contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -1,36 +1,37 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
+require 'monitor'
 
 # base
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/class_util'
+require 'contrast/utils/patching/policy/patcher_utils'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/policy_scanner'
-cs__scoped_require 'contrast/agent/assess/policy/rewriter_patch'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/policy_scanner'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # deadzone
-cs__scoped_require 'contrast/agent/deadzone/policy/policy'
+require 'contrast/agent/deadzone/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # patch
-cs__scoped_require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patch'
 
 # after load patched
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patcher'
+require 'contrast/agent/patching/policy/after_load_patcher'
 
 module Contrast
   module Agent
@@ -42,20 +43,17 @@ module Contrast
         # and how.
         module Patcher
           extend Contrast::Agent::Patching::Policy::AfterLoadPatcher
-
-          include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :scope
+          extend Contrast::Utils::Patching::PatcherUtils
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
 
           class << self
             # Hook to install the Contrast changes needed to allow for the
             # instrumentation of the application - this only occurs once, during
             # startup to catchup on everything we didn't see get loaded
             def patch
-              logger.debug_with_time("\tPatching") do
-                catchup_after_load_patches
-                patch_methods
-                Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations
-              end
+              catchup_after_load_patches
+              catchup_loaded_methods
             end
 
             # Hook to only monkeypatch Contrast. This will not trigger any
@@ -64,10 +62,11 @@ module Contrast
             # where only a subset of the Assess changes are needed.
             PATCH_MONITOR = Monitor.new
 
-            def patch_methods
+            # Iterate over and patch those Modules and Methods which were loaded before the Agent was enabled.
+            def catchup_loaded_methods
               PATCH_MONITOR.synchronize do
                 t = Contrast::Agent::Thread.new do
-                  synchronized_patch_methods
+                  synchronized_catchup_loaded_methods
                 end
                 # aborting on exception makes exceptions propagate.
                 t.abort_on_exception = true
@@ -76,45 +75,6 @@ module Contrast
               end
             end
 
-            # This method is called by TracePointHook to instrument a specific class during a require
-            # or eval of dynamic class definition
-            def patch_specific_module mod
-              mod_name = mod.cs__name
-              return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
-              return if AGENT.skip_instrumentation?(mod_name)
-
-              load_patches_for_module(mod_name)
-
-              return unless all_module_names.any? { |name| name == mod_name }
-
-              module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
-              patch_into_module(module_data)
-              all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
-            rescue StandardError => e
-              logger.error("Unable to patch into #{ mod_name }", e)
-            end
-
-            # We did it, team. We found a patcher(s) that applies to the given
-            # class (or module) and the given method. Time to do some tracking.
-            #
-            # @param mod [Module] the module in which the patch should be
-            #   placed.
-            # @param methods [Array(Symbol)] all the instance or singleton
-            #   methods in this clazz.
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   the policy that applies to the given method_name.
-            # @return [Boolean] if patched, either by this invocation or a
-            #   previous, or not
-            def patch_method mod, methods, method_policy
-              return false unless methods&.any? # don't even build the name if there are no methods
-
-              if Contrast::Utils::ClassUtil.prepended_method?(mod, method_policy)
-                Contrast::Agent::Patching::Policy::Patch.instrument_with_prepend(mod, method_policy)
-              else
-                Contrast::Agent::Patching::Policy::Patch.instrument_with_alias(mod, methods, method_policy)
-              end
-            end
-
             private
 
             POLICIES = [
@@ -142,94 +102,72 @@ module Contrast
             # @return [Array<String>] the names of all the Modules for which
             #   there patches in our policies
             def all_module_names
-              @_all_module_names ||= POLICIES.each_with_object(Set.new) { |policy, set| set.merge(policy.instance.module_names) }
+              @_all_module_names ||=
+                POLICIES.each_with_object(Set.new) { |policy, set| set.merge(policy.instance.module_names) }
             end
 
