contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/extensions/ruby_core/assess/erb.rb

@@ -1,42 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# This module is used to track propagation through ERB template rendering
-module ERBPropagator
-  class << self
-    include Contrast::Components::Interface
-    access_component :logging
-
-    def result_tagger patcher, preshift, ret, _block
-      return unless preshift.args.length >= 1
-
-      logger.debug('ERBPropagator - running propagation')
-      used_binding = preshift.args[0]
-      binding_variable_set = used_binding.local_variables
-
-      erb_pre_result = preshift.object.src
-      binding_variable_set.each do |bound_var_symbol|
-        bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
-        next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
-        next unless erb_pre_result.include?(bound_var_symbol.to_s)
-
-        start_index = ret.index(bound_variable_value)
-        next if start_index.nil?
-
-        logger.debug('ERBPropagator - found bound_variable in erb template result')
-        ret.cs__copy_from(bound_variable_value, start_index)
-      end
-      ret.cs__properties.build_event(
-          patcher,
-          ret,
-          preshift.object,
-          ret,
-          preshift.args,
-          1)
-      logger.debug('ERBPropgator - Finished erb result propagation')
-      ret
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/assess/fiber.rb

@@ -1,124 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-cs__scoped_require 'fiber'
-
-# In order to instrument some difficult methods like String#gsub, as it
-# returns an enumerator, we need to instrument methods on Fiber.
-# Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
-# order to track what happens within Enumerator#next.
-# TODO: RUBY-531 move these out of Fiber class
-class Fiber
-  include Contrast::CoreExtensions::Assess::AssessExtension
-  include Contrast::Components::Interface
-
-  access_component :analysis, :scope
-
-  FIBER_NEW_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_new', # TODO: Why do we patch new here and not initalize? Historically, new has been problematic.
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_new'
-  }.cs__freeze
-  FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
-  private_constant :FIBER_NEW_NODE_HASH
-  private_constant :FIBER_NEW_NODE
-
-  FIBER_YIELD_NODE_HASH = {
-      'class_name' => 'Fiber',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'c_yield',
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'track_rb_fiber_yield'
-  }.cs__freeze
-  FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
-  private_constant :FIBER_YIELD_NODE_HASH
-  private_constant :FIBER_YIELD_NODE
-
-  class << self
-    def track_rb_fiber_yield fiber, _method, results
-      # results will be nil if StopIteration was raised,
-      # otherwise an Array of the yielded arguments
-      return unless results.cs__is_a?(Array)
-      return unless ASSESS.enabled?
-
-      with_contrast_scope do
-        results.each do |result|
-          next unless Contrast::Utils::DuckUtils.trackable?(result)
-          next if result.cs__frozen?
-
-          cs__splat_tags(result, fiber)
-          result.cs__properties.build_event(
-              FIBER_YIELD_NODE,
-              result,
-              fiber,
-              result,
-              [])
-        end
-      end
-    end
-
-    def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
-      return unless Contrast::Utils::DuckUtils.trackable?(underlying)
-      return unless underlying.is_a?(String) && !underlying.empty?
-
-      return unless ASSESS.enabled?
-
-      with_contrast_scope do
-        cs__splat_tags(fiber, underlying)
-        fiber.cs__properties.build_event(
-            FIBER_NEW_NODE,
-            fiber,
-            underlying,
-            fiber,
-            [])
-      end
-    end
-
-    def instrument_fiber_track
-      @_instrument_fiber_variables ||= begin
-          cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
-          true
-        end
-    rescue StandardError => e
-      logger.error(e, 'Error loading fiber track patch')
-      false
-    end
-
-    # Some propagation occurred, but we're not sure what the
-    # exact transformation was. To be safe, we just explode
-    # all the tags from the source to the return.
-    #
-    # If the return already had that tag, the existing tag
-    # range is recycled to save us an object.
-    def cs__splat_tags ret, source = self
-      source.cs__properties.tag_keys.each do |key|
-        length = Contrast::Utils::StringUtils.ret_length(ret)
-        existing = ret.cs__properties.fetch_tag(key)
-        # if the tag already exists, drop all but the first range
-        # then change that range to cover the entire return
-        if existing&.any?
-          existing.drop(existing.length - 1)
-          range = existing[0]
-          range.repurpose(0, length)
-        else
-          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-          ret.cs__properties.add_tag(key, span)
-        end
-      end
-    end
-  end
-end
-
-Fiber.instrument_fiber_track

