contrast-agent 4.4.0 → 4.8.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (313) hide show
  1. checksums.yaml +4 -4
  2. data/.gitmodules +1 -1
  3. data/.simplecov +1 -1
  4. data/Gemfile +1 -1
  5. data/LICENSE.txt +1 -1
  6. data/Rakefile +2 -3
  7. data/exe/contrast_service +1 -1
  8. data/ext/build_funchook.rb +4 -4
  9. data/ext/cs__assess_active_record_named/cs__active_record_named.c +1 -1
  10. data/ext/cs__assess_active_record_named/extconf.rb +1 -1
  11. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  12. data/ext/cs__assess_array/extconf.rb +1 -1
  13. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  14. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  15. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  16. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  17. data/ext/cs__assess_hash/cs__assess_hash.c +4 -2
  18. data/ext/cs__assess_hash/extconf.rb +1 -1
  19. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  20. data/ext/cs__assess_kernel/extconf.rb +1 -1
  21. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  22. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  23. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  24. data/ext/cs__assess_module/extconf.rb +1 -1
  25. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  26. data/ext/cs__assess_regexp/extconf.rb +1 -1
  27. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  28. data/ext/cs__assess_string/extconf.rb +1 -1
  29. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  30. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  31. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  32. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  33. data/ext/cs__common/cs__common.c +5 -5
  34. data/ext/cs__common/cs__common.h +4 -4
  35. data/ext/cs__common/extconf.rb +1 -1
  36. data/ext/cs__contrast_patch/cs__contrast_patch.c +22 -25
  37. data/ext/cs__contrast_patch/extconf.rb +1 -1
  38. data/ext/cs__protect_kernel/cs__protect_kernel.c +1 -1
  39. data/ext/cs__protect_kernel/extconf.rb +1 -1
  40. data/ext/extconf_common.rb +2 -6
  41. data/lib/contrast-agent.rb +1 -1
  42. data/lib/contrast.rb +20 -1
  43. data/lib/contrast/agent.rb +1 -3
  44. data/lib/contrast/agent/assess.rb +2 -2
  45. data/lib/contrast/agent/assess/contrast_event.rb +54 -69
  46. data/lib/contrast/agent/assess/contrast_object.rb +3 -3
  47. data/lib/contrast/agent/assess/events/event_factory.rb +3 -2
  48. data/lib/contrast/agent/assess/events/source_event.rb +7 -2
  49. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  50. data/lib/contrast/agent/assess/finalizers/hash.rb +26 -34
  51. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +24 -20
  52. data/lib/contrast/agent/assess/policy/patcher.rb +11 -18
  53. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/policy_node.rb +26 -34
  55. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/preshift.rb +4 -2
  57. data/lib/contrast/agent/assess/policy/propagation_method.rb +8 -21
  58. data/lib/contrast/agent/assess/policy/propagation_node.rb +20 -9
  59. data/lib/contrast/agent/assess/policy/propagator.rb +2 -1
  60. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -1
  61. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/center.rb +3 -2
  63. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  64. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -1
  65. data/lib/contrast/agent/assess/policy/propagator/insert.rb +4 -2
  66. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  67. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  68. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  69. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  70. data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb +73 -0
  71. data/lib/contrast/agent/assess/policy/propagator/remove.rb +23 -19
  72. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  74. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -13
  75. data/lib/contrast/agent/assess/policy/propagator/splat.rb +1 -1
  76. data/lib/contrast/agent/assess/policy/propagator/split.rb +4 -8
  77. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +2 -8
  78. data/lib/contrast/agent/assess/policy/propagator/trim.rb +64 -45
  79. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +7 -4
