contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/delegators.rb

@@ -1,9 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  # Used to define decorators for objects to add behavior without polluting the namespace
-  module Delegators
-  end
-end
-cs__scoped_require 'contrast/delegators/application_update'

data/lib/contrast/delegators/application_update.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Delegators
-    # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
-    # AppUpdate dtm
-    class ApplicationUpdate < SimpleDelegator
-      def append_view_technology_descriptor_data view_technology_descriptors
-        view_technology_descriptors.each do |vtd|
-          vtd.technology_names.each do |tech_name|
-            @delegate_sd_obj.technologies[tech_name] = true
-          end
-        end
-      end
-
-      # TS only allows you to report 500 routes per application
-      def append_route_coverage_data route_coverage_dtms
-        route_coverage_dtms.take(500).each do |route_coverage_dtm|
-          @delegate_sd_obj.routes << route_coverage_dtm
-        end
-      end
-
-      def append_platform_version platform_version
-        @delegate_sd_obj.platform = Contrast::Api::Dtm::Platform.new if @delegate_sd_obj.platform.nil?
-        @delegate_sd_obj.platform.major = platform_version.major
-        @delegate_sd_obj.platform.minor = platform_version.minor
-        @delegate_sd_obj.platform.build = platform_version.patch
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/cookie.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Rack
-  module Session
-    # Our patch into the Rack::Session::Cookie Class, allowing for the
-    # runtime detection of insecure configurations on individual cookies
-    # within the application
-    class Cookie
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      access_component :scope
-
-      alias_method :cs__patched_initialize, :initialize
-      def initialize app, options = {}
-        Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
-        cs__patched_initialize(app, options)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/request.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Request class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Request
-    unless Rack::Request.instance_methods(true).include?(:set_header)
-      def set_header name, value
-        @env[name] = value
-      end
-    end
-
-    unless Rack::Request.instance_methods(true).include?(:get_header)
-      def get_header name
-        @env[name]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/response.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Response Class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Response
-    unless Rack::Response.instance_methods(true).include?(:set_header)
-      def set_header key, value
-        headers[key] = value
-      end
-    end
-    unless Rack::Response.instance_methods(true).include?(:get_header)
-      def get_header key
-        headers[key]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/action_controller_railties_helper_inherited.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActionController
-  module Railties
-    # Used to monkey patch all the inherited calls in action_pack
-    #
-    # This is the usual entry point for Rails inheritance work, so it should
-    # catch most of the calls to inherited.
-    module Helpers
-      alias_method :cs__patched_inherited, :inherited
-      def inherited klass
-        klass&.instance_variable_set(:@cs__defining_class, true)
-        cs__patched_inherited(klass)
-      ensure
-        klass&.instance_variable_set(:@cs__defining_class, false)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/active_record.rb

@@ -1,26 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActiveRecord
-  module AttributeMethods
-    module Read
-      # Rails / ActiveRecord are sneaky a.f. They define attributes of a
-      # class in one method, then monkey patch allocate in another and
-      # finally invoke module_eval in this method... but of course they use a
-      # '_tmp_' header for the method name and then alias it in this module
-      # to name it what we expect
-      module ClassMethods
-        alias_method :cs__patched_define_method_attribute, :define_method_attribute
-
-        def define_method_attribute *args, &block
-          ret = cs__patched_define_method_attribute(*args, &block)
-          method_name = args[0]
-          Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-          ret
-        end
-
-        protected :cs__patched_define_method_attribute, :define_method_attribute
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/active_record_named.rb

@@ -1,53 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module ActiveRecord
-  module Scoping
-    module Named
-      # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
-      # allowing for the runtime rewrite of interpolation calls defined in
-      # methods defined dynamically during application execution.
-      #
-      # TODO: RUBY-534
-      module ClassMethods
-        include Contrast::Components::Interface
-        access_component :logging, :agent
-
-        def _cs__rewrite method_name, body
-          return body unless AGENT.rewrite_interpolation?
-          return body unless body.is_a?(Proc)
-
-          location = body.source_location
-          return body if location.nil?
-
-          # Good news, once we patch the body once, the source location
-          # becomes eval. We may need to fix this later though (so it may
-          # be bad news)
-          return body if location.empty? || location[0].empty? || location[0].include?('eval')
-
-          opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(self))
-          original_source_code = opener.source_code(location, method_name)
-          return body unless original_source_code
-          return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
-          return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
-
-          # the code looks like 'source :some_method_name, ->lambda_literal'
-          # we just need the lambda
-          body_start = original_source_code.index(',') + 1
-          original_source_code = original_source_code[body_start..-1]
-
-          new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
-          return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
-
-          unbound_eval(cs__name, new_method_source)
-        rescue SyntaxError, StandardError => e
-          logger.debug(e, "Can't parse method source in scoped method #{ method_name }: #{ e.message }")
-          body
-        end
-      end
-    end
-  end
-end
-cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'

data/lib/contrast/extensions/framework/rails/active_record_time_zone_inherited.rb

