contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/policy/trigger_node'

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/trigger_node'

data/lib/contrast/agent/middleware.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ipaddr'
@@ -16,18 +16,17 @@ require 'contrast/utils/timer'
 
 module Contrast
   module Agent
-    # This class allows the Agent to plug into the Rack middleware stack. When the
-    # application is first started, we initialize ourselves as a rack middleware
-    # inside of #initialize. Afterwards, we process each http request and response
-    # as it goes through the middleware stack inside of #call.
+    # This class allows the Agent to plug into the Rack middleware stack. When the application is first started, we
+    # initialize ourselves as a rack middleware inside of #initialize. Afterwards, we process each http request and
+    # response as it goes through the middleware stack inside of #call.
     class Middleware
       include Contrast::Components::Interface
       access_component :agent, :config, :logging, :scope, :settings
 
       attr_reader :app
 
-      # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here
-      # since we're only going to be initialized a single time. Our initialization order is:
+      # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here since
+      # we're only going to be initialized a single time. Our initialization order is:
       # - capture the application
       # - setup the Agent
       # - startup the Agent
@@ -38,22 +37,21 @@ module Contrast
         @app = app  # THIS MUST BE FIRST AND ALWAYS SET!
         setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
         unless AGENT.enabled?
-          logger.error(
-              'The Agent was unable to initialize before the application middleware was initialized. Disabling permanently.')
+          logger.error('The Agent was unable to initialize before the application middleware was initialized. '\
+                       'Disabling permanently.')
           AGENT.disable! # ensure the agent is disabled (probably redundant)
           return
         end
         agent_startup_routine
       end
 
-      # This is where we're hooked into the middleware stack. If the agent is enabled, we're ready
-      # to do some processing on a per request basis. If not, we just pass the request along to the
-      # next middleware in the stack.
+      # This is where we're hooked into the middleware stack. If the agent is enabled, we're ready to do some
+      # processing on a per request basis. If not, we just pass the request along to the next middleware in the stack.
       #
-      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
-      #   and values of this Request
-      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back
-      #   to the user up the Rack framework.
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
+      #   the Rack framework.
       def call env
         return app.call(env) unless AGENT.enabled?
 
@@ -80,13 +78,10 @@ module Contrast
       end
 
       # Startup the Agent as part of the initialization process:
-      # - start the service sending thread, responsible for sending and
-      #   processing messages
+      # - start the service sending thread, responsible for sending and processing messages
       # - start the heartbeat thread, which triggers service startup
-      # - start instrumenting libraries and do a 'catchup' patch for everything
-      #   we didn't see get loaded
-      # - enable TracePoint, which handles all class loads and required
-      #   instrumentation going forward
+      # - start instrumenting libraries and do a 'catchup' patch for everything we didn't see get loaded
+      # - enable TracePoint, which handles all class loads and required instrumentation going forward
       def agent_startup_routine
         logger.debug_with_time('middleware: starting service') do
           Contrast::Agent.thread_watcher.ensure_running?
@@ -102,49 +97,29 @@ module Contrast
         Contrast::Agent::AtExitHook.exit_hook
       end
 
-      # Some things have to wait until first request to happen, either because
-      # resolution is not complete or because the framework will preload
-      # classes, which confuses some of our instrumentation.
+      # Some things have to wait until first request to happen, either because resolution is not complete or because
+      # the framework will preload classes, which confuses some of our instrumentation.
       def handle_first_request
         @_handle_first_request ||= begin
           Contrast::Agent::StaticAnalysis.catchup
-          force_patching
           true
         end
       end
 
