contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,9 +14,13 @@ module Contrast
               # For the source, prepend its tags to the target. It's basically the
               # opposite of append. :-P
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 sources = propagation_node.sources
+                # source1 is the copy of the thing being prepended to
                 source1 = find_source(sources[0], preshift)
 
+                # source2 is the copy of the thing being prepended
                 source2 = sources[1] ? find_source(sources[1], preshift) : source1
 
                 original_start_index = target.rindex(source1) || 0
@@ -24,22 +28,25 @@ module Contrast
                 # tags from the object(since nothing from args was added to
                 # return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
                   # find original in the target, copy tags to the new position in target
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
+                  # then we add the tags from the thing prepended to the start
+                  # of the target
                   start = 0
                   while start < original_start_index
-                    target.cs__copy_from(source2, start, propagation_node.untags)
+                    properties.copy_from(source2, target, start, propagation_node.untags)
                     start += source2.length
                     next unless start > original_start_index
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
+                    properties.tags_at(start - source2.length).each do |tag|
                       tag.update_end(original_start_index)
                     end
                   end
                 end
-                target.cs__properties.cleanup_tags
+                # and finally merge the tags if any overlap.
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Rack::Protection offers several protections against vulnerabilities. Of these, some apply to dataflow and
+          # need to be accounted for in order to properly tag data. Others apply to configurations and may be used to
+          # suppress configuration vulnerabilities in the future.
+          class RackProtection < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # Our custom instrumentation for the Rack::Protection::EscapedParams#escape_string method
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def escaped_params propagation_node, preshift, ret, _block
+                Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                apply_escaper_tags(preshift.object, ret)
+                ret
+              end
+
+              private
+
+              # Rack::Protection::EscapedParams can be configured such that it only applies certain escape. We need
+              # to account for the configuration of the individual escapes when applying tags.
+              #
+              # @param escaper [Rack::Protection::EscapedParams] the instance of Rack::Protection::EscapedParams
+              #   applying the escape_string
+              # @param ret [String] the result of the escape
+              def apply_escaper_tags escaper, ret
+                # I don't know how this could not be an instance of Rack::Protection::EscapedParams, but I don't want
+                # to chance it.
+                return unless escaper.cs__is_a?(Rack::Protection::EscapedParams)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties(ret))
+
+                tags = []
+                untags = []
+                if escaper.instance_variable_get(:@html)
+                  tags << 'HTML_ENCODED'
+                  untags << 'HTML_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@javascript)
+                  tags << 'JAVASCRIPT_ENCODED'
+                  untags << 'JAVASCRIPT_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@url)
+                  tags << 'URL_ENCODED'
+                  untags << 'URL_DECODED'
+                end
+
+                length = Contrast::Utils::StringUtils.ret_length(ret)
+                tags.each do |tag|
+                  properties.add_tag(tag, 0...length)
+                end
+
+                untags.each do |tag|
+                  properties.delete_tags(tag)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,66 +6,78 @@ module Contrast
     module Assess
       module Policy
         module Propagator
-          # Propagation that results in all the tags of the source being
-          # applied to the totality of the target and then those sections
-          # which have been removed from the target are removed from the
-          # tags. The target's preexisting tags are also updated by this
-          # removal.
+          # Propagation that results in all the tags of the source being applied to the totality of the target and then
+          # those sections which have been removed from the target are removed from the tags. The target's preexisting
+          # tags are also updated by this removal.
           class Remove < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # For the source, append its tags to the target.
-              # Once the tag is applied, remove the section that was removed by the delete.
-              # Unlike additive propagation, this currently only supports one source
-              def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+              # For the source, append its tags to the target. Once the tag is applied, remove the section that was
+              # removed by the delete. Unlike additive propagation, this currently only supports one source.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
-
-                source_chars = source.is_a?(String) ? source.chars : source.string.chars
-                handle_removal(source_chars, target)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object (clearing empty spaces, \n..) so we will always return 'O' key
+                           # which is the object itself. Because preshift is disabled for this methods
+                           # we use it's parameter to pass in the original object( in this case just a unchained
+                           # source), preshift = object. To see list of methods in which this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
+                properties.copy_from(source, target, 0, propagation_node.untags)
+                handle_removal(propagation_node, source, target)
               end
 
-              def handle_removal source_chars, target
-                source_idx = 0
+              def handle_removal propagation_node, source, target
+                return unless source
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source_string = source.is_a?(String) ? source : source.to_s
+                # If the lengths are the same, we should just copy the tags because nothing was removed, but a new
+                # instance could have been created. copy_from will handle the case where the source is the target.
+                if source_string.length == target.length
+                  properties.copy_from(source, target, 0, propagation_node.untags)
+                  return
+                end
 