data/lib/contrast/extensions/ruby_core/assess/hash.rb

@@ -1,22 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# This Class provides us with a way to invoke Hash propagation for those
-# methods which are too complex to fit into one of the standard
-# Contrast::Agent::Assess::Policy::Propagator molds.
-class Hash
-  def self.cs__duplicate_and_freeze object
-    return object unless object.is_a?(String) && !object.cs__frozen?
-    return object unless object.cs__tracked?
-
-    object.dup.cs__freeze
-  rescue StandardError
-    logger.error("Unable to track dataflow through array for #{ object }")
-  end
-
-  def cs__bracket_set *args
-    Hash.cs__duplicate_and_freeze(args[0])
-  end
-end
-
-cs__scoped_require 'cs__assess_hash/cs__assess_hash'

data/lib/contrast/extensions/ruby_core/assess/kernel.rb

@@ -1,95 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/exec_trigger'
-
-# This module provides us with a way to invoke Kernel propagation for those
-# methods which are too complex to fit into one of the standard
-# Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
-# Kernel Module or exposing our methods there.
-module KernelPropagator
-  class << self
-    include Contrast::Components::Interface
-    include Contrast::CoreExtensions::Assess::ExecTrigger
-
-    access_component :logging
-
-    # We're 'tracking' sprintf now, meaning if anything is tracked on the way
-    # in, the entire result will be tracked out. We're going to take this
-    # approach for now b/c it's fast and easy. I don't super love it, and by
-    # that I mean I hate it.
-    #
-    # To actually track this, we'd have to find the index of the new things
-    # being added, then remove the tags at the range of the format marker,
-    # which is some arbitrary length thing, and add the new tags from the
-    # inserted string, shifted down by the length of the aforementioned
-    # marker.
-    #
-    # marker is in the format %[flags][width][.precision]type, type being a
-    # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
-    #
-    # also, b/c Ruby hates us, there are things called absolute markers,
-    # (digit)$, that go in the flags section. These cannot be mixed w/ the
-    # order assumed type
-    #
-    # oh, and there's also %<name>type and %{name}... b/c of course there is
-    # -HM
-    def sprintf_tagger patcher, preshift, ret, _block
-      format_string = preshift.args[0]
-      args = preshift.args[1]
-
-      track_sprintf(ret, format_string, args)
-
-      ret.cs__properties.build_event(
-          patcher,
-          ret,
-          preshift.object,
-          ret,
-          preshift.args,
-          1)
-      ret
-    end
-
-    def track_sprintf result, format_string, args
-      tracked_inputs = []
-      tracked_inputs << format_string if format_string.cs__tracked?
-      if args.is_a?(String)
-        tracked_inputs << args if args.cs__tracked?
-      elsif args.is_a?(Hash)
-        args.each_value do |value|
-          next unless Contrast::Utils::DuckUtils.quacks_to?(
-              value,
-              :cs__tracked?)
-          next unless value.cs__tracked?
-
-          tracked_inputs << value
-        end
-      elsif args.is_a?(Array)
-        args.each do |value|
-          next unless Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?)
-          next unless value.cs__tracked?
-
-          tracked_inputs << value
-        end
-      end
-      return result if tracked_inputs.empty?
-
-      tracked_inputs.each do |input|
-        input.cs__properties.events.each do |event|
-          result.cs__properties.events << event
-        end
-        input.cs__splat_tags(result)
-      end
-
-      result
-    rescue StandardError => e
-      logger.error(
-          e,
-          'Unable to track dataflow through sprintf')
-      result
-    end
-  end
-end
-
-cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'

data/lib/contrast/extensions/ruby_core/assess/module.rb

@@ -1,14 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/extensions/ruby_core/eval_trigger'
-
-# Our patch into the Module class, allowing us to track calls to the eval
-# method
-class Module
-  class << self
-    include Contrast::CoreExtensions::Assess::EvalTrigger
-  end
-end
-
-cs__scoped_require 'cs__assess_module/cs__assess_module'

