contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/property/tagged.rb

@@ -0,0 +1,246 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/tag'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/tag_util'
+require 'contrast/utils/assess/property/tagged_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Property
+        # This module serves to hold the functionality required for the
+        # management of our dataflow tags.
+        module Tagged
+          include Contrast::Utils::Assess::TaggedUtils
+          # Is any tag present?
+          # Creating Tags is expensive and we check for Tags all the time on
+          # untracked things. ALWAYS!!! call this method before checking if an
+          # object has tags
+          # @return [Boolean]
+          def tracked?
+            instance_variable_defined?(:@_tags) && tags.any?
+          end
+
+          # Remove all tags within the given ranges.
+          # This does not delete an entire tag if part of that tag is
+          # outside this range, meaning we may reduce sizes of tags
+          # or split them.
+          #
+          # If shift is true, it is assumed the characters at those ranges were
+          # removed. If shift is false, it is assumed those ranges were replaced
+          # by the same number of characters and no shift is needed.
+          #
+          # current tags: 0-15
+          # range:        5-10
+          # result:       0-5, 10-15
+          #
+          # @param ranges [Array<Range>] the ranges to delete
+          # @param shift [Boolean] move remaining tags to the left to account
+          #   for the deletion
+          def delete_tags_at_ranges ranges, shift: true
+            return unless tracked?
+
+            # Stage one - delete the tags w/o changing their
+            # location.
+            ranges.each do |range|
+              remove_tags(range)
+            end
+            return unless shift
+
+            # the amount we've already removed from the string
+            shift = 0
+            # Stage two - shift the tags to the left to account
+            # for the sections that were deleted.
+            ranges.each do |range|
+              shift_tags_for_deletion(range, shift)
+              shift += (range.end - range.begin)
+            end
+
+            # Clean up and merge any touching tags
+            Contrast::Utils::TagUtil.merge_tags(tags)
+          end
+
+          # Shift all the tags in this object by the given ranges.
+          # This method assumes the ranges are sorted, meaning
+          # the leftmost (lowest) range is first
+          #
+          # current tags: 0-15
+          # range:        5-10
+          # result:       0-5, 10-20
+          def shift_tags ranges
+            return unless tracked?
+
+            ranges.each do |range|
+              shift_tags_for_insertion(range)
+            end
+          end
+
+          # Remove the tag ranges covering the given range
+          # and appends any trailing value that might
+          # exist after removal of range
+          def remove_tags range
+            return unless tracked?
+
+            full_delete = []
+            tags.each_pair do |key, value|
+              remove = []
+              add = []
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin, range.end)
+                # ABOVE and BELOW are not affected by this check
+                tags_remove_comparison(comparison, tag, remove, add, range)
+              end
+              value.delete_if { |tag| remove.include?(tag) }
+              Contrast::Utils::TagUtil.ordered_merge(value, add)
+              full_delete << key if value.empty?
+            end
+            full_delete.each { |key| tags.delete(key) }
+          end
+
+          # This method is for the tags comparison
+          # the idea is to move the whole case here
+          # @param comparison [String] indicates type of removal is to occur
+          # @param tag Contrast::Agent::Assess::Tag
+          # @param remove [String] holds removed Tag if exists
+          # @param add [String] holds trailing Tag if exists
+          # @param range [Range] start and stop for idx for removal
+          def tags_remove_comparison comparison, tag, remove, add, range
+            case comparison
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::WITHIN
+              remove << tag
+            when Contrast::Agent::Assess::Tag::WITHOUT
+              new_tag = tag.clone
+              new_tag.update_start(range.end)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN
+              tag.update_start(range.end)
+            end
+          end
+
+          # Shift the tag ranges covering the given range
+          # We assume this is for a deletion, meaning we
