contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/framework/rails/patch/support.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rails framework.
+        module Support
+          # (See BaseSupport#before_load_patches)
+          def before_load_patches!
+            return unless defined?(::Rails)
+
+            # In Rails, session configuration occurs extremely early & only once.
+            # If we defer our patching of the rails session configuration too long
+            # (i.e., where we normally patch) we will miss the configuration
+            # and will never be able to report session misconfiguration rules.
+            Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
+            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+          end
+
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActionController::Live::Buffer',
+                          'contrast/framework/rails/patch/action_controller_live_buffer',
+                          instrumenting_module: 'Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Rails::Application::Configuration',
+                          'contrast/framework/rails/patch/rails_application_configuration',
+                          method_to_instrument: :session_store,
+                          instrumenting_module: 'Contrast::Framework::Rails::Patch::RailsApplicationConfiguration'),
+
+                      # TODO: RUBY-714 remove w/ EOL of 2.5
+                      #
+                      # @deprecated  Everything past here is used for Rewriting and can
+                      #   be removed once we no longer support 2.5.
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActionController::Railties::Helper::ClassMethods',
+                          'contrast/framework/rails/rewrite/action_controller_railties_helper_inherited',
+                          method_to_instrument: :inherited,
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::AttributeMethods::Read::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_attribute_methods_read',
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::Scoping::Named::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_named',
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordNamed'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_time_zone_inherited',
+                          method_to_instrument: :inherited,
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordTimeZoneInherited')
+                    ])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Used to monkey patch all the inherited calls in action_pack
+        #
+        # This is the usual entry point for Rails inheritance work, so it should
+        # catch most of the calls to inherited.
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActionControllerRailtiesHelperInherited
+          def self.instrument
+            @_instrument ||= begin
+                               ::ActionController::Railties::Helpers.class_eval do
+                                 alias_method :cs__patched_helper_inherited, :inherited
+                                 def inherited klass
+                                   klass&.instance_variable_set(:@cs__defining_class, true)
+                                   cs__patched_helper_inherited(klass)
+                                 ensure
+                                   klass&.instance_variable_set(:@cs__defining_class, false)
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Rails / ActiveRecord are sneaky. They define attributes of a class in
+        # one method, then monkey patch allocate in another and finally invoke
+        # module_eval in this method... but of course they use a '_tmp_' header
+        # for the method name and then alias it in this module to name it what
+        # we expect
+        #
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordAttributeMethodsRead
+          def self.instrument
+            @_instrument ||= begin
+                           ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
+                             alias_method :cs__patched_define_method_attribute, :define_method_attribute
+
+                             def define_method_attribute *args, &block
+                               ret = cs__patched_define_method_attribute(*args, &block)
+                               method_name = args[0]
+                               Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+                               ret
+                             end
+
+                             protected :cs__patched_define_method_attribute, :define_method_attribute
+                           end
+                           true
+                         end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
+        # allowing for the runtime rewrite of interpolation calls defined in
+        # methods defined dynamically during application execution.
+        #
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordNamed
+          include Contrast::Components::Interface
+          access_component :agent, :logging
+
+          class << self
+            def rewrite mod, method_name, body
+              return body unless AGENT.rewrite_interpolation?
+              return body unless body.is_a?(Proc)
+
+              location = body.source_location
+              return body unless location_available?(location)
+
+              opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(mod))
+              original_source_code = opener.source_code(location, method_name)
+              return body unless original_source_code
+              return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
+              return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
+
+              # the code looks like 'source :some_method_name, ->lambda_literal'
+              # we just need the lambda
+              body_start = original_source_code.index(',') + 1
+              original_source_code = original_source_code[body_start..-1]
+
+              new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
+              return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
+
+              unbound_eval(cs__name, new_method_source)
+            rescue SyntaxError, StandardError => e
+              logger.debug('Can\'t parse method source in scoped method', e, method: method_name)
+              body
+            end
+
+            # Good news, once we patch the body once, the source location
+            # becomes eval. We may need to fix this later though (so it may
+            # be bad news)
+            def location_available? location
+              return false if location.nil?
+              return false if location.empty? || location[0].empty? || location[0].include?('eval')
+
+              true
+            end
+
+            def instrument
+              @_instrument_named_track ||= begin
+                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                                                 true
+                                               end
+            rescue StandardError, LoadError => e
+              logger.error('Error loading active record named track patch', e)
+              false
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Used to monkey patch all the inherited calls in action_pack
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordTimeZoneInherited
+          def self.instrument
+            @_instrument ||= begin
+                               ::ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods.class_eval do
+                                 private
+
+                                 alias_method :cs__patched_inherited, :inherited
+                                 def inherited klass
+                                   klass&.instance_variable_set(:@cs__defining_class, true)
+                                   cs__patched_inherited(klass)
+                                 ensure
+                                   klass&.instance_variable_set(:@cs__defining_class, false)
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/support.rb

@@ -0,0 +1,115 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/dtm_pb'
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/rails/patch/support'
+cs__scoped_require 'contrast/framework/view_technologies_descriptor'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Framework
+    module Rails
+      # Used when Rails is present to define framework specific behavior
+      class Support < BaseSupport
+        extend Contrast::Framework::Rails::Patch::Support
+
+        class << self
+          RAILS_VIEWS = [
+            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
+            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
+            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
+            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
+            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
+            Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
+          ].cs__freeze
+
+          RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
+
+          def detection_class
+            'Rails'
+          end
+
+          def version
+            ::Rails.version
+          end
+
+          def application_name
+            app_class = ::Rails.application.cs__class
+            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
+            # and instead we need to use parent_module_name
+            return app_class.parent_module_name if Gem::Version.new(::Rails.version) >= RAILS_MODULE_NAME_VERSION
+
+            app_class.parent_name
+          end
+
+          def application_root
+            ::Rails.root
+          end
+
+          def server_type
+            'rails'
+          end
+
+          def scan_views
+            scan_view_directories(RAILS_VIEWS)
+          end
+
+          def collect_routes
+            routes = ::Rails.application.routes.routes.map do |route|
+              route_to_coverage(route)
+            end
+            routes
+          end
+
+          def current_route request
+            return unless ::Rails.cs__respond_to?(:application)
+
+            # returns array of arrays [[match_data, path_parameters, route]], sorted by
+            # precedence
+            # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
+            # path_parameters: hash of various things
+            # route: ActionDispatch::Journey::Route
+            full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
+            return if full_routes.empty?
