contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -8,6 +8,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/propagation_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -15,6 +16,7 @@ module Contrast
       module Policy
         # This class is responsible for the continuation of traces. A Propagator is any method that transforms an
         # untrusted value. In general, these methods work on the String class or a holder of Strings.
+        # rubocop:disable Metrics/ModuleLength
         module PropagationMethod
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::PropagationMethodUtils
@@ -37,7 +39,8 @@ module Contrast
               propagation_node = method_policy.propagation_node
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
+              propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, propagation_data, block)
             end
 
             # I lied above. We had to figure out what the target of the propagation was. Now that we know, we'll
@@ -49,27 +52,33 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
             # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
             #   original function if not nil
-            def apply_propagator propagation_node, preshift, target, object, ret, args, block
+            def apply_propagator propagation_node, preshift, target, propagation_data, block
               return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
+                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node,
+                                                                                     preshift,
+                                                                                     propagation_data.ret)
               elsif propagation_node.action == CUSTOM_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
+                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node,
+                                                                              preshift,
+                                                                              propagation_data.ret,
+                                                                              block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, propagation_data, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_enumerable_propagation(propagation_node, preshift, target, propagation_data, block)
               else
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_cs_properties_propagation(propagation_node, preshift, target, propagation_data, block)
               end
             rescue StandardError => e
               logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
@@ -90,6 +99,10 @@ module Contrast
               end
             end
 
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
             # If this patcher has tags, remove them from the entire target
             #
             # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
@@ -113,6 +126,7 @@ module Contrast
             # @return [Boolean]
             def propagation_possible? propagation_node, target
               return false unless propagation_node && valid_target?(target, propagation_node)
+              return false unless context_available? || Contrast::ASSESS.non_request_tracking?
               return false unless valid_length?(target, propagation_node.action)
 
               true
@@ -135,14 +149,15 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_hash_propagation propagation_node, preshift, target, propagation_data, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, key, propagation_data, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -153,15 +168,16 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_enumerable_propagation propagation_node, preshift, target, propagation_data, block
               target.each do |value|
                 next if target == value
 
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -172,11 +188,12 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param _block [Block] the Block passed to the original method
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
+            def handle_cs_properties_propagation propagation_node, preshift, target, propagation_data, _block
               return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
               return unless (propagation_class = find_propagation_class(propagation_node))
@@ -184,7 +201,7 @@ module Contrast
               restore_frozen_state = false
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless can_handle_frozen?(propagation_node)
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(propagation_data.ret))
 
                 restore_frozen_state = true
                 ret = dup
@@ -195,6 +212,10 @@ module Contrast
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
               propagation_class.propagate(propagation_node, preshift, target)
+              update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
+            end
+
+            def update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
               # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
               apply_tags(propagation_node, target)
               # Even though we skipped propagating tags from the source if they were included in untags, the target may
@@ -204,7 +225,12 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.add_properties(propagation_node.properties)
-              properties.build_event(propagation_node, target, object, ret, args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                          target,
+                                                                          propagation_data.object,
+                                                                          ret,
+                                                                          propagation_data.args)
+              properties.build_event(event_data)
               logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
               restore_frozen_state ? ret : nil
             end
@@ -235,6 +261,7 @@ module Contrast
             end
           end
         end
+        # rubocop:enable Metrics/ModuleLength
       end
     end
   end

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy_node'

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -47,7 +47,11 @@ module Contrast
 
                   # TODO: RUBY-540 handle sanitization, handle nested objects
                   Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                  properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              value, preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  properties.build_event(event_data)
                   next unless tracked_value?(value)
 
                   tainted_columns[key] = properties

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -25,7 +25,10 @@ module Contrast
                                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                                     preshift.object
                                   else
-                                    preshift.args[int]
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
                                   end
 
                 # Find the first difference between the source to which

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -96,8 +96,12 @@ module Contrast
                 applicable_tags.each do |tag_name, tag_ranges|
                   return_properties.set_tags(tag_name, tag_ranges)
                 end
-                return_properties.build_event(propagation_node, return_value, preshift.object, return_value,
-                                              preshift.args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                            return_value,
+                                                                            preshift.object,
+                                                                            return_value,
+                                                                            preshift.args)
+                return_properties.build_event(event_data)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -26,7 +26,8 @@ module Contrast
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
 
                 range = determine_select_range(source, args)
                 return unless range

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
@@ -6,6 +6,8 @@ require 'contrast/components/agent'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/utils/thread_tracker'
+require 'contrast/utils/assess/split_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -17,6 +19,7 @@ module Contrast
           class Split < Contrast::Agent::Assess::Policy::Propagator::Base
             extend Contrast::Components::Scope::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
+            extend Contrast::Utils::Assess::SplitUtils
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
 
@@ -38,24 +41,7 @@ module Contrast
                 source = find_source(propagation_node.sources[0], preshift)
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
 
-                separator_length = find_separator_length(propagation_node, preshift)
-
-                current_index = 0
-                target.each do |target_elem|
-                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
-
-                  # Get tags for element from source by element range.
-                  range = current_index...(current_index + target_elem.length)
-                  tags = source_properties.tags_at_range(range)
-
-                  # Set element properties accordingly.
-                  elem_properties.clear_tags
-                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
-                  elem_properties.build_event(propagation_node, target_elem, preshift.object, target, preshift.args, 0)
-                  elem_properties.add_properties(propagation_node.properties)
-
-                  current_index = range.end + separator_length
-                end
+                update_element_properties propagation_node, target, preshift, source_properties
                 nil
               end
 
@@ -160,12 +146,28 @@ module Contrast
                 split_value[split_scope_depth] = target # rubocop:disable Lint/UselessSetterCall
               end
 
-              # Quick hook to the String#split propagation node in our Assess policy
-              #
-              # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
-              def split_node
-                @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                  node.class_name == 'String' && node.method_name == :split && node.instance_method?
+              def update_element_properties propagation_node, target, preshift, source_properties
+                separator_length = find_separator_length(propagation_node, preshift)
+                current_index = 0
+                target.each do |target_elem|
+                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
+
+                  # Get tags for element from source by element range.
+                  range = current_index...(current_index + target_elem.length)
+                  tags = source_properties.tags_at_range(range)
+
+                  # Set element properties accordingly.
+                  elem_properties.clear_tags
+                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              target_elem,
+                                                                              preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  elem_properties.build_event(event_data, 0)
+                  elem_properties.add_properties(propagation_node.properties)
+
+                  current_index = range.end + separator_length
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,9 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/logger'
-require 'contrast/utils/duck_utils'
-require 'contrast/utils/substitution_utils'
+require 'contrast/agent/assess/policy/propagator/substitution_utils'
 
 module Contrast
   module Agent
@@ -18,7 +16,7 @@ module Contrast
           class Substitution
             include Contrast::Components::Logger::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
-            extend Contrast::Utils::SubstitutionUtils
+            extend Contrast::Agent::Assess::Policy::Propagator::SubstitutionUtils
 
             class << self
               # gsub is hard. there are four versions of this method