contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -1,35 +0,0 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
-
-module Contrast
-  module Framework
-    module Rails
-      module Rewrite
-        # Used to monkey patch all the inherited calls in action_pack
-        # TODO: RUBY-714 remove w/ EOL of 2.5
-        # @deprecated Changes to this class are discouraged as this approach is
-        #   being phased out with support for those language versions.
-        module ActiveRecordTimeZoneInherited
-          def self.instrument
-            @_instrument ||= begin
-              ::ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods.class_eval do
-                private
-
-                alias_method :cs__patched_inherited, :inherited
-                def inherited klass # rubocop:disable Lint/MissingSuper
-                  klass&.instance_variable_set(:@cs__defining_class, true)
-                  cs__patched_inherited(klass) # This calls the original inherited, which should handle super as needed.
-                ensure
-                  klass&.instance_variable_set(:@cs__defining_class, false)
-                end
-              end
-              true
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -1,82 +0,0 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
-
-require 'parser/current'
-module Contrast
-  module Utils
-    # This utility allows us to parse and rewrite the AST in Ruby 2.5,
-    # allowing us to track String interpolation propagation by replacing those
-    # events with String#+ events instead.
-    #
-    # TODO: RUBY-714 remove w/ EOL of 2.5
-    # @deprecated Changes to this class are discouraged as this approach is
-    #   being phased out with support for those language versions.
-    class RubyAstRewriter < Parser::TreeRewriter
-      VARIABLES = %i[ivar cvar gvar].cs__freeze
-
-      # Rewrite the given source_string, converting the interpolation action
-      # therein to a concatenation action
-      #
-      # @param source_string [String] the String to rewrite
-      # @return [String] either the rewritten string or the original on error.
-      def rewrite source_string
-        ast = Parser::CurrentRuby.parse(source_string)
-        buffer = Parser::Source::Buffer.new('rewrite')
-        buffer.source = source_string
-        begin
-          super(buffer, ast)
-        rescue StandardError => _e
-          source_string
-        end
-      end
-
-      # This overloads the on_dstr method in Parser::AST::Processor to handle
-      # the replace within the given node.
-      def on_dstr node
-        return if node.children.all? { |child_node| child_node.type == :str }
-        new_content = +'('
-        idx = 0
-        while idx < node.children.length
-          #node.children.each_with_index do |child_node, index|
-          child_node = node.children[idx]
-          # A begin node looks like #{some_code} in ruby, we do a substring
-          # from [2...-1] to get rid of the #{ & trailing }.
-          if child_node.type == :begin
-            code = child_node.
-              location.
-              expression.
-              source_buffer.
-              source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
-            code = code[2...-1]
-            new_content += "((#{ code }).to_s)"
-
-            # For interpolations that use class, instance, or global variables,
-            # those are NOT within a begin block, but instead are a ivar, cvar,
-            # or gvar node, not stripping of interpolation markers required.
-          elsif VARIABLES.include?(child_node.type)
-            variable = child_node.children.first
-            new_content << "((#{ variable }).to_s)"
-
-            # When interpolation includes strings before or after an
-            # interpolation they are simple :str nodes, in order to preserve
-            # escaping we need to do a dump of the string value.
