contrast-agent 4.13.0 → 5.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (390) hide show
  1. checksums.yaml +4 -4
  2. data/.simplecov +2 -1
  3. data/Gemfile +1 -1
  4. data/LICENSE.txt +1 -1
  5. data/Rakefile +1 -1
  6. data/exe/contrast_service +1 -1
  7. data/ext/build_funchook.rb +1 -1
  8. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  9. data/ext/cs__assess_array/extconf.rb +1 -1
  10. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  11. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  12. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  13. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  14. data/ext/cs__assess_hash/cs__assess_hash.c +1 -1
  15. data/ext/cs__assess_hash/extconf.rb +1 -1
  16. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  17. data/ext/cs__assess_kernel/extconf.rb +1 -1
  18. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  19. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  20. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  21. data/ext/cs__assess_module/extconf.rb +1 -1
  22. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  23. data/ext/cs__assess_regexp/extconf.rb +1 -1
  24. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  25. data/ext/cs__assess_string/extconf.rb +1 -1
  26. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  27. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  28. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  29. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  30. data/ext/cs__common/cs__common.c +1 -1
  31. data/ext/cs__common/extconf.rb +1 -1
  32. data/ext/cs__contrast_patch/cs__contrast_patch.c +1 -1
  33. data/ext/cs__contrast_patch/extconf.rb +1 -1
  34. data/ext/cs__os_information/cs__os_information.c +1 -1
  35. data/ext/cs__os_information/extconf.rb +1 -1
  36. data/ext/extconf_common.rb +1 -1
  37. data/lib/contrast/agent/assess/contrast_event.rb +7 -11
  38. data/lib/contrast/agent/assess/contrast_object.rb +1 -1
  39. data/lib/contrast/agent/assess/events/event_data.rb +30 -0
  40. data/lib/contrast/agent/assess/events/event_factory.rb +14 -6
  41. data/lib/contrast/agent/assess/events/source_event.rb +22 -3
  42. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  43. data/lib/contrast/agent/assess/finalizers/hash.rb +1 -1
  44. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +7 -7
  45. data/lib/contrast/agent/assess/policy/patcher.rb +1 -35
  46. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  47. data/lib/contrast/agent/assess/policy/policy_node.rb +7 -7
  48. data/lib/contrast/agent/assess/policy/policy_scanner.rb +6 -1
  49. data/lib/contrast/agent/assess/policy/preshift.rb +1 -1
  50. data/lib/contrast/agent/assess/policy/propagation_method.rb +55 -28
  51. data/lib/contrast/agent/assess/policy/propagation_node.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/propagator/center.rb +2 -2
  55. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +6 -2
  57. data/lib/contrast/agent/assess/policy/propagator/insert.rb +5 -2
  58. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  59. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +7 -3
  60. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  61. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb +1 -1
  63. data/lib/contrast/agent/assess/policy/propagator/remove.rb +1 -1
  64. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  65. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  66. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -2
  67. data/lib/contrast/agent/assess/policy/propagator/splat.rb +1 -1
  68. data/lib/contrast/agent/assess/policy/propagator/split.rb +27 -25
  69. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +3 -157
  70. data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb +190 -0
  71. data/lib/contrast/agent/assess/policy/propagator/trim.rb +9 -4
  72. data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/source_method.rb +39 -26
  74. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  75. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +1 -1
  76. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  77. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +7 -2
  78. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  79. data/lib/contrast/agent/assess/policy/trigger_method.rb +68 -18
  80. data/lib/contrast/agent/assess/policy/trigger_node.rb +15 -7
  81. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
  82. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  83. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +1 -1
  84. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +2 -2
  85. data/lib/contrast/agent/assess/properties.rb +1 -1
  86. data/lib/contrast/agent/assess/property/evented.rb +25 -12
  87. data/lib/contrast/agent/assess/property/tagged.rb +52 -58
  88. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  89. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +1 -19
  90. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -13
  91. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +42 -60
  92. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  93. data/lib/contrast/agent/assess/rule/response/autocomplete_rule.rb +130 -0
  94. data/lib/contrast/agent/assess/rule/response/base_rule.rb +117 -0
  95. data/lib/contrast/agent/assess/tag.rb +1 -1
  96. data/lib/contrast/agent/assess/tracker.rb +1 -1
  97. data/lib/contrast/agent/assess.rb +1 -2
  98. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  99. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +13 -8
  100. data/lib/contrast/agent/deadzone/policy/policy.rb +1 -1
  101. data/lib/contrast/agent/disable_reaction.rb +1 -1
  102. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  103. data/lib/contrast/agent/inventory/database_config.rb +115 -77
  104. data/lib/contrast/agent/inventory/dependencies.rb +1 -1
  105. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  106. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +3 -3
  107. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  108. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  109. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  110. data/lib/contrast/agent/inventory.rb +1 -1
