contrast-agent 4.3.0 → 4.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (315) hide show
  1. checksums.yaml +4 -4
  2. data/.simplecov +1 -1
  3. data/Gemfile +1 -1
  4. data/LICENSE.txt +1 -1
  5. data/Rakefile +1 -1
  6. data/exe/contrast_service +1 -1
  7. data/ext/build_funchook.rb +1 -1
  8. data/ext/cs__assess_active_record_named/cs__active_record_named.c +1 -1
  9. data/ext/cs__assess_active_record_named/extconf.rb +1 -1
  10. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  11. data/ext/cs__assess_array/extconf.rb +1 -1
  12. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  13. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  14. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  15. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  16. data/ext/cs__assess_hash/cs__assess_hash.c +4 -2
  17. data/ext/cs__assess_hash/extconf.rb +1 -1
  18. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  19. data/ext/cs__assess_kernel/extconf.rb +1 -1
  20. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  21. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  22. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  23. data/ext/cs__assess_module/extconf.rb +1 -1
  24. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  25. data/ext/cs__assess_regexp/extconf.rb +1 -1
  26. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  27. data/ext/cs__assess_string/extconf.rb +1 -1
  28. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  29. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  30. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  31. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  32. data/ext/cs__common/cs__common.c +5 -5
  33. data/ext/cs__common/cs__common.h +4 -4
  34. data/ext/cs__common/extconf.rb +1 -1
  35. data/ext/cs__contrast_patch/cs__contrast_patch.c +22 -25
  36. data/ext/cs__contrast_patch/extconf.rb +1 -1
  37. data/ext/cs__protect_kernel/cs__protect_kernel.c +1 -1
  38. data/ext/cs__protect_kernel/extconf.rb +1 -1
  39. data/ext/extconf_common.rb +1 -1
  40. data/lib/contrast-agent.rb +1 -1
  41. data/lib/contrast.rb +20 -1
  42. data/lib/contrast/agent.rb +6 -2
  43. data/lib/contrast/agent/assess.rb +1 -10
  44. data/lib/contrast/agent/assess/contrast_event.rb +54 -71
  45. data/lib/contrast/agent/assess/contrast_object.rb +6 -3
  46. data/lib/contrast/agent/assess/events/event_factory.rb +1 -1
  47. data/lib/contrast/agent/assess/events/source_event.rb +7 -2
  48. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  49. data/lib/contrast/agent/assess/finalizers/hash.rb +33 -34
  50. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +30 -15
  51. data/lib/contrast/agent/assess/policy/patcher.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/policy_node.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  55. data/lib/contrast/agent/assess/policy/preshift.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/propagation_method.rb +30 -19
  57. data/lib/contrast/agent/assess/policy/propagation_node.rb +1 -1
  58. data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
  59. data/lib/contrast/agent/assess/policy/propagator/append.rb +29 -14
  60. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  61. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  63. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +22 -17
  64. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -1
  65. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  66. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +1 -1
  67. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  68. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  69. data/lib/contrast/agent/assess/policy/propagator/remove.rb +1 -1
  70. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  71. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  72. data/lib/contrast/agent/assess/policy/propagator/select.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/propagator/splat.rb +24 -14
  74. data/lib/contrast/agent/assess/policy/propagator/split.rb +15 -8
  75. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +31 -15
  76. data/lib/contrast/agent/assess/policy/propagator/trim.rb +1 -1
  77. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +1 -1
  78. data/lib/contrast/agent/assess/policy/source_method.rb +87 -76
  79. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  80. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +8 -6
  81. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  82. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +3 -3
  83. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +7 -8
  84. data/lib/contrast/agent/assess/policy/trigger_method.rb +106 -64
  85. data/lib/contrast/agent/assess/policy/trigger_node.rb +31 -10
  86. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +59 -0
  87. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -3
  88. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +7 -5
  89. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +3 -5
  90. data/lib/contrast/agent/assess/properties.rb +1 -3
  91. data/lib/contrast/agent/assess/property/evented.rb +1 -1
  92. data/lib/contrast/agent/assess/property/tagged.rb +38 -20
  93. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  94. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  95. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +1 -1
  96. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
  97. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +1 -1
  98. data/lib/contrast/agent/assess/tag.rb +1 -1
  99. data/lib/contrast/agent/assess/tracker.rb +2 -2
  100. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  101. data/lib/contrast/agent/class_reopener.rb +1 -1
  102. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  103. data/lib/contrast/agent/deadzone/policy/policy.rb +1 -1
  104. data/lib/contrast/agent/disable_reaction.rb +1 -1
  105. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  106. data/lib/contrast/agent/inventory.rb +1 -2
  107. data/lib/contrast/agent/inventory/dependencies.rb +1 -1
  108. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  109. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +35 -23