data/lib/contrast/extensions/ruby_core/assess/regexp.rb

@@ -1,206 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# Monkeypatch Ruby Regexp with Contrast Security tagging support
-class Regexp
-  include Contrast::Components::Interface
-  include Contrast::CoreExtensions::Assess::AssessExtension
-
-  access_component :analysis, :logging, :scope
-
-  def cs__regexp_tagger info_hash
-    return unless ASSESS.enabled?
-
-    # Because we have a special case for this propagation,
-    # it falls out of regular scoping. As such, any patch to the `=~` method
-    # that goes through normal channels, like that for the redos rule,
-    # will force this to be in a scope of 1 (instead of the normal 0).
-    # As such, a scope of 1 here indicates that,
-    # so we know that we're in the top level call for this method.
-    # normal patch [-alias-]> special case patch [-alias-]> original method
-    # TODO:  RUBY-686
-    return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
-
-    with_contrast_scope do
-      result = info_hash[:result]
-      return unless result
-
-      string = info_hash[:string] || nil
-      return unless string
-
-      regexp = info_hash[:regexp]
-      return unless (Contrast::Utils::DuckUtils.quacks_to?(string, :cs__tracked?) && string.cs__tracked?) ||
-          (Contrast::Utils::DuckUtils.quacks_to?(regexp, :cs__tracked?) && regexp.cs__tracked?)
-
-      Regexp.cs__splat_tags(info_hash[:back_ref], string)
-      Regexp.cs__build_event(ARRAY_NODE, info_hash[:back_ref], result, [string])
-    end
-  end
-
-  REGEXP_EQUAL_SQUIGGLE_HASH = {
-      'id' => 'regexp_100',
-      'class_name' => 'Regexp',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => '=~',
-      'source' => 'P0',
-      'target' => 'R',
-      'action' => 'KEEP'
-  }.cs__freeze
-  ARRAY_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
-  private_constant :REGEXP_EQUAL_SQUIGGLE_HASH
-  private_constant :ARRAY_NODE
-
-  REGEXP_MATCH_HASH = {
-      'id' => 'regexp_101',
-      'class_name' => 'Regexp',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'match',
-      'source' => 'P0',
-      'target' => 'R',
-      'action' => 'SPLAT'
-  }.cs__freeze
-  MATCH_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_MATCH_HASH)
-  private_constant :REGEXP_MATCH_HASH
-  private_constant :MATCH_NODE
-
-  POST_HASH = {
-      'class_name' => 'MatchData',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'post_match',
-      'source' => 'O',
-      'target' => 'R',
-      'action' => 'REMOVE'
-  }.cs__freeze
-  POST_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(POST_HASH)
-  private_constant :POST_HASH
-  private_constant :POST_WEAVER
-
-  PRE_HASH = {
-      'class_name' => 'MatchData',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'pre_match',
-      'source' => 'O',
-      'target' => 'R',
-      'action' => 'SPLAT'
-  }.cs__freeze
-  PRE_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(PRE_HASH)
-  private_constant :PRE_HASH
-  private_constant :PRE_WEAVER
-
-  LAST_PAREN_HASH = {
-      'class_name' => 'MatchData',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'last_paren',
-      'source' => 'O',
-      'target' => 'R',
-      'action' => 'SPLAT'
-  }.cs__freeze
-  LAST_PAREN_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(LAST_PAREN_HASH)
-  private_constant :LAST_PAREN_HASH
-  private_constant :LAST_PAREN_WEAVER
-
-  NTH_HASH = {
-      'class_name' => 'MatchData',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'nth_match',
-      'source' => 'O',
-      'target' => 'R',
-      'action' => 'SPLAT'
-  }.cs__freeze
-  NTH_WEAVER = Contrast::Agent::Assess::Policy::PropagationNode.new(NTH_HASH)
-  private_constant :NTH_HASH
-  private_constant :NTH_WEAVER
-
-  class << self
-    def track_rb_pre_match backref, target
-      track_rb_c(PRE_WEAVER, backref, target)
-    end
-
-    def track_rb_post_match backref, target
-      track_rb_c(POST_WEAVER, backref, target)
-    end
-
-    def track_rb_reg_match_last backref, target
-      track_rb_c(LAST_PAREN_WEAVER, backref, target)
-    end
-
-    def track_rb_n_match backref, target
-      track_rb_c(NTH_WEAVER, backref, target)
-    end
-
-    # Some propagation occurred, but we're not sure what the
-    # exact transformation was. To be safe, we just explode
-    # all the tags from the source to the return.
-    #
-    # If the return already had that tag, the existing tag
-    # range is recycled to save us an object.
-    def cs__splat_tags ret, source = self
-      source.cs__properties.tag_keys.each do |key|
-        length = Contrast::Utils::StringUtils.ret_length(ret)
-        existing = ret.cs__properties.fetch_tag(key)
-        # if the tag already exists, drop all but the first range
-        # then change that range to cover the entire return
-        if existing&.any?
-          existing.drop(existing.length - 1)
-          range = existing[0]
-          range.repurpose(0, length)
-        else
-          span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-          ret.cs__properties.add_tag(key, span)
-        end
-      end
-    end
-
-    def cs__build_event node, target, ret, args
-      return unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__tracked?)
-      return unless target.cs__tracked?
-
-      target.cs__properties.build_event(
-          node,
-          target,
-          self,
-          ret,
-          args)
-    end
-
-    def instrument_regexp_track
-      @_instrument_regexp_variables ||= begin
-          cs__scoped_require 'cs__assess_regexp_track/cs__assess_regexp_track'
-          true
-        end
-    rescue StandardError => e
-      logger.error(e, 'Error loading regexp track patch')
-      false
-    end
-
-    private
-
-    def track_rb_c weaver, backref, target
-      return target unless ASSESS.enabled?
-      return target unless backref&.respond_to?(:cs__properties)
-      return target unless target.is_a?(String) && !target.empty?
-
-      with_contrast_scope do
-        cs__splat_tags(target, backref)
-        target.cs__properties.build_event(
-            weaver,
-            target,
-            self,
-            target,
-            [])
-        target
-      end
-    end
-  end
-end
-
-cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
-Regexp.instrument_regexp_track