@@ -1,21 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActiveRecord
-  module AttributeMethods
-    # Used to monkey patch all the inherited calls in action_pack
-    module TimeZoneConversion
-      module ClassMethods #:nodoc:
-        private
-
-        alias_method :cs__patched_inherited, :inherited
-        def inherited klass
-          klass&.instance_variable_set(:@cs__defining_class, true)
-          cs__patched_inherited(klass)
-        ensure
-          klass&.instance_variable_set(:@cs__defining_class, false)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/buffer.rb

@@ -1,28 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module ActionController
-  module Live
-    # This class acts as our patch into the ActionController::Live::Buffer
-    # class, allowing us to track the close event on streamed responses.
-    class Buffer
-      include Contrast::Components::Interface
-      access_component :contrast_service
-
-      # normally pre->in->post filters are applied however, in a streamed response
-      # we can run into a case where it's pre -> in -> post -> more infilters
-      # in order to submit anything found during the infilters after the response has been written we need to explicity send them
-      alias_method :cs__close, :close
-      def close
-        if (context = Contrast::Agent::REQUEST_TRACKER.current)
-          [context.server_activity, context.activity, context.observed_route].each do |msg|
-            CONTRAST_SERVICE.send_message msg
-          end
-        end
-        cs__close
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/configuration.rb

@@ -1,27 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Rails
-  class Application
-    # Our patch into the Rails::Application::Configuration Class, allowing
-    # for the runtime detection of insecure configurations on individual
-    # ActionDispatch::Session::AbstractStore instances within the
-    # application.
-    class Configuration
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      # Note to self / PR reviewers / wizard people dear reader,
-      # including the components into Rails here may be unnecessary
-      # if we're not calling anything besides #analyze_session_store?
-      access_component :analysis, :scope
-
-      alias_method :cs__patched_session_store, :session_store
-      def session_store *args
-        ret = cs__patched_session_store(*args)
-        Contrast::Utils::RailsAssessConfiguration.analyze_session_store(*args)
-        ret
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/sinatra/base.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/framework/sinatra_support'
-
-module Sinatra
-  # Our patch into the Sinatra::Base Class, allowing for the inventory of the
-  # routes called by the application
-  class Base
-    alias_method :cs__patched_call!, :call!
-
-    # publicly available method for Sinatra::Base things -- unfortunately,
-    # getting the routes appear to require a lookup every time
-    def call! *args
-      cs__patched_map_route(*args)
-      cs__patched_call!(*args)
-    end
-
-    private
-
-    # Use logic copied from Sinatra::Base#process_route to determine which
-    # pattern matches the request being invoked by Sinatra::Base#call!
-    #
-    # @param args [Array<Object>] we rely on the @settings object in
-    #   Sinatra::Base and the env variable passed in as args[0]
-    def cs__patched_map_route *args
-      context = Contrast::Agent::REQUEST_TRACKER.current
-      return unless context
-
-      env = args[0]
-      return unless env
-
-      # There isn't a Request object in the Sinatra::Base yet - it's made
-      # during the #call! method, which we're patching - so we need to
-      # access the env
-      method = env[Rack::REQUEST_METHOD]
-      route = env[Rack::PATH_INFO]
-      route = route.to_s
-
-      # get all potential routes for this request type
-      routes = settings.routes[method]
-      return unless routes
-
-      # Do some cleanup that matches Sinatra::Base#process_route
-      route = '/' if route.empty? && !settings.empty_path_info?
-      route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
-
-      # Find the route that matches this request. Since we're using
-      # settings, we should resolve in the same precedence as Sinatra
-      routes.each do |pattern, _, _| # Mustermann::Sinatra
-        next unless pattern.params(route)
-
-        dtm = Contrast::Framework::SinatraSupport.send(:route_to_coverage, cs__class, method, pattern)
-        context.append_route_coverage(dtm)
-        break
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/assess/array.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/patching/policy/patch'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/components/interface'
-
-# This is our patch of the Array class required to handle propagation
-# Disclaimer: there may be a better way, but we're in a 'get it work' state.
-# Hopefully, we'll be in a 'get it right' state soon.
-class Array
-  include Contrast::Components::Interface
-
-  access_component :scope
-
-  ARRAY_JOIN_HASH = {
-      'class_name' => 'Array',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'join',
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'cs__track_join'
-  }.cs__freeze
-  ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
-
-  # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
-  # Multiple Strings are appended with the #join method. Because that
-  # operation happens in C, we have to do it here rather than rely on the
-  # patch of our String append or concat methods.
-  def cs__track_join separator, ret
-    return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
-
-    with_contrast_scope do
-      shift = 0
-      separator_length = separator.nil? ? 0 : separator.to_s.length
-      each do |obj|
-        if obj # skip nil here
-          ret.cs__copy_from(obj, shift)
-          shift += obj.to_s.length
-        end
-        shift += separator_length
-      end
-      return ret unless ret.cs__tracked?
-
-      ret.cs__properties.cleanup_tags
-      ret.cs__properties.build_event(
-          ARRAY_JOIN_NODE,
-          ret,
-          self,
-          ret,
-          [separator])
-      ret
-    end
-  end
-end
-cs__scoped_require 'cs__assess_array/cs__assess_array'

