contrast-agent 4.2.0 → 4.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (106) hide show
  1. checksums.yaml +4 -4
  2. data/Rakefile +1 -0
  3. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +22 -10
  4. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +4 -3
  5. data/lib/contrast/agent/assess/contrast_event.rb +49 -130
  6. data/lib/contrast/agent/assess/contrast_object.rb +51 -0
  7. data/lib/contrast/agent/assess/events/source_event.rb +4 -9
  8. data/lib/contrast/agent/assess/policy/patcher.rb +4 -3
  9. data/lib/contrast/agent/assess/policy/policy_node.rb +31 -59
  10. data/lib/contrast/agent/assess/policy/preshift.rb +3 -3
  11. data/lib/contrast/agent/assess/policy/propagation_method.rb +13 -19
  12. data/lib/contrast/agent/assess/policy/propagation_node.rb +12 -24
  13. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -2
  14. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -2
  15. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  16. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -3
  17. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -2
  18. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -2
  19. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  20. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -2
  21. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -2
  22. data/lib/contrast/agent/assess/policy/propagator/remove.rb +2 -4
  23. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -2
  24. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -2
  25. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -4
  26. data/lib/contrast/agent/assess/policy/propagator/splat.rb +2 -4
  27. data/lib/contrast/agent/assess/policy/propagator/split.rb +73 -117
  28. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +11 -11
  29. data/lib/contrast/agent/assess/policy/propagator/trim.rb +3 -7
  30. data/lib/contrast/agent/assess/policy/source_method.rb +2 -14
  31. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +5 -8
  32. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  33. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  34. data/lib/contrast/agent/assess/property/tagged.rb +21 -15
  35. data/lib/contrast/agent/assess/rule/redos.rb +1 -1
  36. data/lib/contrast/agent/assess/tracker.rb +16 -18
  37. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +7 -0
  38. data/lib/contrast/agent/middleware.rb +50 -1
  39. data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
  40. data/lib/contrast/agent/patching/policy/patch.rb +4 -4
  41. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +47 -1
  42. data/lib/contrast/agent/protect/policy/rule_applicator.rb +53 -0
  43. data/lib/contrast/agent/protect/rule/base.rb +63 -14
  44. data/lib/contrast/agent/protect/rule/cmd_injection.rb +3 -3
  45. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -4
  46. data/lib/contrast/agent/protect/rule/deserialization.rb +4 -1
  47. data/lib/contrast/agent/protect/rule/no_sqli.rb +3 -3
  48. data/lib/contrast/agent/protect/rule/sqli.rb +3 -3
  49. data/lib/contrast/agent/protect/rule/xxe.rb +32 -11
  50. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +10 -6
  51. data/lib/contrast/agent/reaction_processor.rb +1 -1
  52. data/lib/contrast/agent/response.rb +5 -5
  53. data/lib/contrast/agent/rewriter.rb +3 -3
  54. data/lib/contrast/agent/scope.rb +33 -13
  55. data/lib/contrast/agent/static_analysis.rb +13 -7
  56. data/lib/contrast/agent/version.rb +1 -1
  57. data/lib/contrast/api/decorators/library.rb +1 -0
  58. data/lib/contrast/api/decorators/library_usage_update.rb +1 -0
  59. data/lib/contrast/api/decorators/trace_event.rb +19 -31
  60. data/lib/contrast/api/decorators/trace_event_object.rb +11 -3
  61. data/lib/contrast/api/decorators/trace_event_signature.rb +27 -5
  62. data/lib/contrast/api/decorators/user_input.rb +2 -1
  63. data/lib/contrast/common_agent_configuration.rb +1 -1
  64. data/lib/contrast/components/assess.rb +36 -0
  65. data/lib/contrast/components/interface.rb +5 -3
  66. data/lib/contrast/components/scope.rb +23 -0
  67. data/lib/contrast/components/settings.rb +3 -3
  68. data/lib/contrast/config/assess_configuration.rb +2 -1
