contrast-agent 4.1.0 → 4.4.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (139) hide show
  1. checksums.yaml +4 -4
  2. data/Rakefile +1 -0
  3. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +22 -10
  4. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +4 -3
  5. data/lib/contrast/agent.rb +5 -1
  6. data/lib/contrast/agent/assess.rb +0 -9
  7. data/lib/contrast/agent/assess/contrast_event.rb +49 -132
  8. data/lib/contrast/agent/assess/contrast_object.rb +54 -0
  9. data/lib/contrast/agent/assess/events/source_event.rb +4 -9
  10. data/lib/contrast/agent/assess/finalizers/hash.rb +7 -0
  11. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +17 -3
  12. data/lib/contrast/agent/assess/policy/patcher.rb +4 -3
  13. data/lib/contrast/agent/assess/policy/policy_node.rb +31 -59
  14. data/lib/contrast/agent/assess/policy/preshift.rb +3 -3
  15. data/lib/contrast/agent/assess/policy/propagation_method.rb +41 -32
  16. data/lib/contrast/agent/assess/policy/propagation_node.rb +12 -24
  17. data/lib/contrast/agent/assess/policy/propagator/append.rb +29 -15
  18. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -2
  19. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  20. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +21 -18
  21. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -2
  22. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -2
  23. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  24. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -2
  25. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -2
  26. data/lib/contrast/agent/assess/policy/propagator/remove.rb +2 -4
  27. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -2
  28. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -2
  29. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -4
  30. data/lib/contrast/agent/assess/policy/propagator/splat.rb +25 -17
  31. data/lib/contrast/agent/assess/policy/propagator/split.rb +83 -120
  32. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +41 -25
  33. data/lib/contrast/agent/assess/policy/propagator/trim.rb +3 -7
  34. data/lib/contrast/agent/assess/policy/source_method.rb +2 -14
  35. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +5 -8
  36. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  37. data/lib/contrast/agent/assess/policy/trigger_method.rb +13 -8
  38. data/lib/contrast/agent/assess/policy/trigger_node.rb +28 -7
  39. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +59 -0
  40. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -3
  41. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +6 -4
  42. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +2 -4
  43. data/lib/contrast/agent/assess/properties.rb +0 -2
  44. data/lib/contrast/agent/assess/property/tagged.rb +56 -32
  45. data/lib/contrast/agent/assess/tracker.rb +16 -18
  46. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +7 -0
  47. data/lib/contrast/agent/middleware.rb +134 -55
  48. data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
  49. data/lib/contrast/agent/patching/policy/patch.rb +6 -0
  50. data/lib/contrast/agent/patching/policy/patch_status.rb +1 -1
  51. data/lib/contrast/agent/patching/policy/patcher.rb +51 -44
  52. data/lib/contrast/agent/patching/policy/trigger_node.rb +5 -2
  53. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +47 -1
  54. data/lib/contrast/agent/protect/policy/rule_applicator.rb +53 -0
  55. data/lib/contrast/agent/protect/rule/base.rb +63 -14
  56. data/lib/contrast/agent/protect/rule/cmd_injection.rb +12 -28
  57. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -4
  58. data/lib/contrast/agent/protect/rule/deserialization.rb +4 -1
  59. data/lib/contrast/agent/protect/rule/no_sqli.rb +3 -3
  60. data/lib/contrast/agent/protect/rule/sqli.rb +20 -14
  61. data/lib/contrast/agent/protect/rule/xxe.rb +32 -11
  62. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +10 -6
  63. data/lib/contrast/agent/reaction_processor.rb +1 -1
  64. data/lib/contrast/agent/request_context.rb +12 -0
  65. data/lib/contrast/agent/response.rb +5 -5
  66. data/lib/contrast/agent/rewriter.rb +3 -3
  67. data/lib/contrast/agent/scope.rb +81 -55
  68. data/lib/contrast/agent/static_analysis.rb +13 -7
  69. data/lib/contrast/agent/thread.rb +1 -1
  70. data/lib/contrast/agent/thread_watcher.rb +20 -5
  71. data/lib/contrast/agent/version.rb +1 -1
  72. data/lib/contrast/api/communication/messaging_queue.rb +18 -21
  73. data/lib/contrast/api/communication/response_processor.rb +8 -1
  74. data/lib/contrast/api/communication/socket_client.rb +22 -14
  75. data/lib/contrast/api/decorators.rb +2 -0
  76. data/lib/contrast/api/decorators/agent_startup.rb +58 -0
  77. data/lib/contrast/api/decorators/application_startup.rb +51 -0
  78. data/lib/contrast/api/decorators/library.rb +1 -0
  79. data/lib/contrast/api/decorators/library_usage_update.rb +1 -0
  80. data/lib/contrast/api/decorators/route_coverage.rb +15 -5
  81. data/lib/contrast/api/decorators/trace_event.rb +58 -42
  82. data/lib/contrast/api/decorators/trace_event_object.rb +11 -3
  83. data/lib/contrast/api/decorators/trace_event_signature.rb +27 -5
  84. data/lib/contrast/api/decorators/user_input.rb +2 -1
  85. data/lib/contrast/common_agent_configuration.rb +2 -1
  86. data/lib/contrast/components/agent.rb +2 -0