+          # have to move tags to the left
+          # @param range [Range] the range to delete
+          # @param shift [Boolean] move remaining tags to the left to account
+          #   for the deletion
+          def shift_tags_for_deletion range, shift
+            return unless tracked?
+
+            tags.each_value do |value|
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin - shift, range.end - shift)
+                # this is really the only thing we need to shift
+                next unless comparison == Contrast::Agent::Assess::Tag::ABOVE
+
+                length = range.end - range.begin
+                tag.shift(0 - length)
+              end
+            end
+          end
+
+          # Shift the tag ranges covering the given range to account for new
+          # data being added. We assume this is for a insertion, meaning we
+          # have to move tags out of the range and to the right. For example,
+          # given current tags:     0-15
+          # when we insert a range: 5-10
+          # then the result is:     0-5, 10-20
+          #
+          # Note that we disable Lint/DuplicateBranch in this branch in order
+          # list out all tag range cases in the proper order to make this
+          # easier to understand
+          #
+          # @param range [Range] the range of new information that's been
+          #   inserted
+          def shift_tags_for_insertion range
+            return unless tracked?
+
+            tags.each_value do |value|
+              add = []
+              value.each do |tag|
+                comparison = tag.compare_range(range.begin, range.end)
+                length = range.end - range.begin
+                # BELOW is not affected by this check
+                shift_tags_comparison(comparison, add, tag, length, range)
+              end
+              Contrast::Utils::TagUtil.ordered_merge(value, add)
+            end
+          end
+
+          def shift_tags_comparison comparison, add, tag, length, range
+            case comparison
+              # part of the tag is being inserted on
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+              # the tag exists in the inserted range. it is partially shifted
+            when Contrast::Agent::Assess::Tag::WITHIN
+              tag.shift(length)
+              # the tag spans the range. leave the part below alone
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
+              tag.shift(length)
+            end
+          end
+
+          private
+
+          # Because of the auto-fill thing, we should not allow direct access to
+          # the tags hash. Instead, the methods above should be used to do
+          # operations like add, delete, and fetch.
+          #
+          # CONTRAST-22914
+          # please do NOT expose this w/ an attr_reader / accessor. there are
+          # helper methods in this class that safely access the hash. the tags
+          # method is private to avoid the side effect of a direct lookup with
+          # `[]` adding an empty array to the hash.
+          def tags
+            @_tags ||= Hash.new { |h, k| h[k] = [] }
+          end
+
+          # Given a tag, compare it to a given range and, if any part of that tag is within the range, return a new tag
+          # covering the union of the original tag and the range. This new tag will start at the
+          # max(tag.start, range.start) and end at min(tag.end, range.end)
+          #
+          # @param tag [Contrast::Agent::Assess::Tag] the Tag that may be in this range
+          # @param range [Range] the span to check, inclusive to exclusive
+          # @return [Contrast::Agent::Assess::Tag, nil] a new tag, truncated to only span within the given range or nil
+          #   if no overlap exists
+          def resize_to_range tag, range
+            comparison = tag.compare_range(range.begin, range.end)
+            # BELOW and ABOVE are not applicable to this check and result in nil
+            case comparison
+              # part of the tag is being selected
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+              # the tag exists in the requested range, figure out the boundaries
+            when Contrast::Agent::Assess::Tag::WITHIN
+              start = tag.start_idx - range.begin
+              finish = range.size - start
+              Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
+              # the tag spans the requested range.
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+              # part of the tag is being selected
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN # rubocop:disable Lint/DuplicateBranch
+              Contrast::Agent::Assess::Tag.new(tag.label, range.size)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/property/updated.rb