  80. data/lib/contrast/agent/assess/policy/source_method.rb +92 -81
  81. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  82. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +8 -6
  83. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +2 -4
  84. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +7 -3
  85. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +7 -8
  86. data/lib/contrast/agent/assess/policy/trigger_method.rb +102 -74
  87. data/lib/contrast/agent/assess/policy/trigger_node.rb +5 -4
  88. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +5 -4
  89. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -3
  90. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +1 -1
  91. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +2 -9
  92. data/lib/contrast/agent/assess/properties.rb +1 -1
  93. data/lib/contrast/agent/assess/property/evented.rb +9 -6
  94. data/lib/contrast/agent/assess/property/tagged.rb +1 -1
  95. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  96. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  97. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +12 -6
  98. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +5 -2
  99. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +4 -6
  100. data/lib/contrast/agent/assess/tag.rb +1 -1
  101. data/lib/contrast/agent/assess/tracker.rb +1 -1
  102. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  103. data/lib/contrast/agent/class_reopener.rb +4 -2
  104. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  105. data/lib/contrast/agent/deadzone/policy/policy.rb +7 -3
  106. data/lib/contrast/agent/disable_reaction.rb +2 -4
  107. data/lib/contrast/agent/exclusion_matcher.rb +6 -12
  108. data/lib/contrast/agent/inventory.rb +1 -2
  109. data/lib/contrast/agent/inventory/dependencies.rb +3 -1
  110. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  111. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +35 -23
  112. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  113. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  114. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  115. data/lib/contrast/agent/middleware.rb +38 -67
  116. data/lib/contrast/agent/module_data.rb +4 -4
  117. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  118. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +9 -4
  119. data/lib/contrast/agent/patching/policy/method_policy.rb +7 -3
  120. data/lib/contrast/agent/patching/policy/module_policy.rb +15 -8
  121. data/lib/contrast/agent/patching/policy/patch.rb +23 -29
  122. data/lib/contrast/agent/patching/policy/patch_status.rb +7 -8
  123. data/lib/contrast/agent/patching/policy/patcher.rb +23 -22
  124. data/lib/contrast/agent/patching/policy/policy.rb +14 -21
  125. data/lib/contrast/agent/patching/policy/policy_node.rb +15 -5
  126. data/lib/contrast/agent/patching/policy/trigger_node.rb +22 -9
  127. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +2 -2
  128. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +2 -2
  129. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +2 -2
  130. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +3 -4
  131. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +2 -2
  132. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +6 -10
  133. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  134. data/lib/contrast/agent/protect/policy/rule_applicator.rb +6 -6
  135. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  136. data/lib/contrast/agent/protect/rule.rb +1 -1
  137. data/lib/contrast/agent/protect/rule/base.rb +19 -33
  138. data/lib/contrast/agent/protect/rule/base_service.rb +10 -6
  139. data/lib/contrast/agent/protect/rule/cmd_injection.rb +15 -19
  140. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  141. data/lib/contrast/agent/protect/rule/deserialization.rb +7 -14
  142. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +4 -15
  143. data/lib/contrast/agent/protect/rule/no_sqli.rb +7 -3
  144. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +2 -4
  145. data/lib/contrast/agent/protect/rule/path_traversal.rb +6 -6
  146. data/lib/contrast/agent/protect/rule/sqli.rb +3 -3