  87. data/lib/contrast/components/app_context.rb +4 -22
  88. data/lib/contrast/components/assess.rb +36 -0
  89. data/lib/contrast/components/interface.rb +5 -3
  90. data/lib/contrast/components/sampling.rb +48 -6
  91. data/lib/contrast/components/scope.rb +72 -6
  92. data/lib/contrast/components/settings.rb +11 -7
  93. data/lib/contrast/config/assess_configuration.rb +2 -1
  94. data/lib/contrast/extension/assess/array.rb +2 -3
  95. data/lib/contrast/extension/assess/erb.rb +1 -3
  96. data/lib/contrast/extension/assess/exec_trigger.rb +1 -4
  97. data/lib/contrast/extension/assess/fiber.rb +2 -3
  98. data/lib/contrast/extension/assess/hash.rb +4 -2
  99. data/lib/contrast/extension/assess/kernel.rb +1 -2
  100. data/lib/contrast/extension/assess/marshal.rb +34 -26
  101. data/lib/contrast/extension/assess/regexp.rb +3 -8
  102. data/lib/contrast/extension/assess/string.rb +1 -2
  103. data/lib/contrast/framework/base_support.rb +51 -53
  104. data/lib/contrast/framework/manager.rb +16 -14
  105. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  106. data/lib/contrast/framework/rack/support.rb +2 -1
  107. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  108. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  109. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
  110. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
  111. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
  112. data/lib/contrast/framework/rails/support.rb +44 -44
  113. data/lib/contrast/framework/sinatra/support.rb +102 -42
  114. data/lib/contrast/logger/application.rb +0 -3
  115. data/lib/contrast/logger/log.rb +31 -15
  116. data/lib/contrast/utils/class_util.rb +3 -1
  117. data/lib/contrast/utils/duck_utils.rb +1 -1
  118. data/lib/contrast/utils/heap_dump_util.rb +103 -87
  119. data/lib/contrast/utils/invalid_configuration_util.rb +21 -12
  120. data/lib/contrast/utils/object_share.rb +3 -3
  121. data/lib/contrast/utils/preflight_util.rb +1 -1
  122. data/lib/contrast/utils/resource_loader.rb +1 -1
  123. data/lib/contrast/utils/sha256_builder.rb +2 -2
  124. data/lib/contrast/utils/string_utils.rb +1 -1
  125. data/lib/contrast/utils/tag_util.rb +9 -13
  126. data/resources/assess/policy.json +12 -18
  127. data/resources/deadzone/policy.json +156 -0
  128. data/resources/protect/policy.json +12 -0
  129. data/ruby-agent.gemspec +61 -19
  130. data/service_executables/VERSION +1 -1
  131. data/service_executables/linux/contrast-service +0 -0
  132. data/service_executables/mac/contrast-service +0 -0
  133. metadata +126 -113
  134. data/lib/contrast/agent/assess/rule.rb +0 -18
  135. data/lib/contrast/agent/assess/rule/base.rb +0 -52
  136. data/lib/contrast/agent/assess/rule/redos.rb +0 -67
  137. data/lib/contrast/framework/sinatra/patch/base.rb +0 -83
  138. data/lib/contrast/framework/sinatra/patch/support.rb +0 -27
  139. data/lib/contrast/utils/prevent_serialization.rb +0 -52
@@ -55,6 +55,162 @@
55
55
  "instance_method":true,
56
56
  "method_visibility": "public",
57
57
  "method_name":"commit_session"
58
+ }, {
59
+ "class_name":"Rack::Session::Abstract::Persisted",
60
+ "instance_method":true,
61
+ "method_visibility": "private",
62
+ "method_name":"session_exists?",
63
+ "code": "https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L334"
64
+ }, {
65
+ "class_name":"ActionDispatch::Http::MimeNegotiation",
66
+ "instance_method":true,
67
+ "method_visibility": "public",
68
+ "method_name":"formats",
69
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
70
+ }, {
71
+ "class_name":"ActionDispatch::FileHandler",
72
+ "instance_method":true,
73
+ "method_visibility": "public",
74
+ "method_name":"match?",
75
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/static.rb#L30"
76
+ }, {
77
+ "class_name":"ActionDispatch::Journey::Router",
78
+ "instance_method":true,
79
+ "method_visibility": "private",
80
+ "method_name":"find_routes",
81
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/journey/router.rb#L107"
82
+ }, {
83
+ "class_name":"ActionDispatch::Request",
84
+ "instance_method":true,
85
+ "method_visibility": "public",
86
+ "method_name":"controler_class_for",
87
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L84"
88
+ }, {
89
+ "class_name":"ActionDispatch::Request",
90
+ "instance_method":true,
91
+ "method_visibility": "public",
92
+ "method_name":"engine_script_name=",
93
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L158"
94
+ }, {
95
+ "class_name":"ActionDispatch::Request",
96
+ "instance_method":true,
97
+ "method_visibility": "public",
98
+ "method_name":"remote_ip",
99
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L286"
100
+ }, {
101
+ "class_name":"ActionDispatch::Request",
102
+ "instance_method":true,
103
+ "method_visibility": "public",
104
+ "method_name":"request_id",
105
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L302"
106
+ }, {
107
+ "class_name":"ActionDispatch::Request",
108
+ "instance_method":true,
109
+ "method_visibility": "public",
110
+ "method_name":"local?",
111
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L409"
112
+ }, {
113
+ "class_name":"ActionDispatch::Request",
114
+ "instance_method":true,
115
+ "method_visibility": "public",
116
+ "method_name":"cookie_jar",
117
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L11"
118
+ }, {
119