             # Hook to only monkeypatch Contrast. This will not trigger any
             # other functions, like rewriting or scanning. This method should
             # only be invoked by the patch_methods method above in order to
             # ensure it is wrapped in a synchronize call
-            def synchronized_patch_methods
-              # logger.trace_with_time("\t\tRunning patching") do # TODO: RUBY-547
-              patched = []
-              all_module_names.each do |patchable_name|
-                next if AGENT.skip_instrumentation?(patchable_name)
-
-                patchable_mod = patchable(patchable_name)
-                next unless patchable_mod
-
-                module_data = Contrast::Agent::ModuleData.new(patchable_mod, patchable_name)
-                patch_into_module(module_data)
-                patched << patchable_name if status_type.get_status(patchable_mod).patched?
+            def synchronized_catchup_loaded_methods
+              logger.trace_with_time('Running patching') do
+                patched = []
+                all_module_names.each do |patchable_name|
+                  next if ::Contrast::AGENT.skip_instrumentation?(patchable_name)
+
+                  patchable_mod = patchable(patchable_name)
+                  next unless patchable_mod
+
+                  module_data = Contrast::Agent::ModuleData.new(patchable_mod, patchable_name)
+                  patch_into_module(module_data)
+                  patched << patchable_name if status_type.get_status(patchable_mod).patched?
+                end
+                all_module_names.subtract(patched)
               end
-              all_module_names.subtract(patched)
-              # end
             end
 
-            # Given the patchers that apply to this class that may apply, patch
-            # Contrast method calls into the methods for which we have rules.
+            # Given the patchers that apply to this class that may apply, patch Contrast method calls into the methods
+            # for which we have rules.
             #
-            # @param module_data [Contrast::Agent::ModuleData] the module, and
-            #   its name, that's being patched into
-            # @param redo_patch [Boolean] a trigger to force patching
-            #   regardless of the state of the
-            #   Contrast::Agent::Patching::Policy::PatchStatus status on the
-            #   Module
-            def patch_into_module module_data, redo_patch = false
-              status = status_type.get_status(module_data.mod)
+            # @param module_data [Contrast::Agent::ModuleData] the module, and its name, that's being patched into
+            # @param redo_patch [Boolean] a trigger to force patching regardless of the state of the
+            #   Contrast::Agent::Patching::Policy::PatchStatus status on the Module
+            def patch_into_module module_data, redo_patch: false
+              status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod)
               return if (status&.patched? || status&.patching?) && !redo_patch
 
-              # Begin patching our sources into the given clazz (or module)
-              # Any patcher that has the name of the clazz will be evaluated for
-              # patching.
-              # Find all the patchers that apply to this class, sorted by type.
-              module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.create_module_policy(module_data.name)
+              # Begin patching our sources into the given module. Any patcher that has the name of the module will be
+              # evaluated for patching. Find all the patchers that apply to this class, sorted by type.
+              module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.create_module_policy(module_data.mod_name)
 
-              clazz = module_data.mod
-
-              status = status_type.get_status(clazz)
-              return if (status.patched? || status.patching?) && !redo_patch
-
-              status.patching!
-              patched = include_module(module_data)
-
-              counts = 0
-              # Monkey patch any methods in this class that have matching nodes in the policy
-              unless module_policy.empty?
-                instance_methods = all_instance_methods(clazz, true)
-                singleton_methods = clazz.singleton_methods(false)
-                counts += patch_into_methods(clazz, instance_methods, module_policy, true)
-                counts += patch_into_methods(clazz, singleton_methods, module_policy, false)
-                counts = module_policy.num_expected_patches if adjust_for_prepend(clazz)
-                patched = true
-              end
-
-              if patched
-                if module_policy.num_expected_patches == counts
-                  status.patched!
-                else
-                  status.partial_patch!
-                end
-              else
+              # If there's nothing to match, then set that status and exit
+              if module_policy.empty?
                 status.no_patch!
+                return
               end
+
+              patch_methods(status, module_data, module_policy)
             rescue StandardError => e
-              status ||= status_type.get_status(module_data.mod)
-              status.failed_patch!
-              logger.warn(e, "Unable to patch into #{ module_data.name }")
+              status&.failed_patch!
+              logger.warn('Patching failed', e, module: module_data.mod_name)
             ensure
-              logger.debug(nil, "Patching #{ module_data.name } resulted in #{ status_type.get_status(module_data.mod).patch_status }")
+              logger.trace('Patching complete',
+                           module: module_data.mod_name,
+                           result:
+                             Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod).patch_status)
             end
 
