contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -31,7 +31,8 @@ module Contrast
                 return unless sources[1]
 
                 original_end_index = original_start_index + source1.length - 1
-                handle_incoming_tags(target, propagation_node, sources[1], preshift, original_start_index, original_end_index)
+                handle_incoming_tags(target, propagation_node, sources[1], preshift, original_start_index,
+                                     original_end_index)
               end
 
               private

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -33,7 +33,9 @@ module Contrast
                 # point on which all tags need to be adjusted
                 # If the insertion point is the end of the string, preshift length is returned
                 # https://stackoverflow.com/questions/31714522/find-the-first-differing-character-between-two-strings-in-ruby
-                insert_point = (0...preshift_target.length).find { |i| preshift_target[i] != target[i] } || preshift_target.length
+                insert_point = (0...preshift_target.length).find do |i|
+                  preshift_target[i] != target[i]
+                end || preshift_target.length
                 # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
                 # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
                 insert_point = target.rindex(source, insert_point)

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -76,7 +76,8 @@ module Contrast
                 applicable_tags.each do |tag_name, tag_ranges|
                   return_properties.set_tags(tag_name, tag_ranges)
                 end
-                return_properties.build_event(propagation_node, return_value, preshift.object, return_value, preshift.args)
+                return_properties.build_event(propagation_node, return_value, preshift.object, return_value,
+                                              preshift.args)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Rack::Protection offers several protections against vulnerabilities. Of these, some apply to dataflow and
+          # need to be accounted for in order to properly tag data. Others apply to configurations and may be used to
+          # suppress configuration vulnerabilities in the future.
+          class RackProtection < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # Our custom instrumentation for the Rack::Protection::EscapedParams#escape_string method
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def escaped_params propagation_node, preshift, ret, _block
+                Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                apply_escaper_tags(preshift.object, ret)
+                ret
+              end
+
+              private
+
+              # Rack::Protection::EscapedParams can be configured such that it only applies certain escape. We need
+              # to account for the configuration of the individual escapes when applying tags.
+              #
+              # @param escaper [Rack::Protection::EscapedParams] the instance of Rack::Protection::EscapedParams
+              #   applying the escape_string
+              # @param ret [String] the result of the escape
+              def apply_escaper_tags escaper, ret
+                # I don't know how this could not be an instance of Rack::Protection::EscapedParams, but I don't want
+                # to chance it.
+                return unless escaper.cs__is_a?(Rack::Protection::EscapedParams)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties(ret))
+
+                tags = []
+                untags = []
+                if escaper.instance_variable_get(:@html)
+                  tags << 'HTML_ENCODED'
+                  untags << 'HTML_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@javascript)
+                  tags << 'JAVASCRIPT_ENCODED'
+                  untags << 'JAVASCRIPT_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@url)
+                  tags << 'URL_ENCODED'
+                  untags << 'URL_DECODED'
+                end
+
+                length = Contrast::Utils::StringUtils.ret_length(ret)
+                tags.each do |tag|
+                  properties.add_tag(tag, 0...length)
+                end
+
+                untags.each do |tag|
+                  properties.delete_tags(tag)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,28 +6,35 @@ module Contrast
     module Assess
       module Policy
         module Propagator
-          # Propagation that results in all the tags of the source being
-          # applied to the totality of the target and then those sections
-          # which have been removed from the target are removed from the
-          # tags. The target's preexisting tags are also updated by this
-          # removal.
+          # Propagation that results in all the tags of the source being applied to the totality of the target and then
+          # those sections which have been removed from the target are removed from the tags. The target's preexisting
+          # tags are also updated by this removal.
           class Remove < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # For the source, append its tags to the target.
-              # Once the tag is applied, remove the section that was removed by the delete.
-              # Unlike additive propagation, this currently only supports one source
+              # For the source, append its tags to the target. Once the tag is applied, remove the section that was
+              # removed by the delete. Unlike additive propagation, this currently only supports one source.
               def propagate propagation_node, preshift, target
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
                 source = find_source(propagation_node.sources[0], preshift)
                 properties.copy_from(source, target, 0, propagation_node.untags)
-                source_chars = source.is_a?(String) ? source.chars : source.string.chars
-                handle_removal(source_chars, target)
+                handle_removal(propagation_node, source, target)
               end
 
-              def handle_removal source_chars, target
+              def handle_removal propagation_node, source, target
+                return unless source
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
+                source_string = source.is_a?(String) ? source : source.to_s
+
+                # If the lengths are the same, we should just copy the tags because nothing was removed, but a new
+                # instance could have been created. copy_from will handle the case where the source is the target.
+                if source_string.length == target.length
+                  properties.copy_from(source, target, 0, propagation_node.untags)
+                  return
+                end
+
+                source_chars = source_string.chars
                 source_idx = 0
 
                 target_chars = target.chars
@@ -36,10 +43,8 @@ module Contrast
                 remove_ranges = []
                 start = nil
 
-                # loop over the target, the result of the delete
-                # every range of characters that it differs from the source
-                # represents a section that was deleted. these sections
-                # need to have their tags updated
+                # loop over the target, the result of the delete every range of characters that it differs from the
+                # source represents a section that was deleted. these sections need to have their tags updated
                 target_len = target_chars.length
                 while target_idx < target_len
                   target_char = target_chars[target_idx]
@@ -56,9 +61,8 @@ module Contrast
                   source_idx += 1
                 end
 
-                # once we're done looping over the target, anything left
-                # over is extra from the source that was deleted. tags
-                # applying to it need to be removed.
+                # once we're done looping over the target, anything left over is extra from the source that was
+                # deleted. tags applying to it need to be removed.
                 remove_ranges << (source_idx...source_chars.length) if source_idx != source_chars.length
 