+ "class_name":"ActionDispatch::Request",
120
+ "instance_method":true,
121
+ "method_visibility": "public",
122
+ "method_name":"have_cookie_jar?",
123
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L24"
124
+ }, {
125
+ "class_name":"ActionDispatch::Request",
126
+ "instance_method":true,
127
+ "method_visibility": "public",
128
+ "method_name":"key_generator",
129
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L32"
130
+ }, {
131
+ "class_name":"ActionDispatch::Request",
132
+ "instance_method":true,
133
+ "method_visibility": "public",
134
+ "method_name":"signed_cookie_salt",
135
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L36"
136
+ }, {
137
+ "class_name":"ActionDispatch::Request",
138
+ "instance_method":true,
139
+ "method_visibility": "public",
140
+ "method_name":"encrypted_cookie_salt",
141
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L40"
142
+ }, {
143
+ "class_name":"ActionDispatch::Request",
144
+ "instance_method":true,
145
+ "method_visibility": "public",
146
+ "method_name":"encrypted_signed_cookie_salt",
147
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L44"
148
+ }, {
149
+ "class_name":"ActionDispatch::Request",
150
+ "instance_method":true,
151
+ "method_visibility": "public",
152
+ "method_name":"authenticated_encrypted_cookie_salt",
153
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L48"
154
+ }, {
155
+ "class_name":"ActionDispatch::Request",
156
+ "instance_method":true,
157
+ "method_visibility": "public",
158
+ "method_name":"use_authenticated_cookie_encryption",
159
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L52"
160
+ }, {
161
+ "class_name":"ActionDispatch::Request",
162
+ "instance_method":true,
163
+ "method_visibility": "public",
164
+ "method_name":"encrypted_cookie_cipher",
165
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L56"
166
+ }, {
167
+ "class_name":"ActionDispatch::Request",
168
+ "instance_method":true,
169
+ "method_visibility": "public",
170
+ "method_name":"signed_cookie_digest",
171
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L60"
172
+ }, {
173
+ "class_name":"ActionDispatch::Request",
174
+ "instance_method":true,
175
+ "method_visibility": "public",
176
+ "method_name":"secret_key_base",
177
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L64"
178
+ }, {
179
+ "class_name":"ActionDispatch::Request",
180
+ "instance_method":true,
181
+ "method_visibility": "public",
182
+ "method_name":"cookies_serializer",
183
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L68"
184
+ }, {
185
+ "class_name":"ActionDispatch::Request",
186
+ "instance_method":true,
187
+ "method_visibility": "public",
188
+ "method_name":"cookies_digest",
189
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L72"
190
+ }, {
191
+ "class_name":"ActionDispatch::Request",
192
+ "instance_method":true,
193
+ "method_visibility": "public",
194
+ "method_name":"cookies_rotations",
195
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L76"
196
+ }, {
197
+ "class_name":"ActionDispatch::Request",
198
+ "instance_method":true,
199
+ "method_visibility": "public",
200
+ "method_name":"use_cookies_with_metadata",
201
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L80"
202
+ }, {
203
+ "class_name":"ActionDispatch::Request::Session",
204
+ "instance_method":true,
205
+ "method_visibility": "public",
206
+ "method_name":"exists?",
207
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
208
+ }, {
209
+ "class_name":"ActionView::Template",
210
+ "instance_method":true,
211
+ "method_visibility": "private",
212
+ "method_name":"method_name",
213
+ "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionview/lib/action_view/template.rb#L368"
58
214
  }
59
215
  ]
60
216
  }
@@ -379,6 +379,18 @@
379
379
  "method_visibility": "public",
380
380
  "applicator_method": "apply_rule__io",
381
381
  "properties": {}
382
+ },{
383
+ "class_name": "Nokogiri::XML::Document",
384
+ "method_name": "parse",
385
+ "instance_method": false,
386
+ "method_visibility": "public",
387
+ "properties": {}
388
+ }, {
389
+ "class_name": "Nokogiri::XML::SAX::Parser",
390
+ "method_name": "parse",
391
+ "instance_method": true,
392
+ "method_visibility": "public",
393
+ "properties": {}
382
394
  },{
383
395
  "class_name": "Nokogiri::XML::SAX::Parser",
384
396
  "method_name": "parse_memory",
data/ruby-agent.gemspec CHANGED
@@ -14,41 +14,83 @@ def self.add_authors spec
14
14
  donald.propst@contrastsecurity.com
15
15
  alex.macdonald@contrastsecurity.com
16
16
  mark.petersen@contrastsecurity.com
17
+ joshua.reed@contrastsecurity.com
17
18
  ]
18
19
  end
19
20
 
20
21
  # Add those dependencies required to develop or test the Agent
21
22
  def self.add_dev_dependencies spec
22
- spec.add_development_dependency 'amazing_print'
23
+ add_builders(spec)
24
+ add_debuggers(spec)
25
+ add_linters(spec)
26
+ add_specs(spec)
27
+ end
28
+
29
+ # Dependencies used to build the agent during development.
30
+ def self.add_builders spec
23
31
  spec.add_development_dependency 'bundler'
24
- spec.add_development_dependency 'climate_control' # mock ENV
25
- spec.add_development_dependency 'debase'
32
+ spec.add_development_dependency 'rake', '>= 12.3.3'
33
+ spec.add_development_dependency 'rake-compiler', '~> 0'
34
+ end
35
+
36
+ # Dependencies used for local debugging during development.
