contrast-agent 4.3.2 → 4.7.0

data/lib/contrast/extension/assess/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/extension/assess/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -47,13 +47,7 @@ module Contrast
             parent_events = []
             track_sprintf(ret, format_string, args, parent_events)
 
-            properties.build_event(
-                patcher,
-                ret,
-                preshift.object,
-                ret,
-                preshift.args,
-                1)
+            properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
 
             properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret
@@ -70,8 +64,7 @@ module Contrast
               handle_sprintf_array(args, result, parent_events)
             end
           rescue StandardError => e
-            logger.error(
-                'Unable to track dataflow through sprintf', e)
+            logger.error('Unable to track dataflow through sprintf', e)
           end
 
           def instrument_kernel_track

data/lib/contrast/extension/assess/marshal.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -27,20 +27,12 @@ module Contrast
 
           def cs__load_assess source, ret
             with_contrast_scope do
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless current_context
-
               args = [source]
               # source might not be all the args passed in, but it is the one we care
               # about. we could pass in all the args in the last param here if it
               # becomes an issue in rendering on TS
-              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-                  current_context,
-                  trigger_node('Marshal', :load),
-                  source,
-                  self,
-                  ret,
-                  *args)
+              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load), source,
+                                                                           self, ret, *args)
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
               properties.copy_from(source, ret)

data/lib/contrast/extension/assess/regexp.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
@@ -53,12 +53,7 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.splat_from(string, target)
-              properties.build_event(
-                  REGEXP_EQUAL_SQUIGGLE_NODE,
-                  target,
-                  self,
-                  result,
-                  [string])
+              properties.build_event(REGEXP_EQUAL_SQUIGGLE_NODE, target, self, result, [string])
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Regexp#=~', e)

data/lib/contrast/extension/assess/string.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
@@ -66,7 +66,9 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26' if AGENT.patch_interpolation? && Funchook.available?
+                if AGENT.patch_interpolation? && Funchook.available?
+                  require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                end
                 true
               rescue StandardError, LoadError => e
                 logger.error('Error loading interpolation patch', e)

data/lib/contrast/extension/delegator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Some developers override various methods on Delegator, which can often

data/lib/contrast/extension/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'
@@ -41,13 +41,15 @@ module Kernel # :nodoc:
 
   def catch *args, &block
     # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+    scope_level =
+      Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
 
     # Run original catch with block.
     retval = cs__catch(*args, &block)
 
     # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope,
+                                                                                                scope_level)
 
     retval
   end

data/lib/contrast/extension/module.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/extension/protect.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/protect/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/extension/protect/psych.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 if defined?(Psych)

data/lib/contrast/extension/thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # ensure that we're being loaded with an agent

data/lib/contrast/framework/base_support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/manager.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/platform_version'
@@ -19,8 +19,7 @@ module Contrast
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
       # do not exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::Rails::Support,
-        Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Rails::Support, Contrast::Framework::Sinatra::Support,
         Contrast::Framework::Rack::Support
       ].cs__freeze
 
@@ -44,11 +43,9 @@ module Contrast
         end
       end
 
-      # Return all the After Load Patches for all the Frameworks we know, even
-      # if that Framework hasn't been detected.
+      # Return all the After Load Patches for all the Frameworks we know, even if that Framework hasn't been detected.
       #
-      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the
-      #   AfterLoadPatches of each framework
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the AfterLoadPatches of each framework
       def find_after_load_patches
         patches = Set.new
         SUPPORTED_FRAMEWORKS.each do |framework|
@@ -82,8 +79,10 @@ module Contrast
       end
 
       # If we have 0 or n > 1 frameworks, we need to use the default rack request
-      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
-      #   and values of this particular Request
+      #
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values
+      # of this particular Request
+      # @return [::Rack::Request] either a rack request or subclass thereof.
       def retrieve_request env
         return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
 