  110. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  111. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  112. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  113. data/lib/contrast/agent/middleware.rb +87 -58
  114. data/lib/contrast/agent/module_data.rb +1 -1
  115. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  116. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +5 -1
  117. data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
  118. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  119. data/lib/contrast/agent/patching/policy/patch.rb +8 -6
  120. data/lib/contrast/agent/patching/policy/patch_status.rb +2 -2
  121. data/lib/contrast/agent/patching/policy/patcher.rb +59 -54
  122. data/lib/contrast/agent/patching/policy/policy.rb +1 -1
  123. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  124. data/lib/contrast/agent/patching/policy/trigger_node.rb +6 -3
  125. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
  126. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
  127. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
  128. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -1
  129. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
  130. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
  131. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  132. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  133. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  134. data/lib/contrast/agent/protect/rule.rb +1 -1
  135. data/lib/contrast/agent/protect/rule/base.rb +7 -18
  136. data/lib/contrast/agent/protect/rule/base_service.rb +2 -2
  137. data/lib/contrast/agent/protect/rule/cmd_injection.rb +2 -2
  138. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  139. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  140. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  141. data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -2
  142. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -1
  143. data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -1
  144. data/lib/contrast/agent/protect/rule/sqli.rb +18 -12
  145. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  146. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  147. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  148. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  149. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  150. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  151. data/lib/contrast/agent/protect/rule/xxe.rb +1 -1
  152. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -1
  153. data/lib/contrast/agent/railtie.rb +1 -1
  154. data/lib/contrast/agent/reaction_processor.rb +1 -1
  155. data/lib/contrast/agent/request.rb +2 -1
  156. data/lib/contrast/agent/request_context.rb +17 -10
  157. data/lib/contrast/agent/request_handler.rb +1 -1
  158. data/lib/contrast/agent/response.rb +1 -1
  159. data/lib/contrast/agent/rewriter.rb +1 -1
  160. data/lib/contrast/agent/rule_set.rb +3 -3
  161. data/lib/contrast/agent/scope.rb +1 -1
  162. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  163. data/lib/contrast/agent/static_analysis.rb +1 -1
  164. data/lib/contrast/agent/thread.rb +2 -2
  165. data/lib/contrast/agent/thread_watcher.rb +21 -6
  166. data/lib/contrast/agent/tracepoint_hook.rb +1 -1
  167. data/lib/contrast/agent/version.rb +2 -2
  168. data/lib/contrast/agent/worker_thread.rb +1 -1
  169. data/lib/contrast/api.rb +1 -1
  170. data/lib/contrast/api/communication.rb +1 -1
  171. data/lib/contrast/api/communication/connection_status.rb +1 -1
  172. data/lib/contrast/api/communication/messaging_queue.rb +19 -22
  173. data/lib/contrast/api/communication/response_processor.rb +9 -2
  174. data/lib/contrast/api/communication/service_lifecycle.rb +1 -1
  175. data/lib/contrast/api/communication/socket.rb +1 -1
  176. data/lib/contrast/api/communication/socket_client.rb +23 -15
  177. data/lib/contrast/api/communication/speedracer.rb +3 -3
  178. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  179. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  180. data/lib/contrast/api/decorators.rb +3 -1
  181. data/lib/contrast/api/decorators/address.rb +1 -1
  182. data/lib/contrast/api/decorators/agent_startup.rb +58 -0
  183. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  184. data/lib/contrast/api/decorators/application_startup.rb +53 -0
  185. data/lib/contrast/api/decorators/application_update.rb +1 -1
  186. data/lib/contrast/api/decorators/http_request.rb +1 -1
  187. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  188. data/lib/contrast/api/decorators/instrumentation_mode.rb +37 -0
  189. data/lib/contrast/api/decorators/library.rb +1 -1
  190. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  191. data/lib/contrast/api/decorators/message.rb +1 -1
  192. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  193. data/lib/contrast/api/decorators/route_coverage.rb +16 -6
  194. data/lib/contrast/api/decorators/server_features.rb +1 -1
  195. data/lib/contrast/api/decorators/trace_event.rb +43 -15
  196. data/lib/contrast/api/decorators/trace_event_object.rb +1 -1
  197. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  198. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  199. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -1
  200. data/lib/contrast/api/decorators/user_input.rb +1 -1
  201. data/lib/contrast/common_agent_configuration.rb +1 -1
  202. data/lib/contrast/components/agent.rb +3 -1
  203. data/lib/contrast/components/app_context.rb +5 -23
  204. data/lib/contrast/components/assess.rb +1 -1
  205. data/lib/contrast/components/config.rb +1 -1
  206. data/lib/contrast/components/contrast_service.rb +1 -1
  207. data/lib/contrast/components/heap_dump.rb +1 -1
  208. data/lib/contrast/components/interface.rb +1 -1
  209. data/lib/contrast/components/inventory.rb +1 -1
  210. data/lib/contrast/components/logger.rb +1 -1
  211. data/lib/contrast/components/protect.rb +4 -2
  212. data/lib/contrast/components/sampling.rb +49 -7
  213. data/lib/contrast/components/scope.rb +1 -1
  214. data/lib/contrast/components/settings.rb +7 -6