  111. data/lib/contrast/agent/metric_telemetry_event.rb +3 -3
  112. data/lib/contrast/agent/middleware.rb +8 -77
  113. data/lib/contrast/agent/module_data.rb +1 -1
  114. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  115. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +1 -1
  116. data/lib/contrast/agent/patching/policy/method_policy.rb +31 -104
  117. data/lib/contrast/agent/patching/policy/method_policy_extend.rb +113 -0
  118. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  119. data/lib/contrast/agent/patching/policy/patch.rb +1 -1
  120. data/lib/contrast/agent/patching/policy/patch_status.rb +2 -26
  121. data/lib/contrast/agent/patching/policy/patcher.rb +13 -13
  122. data/lib/contrast/agent/patching/policy/policy.rb +1 -1
  123. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  124. data/lib/contrast/agent/patching/policy/trigger_node.rb +1 -1
  125. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
  126. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
  127. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
  128. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -1
  129. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
  130. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
  131. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  132. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  133. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  134. data/lib/contrast/agent/protect/rule/base.rb +1 -1
  135. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  136. data/lib/contrast/agent/protect/rule/cmd_injection.rb +1 -1
  137. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  138. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  139. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  140. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -1
  141. data/lib/contrast/agent/protect/rule/no_sqli.rb +1 -1
  142. data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -1
  143. data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +1 -1
  144. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  145. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  146. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  147. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  148. data/lib/contrast/agent/protect/rule/sqli.rb +1 -1
  149. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  150. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  151. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -1
  152. data/lib/contrast/agent/protect/rule/xxe.rb +1 -1
  153. data/lib/contrast/agent/protect/rule.rb +1 -1
  154. data/lib/contrast/agent/reaction_processor.rb +1 -1
  155. data/lib/contrast/agent/reporting/report.rb +27 -0
  156. data/lib/contrast/agent/reporting/reporter.rb +115 -0
  157. data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb +49 -0
  158. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +82 -0
  159. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +80 -0
  160. data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb +59 -0
  161. data/lib/contrast/agent/reporting/reporting_events/finding.rb +185 -0
  162. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +264 -0
  163. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +57 -0
  164. data/lib/contrast/agent/reporting/reporting_events/finding_object.rb +90 -0
  165. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +121 -0
  166. data/lib/contrast/agent/reporting/reporting_events/finding_signature.rb +105 -0
  167. data/lib/contrast/agent/reporting/reporting_events/finding_stack.rb +67 -0
  168. data/lib/contrast/agent/reporting/reporting_events/finding_taint_range.rb +58 -0
  169. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +93 -0
  170. data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +50 -0
  171. data/lib/contrast/agent/reporting/reporting_events/observed_library_usage.rb +54 -0
  172. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +66 -0
  173. data/lib/contrast/agent/reporting/reporting_events/preflight.rb +39 -0
  174. data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +75 -0
  175. data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +47 -0
  176. data/lib/contrast/agent/reporting/reporting_events/route_coverage.rb +76 -0
  177. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +66 -0
  178. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +65 -0
  179. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +52 -0
  180. data/lib/contrast/agent/reporting/reporting_events/trace_event_source.rb +30 -0
  181. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +137 -0
  182. data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +67 -0
  183. data/lib/contrast/agent/reporting/reporting_utilities/endpoints.rb +165 -0
  184. data/lib/contrast/agent/reporting/reporting_utilities/headers.rb +55 -0
  185. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +86 -0
  186. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +154 -0
  187. data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb +66 -0
  188. data/lib/contrast/agent/reporting/reporting_utilities/response.rb +30 -0
  189. data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +57 -0
  190. data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +196 -0
  191. data/lib/contrast/agent/reporting/settings/application_settings.rb +67 -0
  192. data/lib/contrast/agent/reporting/settings/assess.rb +45 -0
  193. data/lib/contrast/agent/reporting/settings/assess_server_feature.rb +136 -0
  194. data/lib/contrast/agent/reporting/settings/exclusions.rb +123 -0
  195. data/lib/contrast/agent/reporting/settings/protect.rb +89 -0
  196. data/lib/contrast/agent/reporting/settings/protect_server_feature.rb +243 -0
  197. data/lib/contrast/agent/reporting/settings/reaction.rb +30 -0
  198. data/lib/contrast/agent/reporting/settings/server_features.rb +78 -0
  199. data/lib/contrast/agent/request.rb +46 -84
  200. data/lib/contrast/agent/request_context.rb +20 -131
