contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,29 +1,28 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-# base
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
-cs__scoped_require 'contrast/components/interface'
+require 'monitor'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/patching/policy/patch_utils'
 
-# assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
-cs__scoped_require 'contrast/extensions/ruby_core/assess'
+require 'contrast/agent'
+require 'contrast/logger/log'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/trigger_node'
 
-# inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
-cs__scoped_require 'contrast/extensions/ruby_core/inventory'
+# assess
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/propagation_method'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
-cs__scoped_require 'contrast/extensions/ruby_core/protect'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
+require 'contrast/agent/protect/policy/policy'
+
+# inventory
+require 'contrast/agent/inventory/policy/policy'
 
 module Contrast
   module Agent
@@ -34,13 +33,14 @@ module Contrast
         # provides a map for which methods our renamed functions need to call
         # and how.
         module Patch
+          extend Contrast::Utils::Patching::PatchUtils
+
           class << self
             include Contrast::Agent::Assess::Policy::SourceMethod
             include Contrast::Agent::Assess::Policy::PropagationMethod
             include Contrast::Agent::Assess::Policy::TriggerMethod
-
-            include Contrast::Components::Interface
-            access_component :logging, :analysis, :agent, :scope
+            include Contrast::Components::Logger::InstanceMethods
+            include Contrast::Components::Scope::InstanceMethods
 
             POLICIES = [
               Contrast::Agent::Assess::Policy::Policy,
@@ -49,234 +49,11 @@ module Contrast
             ].cs__freeze
 
             def enter_method_scope! method_policy
-              method_policy.scopes_to_enter.each do |scope|
-                enter_scope!(scope)
-              end
+              contrast_enter_method_scopes!(method_policy.scopes_to_enter)
             end
 