  215. data/lib/contrast/config.rb +1 -1
  216. data/lib/contrast/config/agent_configuration.rb +1 -1
  217. data/lib/contrast/config/application_configuration.rb +1 -1
  218. data/lib/contrast/config/assess_configuration.rb +1 -1
  219. data/lib/contrast/config/assess_rules_configuration.rb +1 -1
  220. data/lib/contrast/config/base_configuration.rb +1 -1
  221. data/lib/contrast/config/default_value.rb +1 -1
  222. data/lib/contrast/config/exception_configuration.rb +1 -1
  223. data/lib/contrast/config/heap_dump_configuration.rb +1 -1
  224. data/lib/contrast/config/inventory_configuration.rb +1 -1
  225. data/lib/contrast/config/logger_configuration.rb +1 -1
  226. data/lib/contrast/config/protect_configuration.rb +1 -1
  227. data/lib/contrast/config/protect_rule_configuration.rb +23 -1
  228. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  229. data/lib/contrast/config/root_configuration.rb +1 -1
  230. data/lib/contrast/config/ruby_configuration.rb +1 -1
  231. data/lib/contrast/config/sampling_configuration.rb +1 -1
  232. data/lib/contrast/config/server_configuration.rb +1 -1
  233. data/lib/contrast/config/service_configuration.rb +1 -1
  234. data/lib/contrast/configuration.rb +1 -1
  235. data/lib/contrast/delegators/input_analysis.rb +12 -0
  236. data/lib/contrast/extension/assess.rb +1 -1
  237. data/lib/contrast/extension/assess/array.rb +1 -1
  238. data/lib/contrast/extension/assess/erb.rb +1 -1
  239. data/lib/contrast/extension/assess/eval_trigger.rb +1 -5
  240. data/lib/contrast/extension/assess/exec_trigger.rb +1 -5
  241. data/lib/contrast/extension/assess/fiber.rb +1 -1
  242. data/lib/contrast/extension/assess/hash.rb +1 -1
  243. data/lib/contrast/extension/assess/kernel.rb +1 -1
  244. data/lib/contrast/extension/assess/marshal.rb +1 -5
  245. data/lib/contrast/extension/assess/regexp.rb +1 -1
  246. data/lib/contrast/extension/assess/string.rb +1 -1
  247. data/lib/contrast/extension/delegator.rb +1 -1
  248. data/lib/contrast/extension/inventory.rb +1 -1
  249. data/lib/contrast/extension/kernel.rb +1 -1
  250. data/lib/contrast/extension/module.rb +1 -1
  251. data/lib/contrast/extension/protect.rb +1 -1
  252. data/lib/contrast/extension/protect/kernel.rb +1 -1
  253. data/lib/contrast/extension/protect/psych.rb +1 -1
  254. data/lib/contrast/extension/thread.rb +1 -1
  255. data/lib/contrast/framework/base_support.rb +1 -1
  256. data/lib/contrast/framework/manager.rb +14 -13
  257. data/lib/contrast/framework/platform_version.rb +1 -1
  258. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  259. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  260. data/lib/contrast/framework/rack/support.rb +1 -1
  261. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  262. data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
  263. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +4 -4
  264. data/lib/contrast/framework/rails/patch/support.rb +1 -1
  265. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
  266. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
  267. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +1 -1
  268. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
  269. data/lib/contrast/framework/rails/support.rb +43 -44
  270. data/lib/contrast/framework/sinatra/support.rb +101 -42
  271. data/lib/contrast/funchook/funchook.rb +1 -1
  272. data/lib/contrast/logger/application.rb +1 -1
  273. data/lib/contrast/logger/format.rb +1 -1
  274. data/lib/contrast/logger/log.rb +32 -16
  275. data/lib/contrast/logger/request.rb +1 -1
  276. data/lib/contrast/logger/time.rb +1 -1
  277. data/lib/contrast/security_exception.rb +1 -1
  278. data/lib/contrast/tasks/config.rb +1 -1
  279. data/lib/contrast/tasks/service.rb +1 -1
  280. data/lib/contrast/utils/assess/sampling_util.rb +1 -1
  281. data/lib/contrast/utils/assess/tracking_util.rb +1 -1
  282. data/lib/contrast/utils/class_util.rb +18 -4
  283. data/lib/contrast/utils/duck_utils.rb +1 -1
  284. data/lib/contrast/utils/env_configuration_item.rb +1 -1
  285. data/lib/contrast/utils/hash_digest.rb +14 -19
  286. data/lib/contrast/utils/heap_dump_util.rb +104 -88
  287. data/lib/contrast/utils/invalid_configuration_util.rb +22 -13
  288. data/lib/contrast/utils/inventory_util.rb +1 -1
  289. data/lib/contrast/utils/io_util.rb +1 -1
  290. data/lib/contrast/utils/job_servers_running.rb +1 -1
  291. data/lib/contrast/utils/object_share.rb +1 -1
  292. data/lib/contrast/utils/os.rb +1 -1
  293. data/lib/contrast/utils/preflight_util.rb +1 -1
  294. data/lib/contrast/utils/resource_loader.rb +1 -1
  295. data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
  296. data/lib/contrast/utils/sha256_builder.rb +1 -1
  297. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  298. data/lib/contrast/utils/string_utils.rb +1 -1
  299. data/lib/contrast/utils/tag_util.rb +1 -1
  300. data/lib/contrast/utils/thread_tracker.rb +1 -1
  301. data/lib/contrast/utils/timer.rb +1 -1
  302. data/resources/assess/policy.json +8 -11
  303. data/resources/deadzone/policy.json +7 -23
  304. data/ruby-agent.gemspec +56 -19
  305. data/service_executables/VERSION +1 -1
  306. data/service_executables/linux/contrast-service +0 -0
  307. data/service_executables/mac/contrast-service +0 -0
  308. metadata +117 -161
  309. data/lib/contrast/agent/assess/rule.rb +0 -18
  310. data/lib/contrast/agent/assess/rule/base.rb +0 -52
  311. data/lib/contrast/agent/assess/rule/redos.rb +0 -67
  312. data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +0 -38
  313. data/lib/contrast/framework/sinatra/patch/base.rb +0 -83
  314. data/lib/contrast/framework/sinatra/patch/support.rb +0 -27
  315. data/lib/contrast/utils/prevent_serialization.rb +0 -52
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/patching/policy/method_policy'
@@ -27,6 +27,9 @@ module Contrast
27
27
  class_name = klass.cs__name
28
28
  instance_methods = klass.instance_methods
29
29
  instance_methods.concat(klass.private_instance_methods)
30
+ current_context = Contrast::Agent::REQUEST_TRACKER.current
31
+ current_request = current_context&.request
32
+
30
33
  tainted_columns.each_pair do |field, properties|
31
34
  next unless properties
32
35
 