-      # TODO: RUBY-1090 remove this method and those it calls.
-      #
-      # These modules are auto-loaded by Rails, meaning they are defined at
-      # startup, but that they don't actually exist. We account for this in
-      # most cases by using the ClassUtil.truly_defined? method, but it appears
-      # to fail for these Modules. In the short term, we can forcing a re-patch
-      # so that their dead zones apply.
-      def force_patching
-        force_patch(ActionDispatch::FileHandler) if defined?(ActionDispatch::FileHandler)
-        force_patch(ActionDispatch::Http::MimeNegotiation) if defined?(ActionDispatch::Http::MimeNegotiation)
-        force_patch(ActionView::Template) if defined?(ActionView::Template)
-      end
-
-      def force_patch mod
-        data = Contrast::Agent::ModuleData.new(mod)
-        Contrast::Agent::Patching::Policy::Patcher.send(:patch_into_module, data, true)
-      end
-
-      # This is where we process each request we intercept as a middleware. We make the request context
-      # available globally so that it can be accessed from anywhere. A RequestHandler object is made
-      # for each request, which handles prefilter and postfilter operations.
-      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
-      #   and values of this Request
-      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back
-      #   to the user up the Rack framework.
+      # This is where we process each request we intercept as a middleware. We make the request context available
+      # globally so that it can be accessed from anywhere. A RequestHandler object is made for each request, which
+      # handles prefilter and postfilter operations.
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user
+      #   up the Rack framework.
       def call_with_agent env
         Contrast::Agent.thread_watcher.ensure_running?
         framework_request = Contrast::Agent.framework_manager.retrieve_request(env)
         context = Contrast::Agent::RequestContext.new(framework_request)
         response = nil
 
-        # make the context available for the lifecycle of this request
+        # Make the context available for the lifecycle of this request.
         Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
           logger.request_start
           request_handler = Contrast::Agent::RequestHandler.new(context)
@@ -212,8 +187,8 @@ module Contrast
       end
 
       SECURITY_EXCEPTION_MARKER = 'Contrast::SecurityException'
-      # We're only going to suppress SecurityExceptions indicating a blocked attack.
-      # And, only if the config.agent.ruby.exceptions.capture? is set
+      # We're only going to suppress SecurityExceptions indicating a blocked attack. And, only if the
+      # config.agent.ruby.exceptions.capture? is set
       def handle_exception exception
         if security_exception?(exception)
           exception_control = AGENT.exception_control
@@ -231,22 +206,18 @@ module Contrast
       # @param exception [Exception]
       # @return [Boolean]
       def security_exception? exception
-        exception.is_a?(Contrast::SecurityException) ||
-            exception.message&.include?(SECURITY_EXCEPTION_MARKER)
+        exception.is_a?(Contrast::SecurityException) || exception.message&.include?(SECURITY_EXCEPTION_MARKER)
       end
 
-      # As we deprecate support to prepare to remove dead code, we need to
-      # inform our users still relying on the now deprecated and soon to be
-      # removed functionality. This method handles doing that by leveraging the
-      # standard Kernel#warn approach
+      # As we deprecate support to prepare to remove dead code, we need to inform our users still relying on the now
+      # deprecated and soon to be removed functionality. This method handles doing that by leveraging the standard
+      # Kernel#warn approach
       def inform_deprecations
-        # Ruby 2.5 is currently in security maintenance, meaning int is only
-        # receiving updates for security issues. It will move to eol on 31
-        # March 2021. As such, we can remove support for it in Q2. We'll begin
-        # the deprecation warnings now so that customers have time to reach out
-        # if they'll be impacted.
-        # TODO: RUBY-715 remove this part of the method, leaving it empty if
-        #   there are no other deprecations, when we drop 2.5 support.
+        # Ruby 2.5 is currently in security maintenance, meaning int is only receiving updates for security issues. It
+        # will move to eol on 31 March 2021. As such, we can remove support for it in Q3. We'll begin the deprecation
+        # warnings now so that customers have time to reach out if they'll be impacted.
+        # TODO: RUBY-715 remove this part of the method, leaving it empty if there are no other deprecations, when we
+        #   drop 2.5 support.
         return unless RUBY_VERSION < '2.6.0'
 
         Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\

data/lib/contrast/agent/module_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,11 +6,11 @@ module Contrast
     # A simple wrapper around a Module and a call to its name, used to avoid
     # calling the Module#name method and generating extra Strings
     class ModuleData
-      attr_reader :mod, :name
+      attr_reader :mod, :mod_name
 
-      def initialize mod, name = nil
+      def initialize mod, mod_name = nil
         @mod = mod
-        @name = name || mod.cs__name
+        @mod_name = mod_name || mod.cs__name
       end
     end
   end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/after_load_patch'
@@ -51,10 +51,15 @@ module Contrast
               next unless after_load_patch.target_defined?
               next if AGENT.skip_instrumentation?(after_load_patch.module_name)
 
