contrast-agent 4.0.0 → 4.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. checksums.yaml +4 -4
  2. data/Rakefile +1 -0
  3. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +22 -10
  4. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +4 -3
  5. data/lib/contrast/agent/assess/contrast_event.rb +49 -130
  6. data/lib/contrast/agent/assess/contrast_object.rb +51 -0
  7. data/lib/contrast/agent/assess/events/source_event.rb +4 -9
  8. data/lib/contrast/agent/assess/policy/patcher.rb +4 -3
  9. data/lib/contrast/agent/assess/policy/policy_node.rb +31 -59
  10. data/lib/contrast/agent/assess/policy/preshift.rb +3 -3
  11. data/lib/contrast/agent/assess/policy/propagation_method.rb +13 -19
  12. data/lib/contrast/agent/assess/policy/propagation_node.rb +12 -24
  13. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -2
  14. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -2
  15. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  16. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -3
  17. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -2
  18. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -2
  19. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  20. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -2
  21. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -2
  22. data/lib/contrast/agent/assess/policy/propagator/remove.rb +2 -4
  23. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -2
  24. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -2
  25. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -4
  26. data/lib/contrast/agent/assess/policy/propagator/splat.rb +2 -4
  27. data/lib/contrast/agent/assess/policy/propagator/split.rb +73 -117
  28. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +11 -11
  29. data/lib/contrast/agent/assess/policy/propagator/trim.rb +3 -7
  30. data/lib/contrast/agent/assess/policy/source_method.rb +2 -14
  31. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +5 -8
  32. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  33. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  34. data/lib/contrast/agent/assess/property/tagged.rb +21 -15
  35. data/lib/contrast/agent/assess/rule/redos.rb +1 -1
  36. data/lib/contrast/agent/assess/tracker.rb +16 -18
  37. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +7 -0
  38. data/lib/contrast/agent/middleware.rb +50 -1
  39. data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
  40. data/lib/contrast/agent/patching/policy/patch.rb +6 -0
  41. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +47 -1
  42. data/lib/contrast/agent/protect/policy/rule_applicator.rb +53 -0
  43. data/lib/contrast/agent/protect/rule/base.rb +63 -14
  44. data/lib/contrast/agent/protect/rule/cmd_injection.rb +12 -28
  45. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -4
  46. data/lib/contrast/agent/protect/rule/deserialization.rb +4 -1
  47. data/lib/contrast/agent/protect/rule/no_sqli.rb +3 -3
  48. data/lib/contrast/agent/protect/rule/sqli.rb +3 -3
  49. data/lib/contrast/agent/protect/rule/xxe.rb +32 -11
  50. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +10 -6
  51. data/lib/contrast/agent/reaction_processor.rb +1 -1
  52. data/lib/contrast/agent/response.rb +5 -5
  53. data/lib/contrast/agent/rewriter.rb +3 -3
  54. data/lib/contrast/agent/scope.rb +81 -55
  55. data/lib/contrast/agent/static_analysis.rb +13 -7
  56. data/lib/contrast/agent/version.rb +1 -1
  57. data/lib/contrast/api/decorators/library.rb +1 -0
  58. data/lib/contrast/api/decorators/library_usage_update.rb +1 -0
  59. data/lib/contrast/api/decorators/trace_event.rb +19 -31
  60. data/lib/contrast/api/decorators/trace_event_object.rb +11 -3
  61. data/lib/contrast/api/decorators/trace_event_signature.rb +27 -5
  62. data/lib/contrast/api/decorators/user_input.rb +2 -1
  63. data/lib/contrast/common_agent_configuration.rb +2 -1
  64. data/lib/contrast/components/assess.rb +36 -0
  65. data/lib/contrast/components/interface.rb +5 -3
  66. data/lib/contrast/components/scope.rb +72 -6
  67. data/lib/contrast/components/settings.rb +6 -3
  68. data/lib/contrast/config/assess_configuration.rb +2 -1
  69. data/lib/contrast/extension/assess/array.rb +2 -3
  70. data/lib/contrast/extension/assess/erb.rb +1 -3
  71. data/lib/contrast/extension/assess/exec_trigger.rb +1 -4
  72. data/lib/contrast/extension/assess/fiber.rb +2 -3
  73. data/lib/contrast/extension/assess/hash.rb +4 -2
  74. data/lib/contrast/extension/assess/kernel.rb +1 -2