@@ -34,14 +37,13 @@ module Contrast
34
37
  # Move on if we already know about this Dynamic Source
35
38
  next if Contrast::Agent::Assess::Policy::Policy.instance.find_source_node(class_name, method_name, true)
36
39
 
37
- dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys))
40
+ dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys), current_request)
38
41
  Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
39
42
  method_policy = build_source_policy(method_name, dynamic_source_node)
40
43
  Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
41
- current_context = Contrast::Agent::REQUEST_TRACKER.current
42
44
  next unless current_context
43
45
 
44
- dynamic_source = create_dynamic_source(current_context, dynamic_source_node, field, properties)
46
+ dynamic_source = create_dynamic_source(current_request, dynamic_source_node, field, properties)
45
47
  node_id = Contrast::Utils::StringUtils.force_utf8(dynamic_source_node.id)
46
48
  current_context.activity.dynamic_sources[node_id] = dynamic_source
47
49
  end
@@ -56,8 +58,10 @@ module Contrast
56
58
  # @param class_name [String] the name of the Class to patch
57
59
  # @param method_name [Symbol] the name of the Method to patch
58
60
  # @param tags [Set<String>] the tags this event should apply
61
+ # @param request [Contrast::Agent::Request] the request during
62
+ # which this source is to be created.
59
63
  # @return [Contrast::Agent::Assess::Policy::SourceNode]
60
- def create_source_node class_name, method_name, tags
64
+ def create_source_node class_name, method_name, tags, request
61
65
  node = Contrast::Agent::Assess::Policy::SourceNode.new
62
66
  node.class_name = class_name
63
67
  node.instance_method = true
@@ -72,8 +76,7 @@ module Contrast
72
76
  node.add_property(READ_TABLE, class_name)
73
77
  node.add_property(READ_COLUMN, method_name)
74
78
  node.add_property(WRITE_QUERY_TIME, Contrast::Utils::Timer.now_ms)
75
- url = Contrast::Agent::REQUEST_TRACKER.current&.request&.normalized_uri
76
- node.add_property(WRITE_QUERY_URL, url)
79
+ node.add_property(WRITE_QUERY_URL, request&.normalized_uri)
77
80
  node
78
81
  end
79
82
 