  201. data/lib/contrast/agent/request_context_extend.rb +163 -0
  202. data/lib/contrast/agent/request_handler.rb +41 -5
  203. data/lib/contrast/agent/response.rb +25 -88
  204. data/lib/contrast/agent/rule_set.rb +1 -1
  205. data/lib/contrast/agent/scope.rb +1 -1
  206. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  207. data/lib/contrast/agent/startup_metrics_telemetry_event.rb +73 -23
  208. data/lib/contrast/agent/static_analysis.rb +14 -4
  209. data/lib/contrast/agent/telemetry.rb +16 -8
  210. data/lib/contrast/agent/telemetry_event.rb +9 -10
  211. data/lib/contrast/agent/thread.rb +1 -1
  212. data/lib/contrast/agent/thread_watcher.rb +32 -6
  213. data/lib/contrast/agent/tracepoint_hook.rb +1 -4
  214. data/lib/contrast/agent/version.rb +2 -2
  215. data/lib/contrast/agent/worker_thread.rb +1 -1
  216. data/lib/contrast/agent.rb +16 -1
  217. data/lib/contrast/api/communication/connection_status.rb +11 -8
  218. data/lib/contrast/api/communication/messaging_queue.rb +38 -4
  219. data/lib/contrast/api/communication/response_processor.rb +22 -11
  220. data/lib/contrast/api/communication/service_lifecycle.rb +14 -4
  221. data/lib/contrast/api/communication/socket.rb +7 -9
  222. data/lib/contrast/api/communication/socket_client.rb +33 -13
  223. data/lib/contrast/api/communication/speedracer.rb +38 -2
  224. data/lib/contrast/api/communication/tcp_socket.rb +5 -4
  225. data/lib/contrast/api/communication/unix_socket.rb +2 -1
  226. data/lib/contrast/api/communication.rb +1 -1
  227. data/lib/contrast/api/decorators/address.rb +1 -1
  228. data/lib/contrast/api/decorators/agent_startup.rb +1 -1
  229. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  230. data/lib/contrast/api/decorators/application_startup.rb +1 -1
  231. data/lib/contrast/api/decorators/application_update.rb +1 -1
  232. data/lib/contrast/api/decorators/architecture_component.rb +36 -0
  233. data/lib/contrast/api/decorators/finding.rb +29 -0
  234. data/lib/contrast/api/decorators/http_request.rb +3 -2
  235. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  236. data/lib/contrast/api/decorators/instrumentation_mode.rb +1 -1
  237. data/lib/contrast/api/decorators/library.rb +1 -1
  238. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  239. data/lib/contrast/api/decorators/message.rb +1 -1
  240. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  241. data/lib/contrast/api/decorators/route_coverage.rb +1 -1
  242. data/lib/contrast/api/decorators/server_features.rb +1 -1
  243. data/lib/contrast/api/decorators/trace_event.rb +1 -1
  244. data/lib/contrast/api/decorators/trace_event_object.rb +1 -1
  245. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  246. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  247. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -1
  248. data/lib/contrast/api/decorators/user_input.rb +1 -1
  249. data/lib/contrast/api/decorators.rb +2 -1
  250. data/lib/contrast/api.rb +1 -1
  251. data/lib/contrast/components/agent.rb +5 -24
  252. data/lib/contrast/components/api.rb +67 -2
  253. data/lib/contrast/components/app_context.rb +12 -66
  254. data/lib/contrast/components/app_context_extend.rb +78 -0
  255. data/lib/contrast/components/assess.rb +12 -8
  256. data/lib/contrast/components/base.rb +24 -1
  257. data/lib/contrast/components/config.rb +38 -23
  258. data/lib/contrast/components/contrast_service.rb +6 -1
  259. data/lib/contrast/components/heap_dump.rb +1 -1
  260. data/lib/contrast/components/inventory.rb +5 -1
  261. data/lib/contrast/components/logger.rb +1 -1
  262. data/lib/contrast/components/protect.rb +6 -2
  263. data/lib/contrast/components/sampling.rb +3 -3
  264. data/lib/contrast/components/scope.rb +1 -1
  265. data/lib/contrast/components/settings.rb +25 -12
  266. data/lib/contrast/config/agent_configuration.rb +2 -2
  267. data/lib/contrast/config/api_configuration.rb +9 -4
  268. data/lib/contrast/config/api_proxy_configuration.rb +14 -0
  269. data/lib/contrast/config/application_configuration.rb +3 -4
  270. data/lib/contrast/config/assess_configuration.rb +4 -4
  271. data/lib/contrast/config/assess_rules_configuration.rb +1 -1
  272. data/lib/contrast/config/base_configuration.rb +18 -29
  273. data/lib/contrast/config/certification_configuration.rb +15 -0
  274. data/lib/contrast/config/env_variables.rb +3 -10
  275. data/lib/contrast/config/exception_configuration.rb +1 -1
  276. data/lib/contrast/config/heap_dump_configuration.rb +7 -7
  277. data/lib/contrast/config/inventory_configuration.rb +2 -6
  278. data/lib/contrast/config/logger_configuration.rb +1 -1
  279. data/lib/contrast/config/protect_configuration.rb +1 -1
  280. data/lib/contrast/config/protect_rule_configuration.rb +2 -2
  281. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  282. data/lib/contrast/config/request_audit_configuration.rb +18 -0
  283. data/lib/contrast/config/root_configuration.rb +1 -1
  284. data/lib/contrast/config/ruby_configuration.rb +10 -7
  285. data/lib/contrast/config/sampling_configuration.rb +1 -1
  286. data/lib/contrast/config/server_configuration.rb +1 -1
  287. data/lib/contrast/config/service_configuration.rb +2 -3
  288. data/lib/contrast/config.rb +1 -2
  289. data/lib/contrast/configuration.rb +2 -3
  290. data/lib/contrast/extension/assess/array.rb +9 -9
  291. data/lib/contrast/extension/assess/erb.rb +15 -5
  292. data/lib/contrast/extension/assess/eval_trigger.rb +3 -1
  293. data/lib/contrast/extension/assess/exec_trigger.rb +2 -1
  294. data/lib/contrast/extension/assess/fiber.rb +6 -3
  295. data/lib/contrast/extension/assess/hash.rb +1 -1
  296. data/lib/contrast/extension/assess/kernel.rb +8 -3
  297. data/lib/contrast/extension/assess/marshal.rb +6 -2
  298. data/lib/contrast/extension/assess/regexp.rb +8 -2
  299. data/lib/contrast/extension/assess/string.rb +8 -2
  300. data/lib/contrast/extension/assess.rb +1 -1
  301. data/lib/contrast/extension/delegator.rb +1 -1
  302. data/lib/contrast/extension/extension.rb +2 -4
  303. data/lib/contrast/extension/inventory.rb +1 -1
  304. data/lib/contrast/extension/kernel.rb +1 -1