-            # Includes the given module with the
-            # Contrast::CoreExtensions::Assess::AssessExtension
-            # @param module_data [Contrast::Agent::ModuleData] the module, and
-            #   its name, that's being patched into
-            def include_module module_data
-              return false unless Contrast::Agent::Assess::Policy::Policy.instance.tracked_classes.include?(module_data.name)
+            def patch_methods status, module_data, module_policy
+              status.patching!
+              num_applied_patches = patch_into_instance_methods(module_data, module_policy)
+              num_applied_patches += patch_into_singleton_methods(module_data, module_policy)
 
-              module_data.mod.send(:include, Contrast::CoreExtensions::Assess::AssessExtension)
-              true
+              if adjust_for_prepend(module_data) || module_policy.num_expected_patches == num_applied_patches
+                status.patched!
+              else
+                status.partial_patch!
+              end
             end
 
             # Get all of the instance methods on the given module, excluding
@@ -241,7 +179,7 @@ module Contrast
             # @param private [Boolean] Indicate if the query should include
             #   private, as well as public, instance methods
             # @return [Array<Symbol>]
-            def all_instance_methods mod, private = false
+            def all_instance_methods mod, private: false
               instance_methods = mod.instance_methods(false)
               # C magic rb_define_global_function creates private instance
               # methods. We need to instrument those dudes
@@ -249,29 +187,59 @@ module Contrast
               instance_methods.concat(mod.private_instance_methods(false)) if private
               # initialize is an exception to the inheritance rule.
               instance_methods << :initialize unless instance_methods.include?(:initialize)
+              # Object owns these, but we don't want to patch every :dup or
+              # :clone, just the ones on String, so we'll special case this.
+              # This breaks the norm, where we usually instrument the lowest
+              # method possible.
+              if mod == String
+                instance_methods << :clone
+                instance_methods << :dup
+              end
               instance_methods
             end
 
-            # We've found the patchers that apply to this class (or module). Now we'll
-            # filter on the given method.
+            # Patch into the Instance Methods, including private, of the given Module that match the ModulePolicy
+            # provided.
             #
-            # @param mod [Module] The module from which to retrieve instance
-            #   methods.
-            # @param methods [Array<Symbol>] The names of all the methods in
-            #   in this module
-            # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy]
-            #   All the patchers that apply to this class, sorted by type.
-            # @param is_instance_method [Boolean] Indicates if these methods
-            #   are the instance or singleton methods for this module.
-            # @return [Integer] number of methods patched
+            # @param module_data [Contrast::Agent::ModuleData] the module, and its name, that's being patched into
+            # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy] All the patchers that apply to
+            #   this module, sorted by type.
+            def patch_into_instance_methods module_data, module_policy
+              mod = module_data.mod
+              methods = all_instance_methods(mod, private: true)
+              methods.delete(:initialize) if mod.to_s.start_with?('RSpec') && mod.to_s.include?('Matchers')
+              patch_into_methods(mod, methods, module_policy, true)
+            end
+
+            # Patch into the Singleton Methods of the given Module that match the ModulePolicy provided.
+            #
+            # @param module_data [Contrast::Agent::ModuleData] the module, and its name, that's being patched into
+            # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy] All the patchers that apply to
+            #   this module, sorted by type.
+            def patch_into_singleton_methods module_data, module_policy
+              mod = module_data.mod
+              methods = mod.singleton_methods(false)
+              patch_into_methods(mod, methods, module_policy, false)
+            end
+
+            # We've found the patchers that apply to this class (or module). Now we'll filter on the given method.
+            #
+            # @param mod [Module] The module from which to retrieve instance methods.
+            # @param methods [Array<Symbol>] The names of all the methods in in this module
+            # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy] All the patchers that apply to
+            #   this class, sorted by type.
+            # @param is_instance_method [Boolean] Indicates if these methods are the instance or singleton methods for
+            #   this module.
+            # @return [Integer] number of methods patched.
             def patch_into_methods mod, methods, module_policy, is_instance_method
               count = 0
               methods.each do |method|
-                method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.build_method_policy(method, module_policy, is_instance_method)
+                method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.build_method_policy(method,
+                                                                                                    module_policy,
+                                                                                                    is_instance_method)
                 next if method_policy.empty?
 