+
+            full_route = full_routes[0] # [match_data, path_parameters, route]
+            return unless full_route
+
+            route = full_route[2] # route w/ highest precedence
+            return unless route
+
+            route_to_coverage(route)
+          end
+
+          def retrieve_request env
+            rails_env = ::Rails.application.env_config.merge(env)
+            ::ActionDispatch::Request.new(rails_env || env)
+          end
+
+          AC_INSTANCE = 'action_controller.instance'
+          def streaming? env
+            return false unless defined?(::ActionController::Live)
+
+            env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
+          end
+
+          private
+
+          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          def route_to_coverage route
+            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
+            route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
+
+            verb = source_or_string(route.verb)
+            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+            url = source_or_string(route.path.spec)
+            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
+            route_coverage
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/application_helper.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Sinatra
+      # This module is to help perform sometimes necessary tasks specific to Sinatra
+      module ApplicationHelper
+        SINATRA_VIEWS = [
+          Contrast::Framework::ViewTechnologiesDescriptor.new('public/stylesheets', 'scss', %w[SASS]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html', %w[HTML5]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.erb', %w[HTML5 ERB]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.haml', %w[HTML5 HAML]),
+          Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
+        ].cs__freeze
+
+        def app_class
+          @_app_class ||= begin
+                            return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+                            sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+                            result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+                            result_layer
+                          end
+        end
+
+        def scannable_view_dirs
+          @_scannable_view_dirs ||= begin
+                                      views = SINATRA_VIEWS.dup
+                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'erb', %w[HTML5 ERB]) if view_directory
+                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'haml', %w[HTML5 HAML]) if view_directory
+                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(public_directory, 'html', %w[HTML5]) if public_directory
+                                      views
+                                    end
+        end
+
+        def view_directory
+          @_view_directory ||= begin
+                                 app_class&.settings&.views
+                               end
+        end
+
+        def public_directory
+          @_public_directory ||= begin
+                                   app_class&.settings&.public_dir
+                                 end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -0,0 +1,83 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/sinatra/support'
+
+module Contrast
+  module Framework
+    module Sinatra
+      module Patch
+        # Our patch into the Sinatra::Base Class, allowing for the inventory of the
+        # routes called by the application
+        module Base
+          class << self
+            # Use logic copied from Sinatra::Base#process_route to determine which
+            # pattern matches the request being invoked by Sinatra::Base#call!
+            #
+            # @param clazz [Class] the Class that extends Sinatra::Base in
+            #   which this route is defined.
+            # @param settings [Object] the Sinatra::Base @settings object.
+            # @param args [Array<Object>] we rely on the @settings object in
+            #   Sinatra::Base and the env variable passed in as args[0].
+            def map_route clazz, settings, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context
+
+              env = args[0]
+              return unless env
+              return unless settings
+
+              convert_routes(context, clazz, settings, env)
+            rescue StandardError
+              # Being careful here since we're directly patching something
+            end
+
+            def instrument
+              @_instrument ||= begin
+                                ::Sinatra::Base.class_eval do
+                                  alias_method :cs__patched_sinatra_base_call!, :call!
+                                  # publicly available method for Sinatra::Base things -- unfortunately,
+                                  # getting the routes appear to require a lookup every time
+                                  def call! *args
+                                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
+                                    cs__patched_sinatra_base_call!(*args)
+                                  end
+                                end
+                                true
+                              end
+            end
+
+            private
+
+            # Find the route that matches this request. Since we're using
+            # settings, we should resolve in the same precedence as Sinatra
+            def convert_routes context, clazz, settings, env
+              # There isn't a Request object in the Sinatra::Base yet - it's made
+              # during the #call! method, which we're patching - so we need to
+              # access the env
+              method = env[::Rack::REQUEST_METHOD]
+              # get all potential routes for this request type
+              routes = settings.routes[method]
+              return unless routes
+
+              route = env[::Rack::PATH_INFO]
+              route = route.to_s
+
+              # Do some cleanup that matches Sinatra::Base#process_route
+              route = '/' if route.empty? && !settings.empty_path_info?
+              route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
+
+              routes.each do |pattern, _, _| # Mustermann::Sinatra
+                next unless pattern.params(route)
+
+                dtm = Contrast::Framework::Sinatra::Support.send(:route_to_coverage, clazz, method, pattern)
+                context.append_route_coverage(dtm)
+                break
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end