  305. data/lib/contrast/extension/module.rb +1 -1
  306. data/lib/contrast/extension/protect/psych.rb +1 -1
  307. data/lib/contrast/extension/protect.rb +1 -1
  308. data/lib/contrast/extension/thread.rb +32 -13
  309. data/lib/contrast/framework/base_support.rb +5 -1
  310. data/lib/contrast/framework/grape/support.rb +25 -1
  311. data/lib/contrast/framework/manager.rb +33 -36
  312. data/lib/contrast/framework/manager_extend.rb +50 -0
  313. data/lib/contrast/framework/platform_version.rb +1 -1
  314. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  315. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  316. data/lib/contrast/framework/rack/support.rb +1 -1
  317. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  318. data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
  319. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  320. data/lib/contrast/framework/rails/patch/support.rb +1 -1
  321. data/lib/contrast/framework/rails/railtie.rb +2 -2
  322. data/lib/contrast/framework/rails/support.rb +46 -2
  323. data/lib/contrast/framework/sinatra/support.rb +26 -3
  324. data/lib/contrast/funchook/funchook.rb +21 -18
  325. data/lib/contrast/logger/application.rb +1 -1
  326. data/lib/contrast/logger/format.rb +1 -1
  327. data/lib/contrast/logger/log.rb +9 -104
  328. data/lib/contrast/logger/request.rb +1 -1
  329. data/lib/contrast/logger/time.rb +1 -1
  330. data/lib/contrast/security_exception.rb +1 -1
  331. data/lib/contrast/tasks/config.rb +1 -1
  332. data/lib/contrast/tasks/service.rb +1 -1
  333. data/lib/contrast/utils/assess/propagation_method_utils.rb +1 -1
  334. data/lib/contrast/utils/assess/property/tagged_utils.rb +24 -1
  335. data/lib/contrast/utils/assess/sampling_util.rb +4 -4
  336. data/lib/contrast/utils/assess/source_method_utils.rb +1 -1
  337. data/lib/contrast/utils/assess/split_utils.rb +23 -0
  338. data/lib/contrast/utils/assess/tracking_util.rb +21 -16
  339. data/lib/contrast/utils/assess/trigger_method_utils.rb +4 -3
  340. data/lib/contrast/utils/class_util.rb +19 -15
  341. data/lib/contrast/utils/duck_utils.rb +1 -1
  342. data/lib/contrast/utils/env_configuration_item.rb +2 -2
  343. data/lib/contrast/utils/exclude_key.rb +1 -1
  344. data/lib/contrast/utils/findings.rb +65 -0
  345. data/lib/contrast/utils/hash_digest.rb +46 -79
  346. data/lib/contrast/utils/hash_digest_extend.rb +129 -0
  347. data/lib/contrast/utils/head_dump_utils_extend.rb +74 -0
  348. data/lib/contrast/utils/heap_dump_util.rb +3 -66
  349. data/lib/contrast/utils/invalid_configuration_util.rb +32 -2
  350. data/lib/contrast/utils/io_util.rb +2 -2
  351. data/lib/contrast/utils/job_servers_running.rb +1 -1
  352. data/lib/contrast/utils/log_utils.rb +108 -0
  353. data/lib/contrast/utils/lru_cache.rb +1 -1
  354. data/lib/contrast/utils/metrics_hash.rb +2 -2
  355. data/lib/contrast/utils/middleware_utils.rb +87 -0
  356. data/lib/contrast/utils/net_http_base.rb +165 -0
  357. data/lib/contrast/utils/object_share.rb +2 -6
  358. data/lib/contrast/utils/os.rb +9 -5
  359. data/lib/contrast/utils/patching/policy/patch_utils.rb +63 -99
  360. data/lib/contrast/utils/patching/policy/patcher_utils.rb +1 -1
  361. data/lib/contrast/utils/preflight_util.rb +1 -1
  362. data/lib/contrast/utils/request_utils.rb +96 -0
  363. data/lib/contrast/utils/resource_loader.rb +1 -1
  364. data/lib/contrast/utils/response_utils.rb +97 -0
  365. data/lib/contrast/utils/sha256_builder.rb +1 -1
  366. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  367. data/lib/contrast/utils/string_utils.rb +69 -67
  368. data/lib/contrast/utils/tag_util.rb +11 -10
  369. data/lib/contrast/utils/telemetry.rb +11 -10
  370. data/lib/contrast/utils/telemetry_client.rb +90 -0
  371. data/lib/contrast/utils/telemetry_identifier.rb +18 -25
  372. data/lib/contrast/utils/thread_tracker.rb +1 -1
  373. data/lib/contrast/utils/timer.rb +1 -1
  374. data/lib/contrast-agent.rb +1 -1
  375. data/lib/contrast.rb +1 -1
  376. data/ruby-agent.gemspec +9 -10
  377. metadata +102 -49
  378. data/ext/cs__assess_active_record_named/cs__active_record_named.c +0 -46
  379. data/ext/cs__assess_active_record_named/cs__active_record_named.h +0 -11
  380. data/ext/cs__assess_active_record_named/extconf.rb +0 -5
  381. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +0 -95
  382. data/lib/contrast/agent/class_reopener.rb +0 -258
  383. data/lib/contrast/agent/rewriter.rb +0 -259
  384. data/lib/contrast/config/default_value.rb +0 -17
  385. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +0 -37
  386. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +0 -41
  387. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +0 -75
  388. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +0 -35
  389. data/lib/contrast/utils/requests_client.rb +0 -150
  390. data/lib/contrast/utils/ruby_ast_rewriter.rb +0 -82
@@ -1,258 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
5
-
6
- require 'ripper'
7
- require 'contrast/extension/module'
8
- require 'contrast/components/logger'
9
- require 'contrast/components/scope'
10
- require 'contrast/logger/log'
11
-
12
- # This method is left purposefully at the top level namespace. Moving it
13
- # elsewhere will break functionality as it executes evaluations against the
14
- # namespace from which it is called -- ie putting it in Contrast would make all
15
- # changes it intends for Foo happen to Contrast::Foo instead
16
- #
17
- # @param _class_name [String] the name of the class in which the eval will
18
- # redefine functionality
19
- # @param content [String] the String content that will function as the code in
20
- # the given class
21
- def unbound_eval _class_name, content
22
- # Yuck, this is a top-level method that has to break encapsulation
23
- # in order to access scoping!
24
- ::Contrast::SCOPE.scope_for_current_ec.enter_contrast_scope!
25
- eval(content) # rubocop:disable Security/Eval
26
- rescue Exception # rubocop:disable Lint/RescueException
27
- # We can't use components here, so we have to access the log directly. I hate
28
- # it, but we'll have to deal with it until we remove 2.5 support.