             def exit_method_scope! method_policy
-              method_policy.scopes_to_exit.each do |scope|
-                exit_scope!(scope)
-              end
-            end
-
-            # THIS IS CALLED FROM C. Do not change the signature lightly.
-            #
-            # This method functions to call the infilter methods from our
-            # patches, allowing for analysis and reporting at the point just
-            # before the patched code is invoked.
-            #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   Mapping of the triggers on the given method.
-            # @param method [Symbol] The method into which we're patching
-            # @param exception [StandardError] Any exception raised during the
-            #   call of the patched method.
-            # @param object [Object] The object on which the method is invoked,
-            #   typically what would be returned by self.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            def apply_pre_patch method_policy, method, exception, object, args
-              apply_protect(method_policy, method, exception, object, args)
-              apply_inventory(method_policy, method, exception, object, args)
-            rescue Contrast::SecurityException => e
-              # We were told to block something, so we gotta. Don't catch this
-              # one, let it get back to our Middleware or even all the way out to
-              # the framework
-              raise e
-            rescue StandardError => e
-              # Anything else was our bad and we gotta catch that to allow for
-              # normal application flow
-              logger.error(e, 'Unable to apply pre patch to method.')
-            rescue Exception => e # rubocop:disable Lint/RescueException
-              # This is something like NoMemoryError that we can't
-              # hope to handle.  Nonetheless, shouldn't leak scope.
-              exit_contrast_scope!
-              raise e
-            end
-
-            # THIS IS CALLED FROM C. Do not change the signature lightly.
-            #
-            # This method functions to call the infilter methods from our
-            # patches, allowing for analysis and reporting at the point just
-            # after the patched code is invoked
-            #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   Mapping of the triggers on the given method.
-            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
-            #   of the state of the code just prior to the invocation of the
-            #   patched method.
-            # @param object [Object] The object on which the method was
-            #   invoked, typically what would be returned by self.
-            # @param ret [Object] The return of the method that was invoked.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            # @param block [Proc] The block passed to the method that was
-            #   invoked.
-            def apply_post_patch method_policy, preshift, object, ret, args, block
-              apply_assess(method_policy, preshift, object, ret, args, block)
-            rescue StandardError => e
-              logger.error(e, 'Unable to apply post patch to method.')
-            end
-
-            # Apply the Protect patch which applies to the given method.
-            #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   Mapping of the triggers on the given method.
-            # @param method [Symbol] The method into which we're patching
-            # @param exception [StandardError] Any exception raised during the
-            #   call of the patched method.
-            # @param object [Object] The object on which the method is invoked,
-            #   typically what would be returned by self.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            def apply_protect method_policy, method, exception, object, args
-              return unless PROTECT.enabled?
-
-              apply_trigger_only(method_policy&.protect_node,
-                                 method,
-                                 exception,
-                                 object,
-                                 args)
-            end
-
-            # Apply the Inventory patch which applies to the given method.
-            #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   Mapping of the triggers on the given method.
-            # @param method [Symbol] The method into which we're patching
-            # @param exception [StandardError] Any exception raised during the
-            #   call of the patched method.
-            # @param object [Object] The object on which the method is invoked,
-            #   typically what would be returned by self.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            def apply_inventory method_policy, method, exception, object, args
-              return unless INVENTORY.enabled?
-
-              apply_trigger_only(method_policy&.inventory_node,
-                                 method,
-                                 exception,
-                                 object,
-                                 args)
-            end
-
-            # Apply the Assess patches which apply to the given method.
-            #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   Mapping of the triggers on the given method.
-            # @param preshift [Contrast::Agent::Assess::PreShift] The capture
-            #   of the state of the code just prior to the invocation of the
-            #   patched method.
-            # @param object [Object] The object on which the method was
-            #   invoked, typically what would be returned by self.
-            # @param ret [Object] The return of the method that was invoked.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            # @param block [Proc] The block passed to the method that was
-            #   invoked.
-            def apply_assess method_policy, preshift, object, ret, args, block
-              source_ret = nil
-              propagated_ret = nil
-              return ret unless method_policy && ASSESS.enabled?
-
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return ret unless current_context.analyze_request?
-
-              trigger_node = method_policy.trigger_node
-              Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args) if trigger_node
-
-              if method_policy.source_node
-                # If we were given a frozen return, and it was the target of a
-                # source, and we have frozen sources enabled, we'll need to
-                # replace the return. Note, this is not the default case.
-                source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret, args)
-              end
-
-              if method_policy.propagation_node
-                propagated_ret = Contrast::Agent::Assess::Policy::PropagationMethod.apply_propagation(
-                    method_policy,
-                    preshift,
-                    object,
-                    source_ret || ret,
-                    args,
-                    block)
-              end
-
-              handle_return(propagated_ret, source_ret, ret)
-            rescue StandardError => e
-              logger.error(e, 'Unable to assess method call.')
-              handle_return(propagated_ret, source_ret, ret)
-            rescue Exception => e # rubocop:disable Lint/RescueException
-              logger.error(e, 'Unable to assess method call.')
-              handle_return(propagated_ret, source_ret, ret)
-              raise e
-            end
-
-            # Generic invocation of the Inventory or Protect patch which apply
-            # to the given method.
-            #
-            # @param trigger_node [Contrast::Agent::Inventory::Policy::TriggerNode]
-            #   Mapping of the specific trigger on the given method.
-            # @param method [Symbol] The method into which we're patching
-            # @param exception [StandardError] Any exception raised during the
-            #   call of the patched method.
-            # @param object [Object] The object on which the method is invoked,
-            #   typically what would be returned by self.
-            # @param args [Array<Object>] The arguments passed to the method
-            #   being invoked.
-            def apply_trigger_only trigger_node, method, exception, object, args
-              return unless trigger_node
-
-              # If that rule only applies in the case of an exception being
-              # thrown and there's no exception here, move along, or vice versa
-              return if trigger_node.on_exception && !exception
-              return if !trigger_node.on_exception && exception
-
-              # Each patch has an applicator that handles logic for it. Think
-              # of this as being similar to propagator actions, most closely
-              # resembling CUSTOM - they all have a common interface but their
-              # own logic based on what's in the method(s) they've been patched
-              # into.
-              applicator = trigger_node.applicator
-              # Each patch also knows the method of its applicator. Some
-              # things, like AppliesXxeRule, have different methods depending
-              # on the library patched. This lets us handle the boilerplate of
-              # patching while still allowing for custom handling of the
-              # methods.
-              applicator_method = trigger_node.applicator_method
-              # By calling send like this, we can reuse all the patching.
-              # We `send` to the given method of the given class
-              # (applicator) since they all accept the same inputs
-              applicator.send(applicator_method, method, exception, trigger_node.properties, object, args)
-            end
-
-            # Method to choose which replaced return from the post_patch to
-            # actually return
-            #
-            # @param propagated_ret [Object, nil] The replaced return from the
-            #   propagation patch.
-            # @param source_ret [Object, nil] The replaced return from the
-            #   source patch.
-            # @param ret [Object, nil] The original return of the patched
-            #   method.
-            # @return [Object, nil] The thing to return from the post patch.
-            def handle_return propagated_ret, source_ret, ret
-              safe_return = propagated_ret || source_ret || ret
-              safe_return.rewind if Contrast::Utils::IOUtil.should_rewind?(safe_return)
-              safe_return
-            end
-
-            # Given a module and method, construct an expected name for the
-            # alias by which Contrast will reference the original.
-            #
-            # @param patched_class [Module] the module being patched
-            # @param patched_method [Symbol] the method being patched
-            # @return [Symbol]
-            def build_method_name patched_class, patched_method
-              (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
-                  patched_class.cs__name.gsub('::', '_').downcase +
-                  Contrast::Utils::ObjectShare::UNDERSCORE +
-                  patched_method.to_s).to_sym
+              contrast_exit_method_scopes!(method_policy.scopes_to_exit)
             end
 
