contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/delegators/input_analysis.rb

@@ -0,0 +1,12 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Delegators
+    # Used to decorate the InputAnalysis protobuf model so it can own the
+    # Contrast::Agent::Request from which it came.
+    class InputAnalysis < SimpleDelegator
+      attr_accessor :request
+    end
+  end
+end

data/lib/contrast/extension/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/assess/array.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch'
@@ -56,12 +56,7 @@ module Contrast
               return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
               properties.cleanup_tags
-              properties.build_event(
-                  ARRAY_JOIN_NODE,
-                  ret,
-                  ary,
-                  ret,
-                  [separator])
+              properties.build_event(ARRAY_JOIN_NODE, ret, ary, ret, [separator])
               properties.event.instance_variable_set(:@_parent_events, parent_events)
               ret
             end

data/lib/contrast/extension/assess/erb.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This module is used to track propagation through ERB template rendering
@@ -25,13 +25,7 @@ module ERBPropagator
         parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
         parent_events << parent_event if parent_event
       end
-      properties.build_event(
-          patcher,
-          ret,
-          preshift.object,
-          ret,
-          preshift.args,
-          1)
+      properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
       properties.event.instance_variable_set(:@_parent_events, parent_events)
 
       ret

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -24,9 +24,6 @@ module Contrast
           end
 
           def apply_trigger obj, source, ret, clazz, method
-            current_context = Contrast::Agent::REQUEST_TRACKER.current
-            return unless current_context
-
             # Since we know this is the source of the trigger, we can do some
             # optimization here and return when it is not tracked
             return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
@@ -34,13 +31,8 @@ module Contrast
             # source might not be all the args passed in, but it is the one we care
             # about. we could pass in all the args in the last param here if it
             # becomes an issue in rendering on TS
-            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
-                current_context,
-                trigger_node(clazz, method),
-                source,
-                obj,
-                ret,
-                source)
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(trigger_node(clazz, method), source, obj,
+                                                                              ret, source)
           end
 
           def instrument_basic_object_track

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/at_exit_hook'
@@ -11,9 +11,6 @@ module Contrast
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
         def apply_trigger source
-          current_context = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_context
-
           # Since we know this is the source of the trigger, we can do some
           # optimization here and return when it is not tracked
           return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
@@ -21,21 +18,14 @@ module Contrast
           # source might not be all the args passed in, but it is the one we care
           # about. we could pass in all the args in the last param here if it
           # becomes an issue in rendering on TS
-          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-              current_context,
-              trigger_node,
-              source,
-              Kernel,
-              nil,
-              source)
+          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node, source, Kernel, nil, source)
         end
 
         private
 
         def trigger_node
-          @_trigger_node ||= begin
-            Contrast::Agent::Assess::Policy::Policy.instance.find_node('cmd-injection', 'Kernel', :exec, false)
-          end
+          @_trigger_node ||= Contrast::Agent::Assess::Policy::Policy.instance.find_node('cmd-injection', 'Kernel',
+                                                                                        :exec, false)
         end
       end
     end

data/lib/contrast/extension/assess/fiber.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
@@ -64,12 +64,7 @@ module Contrast
                 next unless (result_properties = Contrast::Agent::Assess::Tracker.properties!(result))
 
                 result_properties.splat_from(fiber, result)
-                result_properties.build_event(
-                    FIBER_YIELD_NODE,
-                    result,
-                    fiber,
-                    result,
-                    [])
+                result_properties.build_event(FIBER_YIELD_NODE, result, fiber, result, [])
               end
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
@@ -85,12 +80,7 @@ module Contrast
               return unless properties
 
               properties.splat_from(underlying, fiber)
-              properties.build_event(
-                  FIBER_NEW_NODE,
-                  fiber,
-                  underlying,
-                  fiber,
-                  [])
+              properties.build_event(FIBER_NEW_NODE, fiber, underlying, fiber, [])
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Fiber.new', e)

data/lib/contrast/extension/assess/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/extension/assess/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -47,13 +47,7 @@ module Contrast
             parent_events = []
             track_sprintf(ret, format_string, args, parent_events)
 