29
- Contrast::Logger::Log.instance.logger.error('Unable to perform unbound eval of new content', module: class_name)
30
- # And we need to return nil here, not the value from the logger.
31
- nil
32
- ensure
33
- ::Contrast::SCOPE.scope_for_current_ec.exit_contrast_scope!
34
- end
35
-
36
- module Contrast
37
- module Agent
38
- # TODO: RUBY-714 remove w/ EOL of 2.5
39
- # @deprecated Changes to this class are discouraged as this approach is
40
- # being phased out with support for those language versions.
41
- class ClassReopener
42
- include Contrast::Components::Logger::InstanceMethods
43
- include Contrast::Components::Scope::InstanceMethods
44
-
45
- END_NEW_LINE = "end\n"
46
- PROTECTED_WITH_NEW_LINE = "protected\n"
47
- PRIVATE_WITH_NEW_LINE = "private\n"
48
- CLASS_SELF_LINE = "class << self\n"
49
-
50
- attr_reader :public_singleton_methods, :class_module_path, :class_name, :files, :is_class, :name_space,
51
- :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
52
-
53
- def initialize module_data
54
- @class_module_path = module_data.mod_name
55
- clazz = module_data.mod
56
- @is_class = clazz.is_a?(Class)
57
- @public_instance_methods = []
58
- @protected_instance_methods = []
59
- @private_instance_methods = []
60
- @public_singleton_methods = []
61
- @files = {}
62
- @name_space = []
63
- @class_name = nil
64
- @locations = Hash.new { |h, k| h[k] = [] }
65
- gather_modules
66
- end
67
-
68
- # Indicates if any methods were rewritten for this class.
69
- #
70
- # @return [Boolean]
71
- def staged_changes?
72
- public_singleton_methods.any? ||
73
- public_instance_methods.any? ||
74
- protected_instance_methods.any? ||
75
- private_instance_methods.any?
76
- end
77
-
78
- # Indicates if this class was written from the given location.
79
- #
80
- # @param source_location [Array<String, Integer>] the result of a
81
- # Method#source_location call
82
- # @return [Boolean]
83
- def written_from_location? source_location
84
- return false unless source_location
85
-
86
- file = source_location[0]
87
- location = source_location[1]
88
- locations[file].include?(location)
89
- end
90
-
91
- # Marks that this class was written from the given location.
92
- #
93
- # @param source_location [Array<String, Integer>] the result of a
94
- # Method#source_location call
95
- # @return [Boolean]
96
- def written_from_location! source_location
97
- return false unless source_location
98
-
99
- file = source_location[0]
100
- location = source_location[1]
101
- locations[file] << location
102
- end
103
-
104
- # Evaluate the patches that have been staged for this class, replacing
105
- # the method definitions with those our rewrite.
106
- def commit_patches
107
- with_contrast_scope do
108
- return unless staged_changes?
109
-
110
- content = build_content
111
- valid = Ripper.sexp(content)
112
- unbound_eval(class_name, content) if !!valid && !class_name.empty?
113
- end
114
- end
115
-
116
- # Find the sourcecode of the method at the given location and return it
117
- # if it is complete and compilable.
118
- #
119
- # @param location [Array<String, Integer>] the result of a
120
- # Method#source_location call
121
- # @param method_name [Symbol] the name of the method defined at the given
122
- # location
123
- # @return [String, nil] the code defining the method or nil if no valid
124
- # code could be found.
125
- def source_code location, method_name
126
- file_name = location[0]
127
- line_number = location[1]
128
- return unless file_contents_available?(file_name, line_number)
129
-
130
- files[file_name] = File.readlines(file_name) unless files.key?(file_name)
131
- lines = files[file_name]
132
- code = +''
133
- # location#line_number is 1 based, arrays are 0 based
134
- line_number -= 1
135
- lines[line_number..-1].each do |line|
136
- code << line
137
- next unless compiles?(code)
138
- break if complete?(code)
139
- end
140
- unless complete?(code) && compiles?(code)
141
- logger.warn(
142
- 'Failed to determine sourcecode for rewriting.',
143
- file: file_name,
144
- method: method_name,
145
- line_number: line_number)
146
- return
147
- end
148
- code
149
- end
150
-
151
- private
152
-
153
- def file_contents_available? file_name, line_number
154
- return false unless file_name && line_number
155
- return false unless File.exist?(file_name) && File.readable?(file_name)
156
- return false if File.empty?(file_name)
157
-
158
- true
159
- end
160
-
161
- def gather_modules
162
- return if class_module_path.nil?
163
-
164
- segments = class_module_path.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
165
- @class_name = segments.last
166
- current = nil
167
- segments[0..-2].each do |chunk|
168
- defined = current ? current.cs__const_defined?(chunk) : Module.cs__const_defined?(chunk)
169
- next unless defined
170
-
171
- current = current ? current.cs__const_get(chunk) : Module.cs__const_get(chunk)
172
- case current
173
- when Class
174
- name_space << [chunk, Class]
175
- when Module
176
- name_space << [chunk, Module]
177
- end
178
- end
179
- end
180
-
181
- # code which ends with a , or \ is incomplete.