@@ -0,0 +1,131 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Property
+        # This module serves to hold the functionality required for the
+        # update of properties as they go through dataflow.
+        module Updated
+          # copy tags and info from source's properties to self
+          # @param source [Object] the object from which existing properties
+          #   should be copied.
+          # @param owner [Object] the object to which these properties apply.
+          # @param shift [Integer] (0) how far to shift the tags during copy,
+          #   useful for insert and append operations.
+          # @param skip_tags [Set<String>] (nil) the tags to not copy over,
+          #   useful for propagation events that have 'untags'.
+          def copy_from source, owner, shift = 0, skip_tags = nil
+            return if owner.equal?(source)
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+
+            original = Contrast::Agent::Assess::Tracker.properties(source)
+            return unless original
+
+            adjust_duplicate(original)
+            original.tag_keys.each do |key|
+              next if skip_tags&.include?(key)
+
+              existing = tags[key]
+              had_existing = existing.any?
+              value = original.fetch_tag(key)
+              value.each do |tag|
+                existing << tag.copy_modified(shift)
+              end
+              Contrast::Utils::TagUtil.size_aware_merge(owner, existing) if had_existing
+            end
+          end
+
+          # Some propagation occurred, but we're not sure what the
+          # exact transformation was. To be safe, we just explode
+          # all the tags from the source to the return.
+          #
+          # If the return already had that tag, the existing tag
+          # range is recycled to save us an object.
+          #
+          # @param source [Object] the object from which existing properties
+          #   should be copied.
+          # @param owner [Object] the object to which these properties apply.
+          def splat_from source, owner
+            splat_length = Contrast::Utils::StringUtils.ret_length(owner)
+            return if splat_length.zero?
+
+            splat_from_ret(splat_length)
+            splat_from_source(source, splat_length)
+            cleanup_tags
+          end
+
+          private
+
+          # Because of how our tracking works now, sometimes the Source and
+          # Target are the same, but their IDs in our map will be different due
+          # to PreShift duplication. To account for this, we have to ensure that
+          # the Object we're copying from does not have the same Properties
+          # that the Object we're copying to does. If they are the same, wipe the
+          # Target so that the copy method can update events and ranges as
+          # necessary.
+          # DO NOT TAKE THIS OUT!
+          def adjust_duplicate original
+            reset_properties if original == self
+            reset_properties if original.__id__ == dupped_from
+            reset_properties if original.dupped_from == __id__
+          end
+
+          # Wipe out the instance variables on this Properties instance,
+          # allowing them to be rebuilt.
+          def reset_properties
+            @_tags = nil
+            @_events = nil
+            @_properties = nil
+          end
+
+          # Splat all the tags from the source to this set of Properties
+          #
+          # @param source [Object] the object from which tags will be copied
+          #   and splatted.
+          # @param splat_length [Integer] the length to which to to set all
+          #   tags.
+          def splat_from_source source, splat_length
+            properties = Contrast::Agent::Assess::Tracker.properties(source)
+            return unless properties
+
+            properties.tag_keys.each do |key|
+              existing = fetch_tag(key)
+              # if the tag already exists, drop all but the first range
+              # then change that range to cover the entire return
+              if existing
+                existing.drop(existing.length - 1)
+                range = existing[0]
+                range.repurpose(0, splat_length)
+              else
+                add_tag(key, 0...splat_length)
+              end
+            end
+          end
+
+          # Splat all the tags existing on this set of Properties
+          #
+          # @param splat_length [Integer] the length to which to to set all
+          #   tags.
+          def splat_from_ret splat_length
+            return unless tracked?
+
+            tag_keys.each do |key|
+              next unless key
+
+              existing = fetch_tag(key)
+              next unless existing
+
+              existing.each do |range|
+                range.repurpose(0, splat_length)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -12,48 +12,87 @@ module Contrast
           # 2) the value is a non-empty array of only Fixnums
           class HardcodedKey
             include Contrast::Agent::Assess::Rule::Provider::HardcodedValueRule
-
+            REDACTED_MARKER = ' = [**REDACTED**]'
             NAME = 'hardcoded-key'
-            def rule_id
-              NAME
-            end
-
             # These are names, determined by the security team (Matt & Ar), that
             # indicate a field is likely to be a password or secret token of some
             # sort.
             KEY_FIELD_NAMES = %w[KEY AES DES IV SECRET].cs__freeze
-
             # These are markers whose presence indicates that a field is more
             # likely to be a descriptor or requirement than an actual key.
             # We should ignore fields that contain them.
             NON_KEY_PARTIAL_NAMES = %w[CONTENT_CODES RESPONSE_CODES ERROR_CODES].cs__freeze
+            BYTE_HOLDERS = %i[ARRAY LIST].cs__freeze
+
+            def rule_id
+              NAME
+            end
 