37
+ def self.add_debuggers spec
38
+ spec.add_development_dependency 'pry'
39
+ spec.add_development_dependency 'ruby-debug-ide'
40
+ end
41
+
42
+ # Dependencies used for framework testing.
43
+ def self.add_frameworks spec
44
+ spec.add_development_dependency 'rails', '>= 3'
45
+ spec.add_development_dependency 'sinatra', '>= 2'
46
+ end
47
+
48
+ # Dependencies used for linting prior to commit.
49
+ def self.add_linters spec
26
50
  spec.add_development_dependency 'debride'
27
- spec.add_development_dependency 'execjs'
28
- spec.add_development_dependency 'factory_bot'
29
- spec.add_development_dependency 'fake_ftp'
30
51
  spec.add_development_dependency 'fasterer'
31
52
  spec.add_development_dependency 'flay'
53
+ add_rubocop(spec)
54
+ end
55
+
56
+ # Dependencies used to run our current RSpec test suite.
57
+ def self.add_specs spec
58
+ add_coverage(spec)
59
+ add_frameworks(spec)
60
+ add_tested_gems(spec)
61
+
62
+ spec.add_development_dependency 'benchmark-ips'
63
+ spec.add_development_dependency 'climate_control' # mock ENV
64
+ spec.add_development_dependency 'factory_bot'
65
+ spec.add_development_dependency 'fake_ftp'
32
66
  spec.add_development_dependency 'openssl'
33
- spec.add_development_dependency 'parser', '~> 2.6'
34
- spec.add_development_dependency 'pry'
35
- spec.add_development_dependency 'rails', '>= 3'
36
- spec.add_development_dependency 'rake', '~> 10.0'
37
- spec.add_development_dependency 'rake-compiler', '~> 0'
38
67
  spec.add_development_dependency 'rspec', '~> 3.0'
39
68
  spec.add_development_dependency 'rspec-benchmark'
40
69
  spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
41
- spec.add_development_dependency 'rubocop', '0.93.1'
42
- spec.add_development_dependency 'rubocop-performance', '1.8.1'
43
- spec.add_development_dependency 'rubocop-rspec', '1.43.2'
44
- spec.add_development_dependency 'ruby-debug-ide'
45
- spec.add_development_dependency 'simplecov', '~> 0.18'
46
- spec.add_development_dependency 'sinatra', '>= 2'
70
+ end
71
+
72
+ def self.add_coverage spec
73
+ spec.add_development_dependency 'codecov'
74
+ spec.add_development_dependency 'simplecov', '0.20.0'
75
+ end
76
+
77
+ # Dependencies used to run all of our Rubocop during the linting phase.
78
+ def self.add_rubocop spec
79
+ spec.add_development_dependency 'rubocop', '1.6.1'
80
+ spec.add_development_dependency 'rubocop-performance', '1.9.1'
81
+ spec.add_development_dependency 'rubocop-rails', '2.9.1'
82
+ spec.add_development_dependency 'rubocop-rake', '0.5.1'
83
+ spec.add_development_dependency 'rubocop-rspec', '2.1.0'
84
+ end
85
+
86
+ # Dependencies not mocked out during RSpec that we test real code of, beyond just frameworks.
87
+ def self.add_tested_gems spec
88
+ spec.add_development_dependency 'debase'
89
+ spec.add_development_dependency 'execjs'
47
90
  spec.add_development_dependency 'sqlite3', '1.3.9'
48
91
  spec.add_development_dependency 'therubyracer'
49
92
  spec.add_development_dependency 'tilt'
50
93
  spec.add_development_dependency 'xpath'
51
- spec.add_development_dependency 'yarjuf', '~> 2.0'
52
94
  end
53
95
 
