contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # This module is specifically for String#(g)sub propagation
+          #
+          # Disclaimer: there may be a better way, but we're
+          # in a 'get it work' state. hopefully, we'll be in
+          # a 'get it right' state soon.
+          module SubstitutionUtils
+            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
+            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+
+            private
+
+            # Update our properties of the object dependent on the substitution pattern used.
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] instance of PreShift
+            # @param ret [String] the result of the substitution
+            # @param block, the given block
+            # @param global [Boolean] if this was a global or single substitution, optional
+            def substitution_tagger patcher, preshift, ret, block, global: true
+              return ret unless ret
+
+              begin
+                # define here what is used across private methods
+                @_preshift = preshift
+                args = @_preshift.args[1]
+                @_self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
+                @_incoming_tracked = args && determine_tracked(args)
+                @_ret = ret
+                return @_ret unless @_self_tracked || @_incoming_tracked
+
+                @_parent_events = []
+                if block
+                  block_sub
+                elsif args.is_a?(String)
+                  string_sub(args, global)
+                elsif args.is_a?(Hash)
+                  hash_sub
+                else # Enumerator, only for gsub
+                  pattern_gsub
+                end
+
+                self_tracked_handle(@_parent_events)
+                string_build_event(patcher)
+              rescue StandardError => e
+                logger.error('Unable to apply gsub propagator', e)
+              end
+              ret
+            end
+
+            def self_tracked_handle parent_events
+              return unless @_self_tracked
+
+              source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+              parent_event = source_properties&.event
+              parent_events.prepend(parent_event) if parent_event
+            end
+
+            def source
+              @_preshift.object
+            end
+
+            # @param args [String] the new String going into the substitution
+            def determine_tracked args
+              # if there's no arg, it can't be tracked
+              return false unless args
+
+              # if it's a string, just ask if it's tracked
+              case args
+              when String
+                Contrast::Agent::Assess::Tracker.tracked?(args)
+                # if it's a hash, ask if it has a tracked string
+              when Hash
+                args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
+                # this should never happen
+              else
+                false
+              end
+            end
+
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            def string_sub incoming, global
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+              @_parent_events << incoming_properties&.event if incoming_properties&.event
+
+              # We can't efficiently find the places that things were
+              # copied from regexp / captures. Trading accuracy for
+              # performance
+              if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
+                properties.splat_from(source, @_ret) if @_self_tracked
+                return
+              end
+
+              # if it's just a straight insert, that we can do
+              # Copy the tags from us to the return
+              ranges = find_string_sub_insert(properties, incoming, global)
+
+              properties.delete_tags_at_ranges(ranges)
+              properties.shift_tags(ranges)
+              return unless @_incoming_tracked
+              return unless incoming_properties
+
+              tags = incoming_properties.tag_keys
+              ranges.each do |range|
+                tags.each do |tag|
+                  properties.add_tag(tag, range)
+                end
+              end
+            end
+
+            # Find the points at which the new String was placed into the original
+            #
+            # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            # @return [Array<Range>] the Ranges where substitution occurred
+            def find_string_sub_insert properties, incoming, global
+              pattern = @_preshift.args[0]
+              properties.copy_from(source, @_ret)
+              # Figure out where inserts occurred
+              last_idx = 0
+              ranges = []
+              # For each insert, move the tag ranges
+              while last_idx
+                idx = source.index(pattern, last_idx)
+                break unless idx
+
+                last_idx = idx ? idx + 1 : nil
+                start_index = idx
+                end_index = idx + incoming.length
+                ranges << (start_index...end_index)
+                break unless global
+              end
+              ranges
+            end
+
+            def block_sub
+              hash_sub
+            end
+
+            def hash_sub
+              return unless @_self_tracked
+
+              properties = Contrast::Agent::Assess::Tracker.properties!(@_ret)
+              properties&.splat_from(source, @_ret)
+            end
+
+            def pattern_gsub
+              return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              source_properties.tag_keys.each do |key|
+                properties.add_tag(key, 0...1)
+              end
+              parent_event = source_properties.event
+              @_parent_events << parent_event if parent_event
+            end
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            def string_build_event patcher
+              return unless Contrast::Agent::Assess::Tracker.tracked?(@_ret)
+
+              properties = Contrast::Agent::Assess::Tracker.properties(@_ret)
+              args = @_preshift.args
+              event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, @_ret, @_preshift, @_ret, args)
+              properties.build_event(event_data, 2)
+              properties.event.instance_variable_set(:@_parent_events, @_parent_events)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,70 +8,92 @@ module Contrast
         module Propagator
           # This class is specifically for String#tr(_s) propagation
           #
-          # Disclaimer: there may be a better way, but we're
-          # in a 'get it work' state. hopefully, we'll be in
-          # a 'get it right' state soon.
