contrast-agent 4.14.0 → 5.2.0

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy_node'
@@ -118,11 +118,8 @@ module Contrast
           # it is an interesting security event that has a meaningful
           # change.
           def tagger?
-            @_tagger ||= begin
-              has_tags = tags&.any?
-              has_untags = untags&.any?
-              has_tags || has_untags
-            end
+            @_tagger = tags&.any? || untags&.any? if @_tagger.nil?
+            @_tagger
           end
         end
       end

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -47,7 +47,11 @@ module Contrast
 
                   # TODO: RUBY-540 handle sanitization, handle nested objects
                   Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                  properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              value, preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  properties.build_event(event_data)
                   next unless tracked_value?(value)
 
                   tainted_columns[key] = properties

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -25,7 +25,10 @@ module Contrast
                                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                                     preshift.object
                                   else
-                                    preshift.args[int]
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
                                   end
 
                 # Find the first difference between the source to which

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -11,6 +11,10 @@ module Contrast
           # are unaffected beyond any merging of overlapping tags.
           class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
+              # This patch method is used to track through the MatchData#[] and
+              # MatchData#match methods, since the last was introduced after
+              # Ruby 3.1.0, but shares similar functionality, except it does not
+              # support ranges.
               def square_bracket_tagger propagation_node, preshift, ret, _block
                 case ret
                 when Array
@@ -33,6 +37,8 @@ module Contrast
               end
 
               def captures_tagger propagation_node, preshift, ret, _block
+                return unless ret
+
                 idx = 0
                 while idx < ret.length
                   return_value = ret[idx]
@@ -96,8 +102,12 @@ module Contrast
                 applicable_tags.each do |tag_name, tag_ranges|
                   return_properties.set_tags(tag_name, tag_ranges)
                 end
-                return_properties.build_event(propagation_node, return_value, preshift.object, return_value,
-                                              preshift.args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                            return_value,
+                                                                            preshift.object,
+                                                                            return_value,
+                                                                            preshift.args)
+                return_properties.build_event(event_data)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -26,7 +26,8 @@ module Contrast
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
 
                 range = determine_select_range(source, args)
                 return unless range

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
@@ -6,6 +6,8 @@ require 'contrast/components/agent'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/utils/thread_tracker'
+require 'contrast/utils/assess/split_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -17,6 +19,7 @@ module Contrast
           class Split < Contrast::Agent::Assess::Policy::Propagator::Base
             extend Contrast::Components::Scope::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
+            extend Contrast::Utils::Assess::SplitUtils
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
 
@@ -38,24 +41,7 @@ module Contrast
                 source = find_source(propagation_node.sources[0], preshift)
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
 
-                separator_length = find_separator_length(propagation_node, preshift)
-
-                current_index = 0
-                target.each do |target_elem|
-                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
-
-                  # Get tags for element from source by element range.
-                  range = current_index...(current_index + target_elem.length)
-                  tags = source_properties.tags_at_range(range)
-
-                  # Set element properties accordingly.
-                  elem_properties.clear_tags
-                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
-                  elem_properties.build_event(propagation_node, target_elem, preshift.object, target, preshift.args, 0)
-                  elem_properties.add_properties(propagation_node.properties)
-
-                  current_index = range.end + separator_length
-                end
+                update_element_properties propagation_node, target, preshift, source_properties
                 nil
               end
 
@@ -160,12 +146,28 @@ module Contrast
                 split_value[split_scope_depth] = target # rubocop:disable Lint/UselessSetterCall
               end
 
-              # Quick hook to the String#split propagation node in our Assess policy
-              #
-              # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
-              def split_node
-                @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                  node.class_name == 'String' && node.method_name == :split && node.instance_method?
+              def update_element_properties propagation_node, target, preshift, source_properties
+                separator_length = find_separator_length(propagation_node, preshift)
+                current_index = 0
+                target.each do |target_elem|
+                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
+
+                  # Get tags for element from source by element range.
+                  range = current_index...(current_index + target_elem.length)
+                  tags = source_properties.tags_at_range(range)
+
+                  # Set element properties accordingly.
+                  elem_properties.clear_tags
+                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              target_elem,
+                                                                              preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  elem_properties.build_event(event_data, 0)
+                  elem_properties.add_properties(propagation_node.properties)
+
+                  current_index = range.end + separator_length
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,9 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/logger'
-require 'contrast/utils/duck_utils'
-require 'contrast/utils/substitution_utils'
+require 'contrast/agent/assess/policy/propagator/substitution_utils'
 
 module Contrast
   module Agent
@@ -18,7 +16,7 @@ module Contrast
           class Substitution
             include Contrast::Components::Logger::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
-            extend Contrast::Utils::SubstitutionUtils
+            extend Contrast::Agent::Assess::Policy::Propagator::SubstitutionUtils
 
             class << self
               # gsub is hard. there are four versions of this method