                 # handle deleting the removed ranges

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -21,22 +21,12 @@ module Contrast
                 # Additionally, an empty string is returned when the starting index for
                 # a character range is at the end of the string. Let's just skip that
                 # and only track a string that has length
-                unless ret &&
-                      !ret.empty? &&
-                      Contrast::Agent::Assess::Tracker.tracked?(source)
-
-                  return
-                end
+                return unless ret && !ret.empty? && Contrast::Agent::Assess::Tracker.tracked?(source)
 
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                properties.build_event(patcher, ret, source, ret, args)
 
                 range = determine_select_range(source, args)
                 return unless range

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
@@ -31,9 +31,7 @@ module Contrast
               # @return [nil] so as not to risk changing the result of the propagation.
 
               def propagate propagation_node, preshift, target
-                logger.trace('Propagation detected',
-                             node_id: propagation_node.id,
-                             target_id: target.__id__)
+                logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
 
                 source = find_source(propagation_node.sources[0], preshift)
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
@@ -162,10 +160,8 @@ module Contrast
               #
               # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
               def split_node
-                @_split_node ||= begin
-                  Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                    node.class_name == 'String' && node.method_name == :split && node.instance_method?
-                  end
+                @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+                  node.class_name == 'String' && node.method_name == :split && node.instance_method?
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -186,13 +186,7 @@ module Contrast
 
                 properties = Contrast::Agent::Assess::Tracker.properties(ret)
                 args = preshift.args
-                properties.build_event(
-                    patcher,
-                    ret,
-                    preshift.object,
-                    ret,
-                    args,
-                    2)
+                properties.build_event(patcher, ret, preshift.object, ret, args, 2)
                 properties.event.instance_variable_set(:@_parent_events, parent_events)
               end
             end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,50 +8,24 @@ module Contrast
         module Propagator
           # This class is specifically for String#tr(_s) propagation
           #
-          # Disclaimer: there may be a better way, but we're
-          # in a 'get it work' state. hopefully, we'll be in
-          # a 'get it right' state soon.
+          # Disclaimer: there may be a better way, but we're in a 'get it work' state. hopefully, we'll be in a 'get it
+          # right' state soon.
           module Trim
             class << self
-              def tr_tagger patcher, preshift, ret, _block
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def tr_tagger policy_node, preshift, ret, _block
                 return ret unless ret && !ret.empty?
                 return ret unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                source = preshift.object
-                args = preshift.args
-                properties.copy_from(source, ret)
-                replace_string = args[1]
-                source_chars = source.chars
-                # if the replace string is empty, then there's a bunch of deletes. this
-                # functions the same as the Removal propagation.
-                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
-                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(source_chars, ret)
-                else
-                  remove_ranges = []
-                  ret_chars = ret.chars
-                  start = nil
-                  source_chars.each_with_index do |char, idx|
-                    if ret_chars[idx] == char
-                      next unless start
+                properties.copy_from(preshift.object, ret)
+                handle_tr(policy_node, preshift, ret, properties)
 
-                      remove_ranges << (start...idx)
-                      start = nil
-                    else
-                      start ||= idx
-                    end
-                  end
-                  # account for the last char being different
-                  remove_ranges << (start...source_chars.length) if start
-                  properties.delete_tags_at_ranges(remove_ranges, false)
-                end
-
-                properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args,
-                    1)
+                properties.build_event(policy_node, ret, preshift.object, ret, preshift.args, 1)
                 ret
               end
 
@@ -62,14 +36,59 @@ module Contrast
                 source = preshift.object
                 args = preshift.args
                 properties.splat_from(source, ret)
-                properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                properties.build_event(patcher, ret, source, ret, args)
                 ret
               end
+
+              private
+
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [String] the target to which to propagate.
+              # @param properties [Contrast::Agent::Assess::Properties] the properties of the ret
+              def handle_tr policy_node, preshift, ret, properties
+                source = preshift.object
+                replace_string = preshift.args[1]
+
+                # if the replace string is empty, then there's a bunch of deletes. this functions the same as the
+                # Removal propagation.
+                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
+                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(policy_node, source, ret)
+                  return
+                end
+
+                # Otherwise, we need to target each insertion point. Based on the spec for #tr & #tr_s, the find is
+                # treated as a regexp range, excepting the `\` character, which we'll need to escape. This converts to
+                # that form, wrapping the input in `[]`.
+                find_string = preshift.args[0]
+                find_string += '\\' if find_string.end_with?('\\')
+                find_regexp = Regexp.new("[#{ find_string }]")
+
+                # Find the first instance to be replaced. If there isn't one, than nothing changed here.
+                idx = source.index(find_regexp)
+                return unless idx
+
+                # Iterate over each change and record where it happened. B/c this is a one to one replace, the index of
+                # the replacement is always one; however, there may be adjacent replacements which become a single
+                # range.
+                start = idx
+                stop = idx + 1
+                remove_ranges = []
+                while (idx = source.index(find_regexp, idx + 1))
+                  # If the previous range ends at this index, we can expand that range to include this index.
+                  # Otherwise, we need to record the held range and start a new one.
+                  if stop != idx
+                    remove_ranges << (start...stop)
+                    start = idx
+                  end
+                  stop = idx + 1
+                end
+                # Be sure to capture the last range in the holder.
+                remove_ranges << (start...stop)
+                properties.delete_tags_at_ranges(remove_ranges, false)
+              end
             end
           end
         end