182
- #
183
- # @param code [String] the text to determine if complete
184
- # @return [Boolean]
185
- def complete? code
186
- code !~ /[,\\]\s*\z/
187
- end
188
-
189
- # code which does not resolve to RubyVM::InstructionSequence does not
190
- # compile
191
- #
192
- # @param code [String] the text to determine if compiles
193
- # @return [Boolean]
194
- def compiles? code
195
- old_verbose = $VERBOSE
196
- $VERBOSE = nil
197
- RubyVM::InstructionSequence.compile(code)
198
- true
199
- rescue SyntaxError => _e
200
- false
201
- ensure
202
- $VERBOSE = old_verbose
203
- end
204
-
205
- def build_content
206
- content = +''
207
- name_space.each do |arr|
208
- name = arr[0]
209
- type = arr[1]
210
- if type == Class
211
- content << "class #{ name }\n"
212
- elsif type == Module
213
- content << "module #{ name }\n"
214
- end
215
- end
216
-
217
- # Set the name to be a class or module
218
- content << if is_class
219
- "class #{ class_name }\n"
220
- else
221
- "module #{ class_name }\n"
222
- end
223
-
224
- # Recreate the updated class methods
225
- if public_singleton_methods.any?
226
- content << CLASS_SELF_LINE
227
- content << public_singleton_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
228
- content << Contrast::Utils::ObjectShare::NEW_LINE
229
- content << END_NEW_LINE
230
- end
231
-
232
- # Recreate the updated instance methods
233
- if public_instance_methods.any?
234
- content << public_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
235
- content << Contrast::Utils::ObjectShare::NEW_LINE
236
- end
237
-
238
- if protected_instance_methods.any?
239
- content << PROTECTED_WITH_NEW_LINE
240
- content << protected_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
241
- content << Contrast::Utils::ObjectShare::NEW_LINE
242
- end
243
-
244
- if private_instance_methods.any?
245
- content << PRIVATE_WITH_NEW_LINE
246
- content << private_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
247
- content << Contrast::Utils::ObjectShare::NEW_LINE
248
- end
249
-
250
- content << END_NEW_LINE
251
- name_space.length.times do
252
- content << END_NEW_LINE
253
- end
254
- content
255
- end
256
- end
257
- end
258
- end
@@ -1,259 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- # intentional -- we're using a << operator here
5
-
6
- return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
7
-
8
- require 'contrast/agent/class_reopener'
9
- require 'contrast/agent/patching/policy/patch_status'
10
- require 'contrast/components/logger'
11
- require 'contrast/components/scope'
12
- require 'contrast/utils/ruby_ast_rewriter'
13
-
14
- module Contrast
15
- module Agent
16
- # Used for Ruby 2.5 to allow us to rewrite those methods which have
17
- # interpolation in them.
18
- #
19
- # TODO: RUBY-714 remove w/ EOL of 2.5
20
- # @deprecated Changes to this class are discouraged as this approach is
21
- # being phased out with support for those language versions.
22
- class Rewriter
23
- extend Contrast::Components::Logger::InstanceMethods
24
- extend Contrast::Components::Scope::InstanceMethods
25
-
26
- SELF_DEFINITION = 'def self.'
27
- DEFINITION = 'def '
28
-
29
- class << self
30
- def rewrite_class module_data, redo_rewrite = false
31
- mod = module_data.mod
32
- return unless mod
33
-
34
- status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
35
- return if (status.rewritten? || status.rewriting?) && !redo_rewrite
36
-
37
- status.rewriting!
38
-
39
- # default-initialize to nil within top-level method scope
40
- # so that it's available w/in the `ensure` block
41
- opener = nil
42
- with_contrast_scope do
43
- unless should_rewrite?(module_data)
44
- status.no_rewrite!
45
- return
46
- end
47
-
48
- opener = Contrast::Agent::ClassReopener.new(module_data)
49
- if opener.nil? || (instance_methods.empty? && singleton_methods.empty?)
50
- status.no_rewrite!
51
- return
52
- end
53
-
54
- rewrite_all_methods(opener, mod, mod.public_instance_methods(false), :PUBLIC_INSTANCE)
55
- rewrite_all_methods(opener, mod, mod.protected_instance_methods(false), :PROTECTED_INSTANCE)
56
- rewrite_all_methods(opener, mod, mod.private_instance_methods(false), :PRIVATE_INSTANCE)
57
- rewrite_all_methods(opener, mod, mod.singleton_methods(false), :SINGLETON)
58
- status.rewritten!
59
- end
60
- rescue SyntaxError, StandardError => e
61
- opener = nil
62
- mod ||= module_data.mod
63
- logger.debug('Reopening threw a handled exception - skipping rewriting', e, module: module_data.mod_name)
64
- status ||= Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
65
- status.failed_rewrite!
66
- ensure
67
- opener&.commit_patches
68
- logger.trace('Rewriting complete',
69
- module: module_data.mod_name,
70
- result: Contrast::Agent::Patching::Policy::PatchStatus.get_status(
71
- module_data.mod).rewrite_status)
72
- end
73
-
74
- private
75
-
76
- def location_available? location
77
- return unless location
78
- return false if location.empty? || location[0].empty? || location[0].include?('eval')
79
-
80
- true
81
- end
82
-
83
- def rewrite_all_methods opener, clazz, methods, type
84
- methods.each do |method|
85
- # Skip contrast woven methods.
86
- # There should be a better way to do this
87
- next if method.to_s.start_with?('cs__')
88
-
89
- original_source_code = source_code(opener, clazz, method, type)
90
- next if original_source_code.nil?
91
- next if unrepeatable?(original_source_code)
92
- next unless interpolations?(original_source_code)
93
-
94
- replace_method_definition(opener, clazz, method, original_source_code, type)
95
- end
96
- end
97
-
98
- def source_code opener, clazz, method_name, type
99
- return unless method_exists?(clazz, method_name, type)
100
-
101
- method_instance = method_instance(clazz, method_name, type)
102
- return if method_instance.nil?