54
96
  # Add those dependencies required to run the Agent in customer applications.
@@ -58,7 +100,7 @@ end
58
100
  # corresponding update to the fake gem server data in TeamServer.
59
101
  def self.add_dependencies spec
60
102
  spec.add_dependency 'ougai', '~> 1.8'
61
- spec.add_dependency 'parser', '~> 2.6'
103
+ spec.add_dependency 'parser', '~> 2.6' # TODO: RUBY-714 remove w/ EOL of 2.5
62
104
  spec.add_dependency 'protobuf', '~> 3.10'
63
105
  spec.add_dependency 'rack', '~> 2.0'
64
106
  end
@@ -1 +1 @@
1
- 2.15.1
1
+ 2.17.4
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.1.0
4
+ version: 4.4.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -9,13 +9,14 @@ authors:
9
9
  - donald.propst@contrastsecurity.com
10
10
  - alex.macdonald@contrastsecurity.com
11
11
  - mark.petersen@contrastsecurity.com
12
+ - joshua.reed@contrastsecurity.com
12
13
  autorequire:
13
14
  bindir: exe
14
15
  cert_chain: []
15
- date: 2020-11-20 00:00:00.000000000 Z
16
+ date: 2021-02-25 00:00:00.000000000 Z
16
17
  dependencies:
17
18
  - !ruby/object:Gem::Dependency
18
- name: amazing_print
19
+ name: bundler
19
20
  requirement: !ruby/object:Gem::Requirement
20
21
  requirements:
21
22
  - - ">="
@@ -29,35 +30,35 @@ dependencies:
29
30
  - !ruby/object:Gem::Version
30
31
  version: '0'
31
32
  - !ruby/object:Gem::Dependency
32
- name: bundler
33
+ name: rake
33
34
  requirement: !ruby/object:Gem::Requirement
34
35
  requirements:
35
36
  - - ">="
36
37
  - !ruby/object:Gem::Version
37
- version: '0'
38
+ version: 12.3.3
38
39
  type: :development
39
40
  prerelease: false
40
41
  version_requirements: !ruby/object:Gem::Requirement
41
42
  requirements:
42
43
  - - ">="
43
44
  - !ruby/object:Gem::Version
44
- version: '0'
45
+ version: 12.3.3
45
46
  - !ruby/object:Gem::Dependency
46
- name: climate_control
47
+ name: rake-compiler
47
48
  requirement: !ruby/object:Gem::Requirement
48
49
  requirements:
49
- - - ">="
50
+ - - "~>"
50
51
  - !ruby/object:Gem::Version
51
52
  version: '0'
52
53
  type: :development
53
54
  prerelease: false
54
55
  version_requirements: !ruby/object:Gem::Requirement
55
56
  requirements:
56
- - - ">="
57
+ - - "~>"
57
58
  - !ruby/object:Gem::Version
58
59
  version: '0'
59
60
  - !ruby/object:Gem::Dependency
60
- name: debase
61
+ name: pry
61
62
  requirement: !ruby/object:Gem::Requirement
62
63
  requirements:
63
64
  - - ">="
@@ -71,7 +72,7 @@ dependencies:
71
72
  - !ruby/object:Gem::Version
72
73
  version: '0'
73
74
  - !ruby/object:Gem::Dependency
74
- name: debride
75
+ name: ruby-debug-ide
75
76
  requirement: !ruby/object:Gem::Requirement
76
77
  requirements:
77
78
  - - ">="
@@ -85,7 +86,7 @@ dependencies:
85
86
  - !ruby/object:Gem::Version
86
87
  version: '0'
87
88
  - !ruby/object:Gem::Dependency
88
- name: execjs
89
+ name: debride
89
90
  requirement: !ruby/object:Gem::Requirement
90
91
  requirements:
91
92
  - - ">="
@@ -99,7 +100,7 @@ dependencies:
99
100
  - !ruby/object:Gem::Version
100
101
  version: '0'
101
102
  - !ruby/object:Gem::Dependency
102
- name: factory_bot
103
+ name: fasterer
103
104
  requirement: !ruby/object:Gem::Requirement
104
105
  requirements:
105
106
  - - ">="
@@ -113,7 +114,7 @@ dependencies:
113
114
  - !ruby/object:Gem::Version
114
115
  version: '0'
115
116
  - !ruby/object:Gem::Dependency
116
- name: fake_ftp
117
+ name: flay
117
118
  requirement: !ruby/object:Gem::Requirement
118
119
  requirements:
119
120
  - - ">="
@@ -127,133 +128,133 @@ dependencies:
127
128
  - !ruby/object:Gem::Version
128
129
  version: '0'
129
130
  - !ruby/object:Gem::Dependency
130
- name: fasterer
131
+ name: rubocop
131
132
  requirement: !ruby/object:Gem::Requirement
132
133
  requirements:
133
- - - ">="
134
+ - - '='
134
135
  - !ruby/object:Gem::Version
135
- version: '0'
136
+ version: 1.6.1
136
137
  type: :development
137
138
  prerelease: false
138
139
  version_requirements: !ruby/object:Gem::Requirement
139
140
  requirements:
140
- - - ">="
141
+ - - '='
141
142
  - !ruby/object:Gem::Version
142
- version: '0'
143
+ version: 1.6.1
143
144
  - !ruby/object:Gem::Dependency
144
- name: flay
145
+ name: rubocop-performance
145
146
  requirement: !ruby/object:Gem::Requirement
146
147
  requirements:
147
- - - ">="
148
+ - - '='
148
149
  - !ruby/object:Gem::Version
149
- version: '0'
150
+ version: 1.9.1
150
151
  type: :development
151
152
  prerelease: false
152
153
  version_requirements: !ruby/object:Gem::Requirement
153
154
  requirements:
154
- - - ">="
155
+ - - '='
155
156
  - !ruby/object:Gem::Version
156
- version: '0'
157
+ version: 1.9.1
157
158