-              logger.trace(
-                  'Catching up on already loaded afterload patch - applying instrumentation',
-                  module: after_load_patch.module_name)
+              logger.trace('Catching up on already loaded afterload patch - applying instrumentation',
+                           module: after_load_patch.module_name)
               after_load_patch.instrument!
+            rescue NameError => e
+              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name,
+                                                                     method: after_load_patch.method_to_instrument)
+            rescue StandardError => e
+              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name,
+                                                                 method: after_load_patch.method_to_instrument)
             end
             after_load_patches.delete_if(&:applied?)
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -49,7 +49,10 @@ module Contrast
           private
 
           def nodes
-            @_nodes ||= [source_node, propagation_node, trigger_node, inventory_node, protect_node, deadzone_node].compact
+            @_nodes ||= [
+              source_node, propagation_node, trigger_node, inventory_node, protect_node,
+              deadzone_node
+            ].compact
           end
 
           def method_scopes
@@ -76,7 +79,8 @@ module Contrast
               protect_node =     find_method_node(module_policy.protect_nodes, method_name, instance_method)
               inventory_node =   find_method_node(module_policy.inventory_nodes, method_name, instance_method)
               deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
-              method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node, inventory_node, deadzone_node)
+              method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
+                                                  inventory_node, deadzone_node)
               MethodPolicy.new(method_name: method_name,
                                method_visibility: method_visibility,
                                instance_method: instance_method,

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'
@@ -20,12 +20,18 @@ module Contrast
             # @return [Contrast::Agent::Patching::Policy::ModulePolicy]
             def create_module_policy module_name
               module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.new
-              module_policy.source_nodes =      nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.sources, module_name)
-              module_policy.propagator_nodes =  nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.propagators, module_name)
-              module_policy.trigger_nodes =     nodes_for_module(Contrast::Agent::Assess::Policy::Policy.instance.triggers, module_name)
-              module_policy.protect_nodes =     nodes_for_module(Contrast::Agent::Protect::Policy::Policy.instance.triggers, module_name)
-              module_policy.inventory_nodes =   nodes_for_module(Contrast::Agent::Inventory::Policy::Policy.instance.triggers, module_name)
-              module_policy.deadzone_nodes =    nodes_for_module(Contrast::Agent::Deadzone::Policy::Policy.instance.deadzones, module_name)
+              module_policy.source_nodes =      nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.sources, module_name)
+              module_policy.propagator_nodes =  nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.propagators, module_name)
+              module_policy.trigger_nodes =     nodes_for_module(
+                  Contrast::Agent::Assess::Policy::Policy.instance.triggers, module_name)
+              module_policy.protect_nodes =     nodes_for_module(
+                  Contrast::Agent::Protect::Policy::Policy.instance.triggers, module_name)
+              module_policy.inventory_nodes =   nodes_for_module(
+                  Contrast::Agent::Inventory::Policy::Policy.instance.triggers, module_name)
+              module_policy.deadzone_nodes =    nodes_for_module(
+                  Contrast::Agent::Deadzone::Policy::Policy.instance.deadzones, module_name)
               module_policy
             end
 
@@ -42,7 +48,8 @@ module Contrast
             end
           end
 
-          attr_accessor :source_nodes, :propagator_nodes, :trigger_nodes, :inventory_nodes, :protect_nodes, :deadzone_nodes
+          attr_accessor :source_nodes, :propagator_nodes, :trigger_nodes, :inventory_nodes, :protect_nodes,
+                        :deadzone_nodes
 
           def empty?
             return false if source_nodes.any?

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'
@@ -130,11 +130,7 @@ module Contrast
               return unless AGENT.enabled?
               return unless PROTECT.enabled?
 
-              apply_trigger_only(method_policy&.protect_node,
-                                 method,
-                                 exception,
-                                 object,
-                                 args)
+              apply_trigger_only(method_policy&.protect_node, method, exception, object, args)
             end
 
             # Apply the Inventory patch which applies to the given method.
@@ -151,11 +147,7 @@ module Contrast
             def apply_inventory method_policy, method, exception, object, args
               return unless INVENTORY.enabled?
 