-                patched = patch_method(mod, methods, method_policy)
-                count += 1 if patched
+                count += 1 if patch_method(mod, methods, method_policy)
               end
               count
             end
@@ -282,11 +250,10 @@ module Contrast
             # it has to be reapplied.
             # TODO: RUBY-620 should remove the need for this
             #
-            # @param mod[Module] the Module for which a prepend action needs to
-            #   be accounted
+            # @param module_data [Contrast::Agent::ModuleData] the module, and its name, that's being patched into
             # @return [Boolean] if an adjustment was made or not
-            def adjust_for_prepend mod
-              return false unless mod.cs__name == 'CGI::Util'
+            def adjust_for_prepend module_data
+              return false unless module_data.mod.cs__name == 'CGI::Util'
 
               CGI.include(CGI::Util)
               CGI.extend(CGI::Util)
@@ -300,10 +267,9 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/extensions/ruby_core/assess'
-cs__scoped_require 'contrast/extensions/ruby_core/inventory'
-cs__scoped_require 'contrast/extensions/ruby_core/protect'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
+require 'contrast/extension/module'
+require 'contrast/extension/assess'
+require 'contrast/extension/inventory'
+require 'contrast/extension/protect'
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,76 +1,74 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'contrast'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'json'
+require 'singleton'
+
+require 'contrast'
+require 'contrast/components/logger'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
     module Patching
       module Policy
-        # This is just a holder for our policy. Takes the policy JSON and
-        # converts it into hashes that we can access nicely
+        # This is just a holder for our policy. Takes the policy JSON and converts it into hashes that we can access
+        # nicely.
+        #
         # @abstract
         class Policy
           include Singleton
-          include Contrast::Components::Interface
+          include Contrast::Components::Logger::InstanceMethods
+          SOURCES_KEY = 'sources'
+          PROPAGATION_KEY = 'propagators'
+          RULES_KEY = 'rules'
+          TRIGGERS_KEY = 'triggers'
+          def initialize
+            @sources = []
+            @propagators = []
+            @triggers = []
+            @providers = {}
+
+            json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
+            from_hash_string(json)
+          end
 
           # Indicates the folder in `resources` where this policy lives.
+          #
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def self.policy_folder
-            raise(NotImplementedError, 'specify policy_folder for patching')
+            raise(NoMethodError, 'specify policy_folder for patching')
           end
 
-          # Indicates is this feature has been disabled by the configuration,
-          # read at startup, and therefore can never be enabled.
+          # Indicates is this feature has been disabled by the configuration, read at startup, and therefore can never
+          # be enabled.
+          #
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def disabled_globally?
-            raise(NotImplementedError, 'specify disabled_globally? conditions for patching')
+            raise(NoMethodError, 'specify disabled_globally? conditions for patching')
           end
 
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def node_type
-            raise(NotImplementedError, 'specify the concrete node type for this poilcy')
+            raise(NoMethodError, 'specify the concrete node type for this poilcy')
           end
 