  - !ruby/object:Gem::Dependency
158
- name: openssl
159
+ name: rubocop-rails
159
160
  requirement: !ruby/object:Gem::Requirement
160
161
  requirements:
161
- - - ">="
162
+ - - '='
162
163
  - !ruby/object:Gem::Version
163
- version: '0'
164
+ version: 2.9.1
164
165
  type: :development
165
166
  prerelease: false
166
167
  version_requirements: !ruby/object:Gem::Requirement
167
168
  requirements:
168
- - - ">="
169
+ - - '='
169
170
  - !ruby/object:Gem::Version
170
- version: '0'
171
+ version: 2.9.1
171
172
  - !ruby/object:Gem::Dependency
172
- name: parser
173
+ name: rubocop-rake
173
174
  requirement: !ruby/object:Gem::Requirement
174
175
  requirements:
175
- - - "~>"
176
+ - - '='
176
177
  - !ruby/object:Gem::Version
177
- version: '2.6'
178
+ version: 0.5.1
178
179
  type: :development
179
180
  prerelease: false
180
181
  version_requirements: !ruby/object:Gem::Requirement
181
182
  requirements:
182
- - - "~>"
183
+ - - '='
183
184
  - !ruby/object:Gem::Version
184
- version: '2.6'
185
+ version: 0.5.1
185
186
  - !ruby/object:Gem::Dependency
186
- name: pry
187
+ name: rubocop-rspec
187
188
  requirement: !ruby/object:Gem::Requirement
188
189
  requirements:
189
- - - ">="
190
+ - - '='
190
191
  - !ruby/object:Gem::Version
191
- version: '0'
192
+ version: 2.1.0
192
193
  type: :development
193
194
  prerelease: false
194
195
  version_requirements: !ruby/object:Gem::Requirement
195
196
  requirements:
196
- - - ">="
197
+ - - '='
197
198
  - !ruby/object:Gem::Version
198
- version: '0'
199
+ version: 2.1.0
199
200
  - !ruby/object:Gem::Dependency
200
- name: rails
201
+ name: codecov
201
202
  requirement: !ruby/object:Gem::Requirement
202
203
  requirements:
203
204
  - - ">="
204
205
  - !ruby/object:Gem::Version
205
- version: '3'
206
+ version: '0'
206
207
  type: :development
207
208
  prerelease: false
208
209
  version_requirements: !ruby/object:Gem::Requirement
209
210
  requirements:
210
211
  - - ">="
211
212
  - !ruby/object:Gem::Version
212
- version: '3'
213
+ version: '0'
213
214
  - !ruby/object:Gem::Dependency
214
- name: rake
215
+ name: simplecov
215
216
  requirement: !ruby/object:Gem::Requirement
216
217
  requirements:
217
- - - "~>"
218
+ - - '='
218
219
  - !ruby/object:Gem::Version
219
- version: '10.0'
220
+ version: 0.20.0
220
221
  type: :development
221
222
  prerelease: false
222
223
  version_requirements: !ruby/object:Gem::Requirement
223
224
  requirements:
224
- - - "~>"
225
+ - - '='
225
226
  - !ruby/object:Gem::Version
226
- version: '10.0'
227
+ version: 0.20.0
227
228
  - !ruby/object:Gem::Dependency
228
- name: rake-compiler
229
+ name: rails
229
230
  requirement: !ruby/object:Gem::Requirement
230
231
  requirements:
231
- - - "~>"
232
+ - - ">="
232
233
  - !ruby/object:Gem::Version
233
- version: '0'
234
+ version: '3'
234
235
  type: :development
235
236
  prerelease: false
236
237
  version_requirements: !ruby/object:Gem::Requirement
237
238
  requirements:
238
- - - "~>"
239
+ - - ">="
239
240
  - !ruby/object:Gem::Version
240
- version: '0'
241
+ version: '3'
241
242
  - !ruby/object:Gem::Dependency
242
- name: rspec
243
+ name: sinatra
243
244
  requirement: !ruby/object:Gem::Requirement
244
245
  requirements:
245
- - - "~>"
246
+ - - ">="
246
247
  - !ruby/object:Gem::Version
247
- version: '3.0'
248
+ version: '2'
248
249
  type: :development
249
250
  prerelease: false
250
251
  version_requirements: !ruby/object:Gem::Requirement
251
252
  requirements:
252
- - - "~>"
253
+ - - ">="
253
254
  - !ruby/object:Gem::Version
254
- version: '3.0'
255
+ version: '2'
255
256
  - !ruby/object:Gem::Dependency
256
- name: rspec-benchmark
257
+ name: debase
257
258
  requirement: !ruby/object:Gem::Requirement
258
259
  requirements:
259
260
  - - ">="
@@ -267,63 +268,63 @@ dependencies:
267
268
  - !ruby/object:Gem::Version
268
269
  version: '0'
269
270
  - !ruby/object:Gem::Dependency
270
- name: rspec_junit_formatter
271
+ name: execjs
271
272
  requirement: !ruby/object:Gem::Requirement
272
273
  requirements:
273
- - - '='
274
+ - - ">="
274
275
  - !ruby/object:Gem::Version
275
- version: 0.3.0
276
+ version: '0'
276
277
  type: :development
277
278
  prerelease: false
278
279
  version_requirements: !ruby/object:Gem::Requirement
279
280
  requirements:
280
- - - '='
281
+ - - ">="
281
282
  - !ruby/object:Gem::Version
282
- version: 0.3.0
283
+ version: '0'
283
284
  - !ruby/object:Gem::Dependency
284
- name: rubocop
285
+ name: sqlite3
285
286
  requirement: !ruby/object:Gem::Requirement
286
287
  requirements:
287
288
  - - '='
288
289
  - !ruby/object:Gem::Version
289
- version: 0.93.1
