_index, preshift, return_value, propagation_node
+                original_start_index = preshift.object.begin(argument_index)
+                original_end_index = preshift.object.end(argument_index)
+                original_properties = preshift.object.cs__properties
+                applicable_tags = original_properties.tags_at_range(Contrast::Agent::Assess::AdjustedSpan.new(original_start_index, original_end_index))
+                return if applicable_tags.empty?
+
+                applicable_tags.each do |tag_name, tag_ranges|
+                  return_value.cs__properties.set_tags(tag_name, tag_ranges)
+                end
+                preshift.object.cs__properties.events.each do |event|
+                  return_value.cs__properties.add_event(event)
+                end
+                return_value.cs__properties.build_event(
+                    propagation_node, return_value, preshift.object, return_value, preshift.args)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end