-            properties.build_event(
-                patcher,
-                ret,
-                preshift.object,
-                ret,
-                preshift.args,
-                1)
+            properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
 
             properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret
@@ -70,8 +64,7 @@ module Contrast
               handle_sprintf_array(args, result, parent_events)
             end
           rescue StandardError => e
-            logger.error(
-                'Unable to track dataflow through sprintf', e)
+            logger.error('Unable to track dataflow through sprintf', e)
           end
 
           def instrument_kernel_track

data/lib/contrast/extension/assess/marshal.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -27,20 +27,12 @@ module Contrast
 
           def cs__load_assess source, ret
             with_contrast_scope do
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless current_context
-
               args = [source]
               # source might not be all the args passed in, but it is the one we care
               # about. we could pass in all the args in the last param here if it
               # becomes an issue in rendering on TS
-              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-                  current_context,
-                  trigger_node('Marshal', :load),
-                  source,
-                  self,
-                  ret,
-                  *args)
+              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load), source,
+                                                                           self, ret, *args)
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
               properties.copy_from(source, ret)

data/lib/contrast/extension/assess/regexp.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
@@ -53,12 +53,7 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.splat_from(string, target)
-              properties.build_event(
-                  REGEXP_EQUAL_SQUIGGLE_NODE,
-                  target,
-                  self,
-                  result,
-                  [string])
+              properties.build_event(REGEXP_EQUAL_SQUIGGLE_NODE, target, self, result, [string])
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Regexp#=~', e)

data/lib/contrast/extension/assess/string.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
@@ -66,7 +66,9 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26' if AGENT.patch_interpolation? && Funchook.available?
+                if AGENT.patch_interpolation? && Funchook.available?
+                  require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                end
                 true
               rescue StandardError, LoadError => e
                 logger.error('Error loading interpolation patch', e)

data/lib/contrast/extension/delegator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Some developers override various methods on Delegator, which can often

data/lib/contrast/extension/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'
@@ -41,13 +41,15 @@ module Kernel # :nodoc:
 
   def catch *args, &block
     # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+    scope_level =
+      Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
 
     # Run original catch with block.
     retval = cs__catch(*args, &block)
 
     # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope,
+                                                                                                scope_level)
 
     retval
   end

data/lib/contrast/extension/module.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/extension/protect.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/protect/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/extension/protect/psych.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 if defined?(Psych)

data/lib/contrast/extension/thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # ensure that we're being loaded with an agent

data/lib/contrast/framework/base_support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/manager.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/platform_version'
@@ -19,8 +19,7 @@ module Contrast
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
       # do not exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::Rails::Support,
-        Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Rails::Support, Contrast::Framework::Sinatra::Support,
         Contrast::Framework::Rack::Support
       ].cs__freeze
 
@@ -81,7 +80,7 @@ module Contrast
 
       # If we have 0 or n > 1 frameworks, we need to use the default rack request
       #
-      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values 
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values
       # of this particular Request
       # @return [::Rack::Request] either a rack request or subclass thereof.
       def retrieve_request env
@@ -102,16 +101,13 @@ module Contrast
         result
       end
 
-      # Iterate through current frameworks and return the current request's route. This will be the first 
+      # Iterate through current frameworks and return the current request's route. This will be the first
       # non-nil result.
       #
       # @param request [Contrast::Agent::Request] the current request.
       # @return [Contrast::Api::Dtm::RouteCoverage] the current route as a Dtm.
-      # TODO: RUBY-1075 add unit test.
       def get_route_dtm request
-        result = nil
-        @_frameworks.find { |framework_klass| result = framework_klass.current_route(request) }
-        result
+        @_frameworks.lazy.map { |framework_support| framework_support.current_route(request) }.reject(&:nil?).first
       end
 
       private

data/lib/contrast/framework/platform_version.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -61,16 +61,9 @@ module Contrast
             end
 
             def apply_secure_session options
-              return unless vulnerable_setting?(
-                  :secure,
-                  true,
-                  options,
-                  safe_default: false)
-
-              cs__report_finding(
-                  CS__SECURE_RULE_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              return unless vulnerable_setting?(:secure, true, options, safe_default: false)
+
+              cs__report_finding(CS__SECURE_RULE_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to secure session', e)
@@ -86,10 +79,7 @@ module Contrast
                                                 safe_default: false,
                                                 comparison_type: :greater_than)
 
-              cs__report_finding(
-                  CS__SESSION_TIMEOUT_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to set session timeout', e)
@@ -101,10 +91,7 @@ module Contrast
             def apply_httponly options
               return unless vulnerable_setting?(:httponly, true, options)
 
-              cs__report_finding(
-                  CS__HTTPONLY_NAME,
-                  options,
-                  caller_locations(10, 9)[0])
+              cs__report_finding(CS__HTTPONLY_NAME, options, caller_locations(10, 9)[0])
             rescue StandardError => e
               begin
                 logger.error('Unable to track call to httponly', e)