             def name_passes? constant_string
               KEY_FIELD_NAMES.any? { |name| constant_string.index(name) } &&
                   NON_KEY_PARTIAL_NAMES.none? { |name| constant_string.index(name) }
             end
 
-            # If the value is a byte array, or at least an array of numbers, it
-            # passes for this rule
-            def value_type_passes? value
-              return false unless value.is_a?(Array) && value.any?
+            # Determine if the given value node violates the hardcode key rule
+            # @param value_node [RubyVM::AbstractSyntaxTree::Node] the node to
+            #   evaluate
+            # @return [Boolean]
+            def value_node_passes? value_node
+              # If it's a freeze call, then evaluate the entity being frozen
+              value_node = value_node.children[0] if freeze_call?(value_node)
+              # If it's a String being turned into bytes, then it matches key
+              # expectations
+              return true if bytes_call?(value_node)
+
+              type = value_node.type
+              return false unless BYTE_HOLDERS.include?(type)
+              return false unless value_node.children.any?
 
-              value.each do |byte|
-                return false unless byte.is_a?(Integer)
+              # Unless this is an array of literal numerics, we don't match.
+              # That array seems to always end in a nil value, so we allow
+              # those as well.
+              value_node.children.each do |child|
+                next unless child
+
+                unless child.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
+                      child.type == :LIT &&
+                      child.children[0]&.cs__is_a?(Integer)
+
+                  return false
+                end
               end
-              true
-            end
 
-            # There isn't a filter for the byte value. The check is not evaluated
-            # for this rule
-            def value_passes? _value
               true
             end
 
-            REDACTED_MARKER = ' = [**REDACTED**]'
             def redacted_marker
               REDACTED_MARKER
             end
+
+            # A node is a bytes_call if it's the Node for String#bytes. We care
+            # about this specifically as it's likely to be a common way to
+            # generate a key constant, rather than directly declaring an
+            # integer array.
+            #
+            # @param value_node [RubyVM::AbstractSyntaxTree::Node] the node to
+            #   evaluate
+            # @return [Boolean] is this a node for String#bytes or not
+            def bytes_call? value_node
+              return false unless value_node.type == :CALL
+
+              children = value_node.children
+              return false unless children
+              return false unless children.length >= 2
+
+              potential_string_node = children[0]
+              unless potential_string_node.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
+                    potential_string_node.type == :STR
+
+                return false
+              end
+
+              children[1] == :bytes
+            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -15,12 +15,9 @@ module Contrast
           #     mixing the characters counts as a violation of this rule
           class HardcodedPassword
             include Contrast::Agent::Assess::Rule::Provider::HardcodedValueRule
-
             NAME = 'hardcoded-password'
-            def rule_id
-              NAME
-            end
-
+            REDACTED_MARKER = ' = "**REDACTED**"'
+            PROPERTY_NAME_PATTERN = /^[a-z]+[._][._a-z]*[a-z]+$/.cs__freeze
             # These are names, determined by the security team (Matt & Ar), that
             # indicate a field is likely to be a password or secret token of some
             # sort.
@@ -29,7 +26,14 @@ module Contrast
             # These are markers whose presence indicates that a field is more
             # likely to be a descriptor or requirement than an actual password.
             # We should ignore fields that contain them.
-            NON_PASSWORD_PARTIAL_NAMES = %w[DATE FORGOT FORM ENCODE PATTERN PREFIX PROP SUFFIX URL BASE FILE URI].cs__freeze
+            NON_PASSWORD_PARTIAL_NAMES = %w[
+              DATE FORGOT FORM ENCODE PATTERN PREFIX PROP SUFFIX URL BASE FILE
+              URI
+            ].cs__freeze
+
+            def rule_id
+              NAME
+            end
 
             # If the constant looks like a password and it doesn't look like a
             # password descriptor, it passes for this rule
@@ -38,15 +42,18 @@ module Contrast
                   NON_PASSWORD_PARTIAL_NAMES.none? { |name| constant_string.index(name) }
             end
 
-            # If the value is a string, it passes for this rule
-            def value_type_passes? value
-              value.is_a?(String)
-            end
+            # Determine if the given value node violates the hardcode key rule
+            # @param value_node [RubyVM::AbstractSyntaxTree::Node] the node to
+            #   evaluate
+            # @return [Boolean]
+            def value_node_passes? value_node
+              # If it's a freeze call, then evaluate the entity being frozen
+              value_node = value_node.children[0] if freeze_call?(value_node)
+              return false unless value_node.type == :STR
 
-            # If the value probably isn't a property name, it passes for this
-            # rule
-            def value_passes? value
-              !probably_property_name?(value)
+              # https://www.rubydoc.info/gems/ruby-internal/Node/STR
+              string = value_node.children[0]
+              !probably_property_name?(string)
             end
 
             # If a field name matches an expected password field, we'll check it's
@@ -56,12 +63,10 @@ module Contrast
             # characters are probably more likely to appear together in a
             # default placeholder than in a password. Note this is opposite of
             # the behavior in Java
-            PROPERTY_NAME_PATTERN = /^[a-z]+[\.\_][\.\_a-z]*[a-z]+$/.cs__freeze
             def probably_property_name? value
               value.match?(PROPERTY_NAME_PATTERN)
             end
 
-            REDACTED_MARKER = ' = "**REDACTED**"'
             def redacted_marker
               REDACTED_MARKER
             end