  69. data/lib/contrast/extension/assess/array.rb +1 -2
  70. data/lib/contrast/extension/assess/erb.rb +1 -3
  71. data/lib/contrast/extension/assess/exec_trigger.rb +1 -1
  72. data/lib/contrast/extension/assess/fiber.rb +2 -3
  73. data/lib/contrast/extension/assess/hash.rb +4 -2
  74. data/lib/contrast/extension/assess/kernel.rb +1 -2
  75. data/lib/contrast/extension/assess/marshal.rb +34 -26
  76. data/lib/contrast/extension/assess/regexp.rb +3 -8
  77. data/lib/contrast/extension/assess/string.rb +1 -2
  78. data/lib/contrast/framework/base_support.rb +51 -53
  79. data/lib/contrast/framework/manager.rb +3 -2
  80. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  81. data/lib/contrast/framework/rack/support.rb +2 -1
  82. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  83. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  84. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
  85. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
  86. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
  87. data/lib/contrast/framework/rails/support.rb +2 -1
  88. data/lib/contrast/framework/sinatra/support.rb +3 -2
  89. data/lib/contrast/logger/application.rb +0 -3
  90. data/lib/contrast/utils/duck_utils.rb +1 -1
  91. data/lib/contrast/utils/heap_dump_util.rb +1 -1
  92. data/lib/contrast/utils/object_share.rb +3 -3
  93. data/lib/contrast/utils/preflight_util.rb +1 -1
  94. data/lib/contrast/utils/prevent_serialization.rb +1 -1
  95. data/lib/contrast/utils/resource_loader.rb +1 -1
  96. data/lib/contrast/utils/sha256_builder.rb +2 -2
  97. data/lib/contrast/utils/string_utils.rb +1 -1
  98. data/lib/contrast/utils/tag_util.rb +9 -13
  99. data/resources/assess/policy.json +9 -9
  100. data/resources/deadzone/policy.json +156 -0
  101. data/resources/protect/policy.json +12 -0
  102. data/ruby-agent.gemspec +9 -6
  103. data/service_executables/VERSION +1 -1
  104. data/service_executables/linux/contrast-service +0 -0
  105. data/service_executables/mac/contrast-service +0 -0
  106. metadata +68 -25
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: contrast-agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.2.0
4
+ version: 4.3.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
13
13
  autorequire:
14
14
  bindir: exe
15
15
  cert_chain: []
16
- date: 2020-12-18 00:00:00.000000000 Z
16
+ date: 2021-01-29 00:00:00.000000000 Z
17
17
  dependencies:
18
18
  - !ruby/object:Gem::Dependency
19
19
  name: amazing_print
@@ -29,6 +29,20 @@ dependencies:
29
29
  - - ">="
30
30
  - !ruby/object:Gem::Version
31
31
  version: '0'
32
+ - !ruby/object:Gem::Dependency
33
+ name: benchmark-ips
34
+ requirement: !ruby/object:Gem::Requirement
35
+ requirements:
36
+ - - ">="
37
+ - !ruby/object:Gem::Version
38
+ version: '0'
39
+ type: :development
40
+ prerelease: false
41
+ version_requirements: !ruby/object:Gem::Requirement
42
+ requirements:
43
+ - - ">="
44
+ - !ruby/object:Gem::Version
45
+ version: '0'
32
46
  - !ruby/object:Gem::Dependency
33
47
  name: bundler
34
48
  requirement: !ruby/object:Gem::Requirement
@@ -215,16 +229,16 @@ dependencies:
215
229
  name: rake
216
230
  requirement: !ruby/object:Gem::Requirement
217
231
  requirements:
218
- - - "~>"
232
+ - - ">="
219
233
  - !ruby/object:Gem::Version
220
- version: '10.0'
234
+ version: 12.3.3
221
235
  type: :development
222
236
  prerelease: false
223
237
  version_requirements: !ruby/object:Gem::Requirement
224
238
  requirements:
225
- - - "~>"
239
+ - - ">="
226
240
  - !ruby/object:Gem::Version
227
- version: '10.0'
241
+ version: 12.3.3
228
242
  - !ruby/object:Gem::Dependency
229
243
  name: rake-compiler
230
244
  requirement: !ruby/object:Gem::Requirement
@@ -287,42 +301,70 @@ dependencies:
287
301
  requirements:
288
302
  - - '='
289
303
  - !ruby/object:Gem::Version
290
- version: 0.93.1
304
+ version: 1.6.1
291
305
  type: :development
292
306
  prerelease: false
293
307
  version_requirements: !ruby/object:Gem::Requirement
294
308
  requirements:
295
309
  - - '='
296
310
  - !ruby/object:Gem::Version
297
- version: 0.93.1
311
+ version: 1.6.1
298
312