@@ -92,8 +95,8 @@ module Contrast
92
95
  method_policy
93
96
  end
94
97
 
95
- # @param current_context [Contrast::Agent::RequestContext] the
96
- # context of the request in which this source is to be created.
98
+ # @param request [Contrast::Agent::Request] the request during
99
+ # which this source is to be created.
97
100
  # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
98
101
  # the SourceNode that applies to this method
99
102
  # @param field [String] the name of the method to which this source
@@ -104,22 +107,34 @@ module Contrast
104
107
  # @return [Contrast::Api::Dtm::DynamicSource] the message to send
105
108
  # to the Service to allow it to report the events leading up to
106
109
  # the creation of the Dynamic Source
107
- def create_dynamic_source current_context, source_node, field, properties
110
+ def create_dynamic_source request, source_node, field, properties
108
111
  dynamic_source = Contrast::Api::Dtm::DynamicSource.new
109
112
  dynamic_source.class_name = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
110
113
  dynamic_source.method_name = Contrast::Utils::StringUtils.force_utf8(field)
111
114
  dynamic_source.instance_method = source_node.instance_method?
112
115
  dynamic_source.target = Contrast::Utils::StringUtils.force_utf8(source_node.target_string)
116
+ append_properties!(dynamic_source, request, source_node, field)
117
+ append_events!(dynamic_source, properties.event)
118
+ dynamic_source
119
+ end
120
+
121
+ # Append the properties needed to reconstruct the given DynamicSource in other dataflows and for rendering
122
+ # in TeamServer
123
+ #
124
+ # @param dynamic_source [Contrast::Api::Dtm::DynamicSource] the message to send to the Service to allow it
125
+ # to report the events leading up to the creation of the Dynamic Source.
126
+ # @param request [Contrast::Agent::Request] the request during which this source is to be created.
127
+ # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the SourceNode that applies to this
128
+ # method.
129
+ # @param field [String] the name of the method to which this source applies.
130
+ def append_properties! dynamic_source, request, source_node, field
113
131
  dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
114
132
  dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
115
133
  dynamic_source.properties[WRITE_QUERY_TIME] = Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
116
- url = current_context.request.normalized_uri
117
- dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(url)
118
- append_events(dynamic_source, properties.event)
119
- dynamic_source
134
+ dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
120
135
  end
121
136
 
122
- def append_events dynamic_source, event
137
+ def append_events! dynamic_source, event
123
138
  return unless event
124
139
 