  75. data/lib/contrast/extension/assess/marshal.rb +34 -26
  76. data/lib/contrast/extension/assess/regexp.rb +3 -8
  77. data/lib/contrast/extension/assess/string.rb +1 -2
  78. data/lib/contrast/framework/base_support.rb +51 -53
  79. data/lib/contrast/framework/manager.rb +3 -2
  80. data/lib/contrast/framework/rack/patch/session_cookie.rb +2 -2
  81. data/lib/contrast/framework/rack/support.rb +2 -1
  82. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  83. data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
  84. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  85. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
  86. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
  87. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
  88. data/lib/contrast/framework/rails/support.rb +2 -1
  89. data/lib/contrast/framework/sinatra/support.rb +3 -2
  90. data/lib/contrast/logger/application.rb +0 -3
  91. data/lib/contrast/utils/duck_utils.rb +1 -1
  92. data/lib/contrast/utils/heap_dump_util.rb +1 -1
  93. data/lib/contrast/utils/object_share.rb +3 -3
  94. data/lib/contrast/utils/preflight_util.rb +1 -1
  95. data/lib/contrast/utils/prevent_serialization.rb +1 -1
  96. data/lib/contrast/utils/resource_loader.rb +1 -1
  97. data/lib/contrast/utils/sha256_builder.rb +2 -2
  98. data/lib/contrast/utils/string_utils.rb +1 -1
  99. data/lib/contrast/utils/tag_util.rb +9 -13
  100. data/resources/assess/policy.json +9 -9
  101. data/resources/deadzone/policy.json +150 -0
  102. data/resources/protect/policy.json +12 -0
  103. data/ruby-agent.gemspec +10 -6
  104. data/service_executables/VERSION +1 -1
  105. data/service_executables/linux/contrast-service +0 -0
  106. data/service_executables/mac/contrast-service +0 -0
  107. metadata +69 -25
data/resources/protect/policy.json CHANGED
@@ -379,6 +379,18 @@
379
379
  "method_visibility": "public",
380
380
  "applicator_method": "apply_rule__io",
381
381
  "properties": {}
382
+ },{
383
+ "class_name": "Nokogiri::XML::Document",
384
+ "method_name": "parse",
385
+ "instance_method": false,
386
+ "method_visibility": "public",
387
+ "properties": {}
388
+ }, {
389
+ "class_name": "Nokogiri::XML::SAX::Parser",
390
+ "method_name": "parse",
391
+ "instance_method": true,
392
+ "method_visibility": "public",
393
+ "properties": {}
382
394
  },{
383
395
  "class_name": "Nokogiri::XML::SAX::Parser",
384
396
  "method_name": "parse_memory",
data/ruby-agent.gemspec CHANGED
@@ -14,12 +14,14 @@ def self.add_authors spec
14
14
  donald.propst@contrastsecurity.com
15
15
  alex.macdonald@contrastsecurity.com
16
16
  mark.petersen@contrastsecurity.com
17
+ joshua.reed@contrastsecurity.com
17
18
  ]
18
19
  end
19
20
 
20
21
  # Add those dependencies required to develop or test the Agent
21
22
  def self.add_dev_dependencies spec
22
23
  spec.add_development_dependency 'amazing_print'
24
+ spec.add_development_dependency 'benchmark-ips'
23
25
  spec.add_development_dependency 'bundler'
24
26
  spec.add_development_dependency 'climate_control' # mock ENV
25
27
  spec.add_development_dependency 'debase'
@@ -33,16 +35,18 @@ def self.add_dev_dependencies spec
33
35
  spec.add_development_dependency 'parser', '~> 2.6'
34
36
  spec.add_development_dependency 'pry'
35
37
  spec.add_development_dependency 'rails', '>= 3'
36
- spec.add_development_dependency 'rake', '~> 10.0'
38
+ spec.add_development_dependency 'rake', '>= 12.3.3'
37
39
  spec.add_development_dependency 'rake-compiler', '~> 0'
38
40
  spec.add_development_dependency 'rspec', '~> 3.0'
39
41
  spec.add_development_dependency 'rspec-benchmark'
40
42
  spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
41
- spec.add_development_dependency 'rubocop', '0.93.1'
42
- spec.add_development_dependency 'rubocop-performance', '1.8.1'
43
- spec.add_development_dependency 'rubocop-rspec', '1.43.2'
43
+ spec.add_development_dependency 'rubocop', '1.6.1'
44
+ spec.add_development_dependency 'rubocop-performance', '1.9.1'
45
+ spec.add_development_dependency 'rubocop-rails', '2.9.1'
46
+ spec.add_development_dependency 'rubocop-rake', '0.5.1'
47
+ spec.add_development_dependency 'rubocop-rspec', '2.1.0'
44
48
  spec.add_development_dependency 'ruby-debug-ide'
45
- spec.add_development_dependency 'simplecov', '~> 0.18'
49
+ spec.add_development_dependency 'simplecov', '0.20.0'
46
50
  spec.add_development_dependency 'sinatra', '>= 2'
47
51
  spec.add_development_dependency 'sqlite3', '1.3.9'
48
52
  spec.add_development_dependency 'therubyracer'