-                target_chars = target.chars
+                source_idx = 0
                 target_idx = 0
 
                 remove_ranges = []
-                current_range = nil
+                start = nil
 
-                # loop over the target, the result of the delete
-                # every range of characters that it differs from the source
-                # represents a section that was deleted. these sections
-                # need to have their tags updated
-                target_len = target_chars.length
-                while target_idx < target_len
-                  target_char = target_chars[target_idx]
-                  source_char = source_chars[source_idx]
+                # loop over the target, the result of the delete every range of characters that it differs from the
+                # source represents a section that was deleted. these sections need to have their tags updated
+                while target_idx < target.length
+                  target_char = target[target_idx]
+                  source_char = source_string[source_idx]
                   if target_char == source_char
                     target_idx += 1
-                    if current_range
-                      current_range.stop = source_idx
-                      remove_ranges << current_range
-                      current_range = nil
+                    if start
+                      remove_ranges << (start...source_idx)
+                      start = nil
                     end
                   else
-                    current_range ||= Contrast::Agent::Assess::AdjustedSpan.new(source_idx)
+                    start ||= source_idx
                   end
                   source_idx += 1
                 end
 
-                # once we're done looping over the target, anything left
-                # over is extra from the source that was deleted. tags
-                # applying to it need to be removed.
-                if source_idx != source_chars.length
-                  remove_ranges << Contrast::Agent::Assess::AdjustedSpan.new(
-                      source_idx,
-                      source_chars.length)
-                end
+                # once we're done looping over the target, anything left over is extra from the source that was
+                # deleted. tags applying to it need to be removed.
+                remove_ranges << (source_idx...source_string.length) if source_idx != source_string.length
 
                 # handle deleting the removed ranges
-                target.cs__properties.delete_tags_at_ranges(remove_ranges)
+                properties.delete_tags_at_ranges(remove_ranges)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,9 +14,11 @@ module Contrast
               # Replace means we're replacing the target w/ the source. Anything
               # on the source should be passed to the target.
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 source = find_source(propagation_node.sources[0], preshift)
-                target.cs__properties.clear_tags
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                properties.clear_tags
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,13 +13,14 @@ module Contrast
           class Reverse < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                target.cs__copy_from(source, 0, propagation_node.untags)
+                source = find_source(propagation_node.sources[0], preshift)
+                properties.copy_from(source, target, 0, propagation_node.untags)
 
                 length = target.length
-                target.cs__properties.tag_keys.each do |key|
-                  tags = target.cs__properties.fetch_tag(key)
+                properties.tag_keys.each do |key|
+                  tags = properties.fetch_tag(key)
                   tags.each do |tag|
                     new_end = length - tag.start_idx
                     new_start = new_end - tag.length
@@ -27,7 +28,7 @@ module Contrast
                   end
                 end
 
-                target.cs__properties.cleanup_tags
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -12,9 +12,6 @@ module Contrast
           # in a 'get it work' state. hopefully, we'll be in
           # a 'get it right' state soon.
           class Select
-            include Contrast::Components::Interface
-            access_component :logging
-
             class << self
               def select_tagger patcher, preshift, ret, _block
                 source = preshift.object
@@ -24,57 +21,69 @@ module Contrast
                 # Additionally, an empty string is returned when the starting index for
                 # a character range is at the end of the string. Let's just skip that
                 # and only track a string that has length
-                return unless source.cs__tracked? && ret && !ret.empty?
+                return unless ret && !ret.empty? && Contrast::Agent::Assess::Tracker.tracked?(source)
 
-                source.cs__properties.events.each do |event|
-                  ret.cs__properties.events << event
-                end
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
 
                 range = determine_select_range(source, args)
                 return unless range
 