             # @param mod [Module] the module in which the patch should be
@@ -292,15 +69,21 @@ module Contrast
               # we've already patched this class, don't do it again
               return true if methods.include?(cs_method_name)
 
+              # that method is within Contrast definition so it should be skipped
+              method = mod.instance_method(method_policy.method_name) if method_policy.instance_method
+              method = mod.singleton_method(method_policy.method_name) unless method_policy.instance_method
+              return true if method.owner <= Contrast
+
               begin
                 contrast_define_method(mod, method_policy, cs_method_name)
               rescue NameError => e
                 # This shouldn't happen anymore, but just in case calling alias
                 # results in a NameError, we'll be safe here.
-                logger.debug(
+                logger.error(
+                    'Attempted to alias a method on a Module that doesn\'t respond to it.',
                     e,
-                    "The class #{ mod.cs__name } does not respond to the "\
-                    "method#{ method_policy.method_name }.")
+                    module: mod.cs__name,
+                    method: method_policy.method_name)
                 return false
               end
               true
@@ -316,10 +99,96 @@ module Contrast
               contrast_prepend_method(mod, method_policy)
             end
 
+            # @param unbound_method [UnboundMethod] An unbound method, that doesn't reference its binding.
+            #   This method executes C hooking code.
+            def register_c_hook unbound_method
+              # current binding is as meaningless as any other.  but we need something
+              unbound_method.bind_call(self)
+            end
+
+            # @param target_module_name [String] Fully-qualified module name, as string, to which the C patch applies.
+            # @param unbound_method [UnboundMethod] An unbound method, to be patched into target_module.
+            # @param impl [Symbol] Strategy for applying the patch: { :alias_instance, :alias_singleton, or :prepend }:
+            #   :alias_instance     -> alias instance method of module
+            #   :alias_singleton    -> alias instance method of singleton class of module
+            #                          (equivalent to :alias, where `module = module.singleton class`)
+            #                          (this is a.k.a. "class-method patch")
+            #   :prepend            -> prepend instance method of module
+            #   :prepending singleton -> prepend singleton method of module
+            # @return [Symbol] new alias for the underlying method (presumably, so the patched method can call it)
+            def register_c_patch target_module_name, unbound_method, impl = :alias_instance
+              # These could be set as AfterLoadPatches.
+              method_name = unbound_method.name.to_sym # rubocop:disable Security/Module/Name -- ruby built in attribute.
+              underlying_method_name = underlying_method_name(method_name, impl)
+
+              target_module = Module.cs__const_get(target_module_name)
+              target_module = target_module.cs__singleton_class if %i[prepend_singleton alias_singleton].include?(impl)
+
+              visibility = if target_module.private_instance_methods(false).include?(method_name)
+                             :private
+                           elsif target_module.protected_instance_methods(false).include?(method_name)
+                             :protected
+                           elsif target_module.public_instance_methods(false).include?(method_name)
+                             :public
+                           else
+                             raise(NoMethodError,
+                                   <<~ERR)
+                                     Tried to register a C-defined #{ impl } patch for \
+                                     #{ target_module_name }##{ method_name }, but can't find :#{ method_name }.
+                                   ERR
+                           end
+
+              reflect_implementation(impl, target_module, unbound_method, visibility)
+              # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
+              # can't invoke this logging method or we'll seg fault as we'd
+              # change the method definition mid-call
+              # if method_name != :[]= &&
+              #   Contrast::Agent::Logger.defined!
+              #   logger.trace(
+              #       'Registered C-defined patch',
+              #       implementation: impl,
+              #       module: target_mod,
+              #       method: method_name,
+              #       visibility: visibility)
+              # end
+              underlying_method_name
+            end
+
+            # @param impl [Symbol] Strategy for applying the patch: { :alias_instance, :alias_singleton, or :prepend }:
+            # @param target_module [Module] The targeted module
+            # @param unbound_method [UnboundMethod] An unbound method, to be patched into target_module.
+            # @param visibility [Symbol] method visibility
+            def reflect_implementation impl, target_module, unbound_method, visibility
+              method_name = unbound_method.name.to_sym # rubocop:disable Security/Module/Name -- ruby built in attribute.
+              underlying_method_name = underlying_method_name(method_name, impl)
+
+              case impl
+              when :alias_instance, :alias_singleton
+                # Core to patching. Ignore define method usage cop.
+                # rubocop:disable Performance/Kernel/DefineMethod
+                unless target_module.instance_methods(false).include?(underlying_method_name)
+                  # alias_method may be private
+                  target_module.send(:alias_method, underlying_method_name, method_name)
+                  target_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                end
+                target_module.send(visibility, method_name) # e.g., module.private(:my_method)
+              when :prepend_instance, :prepend_singleton
+                prepending_module = Module.new
+                prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                prepending_module.send(visibility, method_name)
+
+                # This prepends to the singleton class (it patches a class method)
+                target_module.prepend(prepending_module)
+                # rubocop:enable Performance/Kernel/DefineMethod
+              end
+            end
+
             # @return [Boolean]
             def skip_contrast_analysis?
               return true if in_contrast_scope?
-              return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+              return false unless defined?(Contrast::Agent::REQUEST_TRACKER)
+              return false unless Contrast::Agent::REQUEST_TRACKER.current
+              return true unless Contrast::Agent::REQUEST_TRACKER.current.analyze_request?
 