@@ -58,7 +62,7 @@ end
58
62
  # corresponding update to the fake gem server data in TeamServer.
59
63
  def self.add_dependencies spec
60
64
  spec.add_dependency 'ougai', '~> 1.8'
61
- spec.add_dependency 'parser', '~> 2.6'
65
+ spec.add_dependency 'parser', '~> 2.6' # TODO: RUBY-714 remove w/ EOL of 2.5
62
66
  spec.add_dependency 'protobuf', '~> 3.10'
63
67
  spec.add_dependency 'rack', '~> 2.0'
64
68
  end
data/service_executables/VERSION CHANGED
@@ -1 +1 @@
1
- 2.14.4
1
+ 2.17.4
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.0.0
4
+ version: 4.3.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -9,10 +9,11 @@ authors:
9
9
  - donald.propst@contrastsecurity.com
10
10
  - alex.macdonald@contrastsecurity.com
11
11
  - mark.petersen@contrastsecurity.com
12
+ - joshua.reed@contrastsecurity.com
12
13
  autorequire:
13
14
  bindir: exe
14
15
  cert_chain: []
15
- date: 2020-11-05 00:00:00.000000000 Z
16
+ date: 2021-02-13 00:00:00.000000000 Z
16
17
  dependencies:
17
18
  - !ruby/object:Gem::Dependency
18
19
  name: amazing_print
@@ -28,6 +29,20 @@ dependencies:
28
29
  - - ">="
29
30
  - !ruby/object:Gem::Version
30
31
  version: '0'
32
+ - !ruby/object:Gem::Dependency
33
+ name: benchmark-ips
34
+ requirement: !ruby/object:Gem::Requirement
35
+ requirements:
36
+ - - ">="
37
+ - !ruby/object:Gem::Version
38
+ version: '0'
39
+ type: :development
40
+ prerelease: false
41
+ version_requirements: !ruby/object:Gem::Requirement
42
+ requirements:
43
+ - - ">="
44
+ - !ruby/object:Gem::Version
45
+ version: '0'
31
46
  - !ruby/object:Gem::Dependency
32
47
  name: bundler
33
48
  requirement: !ruby/object:Gem::Requirement
@@ -214,16 +229,16 @@ dependencies:
214
229
  name: rake
215
230
  requirement: !ruby/object:Gem::Requirement
216
231
  requirements:
217
- - - "~>"
232
+ - - ">="
218
233
  - !ruby/object:Gem::Version
219
- version: '10.0'
234
+ version: 12.3.3
220
235
  type: :development
221
236
  prerelease: false
222
237
  version_requirements: !ruby/object:Gem::Requirement
223
238
  requirements:
224
- - - "~>"
239
+ - - ">="
225
240
  - !ruby/object:Gem::Version
226
- version: '10.0'
241
+ version: 12.3.3
227
242
  - !ruby/object:Gem::Dependency
228
243
  name: rake-compiler
229
244
  requirement: !ruby/object:Gem::Requirement
@@ -286,42 +301,70 @@ dependencies:
286
301
  requirements:
287
302
  - - '='
288
303
  - !ruby/object:Gem::Version
289
- version: 0.93.1
304
+ version: 1.6.1
290
305
  type: :development
291
306
  prerelease: false
292
307
  version_requirements: !ruby/object:Gem::Requirement
293
308
  requirements:
294
309
  - - '='
295
310
  - !ruby/object:Gem::Version
296
- version: 0.93.1
311
+ version: 1.6.1
297
312
  - !ruby/object:Gem::Dependency
298
313
  name: rubocop-performance
299
314
  requirement: !ruby/object:Gem::Requirement
300
315
  requirements:
301
316
  - - '='
302
317
  - !ruby/object:Gem::Version
303
- version: 1.8.1
318
+ version: 1.9.1
304
319
  type: :development
305
320
  prerelease: false
306
321
  version_requirements: !ruby/object:Gem::Requirement
307
322
  requirements:
308
323
  - - '='
309
324
  - !ruby/object:Gem::Version
310
- version: 1.8.1
325
+ version: 1.9.1
326
+ - !ruby/object:Gem::Dependency
327
+ name: rubocop-rails
328
+ requirement: !ruby/object:Gem::Requirement
329
+ requirements:
330
+ - - '='
331
+ - !ruby/object:Gem::Version
332
+ version: 2.9.1
333
+ type: :development
334
+ prerelease: false