@@ -102,15 +101,13 @@ module Contrast
         result
       end
 
+      # Iterate through current frameworks and return the current request's route. This will be the first
+      # non-nil result.
+      #
+      # @param request [Contrast::Agent::Request] the current request.
+      # @return [Contrast::Api::Dtm::RouteCoverage] the current route as a Dtm.
       def get_route_dtm request
-        result = nil
-        @_frameworks.find do |framework_klass|
-          # TODO: RUBY-763 Sinatra::Base#call patch adds the Route report
-          next if framework_klass == Contrast::Framework::Sinatra::Support
-
-          result = framework_klass.current_route(request)
-        end
-        result
+        @_frameworks.lazy.map { |framework_support| framework_support.current_route(request) }.reject(&:nil?).first
       end
 
       private

data/lib/contrast/framework/platform_version.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -61,16 +61,9 @@ module Contrast
             end
 
             def apply_secure_session options
-              return unless vulnerable_setting?(
-                  :secure,
-                  true,
-                  options,
-                  safe_default: false)
-
-              cs__report_finding(
-                  CS__SECURE_RULE_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              return unless vulnerable_setting?(:secure, true, options, safe_default: false)
+
+              cs__report_finding(CS__SECURE_RULE_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to secure session', e)
@@ -86,10 +79,7 @@ module Contrast
                                                 safe_default: false,
                                                 comparison_type: :greater_than)
 
-              cs__report_finding(
-                  CS__SESSION_TIMEOUT_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -101,10 +91,7 @@ module Contrast
             def apply_httponly options
               return unless vulnerable_setting?(:httponly, true, options)
 
-              cs__report_finding(
-                  CS__HTTPONLY_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              cs__report_finding(CS__HTTPONLY_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to httponly', e)

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/after_load_patch'
@@ -12,10 +12,12 @@ module Contrast
         module Support
           # (See BaseSupport#after_load_patches)
           def after_load_patches
-            Set.new([Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                'Rack::Session::Cookie',
-                'contrast/framework/rack/patch/session_cookie',
-                instrumenting_module: 'Contrast::Framework::Rack::Patch::SessionCookie')])
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Rack::Session::Cookie',
+                          'contrast/framework/rack/patch/session_cookie',
+                          instrumenting_module: 'Contrast::Framework::Rack::Patch::SessionCookie')
+                    ])
           end
         end
       end

data/lib/contrast/framework/rack/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -32,7 +32,11 @@ module Contrast
 
             private
 
-            def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
+            def vulnerable_setting?(setting_key,
+                                    safe_settings_value,
+                                    original_args,
+                                    safe_default: true,
+                                    comparison_type: nil)
               # In most cases, Rails is pretty nice and the default value is safe
               return !safe_default unless original_args && original_args.length > 1
 
@@ -49,7 +53,8 @@ module Contrast
 
             def apply_session_timeout *args
               return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
-              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
+              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args,
+                                                comparison_type: :greater_than, safe_default: false)
 
               rails_session_settings = args[1]
               cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(3, 2)[0])

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/rails/patch/assess_configuration'
@@ -15,9 +15,9 @@ module Contrast
             @_instrument ||= begin
               ::Rails::Application::Configuration.class_eval do
                 alias_method :cs__patched_session_store, :session_store
-                def session_store *args
-                  ret = cs__patched_session_store(*args)
-                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                def session_store *args, **kwargs
+                  ret = cs__patched_session_store(*args, **kwargs)
+                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args, **kwargs)
                   ret
                 end
               end

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/rails/patch/rails_application_configuration'
@@ -44,11 +44,13 @@ module Contrast
                           'ActionController::Railties::Helper::ClassMethods',
                           'contrast/framework/rails/rewrite/action_controller_railties_helper_inherited',
                           method_to_instrument: :inherited,
-                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
+                          instrumenting_module:
+                            'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
                       Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
                           'ActiveRecord::AttributeMethods::Read::ClassMethods',
                           'contrast/framework/rails/rewrite/active_record_attribute_methods_read',
-                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
+                          instrumenting_module:
+                            'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
                       Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
                           'ActiveRecord::Scoping::Named::ClassMethods',
                           'contrast/framework/rails/rewrite/active_record_named',

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails
@@ -19,7 +21,8 @@ module Contrast
                 alias_method :cs__patched_helper_inherited, :inherited
                 def inherited klass # rubocop:disable Lint/MissingSuper
                   klass&.instance_variable_set(:@cs__defining_class, true)
-                  cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                  # This calls the original inherited, which should handle super as needed.
+                  cs__patched_helper_inherited(klass)
                 ensure
                   klass&.instance_variable_set(:@cs__defining_class, false)
                 end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 module Contrast
   module Framework
     module Rails