125
140
  event.parent_events&.each do |parent_event|
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/assess/policy/policy'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'json'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/patching/policy/policy_node'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'set'
@@ -86,10 +86,6 @@ module Contrast
86
86
  SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
87
87
  }.cs__freeze
88
88
 
89
- def context_available?
90
- !!Contrast::Agent::REQUEST_TRACKER.current
91
- end
92
-
93
89
  # I lied above. We had to figure out what the target of the
94
90
  # propagation was. Now that we know, we'll actually do things to
95
91
  # it. Note that the return of this method will replace the original
@@ -225,7 +221,7 @@ module Contrast
225
221
 
226
222
  # This is checked right before actual propagation
227
223
  def propagation_possible? propagation_node, target
228
- return false unless context_available? && propagation_node && valid_target?(target, propagation_node)
224
+ return false unless propagation_node && valid_target?(target, propagation_node)
229
225
  return false unless valid_length?(target, propagation_node.action)
230
226
 
231
227
  true
@@ -258,22 +254,12 @@ module Contrast
258
254
  def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
259
255
  return if propagation_node.action == NOOP_ACTION
260
256
  return unless can_propagate?(propagation_node, preshift, target)
257
+ return unless (propagation_class = find_propagation_class(propagation_node))
261
258
 
262
- propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil)
263
- unless propagation_class
264
- logger.warn(
265
- 'Unknown propagation action received. Unable to propagate.',
266
- node_id: propagation_node.id,
267
- action: propagation_node.action)
268
- return
269
- end
270
259
  restore_frozen_state = false
271
260
  if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
272
- return unless ASSESS.track_frozen_sources?
273
- return unless propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
274
-
275
- dup = safe_dup(ret)
276
- return unless dup
261
+ return unless can_handle_frozen?(propagation_node)
262
+ return unless (dup = safe_dup(ret))
277
263
 
278
264
  restore_frozen_state = true
279
265
  ret = dup
@@ -302,6 +288,31 @@ module Contrast
302
288
  target_id: target.__id__)
303
289
  restore_frozen_state ? ret : nil
304
290
  end
291
+
292
+ # Find the propagation class from the given node, if one exists.
293
+ #
294
+ # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs a
295
+ # propagation event.
296
+ # @return [Contrast::Agent::Assess::Policy::Propagator, nil]
297
+ def find_propagation_class propagation_node
298
+ unless (propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil))
299
+ logger.warn(
300
+ 'Unknown propagation action received. Unable to propagate.',
301
+ node_id: propagation_node.id,
302
+ action: propagation_node.action)
303
+ end
304
+ propagation_class
305
+ end
306
+
307
+ # We can handle frozen propagation iff we're allowed to, as determined by configuration, and the target of
308
+ # the propagation is a return, as that's a replaceable value.
309
+ #
310
+ # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs a
311
+ # propagation event.
312
+ # @return [Boolean]
313
+ def can_handle_frozen? propagation_node
314
+ ASSESS.track_frozen_sources? && propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
315
+ end
305
316
  end
306
317
  end
307
318
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/assess/policy/policy_node'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -29,23 +29,38 @@ module Contrast
29
29
  if source1.length == target.length
30
30
  properties.copy_from(source1, target, 0, propagation_node.untags)
31
31
  else
32
- # find original in the target, copy tags to the new position in
33
- # target
34
- original_start_index = target.index(source1)
35
- properties.copy_from(source1, target, original_start_index, propagation_node.untags)
32
+ handle_append(propagation_node, source1, source2, target, properties)
33
+ end
34
+ properties.cleanup_tags
35
+ end
36
36
 
37
- start = original_start_index + source1.length
38
- while start < target.length
39
- properties.copy_from(source2, target, start, propagation_node.untags)
40
- start += source2.length
41
- next unless start > target.length
37
+ private
42
38
 