103
-
104
- location = method_instance.source_location
105
- return unless location_available?(location)
106
- return if opener.written_from_location?(location)
107
-
108
- opener.written_from_location!(location)
109
- opener.source_code(location, method_name)
110
- rescue SyntaxError
111
- logger.debug('Can\'t parse method source', error: 'SyntaxError', module: clazz.cs__name, method: method_name)
112
- rescue StandardError => e
113
- if defined?(MethodSource) && defined?(MethodSource::SourceNotFoundError)
114
- logger.debug(
115
- 'Can\'t parse method source',
116
- e,
117
- error: 'SourceNotFoundError',
118
- module: clazz.cs__name,
119
- method: method_name)
120
- else
121
- logger.debug('Can\'t lookup method source', module: clazz.cs__name, method: method_name)
122
- end
123
- end
124
-
125
- def method_exists? clazz, method_name, type
126
- case type
127
- when :SINGLETON
128
- clazz.cs__singleton_class.public_method_defined?(method_name)
129
- when :PUBLIC_INSTANCE
130
- clazz.public_method_defined?(method_name)
131
- when :PROTECTED_INSTANCE
132
- clazz.protected_method_defined?(method_name)
133
- when :PRIVATE_INSTANCE
134
- clazz.private_method_defined?(method_name)
135
- end
136
- end
137
-
138
- def method_instance clazz, method_name, type
139
- case type
140
- when :SINGLETON
141
- clazz.singleton_method(method_name)
142
- else
143
- clazz.instance_method(method_name)
144
- end
145
- end
146
-
147
- def replace_method_definition opener, clazz, method, original_source_code, type
148
- new_method_source = rewrite_method(original_source_code)
149
- return unless valid_code?(new_method_source)
150
-
151
- case type
152
- when :SINGLETON
153
- opener.public_singleton_methods << new_method_source
154
- when :PUBLIC_INSTANCE
155
- opener.public_instance_methods << new_method_source
156
- when :PROTECTED_INSTANCE
157
- opener.protected_instance_methods << new_method_source
158
- when :PRIVATE_INSTANCE
159
- opener.private_instance_methods << new_method_source
160
- end
161
- rescue StandardError => e
162
- logger.debug('Can\'t rewrite in class_eval', e, module: clazz.cs__name, method: method)
163
- end
164
-
165
- def rewrite_method original_source_code
166
- new_code = rewrite(original_source_code)
167
- remove_self_definition(new_code)
168
- end
169
-
170
- def rewrite source
171
- @rewriter ||= Contrast::Utils::RubyAstRewriter.new
172
- @rewriter.rewrite(source)
173
- end
174
-
175
- def remove_self_definition new_code
176
- new_code.gsub(SELF_DEFINITION, DEFINITION)
177
- end
178
-
179
- # attempt to generate an AST for the rewritten code, if one can be generated we can assume it is at least valid ruby
180
- # if it returns nil that means that the AST was unable to build due to an error and we should use the original source code
181
- def valid_code? new_content
182
- !Ripper.sexp(new_content).nil?
183
- end
184
-
185
- def interpolations? method_source
186
- method_source.match?(/^.*".*#(\$\w+|@\w+|@@\w+|\{.*\}).*".*$/)
187
- end
188
-
189
- # These functions cannot be repeated -- when doing replace things, we
190
- # should comment these lines out.
191
- # cannot repeat class foo <
192
- # bar
193
- UNREPEATABLE_FUNCTIONS = /(^|\s)(class\s*\W.*<|included(\s+do|\s*{))/.cs__freeze
194
-
195
- # these methods dynamically create functions. replacing them in rails
196
- # resulted in a lot of undefined_ errors. i know we'll have to figure
197
- # out how to support them, but baby steps
198
- UNREPEATABLE_ACCESSOR_FUNCTIONS =
199
- /(^|\s)((cattr_accessor|cattr_reader|cattr_writer|attr_reader|attr_writer|attr_accessor|mattr_accessor|mattr_reader|mattr_writer|public) )/.cs__freeze
200
- # evals are scary and terrify me. we shouldn't rewrite them if we don't
201
- # have to
202
- POTENTIALLY_UNREPEATABLE_FUNCTIONS =
203
- /(class_eval|instance_eval|method_eval|eval|module_eval|define_method|define_method_attribute|require_dependency|instance_predicate)/.cs__freeze
204
- # Binding a Constant, ie starting with ::, affects the lookup of that
205
- # Constant. Since we're effectively moving the file in which it would
206
- # be declared, we cannot repeat this lookup, so we cannot replace this
207
- # file
208
- BOUND_CONSTANTS = /(^|\s)::\w/.cs__freeze
209
-
210
- DISABLE_FUNCTIONS_REGEXP = /(^|\s)((undef|include|extend|alias|alias_method|require|require_relative|send) )/.cs__freeze
211
- def unrepeatable? original_source_code
212
- (original_source_code.index('__dir__') ||
213
- original_source_code.index('File.dirname') ||
214
- original_source_code.index('__FILE__') ||
215
- original_source_code.match?(UNREPEATABLE_FUNCTIONS) ||
216
- original_source_code.match?(UNREPEATABLE_ACCESSOR_FUNCTIONS) ||
217
- original_source_code.match?(POTENTIALLY_UNREPEATABLE_FUNCTIONS) ||
218
- original_source_code.match?(BOUND_CONSTANTS) ||
219
- original_source_code.match?(DISABLE_FUNCTIONS_REGEXP))
220
- end
221
-
222
- UNTOUCHABLE_MODULES = %w[
223
- AbstractController
224
- ActionCable ActionController ActionDispatch ActionMailer ActionPack ActionView
225
- ActiveModel ActiveRecord ActiveSupport
226
- Brakeman
227
- Contrast
228
- Debase
229
- Debugger
230
- Erubis
231
- GraphQL
232
- NewRelic
233
- Pry
234
- Puma
235
- PhusionPassenger
236
- Rails::Application Rails::Engine Rails::Railtie
237
- Rake
238
- RSpec
239
- Warden
240
- WEBrick
241
- ].cs__freeze
242
- def should_rewrite? module_data
243
- clazz = module_data.mod
244
- name = module_data.mod_name
245
- return false unless clazz
246
-
247
- # Name can be nil for anonymous modules. We won't work on them.