-          class Trim
+          # Disclaimer: there may be a better way, but we're in a 'get it work' state. hopefully, we'll be in a 'get it
+          # right' state soon.
+          module Trim
             class << self
-              def tr_tagger patcher, preshift, ret, _block
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def tr_tagger policy_node, preshift, ret, _block
                 return ret unless ret && !ret.empty?
+                return ret unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                source = preshift.object
-                args = preshift.args
-                ret.cs__copy_from(source)
-                replace_string = args[1]
-                source_chars = source.chars
-                # if the replace string is empty, then there's a bunch of deletes. this
-                # functions the same as the Removal propagation.
-                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
-                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(source_chars, ret)
-                else
-                  remove_ranges = []
-                  ret_chars = ret.chars
-                  curr_span = nil
-                  source_chars.each_with_index do |char, idx|
-                    if ret_chars[idx] == char
-                      next unless curr_span
-
-                      curr_span.stop = idx
-                      remove_ranges << curr_span
-                      curr_span = nil
-                    else
-                      curr_span ||= Contrast::Agent::Assess::AdjustedSpan.new(idx)
-                    end
-                  end
-                  # account for the last char being different
-                  if curr_span
-                    curr_span.stop = source_chars.length
-                    remove_ranges << curr_span
-                  end
-                  ret.cs__properties.delete_tags_at_ranges(remove_ranges, false)
-                end
-
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args,
-                    1)
+                properties.copy_from(preshift.object, ret)
+                handle_tr(policy_node, preshift, ret, properties)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
               def tr_s_tagger patcher, preshift, ret, _block
                 return unless ret && !ret.empty?
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
                 source = preshift.object
                 args = preshift.args
-                source.cs__splat_tags(ret)
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                properties.splat_from(source, ret)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
                 ret
               end
+
+              private
+
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [String] the target to which to propagate.
+              # @param properties [Contrast::Agent::Assess::Properties] the properties of the ret
+              def handle_tr policy_node, preshift, ret, properties
+                source = preshift.object
+                replace_string = preshift.args[1]
+
+                # if the replace string is empty, then there's a bunch of deletes. this functions the same as the
+                # Removal propagation.
+                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
+                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(policy_node, source, ret)
+                  return
+                end
+
+                # Otherwise, we need to target each insertion point. Based on the spec for #tr & #tr_s, the find is
+                # treated as a regexp range, excepting the `\` character, which we'll need to escape. This converts to
+                # that form, wrapping the input in `[]`.
+                find_string = preshift.args[0]
+                find_string += '\\' if find_string.end_with?('\\')
+                find_regexp = Regexp.new("[#{ find_string }]")
+
+                # Find the first instance to be replaced. If there isn't one, than nothing changed here.
+                idx = source.index(find_regexp)
+                return unless idx
+
+                # Iterate over each change and record where it happened. B/c this is a one to one replace, the index of
+                # the replacement is always one; however, there may be adjacent replacements which become a single
+                # range.
+                start = idx
+                stop = idx + 1
+                remove_ranges = []
+                while (idx = source.index(find_regexp, idx + 1))
+                  # If the previous range ends at this index, we can expand that range to include this index.
+                  # Otherwise, we need to record the held range and start a new one.
+                  if stop != idx
+                    remove_ranges << (start...stop)
+                    start = idx
+                  end
+                  stop = idx + 1
+                end
+                # Be sure to capture the last range in the holder.
+                remove_ranges << (start...stop)
+                properties.delete_tags_at_ranges(remove_ranges, shift: false)
+              end
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,24 +10,27 @@ module Contrast
         # functionality. Any class under this namespace should be required
         # here, providing a single point of require for this functionality.
         module Propagator
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/base'
+          require 'contrast/agent/assess/policy/propagator/base'
 
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/append'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/center'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/custom'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/replace'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/reverse'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/select'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/splat'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/split'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/substitution'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/append'
+          require 'contrast/agent/assess/policy/propagator/center'
+          require 'contrast/agent/assess/policy/propagator/custom'
+          require 'contrast/agent/assess/policy/propagator/database_write'
+          require 'contrast/agent/assess/policy/propagator/insert'
+          require 'contrast/agent/assess/policy/propagator/keep'
+          require 'contrast/agent/assess/policy/propagator/match_data'
+          require 'contrast/agent/assess/policy/propagator/next'
+          require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/rack_protection'
+          require 'contrast/agent/assess/policy/propagator/remove'
+          require 'contrast/agent/assess/policy/propagator/replace'
+          require 'contrast/agent/assess/policy/propagator/reverse'
+          require 'contrast/agent/assess/policy/propagator/select'
+          require 'contrast/agent/assess/policy/propagator/splat'
+          require 'contrast/agent/assess/policy/propagator/split'
+          require 'contrast/agent/assess/policy/propagator/substitution'
+          require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/buffer'
         end
       end
     end