               false
             end
@@ -331,7 +200,13 @@ module Contrast
             def skip_assess_analysis?
               return true if skip_contrast_analysis?
 
-              !ASSESS.enabled?
+              !ASSESS&.enabled?
+            end
+
+            def underlying_method_name method_name, impl
+              return method_name.to_sym if %i[prepend_instance prepend_singleton].include?(impl)
+
+              build_unbound_method_name(method_name).to_sym
             end
           end
         end
@@ -340,4 +215,4 @@ module Contrast
   end
 end
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/patch_status.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,15 +13,11 @@ module Contrast
             # one does not exist.
             #
             # @param mod [Module] the Module for which the status is asked
-            # @return [Contrast::Agent::Patching::Policy::PolicyStatus]
+            # @return [Contrast::Agent::Patching::Policy::PatchStatus]
             def get_status mod
-              if mod.cs__const_defined?(status_key, false)
-                mod.cs__const_get(status_key, false)
-              else
-                s = new
-                mod.cs__const_set(status_key, s)
-                s
-              end
+              return mod.cs__const_get(status_key) if mod.cs__const_defined?(status_key, false)
+
+              mod.cs__const_set(status_key, new)
             end
 
             # Allows our C patches to look up the :MethodPolicy for a given
@@ -68,7 +64,10 @@ module Contrast
             def set_info_for mod, method, method_policy, is_instance_method, cs_method
               mod.instance_variable_set(method_info_key, {}) unless mod.instance_variable_defined?(method_info_key)
               holder = mod.instance_variable_get(method_info_key)
-              holder[method_name_key(method, is_instance_method)] = [method_policy, cs_method] unless holder.key?(method)
+              # if we already have this information, then we don't need to set it as we'll update the info on access
+              return if holder.key?(method)
+
+              holder[method_name_key(method, is_instance_method)] = [method_policy, cs_method]
             end
 
             private
@@ -100,10 +99,17 @@ module Contrast
               :CONTRAST_PATCH_POLICY_STATUS
             end
 
+            # @param mod [Module or Class] the entity on which the patch has been placed
+            # @param method [Symbol] the method being patched
+            # @param ret [Contrast::Agent::Patching::Policy::MethodPolicy] the policy of the patched method
             def update_holder mod, method, ret
-              mod.instance_variable_set(method_info_key, {}) unless mod.instance_variable_defined?(method_info_key)
-              holder = mod.instance_variable_get(method_info_key)
-              holder[method] = ret
+              unless mod.instance_variable_defined?(method_info_key) &&
+                    (holder = mod.instance_variable_get(method_info_key))
+
+                holder = {}
+                mod.instance_variable_set(method_info_key, holder)
+              end
+              holder[method] = ret # rubocop:disable Lint/UselessSetterCall
             end
 
             def find_info_for candidates, method
@@ -126,7 +132,7 @@ module Contrast
             MOD_ARRAY = [Module].cs__freeze
           end
 
-          attr_reader :patch_status, :rewrite_status
+          attr_reader :patch_status
 
           def patching!
             @patch_status = :PATCHING
@@ -153,35 +159,7 @@ module Contrast
           end
 
           def patched?
-            @patch_status == :PATCHED ||
-                @patch_status == :NONE ||
-                @patch_status == :FAILED
-          end
-
-          def rewriting!
-            @rewrite_status = :REWRITING
-          end
-
-          def no_rewrite!
-            @rewrite_status = :NO_REWRITE
-          end
-
-          def rewritten!
-            @rewrite_status = :REWRITTEN
-          end
-
-          def failed_rewrite!
-            @rewrite_status = :FAILED_REWRITE
-          end
-
-          def rewriting?
-            @rewrite_status == :REWRITING
-          end
-
-          def rewritten?
-            @rewrite_status == :REWRITTEN ||
-                @rewrite_status == :NO_REWRITE ||
-                @rewrite_status == :FAILED_REWRITE
+            @patch_status == :PATCHED || @patch_status == :NONE || @patch_status == :FAILED
           end
         end
       end