248
- return false unless name
249
- return false if name == Contrast::Utils::ObjectShare::CLASS
250
- return false if name == Contrast::Utils::ObjectShare::MODULE
251
-
252
- # We've ran into issues rewriting these Modules. Ideally, we'll solve
253
- # the issues and this check will go away
254
- UNTOUCHABLE_MODULES.none? { |untouchable| name.include?(untouchable) }
255
- end
256
- end
257
- end
258
- end
259
- end
@@ -1,17 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Config
6
- # This is the wrapper for the default values in the configurations, used to
7
- # differentiate between nil or false defaults and things being set
8
- # explicitly to false.
9
- class DefaultValue
10
- attr_reader :value
11
-
12
- def initialize value
13
- @value = value
14
- end
15
- end
16
- end
17
- end
@@ -1,37 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
5
-
6
- module Contrast
7
- module Framework
8
- module Rails
9
- module Rewrite
10
- # Used to monkey patch all the inherited calls in action_pack
11
- #
12
- # This is the usual entry point for Rails inheritance work, so it should
13
- # catch most of the calls to inherited.
14
- # TODO: RUBY-714 remove w/ EOL of 2.5
15
- # @deprecated Changes to this class are discouraged as this approach is
16
- # being phased out with support for those language versions.
17
- module ActionControllerRailtiesHelperInherited
18
- def self.instrument
19
- @_instrument ||= begin
20
- ::ActionController::Railties::Helpers.class_eval do
21
- alias_method :cs__patched_helper_inherited, :inherited
22
- def inherited klass # rubocop:disable Lint/MissingSuper
23
- klass&.instance_variable_set(:@cs__defining_class, true)
24
- # This calls the original inherited, which should handle super as needed.
25
- cs__patched_helper_inherited(klass)
26
- ensure
27
- klass&.instance_variable_set(:@cs__defining_class, false)
28
- end
29
- end
30
- true
31
- end
32
- end
33
- end
34
- end
35
- end
36
- end
37
- end
@@ -1,41 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
5
-
6
- module Contrast
7
- module Framework
8
- module Rails
9
- module Rewrite
10
- # Rails / ActiveRecord are sneaky. They define attributes of a class in
11
- # one method, then monkey patch allocate in another and finally invoke
12
- # module_eval in this method... but of course they use a '_tmp_' header
13
- # for the method name and then alias it in this module to name it what
14
- # we expect
15
- #
16
- # TODO: RUBY-714 remove w/ EOL of 2.5
17
- # @deprecated Changes to this class are discouraged as this approach is
18
- # being phased out with support for those language versions.
19
- module ActiveRecordAttributeMethodsRead
20
- def self.instrument
21
- @_instrument ||= begin
22
- ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
23
- alias_method :cs__patched_define_method_attribute, :define_method_attribute
24
-
25
- def define_method_attribute *args, &block
26
- ret = cs__patched_define_method_attribute(*args, &block)
27
- method_name = args[0]
28
- Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
29
- ret
30
- end
31
-
32
- protected :cs__patched_define_method_attribute, :define_method_attribute
33
- end
34
- true
35
- end
36
- end
37
- end
38
- end
39
- end
40
- end
41
- end
@@ -1,75 +0,0 @@
1
- # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
5
-
6
- require 'contrast/components/logger'
7
-
8
- module Contrast
9
- module Framework
10
- module Rails
11
- module Rewrite
12
- # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
13
- # allowing for the runtime rewrite of interpolation calls defined in
14
- # methods defined dynamically during application execution.
15
- #
16
- # TODO: RUBY-714 remove w/ EOL of 2.5
17
- # @deprecated Changes to this class are discouraged as this approach is
18
- # being phased out with support for those language versions.
19
- class ActiveRecordNamed
20
- include Contrast::Components::Logger::InstanceMethods
21
- extend Contrast::Components::Logger::InstanceMethods
22
-
23
- class << self
24
- def rewrite mod, method_name, body
25
- return body unless ::Contrast::AGENT.rewrite_interpolation?
26
- return body unless body.is_a?(Proc)
27
-
28
- location = body.source_location
29
- return body unless location_available?(location)
30
-
31
- opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(mod))
32
- original_source_code = opener.source_code(location, method_name)
33
- return body unless original_source_code
34
- return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
35
- return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
36
-
37
- # the code looks like 'source :some_method_name, ->lambda_literal'
38
- # we just need the lambda
39
- body_start = original_source_code.index(',') + 1
40
- original_source_code = original_source_code[body_start..-1]
41
-
42
- new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
43
- return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
44
-
45
- unbound_eval(cs__name, new_method_source)
46
- rescue SyntaxError, StandardError => e
47
- logger.debug('Can\'t parse method source in scoped method', e, method: method_name)
48
- body
49
- end
50
-
51
- # Good news, once we patch the body once, the source location
52
- # becomes eval. We may need to fix this later though (so it may
53
- # be bad news)
54
- def location_available? location
55
- return false if location.nil?
56
- return false if location.empty? || location[0].empty? || location[0].include?('eval')
57
-
58
- true
59
- end
60
-
61
- def instrument
62
- @_instrument_named_track ||= begin
63
- require 'cs__assess_active_record_named/cs__assess_active_record_named'
64
- true
65
- end
66
- rescue StandardError, LoadError => e
67
- logger.error('Error loading active record named track patch', e)
68
- false
69
- end
70
- end
71
- end
72
- end
73
- end
74
- end
75
- end