290
+ version: 1.3.9
290
291
  type: :development
291
292
  prerelease: false
292
293
  version_requirements: !ruby/object:Gem::Requirement
293
294
  requirements:
294
295
  - - '='
295
296
  - !ruby/object:Gem::Version
296
- version: 0.93.1
297
+ version: 1.3.9
297
298
  - !ruby/object:Gem::Dependency
298
- name: rubocop-performance
299
+ name: therubyracer
299
300
  requirement: !ruby/object:Gem::Requirement
300
301
  requirements:
301
- - - '='
302
+ - - ">="
302
303
  - !ruby/object:Gem::Version
303
- version: 1.8.1
304
+ version: '0'
304
305
  type: :development
305
306
  prerelease: false
306
307
  version_requirements: !ruby/object:Gem::Requirement
307
308
  requirements:
308
- - - '='
309
+ - - ">="
309
310
  - !ruby/object:Gem::Version
310
- version: 1.8.1
311
+ version: '0'
311
312
  - !ruby/object:Gem::Dependency
312
- name: rubocop-rspec
313
+ name: tilt
313
314
  requirement: !ruby/object:Gem::Requirement
314
315
  requirements:
315
- - - '='
316
+ - - ">="
316
317
  - !ruby/object:Gem::Version
317
- version: 1.43.2
318
+ version: '0'
318
319
  type: :development
319
320
  prerelease: false
320
321
  version_requirements: !ruby/object:Gem::Requirement
321
322
  requirements:
322
- - - '='
323
+ - - ">="
323
324
  - !ruby/object:Gem::Version
324
- version: 1.43.2
325
+ version: '0'
325
326
  - !ruby/object:Gem::Dependency
326
- name: ruby-debug-ide
327
+ name: xpath
327
328
  requirement: !ruby/object:Gem::Requirement
328
329
  requirements:
329
330
  - - ">="
@@ -337,49 +338,49 @@ dependencies:
337
338
  - !ruby/object:Gem::Version
338
339
  version: '0'
339
340
  - !ruby/object:Gem::Dependency
340
- name: simplecov
341
+ name: benchmark-ips
341
342
  requirement: !ruby/object:Gem::Requirement
342
343
  requirements:
343
- - - "~>"
344
+ - - ">="
344
345
  - !ruby/object:Gem::Version
345
- version: '0.18'
346
+ version: '0'
346
347
  type: :development
347
348
  prerelease: false
348
349
  version_requirements: !ruby/object:Gem::Requirement
349
350
  requirements:
350
- - - "~>"
351
+ - - ">="
351
352
  - !ruby/object:Gem::Version
352
- version: '0.18'
353
+ version: '0'
353
354
  - !ruby/object:Gem::Dependency
354
- name: sinatra
355
+ name: climate_control
355
356
  requirement: !ruby/object:Gem::Requirement
356
357
  requirements:
357
358
  - - ">="
358
359
  - !ruby/object:Gem::Version
359
- version: '2'
360
+ version: '0'
360
361
  type: :development
361
362
  prerelease: false
362
363
  version_requirements: !ruby/object:Gem::Requirement
363
364
  requirements:
364
365
  - - ">="
365
366
  - !ruby/object:Gem::Version
366
- version: '2'
367
+ version: '0'
367
368
  - !ruby/object:Gem::Dependency
368
- name: sqlite3
369
+ name: factory_bot
369
370
  requirement: !ruby/object:Gem::Requirement
370
371
  requirements:
371
- - - '='
372
+ - - ">="
372
373
  - !ruby/object:Gem::Version
373
- version: 1.3.9
374
+ version: '0'
374
375
  type: :development
375
376
  prerelease: false
376
377
  version_requirements: !ruby/object:Gem::Requirement
377
378
  requirements:
378
- - - '='
379
+ - - ">="
379
380
  - !ruby/object:Gem::Version
380
- version: 1.3.9
381
+ version: '0'
381
382
  - !ruby/object:Gem::Dependency
382
- name: therubyracer
383
+ name: fake_ftp
383
384
  requirement: !ruby/object:Gem::Requirement
384
385
  requirements:
385
386
  - - ">="
@@ -393,7 +394,7 @@ dependencies:
393
394
  - !ruby/object:Gem::Version
394
395
  version: '0'
395
396
  - !ruby/object:Gem::Dependency
396
- name: tilt
397
+ name: openssl
397
398
  requirement: !ruby/object:Gem::Requirement
398
399
  requirements:
399
400
  - - ">="
@@ -407,7 +408,21 @@ dependencies:
407
408
  - !ruby/object:Gem::Version
408
409
  version: '0'
409
410
  - !ruby/object:Gem::Dependency
410
- name: xpath
411
+ name: rspec
412
+ requirement: !ruby/object:Gem::Requirement
413
+ requirements:
414
+ - - "~>"
415
+ - !ruby/object:Gem::Version
416
+ version: '3.0'
417
+ type: :development
418
+ prerelease: false
419
+ version_requirements: !ruby/object:Gem::Requirement
420
+ requirements:
421
+ - - "~>"
422
+ - !ruby/object:Gem::Version
423
+ version: '3.0'
424
+ - !ruby/object:Gem::Dependency
425
+ name: rspec-benchmark
411
426
  requirement: !ruby/object:Gem::Requirement
412
427
  requirements:
413
428
  - - ">="
@@ -421,19 +436,19 @@ dependencies:
421
436
  - !ruby/object:Gem::Version
422
437
  version: '0'
423
438
  - !ruby/object:Gem::Dependency
424
- name: yarjuf
439
+ name: rspec_junit_formatter
425
440
  requirement: !ruby/object:Gem::Requirement
426
441
  requirements:
427
- - - "~>"
442
+ - - '='
428
443
  - !ruby/object:Gem::Version
429
- version: '2.0'
444