data/lib/contrast/extensions/ruby_core/assess/basic_object.rb

@@ -1,15 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/extensions/ruby_core/eval_trigger'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-
-# Our patch into the BasicObject class, allowing us to track calls to the eval
-# method
-class BasicObject
-  class << self
-    include Contrast::CoreExtensions::Assess::EvalTrigger
-  end
-end
-
-cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'

data/lib/contrast/extensions/ruby_core/assess/fiber.rb

@@ -1,124 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-cs__scoped_require 'fiber'
-
-# In order to instrument some difficult methods like String#gsub, as it
-# returns an enumerator, we need to instrument methods on Fiber.
-# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
-# order to track what happens within Enumerator#next.
-# TODO: RUBY-531 move these out of Fiber class
-class Fiber
-  include Contrast::CoreExtensions::Assess::AssessExtension
-  include Contrast::Components::Interface
-
-  access_component :analysis, :scope
-
-  FIBER_NEW_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_new', # TODO: Why do we patch new here and not initalize? Historically, new has been problematic.
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_new'
-  }.cs__freeze
-  FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
-  private_constant :FIBER_NEW_NODE_HASH
-  private_constant :FIBER_NEW_NODE
-
-  FIBER_YIELD_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_yield',
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_yield'
-  }.cs__freeze
-  FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
-  private_constant :FIBER_YIELD_NODE_HASH
-  private_constant :FIBER_YIELD_NODE
-
-  class << self
-    def track_rb_fiber_yield fiber, _method, results
-      # results will be nil if StopIteration was raised,
-      # otherwise an Array of the yielded arguments
-      return unless results.cs__is_a?(Array)
-      return unless ASSESS.enabled?
-
-      with_contrast_scope do
-        results.each do |result|
-          next unless Contrast::Utils::DuckUtils.trackable?(result)
-          next if result.cs__frozen?
-
-          cs__splat_tags(result, fiber)
-          result.cs__properties.build_event(
-              FIBER_YIELD_NODE,
-              result,
-              fiber,
-              result,
-              [])
-        end
-      end
-    end
-
-    def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
-      return unless Contrast::Utils::DuckUtils.trackable?(underlying)
-      return unless underlying.is_a?(String) && !underlying.empty?
-
-      return unless ASSESS.enabled?
-
-      with_contrast_scope do
-        cs__splat_tags(fiber, underlying)
-        fiber.cs__properties.build_event(
-            FIBER_NEW_NODE,
-            fiber,
-            underlying,
-            fiber,
-            [])
-      end
-    end
-
-    def instrument_fiber_track
-      @_instrument_fiber_variables ||= begin
-          cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
-          true
-        end
-    rescue StandardError => e
-      logger.error(e, 'Error loading fiber track patch')
-      false
-    end
-
-    # Some propagation occurred, but we're not sure what the
-    # exact transformation was. To be safe, we just explode
-    # all the tags from the source to the return.
-    #
-    # If the return already had that tag, the existing tag
-    # range is recycled to save us an object.
-    def cs__splat_tags ret, source = self
-      source.cs__properties.tag_keys.each do |key|
-        length = Contrast::Utils::StringUtils.ret_length(ret)
-        existing = ret.cs__properties.fetch_tag(key)
-        # if the tag already exists, drop all but the first range
-        # then change that range to cover the entire return
-        if existing&.any?
-          existing.drop(existing.length - 1)
-          range = existing[0]
-          range.repurpose(0, length)
-        else
-          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-          ret.cs__properties.add_tag(key, span)
-        end
-      end
-    end
-  end
-end
-
-Fiber.instrument_fiber_track