-          access_component :logging, :analysis
-
-          attr_accessor :providers, :tracked_classes
-          attr_reader :sources, :propagators, :triggers, :patched_names
-
-          SOURCES_KEY =          'sources'
-          PROPAGATION_KEY =      'propagators'
-          RULES_KEY = 'rules'
-          TRIGGERS_KEY = 'triggers'
-          TRACKED_CLASSES_KEY = 'tracked_classes'
+          attr_reader :sources, :propagators, :triggers, :providers
 
           def self.policy_json
             File.join(policy_folder, 'policy.json').cs__freeze
           end
 
-          def initialize
-            @sources = []
-            @propagators = []
-            @triggers = []
-            @providers = {}
-            @tracked_classes = []
-            @patched_names = Set.new
-
-            json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
-            from_hash_string(json)
-          end
-
-          # Our policy for patching rules is a 'dope ass' JSON file. Rather than
-          # hard code in a bunch of things to monkey patch, we let the JSON file
-          # define the conditions in which modifications are applied.
-          # This let's us be flexible and extensible.
+          # Our policy for patching rules is a 'dope ass' JSON file. Rather than hard code in a bunch of things to
+          # monkey patch, we let the JSON file define the conditions in which modifications are applied. This let's us
+          # be flexible and extensible.
           def from_hash_string string
-            # The default behavior of the agent is to load the policy on startup,
-            # as at this point we do not know in which mode we'll be run.
+            # The default behavior of the agent is to load the policy on startup, as at this point we do not know in
+            # which mode we'll be run.
             #
-            # If the configuration file explicitly disables a feature, we know
-            # that we will not ever be able to enable it, so in that case, we
-            # can skip policy loading.
+            # If the configuration file explicitly disables a feature, we know that we will not ever be able to enable
+            # it, so in that case, we can skip policy loading.
             return if disabled_globally?
 
             policy_data = JSON.parse(string)
@@ -85,14 +83,14 @@ module Contrast
 
           def add_node node, node_type = :trigger
             unless node
-              logger.error(nil, 'Node was nil when adding node to policy')
+              logger.error('Node was nil when adding node to policy')
               return
             end
 
             begin
               node.validate
             rescue ArgumentError => e
-              logger.error(e, e.message)
+              logger.error('Node failed validation', e)
               return
             end
 
@@ -107,19 +105,12 @@ module Contrast
               module_names << node.class_name
               @sources << node
             else
-              logger.error(nil, "Invalid node_type: #{ node_type } provided when adding node to policy")
+              logger.error('Invalid node_type provided when adding node to policy', node_type: node_type)
             end
           end
 
           def module_names
-            @_module_names ||= begin
-              m = Set.new
-              tracked_classes.each { |tracked| m << tracked }
-              sources.each { |source| m << source.class_name }
-              propagators.each { |propagator| m << propagator.class_name }
-              triggers.each { |trigger| m << trigger.class_name }
-              m
-            end
+            @_module_names ||= Set.new([sources, propagators, triggers].flatten.map!(&:class_name))
           end
 
           def find_triggers_by_rule rule_id
@@ -127,12 +118,26 @@ module Contrast
           end
 
           def find_source_node class_name, method_name, instance_method
-            sources.find { |source| source.class_name == class_name && source.method_name == method_name && source.instance_method == instance_method }
+            sources.find do |source|
+              source.class_name == class_name &&
+                  source.method_name == method_name &&
+                  source.instance_method == instance_method
+            end
+          end
+
+          def find_propagator_node class_name, method_name, instance_method
+            propagators.find do |propagator|
+              propagator.class_name == class_name &&
+                  propagator.method_name == method_name &&
+                  propagator.instance_method == instance_method
+            end
           end
 
           def find_node rule_id, class_name, method_name, instance_method
             find_triggers_by_rule(rule_id).find do |node|
-              node.class_name == class_name && node.method_name == method_name && node.instance_method == instance_method
+              node.class_name == class_name &&
+                  node.method_name == method_name &&
+                  node.instance_method == instance_method
             end
           end
         end