43
- properties.tags_at(start - source2.length).each do |tag|
44
- tag.update_end(target.length)
45
- end
39
+ # Given the append operation on source 1 added source 2 to it, changing the target output, modify the
40
+ # tags on the target to account for the change.
41
+ #
42
+ # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node responsible for the
43
+ # propagation action required by this method
44
+ # @param source1 [Object] the thing being appended to
45
+ # @param source2 [Object] the thing being appended
46
+ # @param target [Object] the result of the append operation
47
+ # @param properties [Contrast::Agent::Assess::Properties] the properties of the target
48
+ def handle_append propagation_node, source1, source2, target, properties
49
+ # find original in the target, copy tags to the new position in
50
+ # target
51
+ original_start_index = target.index(source1)
52
+ properties.copy_from(source1, target, original_start_index, propagation_node.untags)
53
+
54
+ start = original_start_index + source1.length
55
+ while start < target.length
56
+ properties.copy_from(source2, target, start, propagation_node.untags)
57
+ start += source2.length
58
+ next unless start > target.length
59
+
60
+ properties.tags_at(start - source2.length).each do |tag|
61
+ tag.update_end(target.length)
46
62
  end
47
63
  end
48
- properties.cleanup_tags
49
64
  end
50
65
  end
51
66
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/extension/module'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -24,23 +24,8 @@ module Contrast
24
24
 
25
25
  known_tainted = ASSESS.tainted_columns[class_name]
26
26
  propagation_node.sources.each do |source|
27
- arg = preshift.args[source]
28
- next unless arg.cs__respond_to?(:each_pair)
29
-
30
- arg.each_pair do |key, value|
31
- next unless value
32
- next if known_tainted&.include?(key)
33
- next unless (properties = Contrast::Agent::Assess::Tracker.properties!(value))
34
-
35
- # TODO: RUBY-540 handle sanitization, handle nested objects
36
- Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
37
- properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
38
- next unless tracked_value?(value)
39
-
40
- tainted_columns[key] = properties
41
- end
27
+ handle_write(propagation_node, source, preshift, target, known_tainted, tainted_columns)
42
28
  end
43
-
44
29
  return if tainted_columns.empty?
45
30
 
46
31
  if known_tainted
@@ -51,6 +36,26 @@ module Contrast
51
36
 
52
37
  Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns
53
38
  end
39
+
40
+ private
41
+
42
+ def handle_write propagation_node, source, preshift, target, known_tainted, tainted_columns
43
+ arg = preshift.args[source]
44
+ return unless arg.cs__respond_to?(:each_pair)
45
+
46
+ arg.each_pair do |key, value|
47
+ next unless value
48
+ next if known_tainted&.include?(key)
49
+ next unless (properties = Contrast::Agent::Assess::Tracker.properties!(value))
50
+
51
+ # TODO: RUBY-540 handle sanitization, handle nested objects
52
+ Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
53
+ properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
54
+ next unless tracked_value?(value)
55
+
56
+ tainted_columns[key] = properties
57
+ end
58
+ end
54
59
  end
55
60
  end
56
61
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -19,19 +19,7 @@ module Contrast
19
19
  when Contrast::Utils::ObjectShare::OBJECT_KEY
20
20
  tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
21
21
  else
22
- arg = preshift.args[source]
23
- if arg.is_a?(String)
24
- tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
25
- elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
26
- arg.each_pair do |key, value|
27
- tracked_inputs << key if tracked_value?(key)
28
- tracked_inputs << value if tracked_value?(value)
29
- end
30
- elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
31
- arg.each do |value|
32
- tracked_inputs << value if tracked_value?(value)
33
- end
34
- end
22
+ find_argument_inputs(tracked_inputs, preshift.args[source])
35
23
  end
36
24
  end
37
25
 
@@ -50,6 +38,28 @@ module Contrast
50
38
  properties.splat_from(input, target)
51
39
  end
52
40
  end
41
+
42
+ private
43
+
44
+ # The arguments to the splat method are complex and of multiple types. As such, we need to handle
45
+ # Strings and iterables to determine the tracked inputs on which to act.
46
+ #
47
+ # @param tracked_inputs [Array] storage for the inputs to act on later
48
+ # @param arg [Object] an input to the method which act as sources for this propagation.
49
+ def find_argument_inputs tracked_inputs, arg
50
+ if arg.is_a?(String)
51
+ tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
52
+ elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
53
+ arg.each_pair do |key, value|
54
+ tracked_inputs << key if tracked_value?(key)
55
+ tracked_inputs << value if tracked_value?(value)
56
+ end
57
+ elsif Contrast::Utils::DuckUtils.iterable_enumerable?(arg)
58
+ arg.each do |value|
59
+ tracked_inputs << value if tracked_value?(value)
60
+ end
61
+ end
62
+ end
53
63
  end
54
64
  end
55
65
  end