-          elsif child_node.type == :str
-            literal_value = child_node.children.first
-            literal_value = literal_value.dump[1...-1]
-            new_content <<  "\"#{ literal_value }\""
-          end
-          new_content << ' + ' unless idx == node.children.length - 1
-          idx += 1
-        end
-        new_content << ')'
-        if node.location.cs__respond_to?(:heredoc_body)
-          replace(node.location.heredoc_body, new_content)
-        else
-          replace(node.location.expression, new_content)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/substitution_utils.rb

@@ -1,167 +0,0 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # used in Contrast::Agent::Assesss::Policy::Propagator::Substitution
-    module SubstitutionUtils
-      CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
-      CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
-
-      private
-
-      def substitution_tagger patcher, preshift, ret, block, global = true
-        return ret unless ret
-
-        begin
-          source = preshift.object
-          self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
-          args = preshift.args[1]
-          incoming_tracked = args && determine_tracked(args)
-          return ret unless self_tracked || incoming_tracked
-
-          parent_events = []
-          if block
-            block_sub(self_tracked, source, ret)
-          elsif args.is_a?(String)
-            string_sub(parent_events, self_tracked, preshift, ret, args, incoming_tracked, global)
-          elsif args.is_a?(Hash)
-            hash_sub(self_tracked, source, ret)
-          else # Enumerator, only for gsub
-            pattern_gsub(parent_events, preshift, ret)
-          end
-
-          self_tracked_handle self_tracked, source, parent_events
-          string_build_event(parent_events, patcher, preshift, ret)
-        rescue StandardError => e
-          logger.error('Unable to apply gsub propagator', e)
-        end
-        ret
-      end
-
-      def self_tracked_handle self_tracked, source, parent_events
-        return unless self_tracked
-
-        source_properties = Contrast::Agent::Assess::Tracker.properties(source)
-        parent_event = source_properties&.event
-        parent_events.prepend(parent_event) if parent_event
-      end
-
-      def determine_tracked args
-        # if there's no arg, it can't be tracked
-        return false unless args
-
-        # if it's a string, just ask if it's tracked
-        case args
-        when String
-          Contrast::Agent::Assess::Tracker.tracked?(args)
-          # if it's a hash, ask if it has a tracked string
-        when Hash
-          args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
-          # this should never happen
-        else
-          false
-        end
-      end
-
-      def string_sub parent_events, self_tracked, preshift, ret, incoming, incoming_tracked, global
-        return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-        incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
-        parent_events << incoming_properties&.event if incoming_properties&.event
-
-        source = preshift.object
-
-        # We can't efficiently find the places that things were
-        # copied from regexp / captures. Trading accuracy for
-        # performance
-        if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
-          properties.splat_from(source, ret) if self_tracked
-          return
-        end
-
-        # if it's just a straight insert, that we can do
-        # Copy the tags from us to the return
-        ranges = find_string_sub_insert(properties, preshift, incoming, ret, global)
-
-        properties.delete_tags_at_ranges(ranges)
-        properties.shift_tags(ranges)
-        return unless incoming_tracked
-        return unless incoming_properties
-
-        tags = incoming_properties.tag_keys
-        ranges.each do |range|
-          tags.each do |tag|
-            properties.add_tag(tag, range)
-          end
-        end
-      end
-
-      # Find the points at which the new String was placed into the original
-      #
-      # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
-      # @param preshift [Contrast::Agent::Assess::PreShift] the capture of the state of the code just prior to
-      #   the invocation of the patched method
-      # @param incoming [String] the new String going into the substitution
-      # @param ret [String] the result of the substitution
-      # @param global [Boolean] if this was a global or single substitution
-      # @return [Array<Range>] the Ranges where substitution occurred
-      def find_string_sub_insert properties, preshift, incoming, ret, global
-        pattern = preshift.args[0]
-        source = preshift.object
-
-        properties.copy_from(source, ret)
-        # Figure out where inserts occurred
-        last_idx = 0
-        ranges = []
-        # For each insert, move the tag ranges
-        while last_idx
-          idx = source.index(pattern, last_idx)
-          break unless idx
-
-          last_idx = idx ? idx + 1 : nil
-          start_index = idx
-          end_index = idx + incoming.length
-          ranges << (start_index...end_index)
-          break unless global
-        end
-        ranges
-      end
-
-      def block_sub self_tracked, source, ret
-        return unless self_tracked
-
-        properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-        properties&.splat_from(source, ret)
-      end
-
-      def hash_sub self_tracked, source, ret
-        return unless self_tracked
-
-        properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-        properties&.splat_from(source, ret)
-      end
-
-      def pattern_gsub parent_events, preshift, ret
-        source = preshift.object
-        return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
-        return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-        source_properties.tag_keys.each do |key|
-          properties.add_tag(key, 0...1)
-        end
-        parent_event = source_properties.event
-        parent_events << parent_event if parent_event
-      end
-
-      def string_build_event parent_events, patcher, preshift, ret
-        return unless Contrast::Agent::Assess::Tracker.tracked?(ret)
-
-        properties = Contrast::Agent::Assess::Tracker.properties(ret)
-        args = preshift.args
-        properties.build_event(patcher, ret, preshift.object, ret, args, 2)
-        properties.event.instance_variable_set(:@_parent_events, parent_events)
-      end
-    end
-  end
-end