-                tags = source.cs__properties.tags_at_range(range)
-                ret.cs__properties.clear_tags
+                tags = source_properties.tags_at_range(range)
+                properties.clear_tags
                 tags.each_pair do |key, value|
-                  ret.cs__properties.set_tags(key, value)
+                  properties.set_tags(key, value)
                 end
                 ret
               end
 
               private
 
+              def handle_integer args, arg, source
+                length = args[1] || 1
+                # (void) negative range
+                arg += source.length if arg.negative?
+                arg...(arg + length)
+              end
+
+              def handle_string arg, source
+                idx = source.index(arg)
+                idx...(idx + arg.length)
+              end
+
+              def handle_regexp args, arg, source
+                match_data = arg.match(source)
+                # nil has the same meaning as 0. use full match
+                group = args[1] || 0
+                match_data.begin(group)...match_data.end(group)
+              end
+
+              def handle_range arg, source
+                start = arg.begin
+                finish = arg.end
+
+                # (void) negative range
+                start += source.length if start.negative?
+                finish += source.length if finish.negative?
+                finish += 1 unless arg.exclude_end?
+
+                start...finish
+              end
+
               def determine_select_range source, args
                 arg = args[0]
                 case arg
                 when Integer
-                  length = args[1] || 1
-                  # (void) negative range
-                  arg += source.length if arg.negative?
-                  Contrast::Agent::Assess::AdjustedSpan.new(arg, arg + length)
+                  handle_integer(args, arg, source)
                 when String
-                  idx = source.index(arg)
-                  Contrast::Agent::Assess::AdjustedSpan.new(idx, idx + arg.length)
+                  handle_string(arg, source)
                 when Regexp
-                  match_data = arg.match(source)
-                  # nil has the same meaning as 0. use full match
-                  group = args[1] || 0
-                  Contrast::Agent::Assess::AdjustedSpan.new(match_data.begin(group), match_data.end(group))
+                  handle_regexp(args, arg, source)
                 when Range
-                  start = arg.begin
-                  finish = arg.end
-
-                  # (void) negative range
-                  start += source.length if start.negative?
-                  finish += source.length if finish.negative?
-                  finish += 1 unless arg.exclude_end?
-
-                  Contrast::Agent::Assess::AdjustedSpan.new(start, finish)
+                  handle_range(arg, source)
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -17,40 +17,63 @@ module Contrast
                 propagation_node.sources.each do |source|
                   case source
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
-                    tracked_inputs << preshift.object if preshift.object.cs__tracked?
+                    tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
-                    arg = preshift.args[source]
-                    if arg.is_a?(String)
-                      tracked_inputs << arg if arg.cs__tracked?
-                    elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
-                      arg.each_pair do |key, value|
-                        tracked_inputs << key if tracked_value?(key)
-                        tracked_inputs << value if tracked_value?(value)
-                      end
-                    elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
-                      arg.each do |value|
-                        tracked_inputs << value if tracked_value?(value)
-                      end
-                    end
+                    check_for_buffer(tracked_inputs, preshift.args[source])
+                    find_argument_inputs(tracked_inputs, preshift.args[source])
                   end
                 end
 
                 splat_tags(tracked_inputs, target)
-                target.cs__properties.cleanup_tags
+                Contrast::Agent::Assess::Tracker.properties(target)&.cleanup_tags
               end
 
               def splat_tags tracked_inputs, target
                 return if tracked_inputs.empty?
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
                 tracked_inputs.each do |input|
-                  unless input == target
-                    input.cs__properties.events.each do |event|
-                      target.cs__properties.events << event
-                    end
+                  input_properties = Contrast::Agent::Assess::Tracker.properties(input)
+                  next unless input_properties
+
+                  properties.splat_from(input, target)
+                end
+              end
+
+              private
+
+              # The arguments to the splat method are complex and of multiple types. As such, we need to handle
+              # Strings and iterables to determine the tracked inputs on which to act.
+              #
+              # @param tracked_inputs [Array] storage for the inputs to act on later
+              # @param arg [Object] an input to the method which act as sources for this propagation.
+              def find_argument_inputs tracked_inputs, arg
+                if arg.is_a?(String) || arg.is_a?(File)
+                  tracked_inputs << arg if tracked_value?(arg)
+                else
+                  iterable_arg(tracked_inputs, arg)
+                end
+              end
+
+              def iterable_arg tracked_inputs, arg
+                if Contrast::Utils::DuckUtils.iterable_hash?(arg)
+                  arg.each_pair do |key, value|
+                    tracked_inputs << key if tracked_value?(key)
+                    tracked_inputs << value if tracked_value?(value)
+                  end
+                elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
+                  arg.each do |value|
+                    tracked_inputs << value if tracked_value?(value)
                   end
-                  input.cs__splat_tags(target)
                 end
               end
+
+              def check_for_buffer tracked_inputs, arg
+                return if RUBY_VERSION < '3.1.0'
+                return unless  arg.is_a?(IO::Buffer) && tracked_value?(arg)
+
+                tracked_inputs << arg
+              end
             end
           end
         end