data/lib/contrast/extensions/ruby_core/assess/string.rb

@@ -1,75 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# This patch installs our extension as early as possible. The alternative is to
-# litter our code with responds_to? checks.
-class String
-  include Contrast::CoreExtensions::Assess::AssessExtension
-end
-
-module Contrast
-  module CoreExtensions
-    module Assess
-      # This Class provides us with a way to invoke String propagation for those
-      # methods which are too complex to fit into one of the standard
-      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
-      # String Class or exposing our methods there.
-      class StringPropagator
-        include Contrast::Components::Interface
-
-        access_component :analysis, :agent, :logging, :scope
-
-        NODE_HASH = {
-            'class_name' => 'String',
-            'instance_method' => true,
-            'method_name' => 'interpolate',
-            'method_visibility' => 'public',
-            'action' => 'CUSTOM',
-            'source' => 'O,P0',
-            'target' => 'R',
-            'patch_class' => 'NOOP',
-            'patch_method' => 'track_interpolation'
-        }.cs__freeze
-        INTERPOLATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
-
-        class << self
-          def track_interpolation inputs, result
-            return unless AGENT.interpolation_enabled?
-            return if in_contrast_scope?
-            return unless inputs.any?(&:cs__tracked?)
-
-            with_contrast_scope do
-              offset = 0
-              inputs.each do |input|
-                result.cs__copy_from(input, offset)
-                offset += input.length
-              end
-              result.cs__properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
-            end
-          end
-
-          def instrument_string_interpolation
-            if @_instrument_string_interpolation.nil?
-              @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
-                                                    end
-                                                    true
-                                                  rescue StandardError => e
-                                                    logger.error(e, 'Error loading interpolation patch')
-                                                    false
-                                                  end
-            end
-            @_instrument_string_interpolation
-          end
-        end
-      end
-    end
-  end
-end
-
-cs__scoped_require 'cs__assess_string/cs__assess_string'
-
-Contrast::CoreExtensions::Assess::StringPropagator.instrument_string_interpolation

data/lib/contrast/extensions/ruby_core/assess/tilt_template_trigger.rb

@@ -1,73 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-# This module acts a trigger & propagator for Tilt::Template evaluation
-module TiltTemplateTrigger
-  include Contrast::Components::Interface
-  access_component :logging
-  class << self
-    NODE_HASH = {
-        'class_name' => 'Tilt::Template',
-        'instance_method' => true,
-        'method_name' => 'render',
-        'method_visibility' => 'public',
-        'action' => 'CUSTOM',
-        'source' => 'O,P0',
-        'target' => 'R',
-        'patch_class' => 'NOOP',
-        'patch_method' => 'track_template_evaluation'
-    }.cs__freeze
-    TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
-
-    def render_trigger_check context, trigger_node, _source, object, ret, invoked, *args
-      logger.debug { 'Tilt::Template Trigger - running propagation' }
-
-      scope = args[0]
-      binding_variables = scope.instance_variables
-      erb_template_prerender = object.instance_variable_get(:@data)
-      interpolated_inputs = []
-      binding_variables.each do |bound_variable_sym|
-        bound_variable_value = scope.instance_variable_get(bound_variable_sym)
-
-        next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
-        next unless erb_template_prerender.include?(bound_variable_sym.to_s)
-
-        start_index = ret.index(bound_variable_value)
-        next if start_index.nil?
-
-        logger.debug('Tilt::Template Trigger - found bound_variable in erb template result')
-        ret.cs__copy_from(bound_variable_value, start_index)
-        interpolated_inputs << bound_variable_sym
-      end
-
-      locals = args[1]
-      locals.each do |local_name, local_value|
-        next unless local_value.cs__respond_to?(:cs__tracked?) && local_value.cs__tracked?
-        next unless erb_template_prerender.include?(local_name.to_s)
-
-        start_index = ret.index(local_value)
-        next if start_index.nil?
-
-        logger.debug('Tilt:Template Trigger - found local_value in erb template result')
-        ret.cs__copy_from(local_value, start_index)
-        interpolated_inputs << local_name
-      end
-
-      unless interpolated_inputs.empty?
-        interpolated_inputs.each do |input|
-          input.cs__properties.events.each do |event|
-            ret.cs__properties.events << event
-          end
-        end
-        ret.cs__properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs, invoked + 1)
-      end
-
-      if ret.cs__tracked?
-        Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, invoked + 1, interpolated_inputs)
-      end
-
-      ret
-    end
-  end
-end