  147. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  148. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  149. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  150. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  151. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +2 -2
  152. data/lib/contrast/agent/protect/rule/xss.rb +2 -2
  153. data/lib/contrast/agent/protect/rule/xxe.rb +6 -13
  154. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +2 -3
  155. data/lib/contrast/agent/reaction_processor.rb +12 -11
  156. data/lib/contrast/agent/request.rb +25 -24
  157. data/lib/contrast/agent/request_context.rb +13 -23
  158. data/lib/contrast/agent/request_handler.rb +1 -1
  159. data/lib/contrast/agent/response.rb +1 -1
  160. data/lib/contrast/agent/rewriter.rb +6 -4
  161. data/lib/contrast/agent/rule_set.rb +3 -3
  162. data/lib/contrast/agent/scope.rb +1 -1
  163. data/lib/contrast/agent/service_heartbeat.rb +3 -4
  164. data/lib/contrast/agent/static_analysis.rb +1 -1
  165. data/lib/contrast/agent/thread.rb +1 -1
  166. data/lib/contrast/agent/thread_watcher.rb +1 -1
  167. data/lib/contrast/agent/tracepoint_hook.rb +2 -2
  168. data/lib/contrast/agent/version.rb +2 -2
  169. data/lib/contrast/agent/worker_thread.rb +1 -1
  170. data/lib/contrast/api.rb +1 -1
  171. data/lib/contrast/api/communication.rb +1 -1
  172. data/lib/contrast/api/communication/connection_status.rb +1 -1
  173. data/lib/contrast/api/communication/messaging_queue.rb +1 -1
  174. data/lib/contrast/api/communication/response_processor.rb +5 -7
  175. data/lib/contrast/api/communication/service_lifecycle.rb +5 -3
  176. data/lib/contrast/api/communication/socket.rb +1 -1
  177. data/lib/contrast/api/communication/socket_client.rb +9 -22
  178. data/lib/contrast/api/communication/speedracer.rb +6 -10
  179. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  180. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  181. data/lib/contrast/api/decorators.rb +1 -1
  182. data/lib/contrast/api/decorators/address.rb +1 -1
  183. data/lib/contrast/api/decorators/agent_startup.rb +1 -1
  184. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  185. data/lib/contrast/api/decorators/application_startup.rb +10 -4
  186. data/lib/contrast/api/decorators/application_update.rb +1 -1
  187. data/lib/contrast/api/decorators/http_request.rb +1 -1
  188. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  189. data/lib/contrast/api/decorators/instrumentation_mode.rb +37 -0
  190. data/lib/contrast/api/decorators/library.rb +9 -7
  191. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  192. data/lib/contrast/api/decorators/message.rb +4 -4
  193. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  194. data/lib/contrast/api/decorators/route_coverage.rb +1 -1
  195. data/lib/contrast/api/decorators/server_features.rb +1 -1
  196. data/lib/contrast/api/decorators/trace_event.rb +4 -2
  197. data/lib/contrast/api/decorators/trace_event_object.rb +2 -4
  198. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  199. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  200. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +2 -7
  201. data/lib/contrast/api/decorators/user_input.rb +1 -1
  202. data/lib/contrast/components/agent.rb +14 -15
  203. data/lib/contrast/components/app_context.rb +7 -7
  204. data/lib/contrast/components/assess.rb +6 -11
  205. data/lib/contrast/components/config.rb +3 -2
  206. data/lib/contrast/components/contrast_service.rb +8 -9
  207. data/lib/contrast/components/heap_dump.rb +1 -1
  208. data/lib/contrast/components/interface.rb +4 -3
  209. data/lib/contrast/components/inventory.rb +1 -1
  210. data/lib/contrast/components/logger.rb +1 -1
  211. data/lib/contrast/components/protect.rb +11 -14
  212. data/lib/contrast/components/sampling.rb +9 -3
  213. data/lib/contrast/components/scope.rb +2 -1
  214. data/lib/contrast/components/settings.rb +27 -98
  215. data/lib/contrast/config.rb +1 -1
  216. data/lib/contrast/config/agent_configuration.rb +1 -1
  217. data/lib/contrast/config/application_configuration.rb +1 -1
  218. data/lib/contrast/config/assess_configuration.rb +1 -1
  219. data/lib/contrast/config/assess_rules_configuration.rb +2 -4
  220. data/lib/contrast/config/base_configuration.rb +5 -6
  221. data/lib/contrast/config/default_value.rb +1 -1
  222. data/lib/contrast/config/exception_configuration.rb +2 -6