+ version: 0.3.0
430
445
  type: :development
431
446
  prerelease: false
432
447
  version_requirements: !ruby/object:Gem::Requirement
433
448
  requirements:
434
- - - "~>"
449
+ - - '='
435
450
  - !ruby/object:Gem::Version
436
- version: '2.0'
451
+ version: 0.3.0
437
452
  - !ruby/object:Gem::Dependency
438
453
  name: ougai
439
454
  requirement: !ruby/object:Gem::Requirement
@@ -498,20 +513,20 @@ executables:
498
513
  - contrast_service
499
514
  extensions:
500
515
  - ext/cs__common/extconf.rb
501
- - ext/cs__contrast_patch/extconf.rb
502
516
  - ext/cs__assess_active_record_named/extconf.rb
503
- - ext/cs__assess_module/extconf.rb
504
- - ext/cs__assess_marshal_module/extconf.rb
505
- - ext/cs__assess_hash/extconf.rb
506
- - ext/cs__assess_regexp/extconf.rb
507
517
  - ext/cs__assess_string/extconf.rb
508
- - ext/cs__protect_kernel/extconf.rb
509
- - ext/cs__assess_string_interpolation26/extconf.rb
510
518
  - ext/cs__assess_kernel/extconf.rb
519
+ - ext/cs__assess_basic_object/extconf.rb
520
+ - ext/cs__assess_regexp/extconf.rb
521
+ - ext/cs__assess_yield_track/extconf.rb
511
522
  - ext/cs__assess_fiber_track/extconf.rb
523
+ - ext/cs__assess_hash/extconf.rb
512
524
  - ext/cs__assess_array/extconf.rb
513
- - ext/cs__assess_yield_track/extconf.rb
514
- - ext/cs__assess_basic_object/extconf.rb
525
+ - ext/cs__assess_string_interpolation26/extconf.rb
526
+ - ext/cs__assess_module/extconf.rb
527
+ - ext/cs__assess_marshal_module/extconf.rb
528
+ - ext/cs__contrast_patch/extconf.rb
529
+ - ext/cs__protect_kernel/extconf.rb
515
530
  extra_rdoc_files: []
516
531
  files:
517
532
  - ".clang-format"
@@ -708,6 +723,7 @@ files:
708
723
  - lib/contrast/agent.rb
709
724
  - lib/contrast/agent/assess.rb
710
725
  - lib/contrast/agent/assess/contrast_event.rb
726
+ - lib/contrast/agent/assess/contrast_object.rb
711
727
  - lib/contrast/agent/assess/events/event_factory.rb
712
728
  - lib/contrast/agent/assess/events/source_event.rb
713
729
  - lib/contrast/agent/assess/finalizers/freeze.rb
@@ -748,6 +764,7 @@ files:
748
764
  - lib/contrast/agent/assess/policy/trigger/xpath.rb
749
765
  - lib/contrast/agent/assess/policy/trigger_method.rb
750
766
  - lib/contrast/agent/assess/policy/trigger_node.rb
767
+ - lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb
751
768
  - lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb
752
769
  - lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb
753
770
  - lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb
@@ -755,13 +772,10 @@ files:
755
772
  - lib/contrast/agent/assess/property/evented.rb
756
773
  - lib/contrast/agent/assess/property/tagged.rb
757
774
  - lib/contrast/agent/assess/property/updated.rb
758
- - lib/contrast/agent/assess/rule.rb
759
- - lib/contrast/agent/assess/rule/base.rb
760
775
  - lib/contrast/agent/assess/rule/provider.rb
761
776
  - lib/contrast/agent/assess/rule/provider/hardcoded_key.rb
762
777
  - lib/contrast/agent/assess/rule/provider/hardcoded_password.rb
763
778
  - lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb
764
- - lib/contrast/agent/assess/rule/redos.rb
765
779
  - lib/contrast/agent/assess/tag.rb
766
780
  - lib/contrast/agent/assess/tracker.rb
767
781
  - lib/contrast/agent/at_exit_hook.rb
@@ -848,7 +862,9 @@ files:
848
862
  - lib/contrast/api/communication/unix_socket.rb
849
863
  - lib/contrast/api/decorators.rb
850
864
  - lib/contrast/api/decorators/address.rb
865
+ - lib/contrast/api/decorators/agent_startup.rb
851
866
  - lib/contrast/api/decorators/application_settings.rb
867
+ - lib/contrast/api/decorators/application_startup.rb
852
868
  - lib/contrast/api/decorators/application_update.rb
853
869
  - lib/contrast/api/decorators/http_request.rb
854
870
  - lib/contrast/api/decorators/input_analysis.rb
@@ -934,8 +950,6 @@ files:
934
950
  - lib/contrast/framework/rails/rewrite/active_record_named.rb
935
951
  - lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb
936
952
  - lib/contrast/framework/rails/support.rb
937
- - lib/contrast/framework/sinatra/patch/base.rb
938
- - lib/contrast/framework/sinatra/patch/support.rb
939
953
  - lib/contrast/framework/sinatra/support.rb
940
954
  - lib/contrast/funchook/funchook.rb
941
955
  - lib/contrast/logger/application.rb
@@ -960,7 +974,6 @@ files:
960
974
  - lib/contrast/utils/object_share.rb
961
975
  - lib/contrast/utils/os.rb
962
976
  - lib/contrast/utils/preflight_util.rb
963
- - lib/contrast/utils/prevent_serialization.rb
964
977
  - lib/contrast/utils/resource_loader.rb
965
978
  - lib/contrast/utils/ruby_ast_rewriter.rb
966
979
  - lib/contrast/utils/sha256_builder.rb