-              apply_trigger_only(method_policy&.inventory_node,
-                                 method,
-                                 exception,
-                                 object,
-                                 args)
+              apply_trigger_only(method_policy&.inventory_node, method, exception, object, args)
             end
 
             # Apply the Assess patches which apply to the given method.
@@ -178,15 +170,18 @@ module Contrast
               return ret unless method_policy && ASSESS.enabled?
 
               current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return ret unless current_context.analyze_request?
+              return ret if current_context && !current_context.analyze_request?
 
               trigger_node = method_policy.trigger_node
-              Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args) if trigger_node
+              if trigger_node
+                Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args)
+              end
               if method_policy.source_node
                 # If we were given a frozen return, and it was the target of a
                 # source, and we have frozen sources enabled, we'll need to
                 # replace the return. Note, this is not the default case.
-                source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret, args)
+                source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret,
+                                                                                           args)
               end
               if method_policy.propagation_node
                 propagated_ret = Contrast::Agent::Assess::Policy::PropagationMethod.apply_propagation(
@@ -277,9 +272,9 @@ module Contrast
             # <method_start>_unbound_<method_name>
             def build_unbound_method_name patcher_method
               (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
-                  'unbound' +
-                  Contrast::Utils::ObjectShare::UNDERSCORE +
-                  patcher_method.to_s).to_sym
+                'unbound' +
+                Contrast::Utils::ObjectShare::UNDERSCORE +
+                patcher_method.to_s).to_sym
             end
 
             # @param mod [Module] the module in which the patch should be
@@ -339,7 +334,7 @@ module Contrast
             # @return [Symbol] new alias for the underlying method (presumably, so the patched method can call it)
             def register_c_patch target_module_name, unbound_method, impl = :alias_instance
               # These could be set as AfterLoadPatches.
-              method_name = unbound_method.name.to_sym
+              method_name = unbound_method.name.to_sym # rubocop:disable Security/Module/Name -- ruby built in attribute.
               underlying_method_name = build_unbound_method_name(method_name).to_sym
 
               target_module = Module.cs__const_get(target_module_name)
@@ -362,29 +357,27 @@ module Contrast
 
               case impl
               when :alias_instance, :alias_singleton
+                # Core to patching. Ignore define method usage cop.
+                # rubocop:disable Performance/Kernel/DefineMethod
                 unless target_module.instance_methods(false).include? underlying_method_name
                   # alias_method may be private
                   target_module.send(:alias_method, underlying_method_name, method_name)
-                  # TODO: RUBY-1052
-                  # rubocop:disable Performance/Kernel/DefineMethod
                   target_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                  # rubocop:enable Performance/Kernel/DefineMethod
                 end
                 target_module.send(visibility, method_name) # e.g., module.private(:my_method)
               when :prepend
                 prepending_module = Module.new
-                # TODO: RUBY-1052
-                # rubocop:disable Performance/Kernel/DefineMethod
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                # rubocop:enable Performance/Kernel/DefineMethod
                 prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
+                # rubocop:enable Performance/Kernel/DefineMethod
               end
               # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
               # can't invoke this logging method or we'll seg fault as we'd
               # change the method definition mid-call
-              # if method_name != :[]=
+              # if method_name != :[]= &&
+              #   Contrast::Agent::Logger.defined!
               #   logger.trace(
               #       'Registered C-defined patch',
               #       implementation: impl,
@@ -392,14 +385,15 @@ module Contrast
               #       method: method_name,
               #       visibility: visibility)
               # end
-              underlying_method_name.to_sym
+              underlying_method_name
             end
 
             # @return [Boolean]
             def skip_contrast_analysis?
               return true if in_contrast_scope?
-              return true unless defined?(Contrast::Agent::REQUEST_TRACKER)
-              return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+              return false unless defined?(Contrast::Agent::REQUEST_TRACKER)
+              return false unless Contrast::Agent::REQUEST_TRACKER.current
+              return true unless Contrast::Agent::REQUEST_TRACKER.current.analyze_request?
 
               false
             end
@@ -411,7 +405,7 @@ module Contrast
             def skip_assess_analysis?
               return true if skip_contrast_analysis?
 
-              !ASSESS.enabled?
+              !ASSESS&.enabled?
             end
           end
         end