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # This module is specifically for String#(g)sub propagation
+          #
+          # Disclaimer: there may be a better way, but we're
+          # in a 'get it work' state. hopefully, we'll be in
+          # a 'get it right' state soon.
+          module SubstitutionUtils
+            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
+            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+
+            private
+
+            # Update our properties of the object dependent on the substitution pattern used.
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] instance of PreShift
+            # @param ret [String] the result of the substitution
+            # @param block, the given block
+            # @param global [Boolean] if this was a global or single substitution, optional
+            def substitution_tagger patcher, preshift, ret, block, global = true
+              return ret unless ret
+
+              begin
+                # define here what is used across private methods
+                @_preshift = preshift
+                args = @_preshift.args[1]
+                @_self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
+                @_incoming_tracked = args && determine_tracked(args)
+                @_ret = ret
+                return @_ret unless @_self_tracked || @_incoming_tracked
+
+                @_parent_events = []
+                if block
+                  block_sub
+                elsif args.is_a?(String)
+                  string_sub(args, global)
+                elsif args.is_a?(Hash)
+                  hash_sub
+                else # Enumerator, only for gsub
+                  pattern_gsub
+                end
+
+                self_tracked_handle(@_parent_events)
+                string_build_event(patcher)
+              rescue StandardError => e
+                logger.error('Unable to apply gsub propagator', e)
+              end
+              ret
+            end
+
+            def self_tracked_handle parent_events
+              return unless @_self_tracked
+
+              source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+              parent_event = source_properties&.event
+              parent_events.prepend(parent_event) if parent_event
+            end
+
+            def source
+              @_preshift.object
+            end
+
+            # @param args [String] the new String going into the substitution
+            def determine_tracked args
+              # if there's no arg, it can't be tracked
+              return false unless args
+
+              # if it's a string, just ask if it's tracked
+              case args
+              when String
+                Contrast::Agent::Assess::Tracker.tracked?(args)
+                # if it's a hash, ask if it has a tracked string
+              when Hash
+                args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
+                # this should never happen
+              else
+                false
+              end
+            end
+
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            def string_sub incoming, global
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+              @_parent_events << incoming_properties&.event if incoming_properties&.event
+
+              # We can't efficiently find the places that things were
+              # copied from regexp / captures. Trading accuracy for
+              # performance
+              if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
+                properties.splat_from(source, @_ret) if @_self_tracked
+                return
+              end
+
+              # if it's just a straight insert, that we can do
+              # Copy the tags from us to the return
+              ranges = find_string_sub_insert(properties, incoming, global)
+
+              properties.delete_tags_at_ranges(ranges)
+              properties.shift_tags(ranges)
+              return unless @_incoming_tracked
+              return unless incoming_properties
+
+              tags = incoming_properties.tag_keys
+              ranges.each do |range|
+                tags.each do |tag|
+                  properties.add_tag(tag, range)
+                end
+              end
+            end
+
+            # Find the points at which the new String was placed into the original
+            #
+            # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            # @return [Array<Range>] the Ranges where substitution occurred
+            def find_string_sub_insert properties, incoming, global
+              pattern = @_preshift.args[0]
+              properties.copy_from(source, @_ret)
+              # Figure out where inserts occurred
+              last_idx = 0
+              ranges = []
+              # For each insert, move the tag ranges
+              while last_idx
+                idx = source.index(pattern, last_idx)
+                break unless idx
+
+                last_idx = idx ? idx + 1 : nil
+                start_index = idx
+                end_index = idx + incoming.length
+                ranges << (start_index...end_index)
+                break unless global
+              end
+              ranges
+            end
+
+            def block_sub
+              hash_sub
+            end
+
+            def hash_sub
+              return unless @_self_tracked
+
+              properties = Contrast::Agent::Assess::Tracker.properties!(@_ret)
+              properties&.splat_from(source, @_ret)
+            end
+
+            def pattern_gsub
+              return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              source_properties.tag_keys.each do |key|
+                properties.add_tag(key, 0...1)
+              end
+              parent_event = source_properties.event
+              @_parent_events << parent_event if parent_event
+            end
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            def string_build_event patcher
+              return unless Contrast::Agent::Assess::Tracker.tracked?(@_ret)
+
+              properties = Contrast::Agent::Assess::Tracker.properties(@_ret)
+              args = @_preshift.args
+              event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, @_ret, @_preshift, @_ret, args)
+              properties.build_event(event_data, 2)
+              properties.event.instance_variable_set(:@_parent_events, @_parent_events)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,8 +24,12 @@ module Contrast
 
                 properties.copy_from(preshift.object, ret)
                 handle_tr(policy_node, preshift, ret, properties)
-
-                properties.build_event(policy_node, ret, preshift.object, ret, preshift.args, 1)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
@@ -36,7 +40,8 @@ module Contrast
                 source = preshift.object
                 args = preshift.args
                 properties.splat_from(source, ret)
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new patcher, ret, source, ret, args
+                properties.build_event(event_data)
                 ret
               end
 

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast