contrast-agent 4.3.0 → 4.5.0

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'
@@ -27,6 +27,9 @@ module Contrast
               class_name = klass.cs__name
               instance_methods = klass.instance_methods
               instance_methods.concat(klass.private_instance_methods)
+              current_context = Contrast::Agent::REQUEST_TRACKER.current
+              current_request = current_context&.request
+
               tainted_columns.each_pair do |field, properties|
                 next unless properties
 
@@ -34,14 +37,13 @@ module Contrast
                 # Move on if we already know about this Dynamic Source
                 next if Contrast::Agent::Assess::Policy::Policy.instance.find_source_node(class_name, method_name, true)
 
-                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys))
+                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys), current_request)
                 Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
                 method_policy = build_source_policy(method_name, dynamic_source_node)
                 Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
-                current_context = Contrast::Agent::REQUEST_TRACKER.current
                 next unless current_context
 
-                dynamic_source = create_dynamic_source(current_context, dynamic_source_node, field, properties)
+                dynamic_source = create_dynamic_source(current_request, dynamic_source_node, field, properties)
                 node_id = Contrast::Utils::StringUtils.force_utf8(dynamic_source_node.id)
                 current_context.activity.dynamic_sources[node_id] = dynamic_source
               end
@@ -56,8 +58,10 @@ module Contrast
             # @param class_name [String] the name of the Class to patch
             # @param method_name [Symbol] the name of the Method to patch
             # @param tags [Set<String>] the tags this event should apply
+            # @param request [Contrast::Agent::Request] the request during
+            #  which this source is to be created.
             # @return [Contrast::Agent::Assess::Policy::SourceNode]
-            def create_source_node class_name, method_name, tags
+            def create_source_node class_name, method_name, tags, request
               node = Contrast::Agent::Assess::Policy::SourceNode.new
               node.class_name = class_name
               node.instance_method = true
@@ -72,8 +76,7 @@ module Contrast
               node.add_property(READ_TABLE, class_name)
               node.add_property(READ_COLUMN, method_name)
               node.add_property(WRITE_QUERY_TIME, Contrast::Utils::Timer.now_ms)
-              url = Contrast::Agent::REQUEST_TRACKER.current&.request&.normalized_uri
-              node.add_property(WRITE_QUERY_URL, url)
+              node.add_property(WRITE_QUERY_URL, request&.normalized_uri)
               node
             end
 
@@ -92,8 +95,8 @@ module Contrast
               method_policy
             end
 
-            # @param current_context [Contrast::Agent::RequestContext] the
-            #   context of the request in which this source is to be created.
+            # @param request [Contrast::Agent::Request] the request during
+            #   which this source is to be created.
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
             #   the SourceNode that applies to this method
             # @param field [String] the name of the method to which this source
@@ -104,22 +107,34 @@ module Contrast
             # @return [Contrast::Api::Dtm::DynamicSource] the message to send
             #   to the Service to allow it to report the events leading up to
             #   the creation of the Dynamic Source
-            def create_dynamic_source current_context, source_node, field, properties
+            def create_dynamic_source request, source_node, field, properties
               dynamic_source = Contrast::Api::Dtm::DynamicSource.new
               dynamic_source.class_name = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
               dynamic_source.method_name = Contrast::Utils::StringUtils.force_utf8(field)
               dynamic_source.instance_method = source_node.instance_method?
               dynamic_source.target = Contrast::Utils::StringUtils.force_utf8(source_node.target_string)
+              append_properties!(dynamic_source, request, source_node, field)
+              append_events!(dynamic_source, properties.event)
+              dynamic_source
+            end
+
+            # Append the properties needed to reconstruct the given DynamicSource in other dataflows and for rendering
+            # in TeamServer
+            #
+            # @param dynamic_source [Contrast::Api::Dtm::DynamicSource] the message to send to the Service to allow it
+            #   to report the events leading up to the creation of the Dynamic Source.
+            # @param request [Contrast::Agent::Request] the request during which this source is to be created.
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the SourceNode that applies to this
+            #   method.
+            # @param field [String] the name of the method to which this source applies.
+            def append_properties! dynamic_source, request, source_node, field
               dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
               dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
               dynamic_source.properties[WRITE_QUERY_TIME] = Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
-              url = current_context.request.normalized_uri
-              dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(url)
-              append_events(dynamic_source, properties.event)
-              dynamic_source
+              dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
             end
 
-            def append_events dynamic_source, event
+            def append_events! dynamic_source, event
               return unless event
 
               event.parent_events&.each do |parent_event|

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy'

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'json'

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -86,10 +86,6 @@ module Contrast
                 SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
             }.cs__freeze
 
-            def context_available?
-              !!Contrast::Agent::REQUEST_TRACKER.current
-            end
-
             # I lied above. We had to figure out what the target of the
             # propagation was. Now that we know, we'll actually do things to
             # it. Note that the return of this method will replace the original
@@ -225,7 +221,7 @@ module Contrast
 
             # This is checked right before actual propagation
             def propagation_possible? propagation_node, target
-              return false unless context_available? && propagation_node && valid_target?(target, propagation_node)
+              return false unless propagation_node && valid_target?(target, propagation_node)
               return false unless valid_length?(target, propagation_node.action)
 
               true
@@ -258,22 +254,12 @@ module Contrast
             def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
               return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
+              return unless (propagation_class = find_propagation_class(propagation_node))
 
-              propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil)
-              unless propagation_class
-                logger.warn(
-                    'Unknown propagation action received. Unable to propagate.',
-                    node_id: propagation_node.id,
-                    action: propagation_node.action)
-                return
-              end
               restore_frozen_state = false
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
-                return unless ASSESS.track_frozen_sources?
-                return unless propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-
-                dup = safe_dup(ret)
-                return unless dup
+                return unless can_handle_frozen?(propagation_node)
+                return unless (dup = safe_dup(ret))
 
                 restore_frozen_state = true
                 ret = dup
@@ -302,6 +288,31 @@ module Contrast
                            target_id: target.__id__)
               restore_frozen_state ? ret : nil
             end
+
+            # Find the propagation class from the given node, if one exists.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs a
+            #   propagation event.
+            # @return [Contrast::Agent::Assess::Policy::Propagator, nil]
+            def find_propagation_class propagation_node
+              unless (propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil))
+                logger.warn(
+                    'Unknown propagation action received. Unable to propagate.',
+                    node_id: propagation_node.id,
+                    action: propagation_node.action)
+              end
+              propagation_class
+            end
+
+            # We can handle frozen propagation iff we're allowed to, as determined by configuration, and the target of
+            # the propagation is a return, as that's a replaceable value.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs a
+            #   propagation event.
+            # @return [Boolean]
+            def can_handle_frozen? propagation_node
+              ASSESS.track_frozen_sources? && propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy_node'

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -29,23 +29,38 @@ module Contrast
                 if source1.length == target.length
                   properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
-                  # find original in the target, copy tags to the new position in
-                  # target
-                  original_start_index = target.index(source1)
-                  properties.copy_from(source1, target, original_start_index, propagation_node.untags)
+                  handle_append(propagation_node, source1, source2, target, properties)
+                end
+                properties.cleanup_tags
+              end
 
-                  start = original_start_index + source1.length
-                  while start < target.length
-                    properties.copy_from(source2, target, start, propagation_node.untags)
-                    start += source2.length
-                    next unless start > target.length
+              private
 
-                    properties.tags_at(start - source2.length).each do |tag|
-                      tag.update_end(target.length)
-                    end
+              # Given the append operation on source 1 added source 2 to it, changing the target output, modify the
+              # tags on the target to account for the change.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node responsible for the
+              #   propagation action required by this method
+              # @param source1 [Object] the thing being appended to
+              # @param source2 [Object] the thing being appended
+              # @param target [Object] the result of the append operation
+              # @param properties [Contrast::Agent::Assess::Properties] the properties of the target
+              def handle_append propagation_node, source1, source2, target, properties
+                # find original in the target, copy tags to the new position in
+                # target
+                original_start_index = target.index(source1)
+                properties.copy_from(source1, target, original_start_index, propagation_node.untags)
+
+                start = original_start_index + source1.length
+                while start < target.length
+                  properties.copy_from(source2, target, start, propagation_node.untags)
+                  start += source2.length
+                  next unless start > target.length
+
+                  properties.tags_at(start - source2.length).each do |tag|
+                    tag.update_end(target.length)
                   end
                 end
-                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -24,23 +24,8 @@ module Contrast
 
                 known_tainted = ASSESS.tainted_columns[class_name]
                 propagation_node.sources.each do |source|
-                  arg = preshift.args[source]
-                  next unless arg.cs__respond_to?(:each_pair)
-
-                  arg.each_pair do |key, value|
-                    next unless value
-                    next if known_tainted&.include?(key)
-                    next unless (properties = Contrast::Agent::Assess::Tracker.properties!(value))
-
-                    # TODO: RUBY-540 handle sanitization, handle nested objects
-                    Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                    properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
-                    next unless tracked_value?(value)
-
-                    tainted_columns[key] = properties
-                  end
+                  handle_write(propagation_node, source, preshift, target, known_tainted, tainted_columns)
                 end
-
                 return if tainted_columns.empty?
 
                 if known_tainted
@@ -51,6 +36,26 @@ module Contrast
 
                 Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns
               end
+
+              private
+
+              def handle_write propagation_node, source, preshift, target, known_tainted, tainted_columns
+                arg = preshift.args[source]
+                return unless arg.cs__respond_to?(:each_pair)
+
+                arg.each_pair do |key, value|
+                  next unless value
+                  next if known_tainted&.include?(key)
+                  next unless (properties = Contrast::Agent::Assess::Tracker.properties!(value))
+
+                  # TODO: RUBY-540 handle sanitization, handle nested objects
+                  Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
+                  properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                  next unless tracked_value?(value)
+
+                  tainted_columns[key] = properties
+                end
+              end
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,19 +19,7 @@ module Contrast
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                     tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
-                    arg = preshift.args[source]
-                    if arg.is_a?(String)
-                      tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
-                    elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
-                      arg.each_pair do |key, value|
-                        tracked_inputs << key if tracked_value?(key)
-                        tracked_inputs << value if tracked_value?(value)
-                      end
-                    elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
-                      arg.each do |value|
-                        tracked_inputs << value if tracked_value?(value)
-                      end
-                    end
+                    find_argument_inputs(tracked_inputs, preshift.args[source])
                   end
                 end
 
@@ -50,6 +38,28 @@ module Contrast
                   properties.splat_from(input, target)
                 end
               end
+
+              private
+
+              # The arguments to the splat method are complex and of multiple types. As such, we need to handle
+              # Strings and iterables to determine the tracked inputs on which to act.
+              #
+              # @param tracked_inputs [Array] storage for the inputs to act on later
+              # @param arg [Object] an input to the method which act as sources for this propagation.
+              def find_argument_inputs tracked_inputs, arg
+                if arg.is_a?(String)
+                  tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
+                elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
+                  arg.each_pair do |key, value|
+                    tracked_inputs << key if tracked_value?(key)
+                    tracked_inputs << value if tracked_value?(value)
+                  end
+                elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
+                  arg.each do |value|
+                    tracked_inputs << value if tracked_value?(value)
+                  end
+                end
+              end
             end
           end
         end