  - !ruby/object:Gem::Dependency
299
313
  name: rubocop-performance
300
314
  requirement: !ruby/object:Gem::Requirement
301
315
  requirements:
302
316
  - - '='
303
317
  - !ruby/object:Gem::Version
304
- version: 1.8.1
318
+ version: 1.9.1
305
319
  type: :development
306
320
  prerelease: false
307
321
  version_requirements: !ruby/object:Gem::Requirement
308
322
  requirements:
309
323
  - - '='
310
324
  - !ruby/object:Gem::Version
311
- version: 1.8.1
325
+ version: 1.9.1
326
+ - !ruby/object:Gem::Dependency
327
+ name: rubocop-rails
328
+ requirement: !ruby/object:Gem::Requirement
329
+ requirements:
330
+ - - '='
331
+ - !ruby/object:Gem::Version
332
+ version: 2.9.1
333
+ type: :development
334
+ prerelease: false
335
+ version_requirements: !ruby/object:Gem::Requirement
336
+ requirements:
337
+ - - '='
338
+ - !ruby/object:Gem::Version
339
+ version: 2.9.1
340
+ - !ruby/object:Gem::Dependency
341
+ name: rubocop-rake
342
+ requirement: !ruby/object:Gem::Requirement
343
+ requirements:
344
+ - - '='
345
+ - !ruby/object:Gem::Version
346
+ version: 0.5.1
347
+ type: :development
348
+ prerelease: false
349
+ version_requirements: !ruby/object:Gem::Requirement
350
+ requirements:
351
+ - - '='
352
+ - !ruby/object:Gem::Version
353
+ version: 0.5.1
312
354
  - !ruby/object:Gem::Dependency
313
355
  name: rubocop-rspec
314
356
  requirement: !ruby/object:Gem::Requirement
315
357
  requirements:
316
358
  - - '='
317
359
  - !ruby/object:Gem::Version
318
- version: 1.43.2
360
+ version: 2.1.0
319
361
  type: :development
320
362
  prerelease: false
321
363
  version_requirements: !ruby/object:Gem::Requirement
322
364
  requirements:
323
365
  - - '='
324
366
  - !ruby/object:Gem::Version
325
- version: 1.43.2
367
+ version: 2.1.0
326
368
  - !ruby/object:Gem::Dependency
327
369
  name: ruby-debug-ide
328
370
  requirement: !ruby/object:Gem::Requirement
@@ -341,16 +383,16 @@ dependencies:
341
383
  name: simplecov
342
384
  requirement: !ruby/object:Gem::Requirement
343
385
  requirements:
344
- - - "~>"
386
+ - - '='
345
387
  - !ruby/object:Gem::Version
346
- version: '0.18'
388
+ version: 0.20.0
347
389
  type: :development
348
390
  prerelease: false
349
391
  version_requirements: !ruby/object:Gem::Requirement
350
392
  requirements:
351
- - - "~>"
393
+ - - '='
352
394
  - !ruby/object:Gem::Version
353
- version: '0.18'
395
+ version: 0.20.0
354
396
  - !ruby/object:Gem::Dependency
355
397
  name: sinatra
356
398
  requirement: !ruby/object:Gem::Requirement
@@ -499,20 +541,20 @@ executables:
499
541
  - contrast_service
500
542
  extensions:
501
543
  - ext/cs__common/extconf.rb
502
- - ext/cs__assess_active_record_named/extconf.rb
503
- - ext/cs__assess_fiber_track/extconf.rb
504
- - ext/cs__assess_basic_object/extconf.rb
544
+ - ext/cs__assess_string_interpolation26/extconf.rb
505
545
  - ext/cs__contrast_patch/extconf.rb
546
+ - ext/cs__assess_module/extconf.rb
547
+ - ext/cs__assess_marshal_module/extconf.rb
548
+ - ext/cs__assess_hash/extconf.rb
506
549
  - ext/cs__assess_array/extconf.rb
550
+ - ext/cs__assess_basic_object/extconf.rb
507
551
  - ext/cs__protect_kernel/extconf.rb
508
- - ext/cs__assess_kernel/extconf.rb
552
+ - ext/cs__assess_string/extconf.rb
553
+ - ext/cs__assess_active_record_named/extconf.rb
509
554
  - ext/cs__assess_regexp/extconf.rb
510
- - ext/cs__assess_hash/extconf.rb
511
- - ext/cs__assess_module/extconf.rb
512
- - ext/cs__assess_string_interpolation26/extconf.rb
513
- - ext/cs__assess_marshal_module/extconf.rb
514
555
  - ext/cs__assess_yield_track/extconf.rb
515
- - ext/cs__assess_string/extconf.rb
556
+ - ext/cs__assess_fiber_track/extconf.rb
557
+ - ext/cs__assess_kernel/extconf.rb
516
558
  extra_rdoc_files: []
517
559
  files:
518
560
  - ".clang-format"
@@ -709,6 +751,7 @@ files:
709
751
  - lib/contrast/agent.rb
710
752
  - lib/contrast/agent/assess.rb
711
753
  - lib/contrast/agent/assess/contrast_event.rb
754
+ - lib/contrast/agent/assess/contrast_object.rb
712
755
  - lib/contrast/agent/assess/events/event_factory.rb
713
756
  - lib/contrast/agent/assess/events/source_event.rb
714
757
  - lib/contrast/agent/assess/finalizers/freeze.rb