335
+ version_requirements: !ruby/object:Gem::Requirement
336
+ requirements:
337
+ - - '='
338
+ - !ruby/object:Gem::Version
339
+ version: 2.9.1
340
+ - !ruby/object:Gem::Dependency
341
+ name: rubocop-rake
342
+ requirement: !ruby/object:Gem::Requirement
343
+ requirements:
344
+ - - '='
345
+ - !ruby/object:Gem::Version
346
+ version: 0.5.1
347
+ type: :development
348
+ prerelease: false
349
+ version_requirements: !ruby/object:Gem::Requirement
350
+ requirements:
351
+ - - '='
352
+ - !ruby/object:Gem::Version
353
+ version: 0.5.1
311
354
  - !ruby/object:Gem::Dependency
312
355
  name: rubocop-rspec
313
356
  requirement: !ruby/object:Gem::Requirement
314
357
  requirements:
315
358
  - - '='
316
359
  - !ruby/object:Gem::Version
317
- version: 1.43.2
360
+ version: 2.1.0
318
361
  type: :development
319
362
  prerelease: false
320
363
  version_requirements: !ruby/object:Gem::Requirement
321
364
  requirements:
322
365
  - - '='
323
366
  - !ruby/object:Gem::Version
324
- version: 1.43.2
367
+ version: 2.1.0
325
368
  - !ruby/object:Gem::Dependency
326
369
  name: ruby-debug-ide
327
370
  requirement: !ruby/object:Gem::Requirement
@@ -340,16 +383,16 @@ dependencies:
340
383
  name: simplecov
341
384
  requirement: !ruby/object:Gem::Requirement
342
385
  requirements:
343
- - - "~>"
386
+ - - '='
344
387
  - !ruby/object:Gem::Version
345
- version: '0.18'
388
+ version: 0.20.0
346
389
  type: :development
347
390
  prerelease: false
348
391
  version_requirements: !ruby/object:Gem::Requirement
349
392
  requirements:
350
- - - "~>"
393
+ - - '='
351
394
  - !ruby/object:Gem::Version
352
- version: '0.18'
395
+ version: 0.20.0
353
396
  - !ruby/object:Gem::Dependency
354
397
  name: sinatra
355
398
  requirement: !ruby/object:Gem::Requirement
@@ -498,20 +541,20 @@ executables:
498
541
  - contrast_service
499
542
  extensions:
500
543
  - ext/cs__common/extconf.rb
501
- - ext/cs__assess_module/extconf.rb
502
- - ext/cs__protect_kernel/extconf.rb
503
- - ext/cs__assess_array/extconf.rb
504
- - ext/cs__assess_hash/extconf.rb
505
- - ext/cs__assess_marshal_module/extconf.rb
544
+ - ext/cs__assess_active_record_named/extconf.rb
545
+ - ext/cs__assess_string/extconf.rb
506
546
  - ext/cs__assess_kernel/extconf.rb
547
+ - ext/cs__assess_basic_object/extconf.rb
507
548
  - ext/cs__assess_regexp/extconf.rb
508
549
  - ext/cs__assess_yield_track/extconf.rb
509
- - ext/cs__assess_string/extconf.rb
510
- - ext/cs__contrast_patch/extconf.rb
511
- - ext/cs__assess_active_record_named/extconf.rb
512
550
  - ext/cs__assess_fiber_track/extconf.rb
513
- - ext/cs__assess_basic_object/extconf.rb
551
+ - ext/cs__assess_hash/extconf.rb
552
+ - ext/cs__assess_array/extconf.rb
514
553
  - ext/cs__assess_string_interpolation26/extconf.rb
554
+ - ext/cs__assess_module/extconf.rb
555
+ - ext/cs__assess_marshal_module/extconf.rb
556
+ - ext/cs__contrast_patch/extconf.rb
557
+ - ext/cs__protect_kernel/extconf.rb
515
558
  extra_rdoc_files: []
516
559
  files:
517
560
  - ".clang-format"
@@ -708,6 +751,7 @@ files:
708
751
  - lib/contrast/agent.rb
709
752
  - lib/contrast/agent/assess.rb
710
753
  - lib/contrast/agent/assess/contrast_event.rb
754
+ - lib/contrast/agent/assess/contrast_object.rb
711
755
  - lib/contrast/agent/assess/events/event_factory.rb
712
756
  - lib/contrast/agent/assess/events/source_event.rb
713
757
  - lib/contrast/agent/assess/finalizers/freeze.rb