  223. data/lib/contrast/config/heap_dump_configuration.rb +13 -7
  224. data/lib/contrast/config/inventory_configuration.rb +1 -1
  225. data/lib/contrast/config/logger_configuration.rb +2 -6
  226. data/lib/contrast/config/protect_configuration.rb +1 -1
  227. data/lib/contrast/config/protect_rule_configuration.rb +23 -1
  228. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  229. data/lib/contrast/config/root_configuration.rb +1 -1
  230. data/lib/contrast/config/ruby_configuration.rb +1 -1
  231. data/lib/contrast/config/sampling_configuration.rb +1 -1
  232. data/lib/contrast/config/server_configuration.rb +1 -1
  233. data/lib/contrast/config/service_configuration.rb +1 -1
  234. data/lib/contrast/configuration.rb +4 -15
  235. data/lib/contrast/delegators/input_analysis.rb +12 -0
  236. data/lib/contrast/extension/assess.rb +1 -1
  237. data/lib/contrast/extension/assess/array.rb +2 -7
  238. data/lib/contrast/extension/assess/erb.rb +2 -8
  239. data/lib/contrast/extension/assess/eval_trigger.rb +3 -11
  240. data/lib/contrast/extension/assess/exec_trigger.rb +4 -14
  241. data/lib/contrast/extension/assess/fiber.rb +3 -13
  242. data/lib/contrast/extension/assess/hash.rb +1 -1
  243. data/lib/contrast/extension/assess/kernel.rb +3 -10
  244. data/lib/contrast/extension/assess/marshal.rb +3 -11
  245. data/lib/contrast/extension/assess/regexp.rb +2 -7
  246. data/lib/contrast/extension/assess/string.rb +4 -2
  247. data/lib/contrast/extension/delegator.rb +1 -1
  248. data/lib/contrast/extension/inventory.rb +1 -1
  249. data/lib/contrast/extension/kernel.rb +5 -3
  250. data/lib/contrast/extension/module.rb +1 -1
  251. data/lib/contrast/extension/protect.rb +1 -1
  252. data/lib/contrast/extension/protect/kernel.rb +1 -1
  253. data/lib/contrast/extension/protect/psych.rb +1 -1
  254. data/lib/contrast/extension/thread.rb +1 -1
  255. data/lib/contrast/framework/base_support.rb +1 -1
  256. data/lib/contrast/framework/manager.rb +5 -9
  257. data/lib/contrast/framework/platform_version.rb +1 -1
  258. data/lib/contrast/framework/rack/patch/session_cookie.rb +6 -19
  259. data/lib/contrast/framework/rack/patch/support.rb +7 -5
  260. data/lib/contrast/framework/rack/support.rb +1 -1
  261. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  262. data/lib/contrast/framework/rails/patch/assess_configuration.rb +8 -3
  263. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +4 -4
  264. data/lib/contrast/framework/rails/patch/support.rb +6 -4
  265. data/lib/contrast/framework/rails/railtie.rb +32 -0
  266. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +5 -2
  267. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +3 -1
  268. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +3 -1
  269. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +3 -1
  270. data/lib/contrast/framework/rails/support.rb +3 -3
  271. data/lib/contrast/framework/sinatra/support.rb +4 -2
  272. data/lib/contrast/funchook/funchook.rb +2 -6
  273. data/lib/contrast/logger/application.rb +13 -10
  274. data/lib/contrast/logger/format.rb +3 -6
  275. data/lib/contrast/logger/log.rb +5 -4
  276. data/lib/contrast/logger/request.rb +2 -3
  277. data/lib/contrast/logger/time.rb +1 -1
  278. data/lib/contrast/security_exception.rb +2 -2
  279. data/lib/contrast/tasks/config.rb +1 -1
  280. data/lib/contrast/tasks/service.rb +6 -2
  281. data/lib/contrast/utils/assess/sampling_util.rb +1 -1
  282. data/lib/contrast/utils/assess/tracking_util.rb +2 -3
  283. data/lib/contrast/utils/class_util.rb +15 -11
  284. data/lib/contrast/utils/duck_utils.rb +1 -1
  285. data/lib/contrast/utils/env_configuration_item.rb +1 -1
  286. data/lib/contrast/utils/hash_digest.rb +16 -24
  287. data/lib/contrast/utils/heap_dump_util.rb +1 -1
  288. data/lib/contrast/utils/invalid_configuration_util.rb +1 -1
  289. data/lib/contrast/utils/inventory_util.rb +1 -1
  290. data/lib/contrast/utils/io_util.rb +2 -2
  291. data/lib/contrast/utils/job_servers_running.rb +10 -5
  292. data/lib/contrast/utils/object_share.rb +1 -1
  293. data/lib/contrast/utils/os.rb +3 -2
  294. data/lib/contrast/utils/preflight_util.rb +1 -1
  295. data/lib/contrast/utils/resource_loader.rb +1 -1
  296. data/lib/contrast/utils/ruby_ast_rewriter.rb +3 -2
  297. data/lib/contrast/utils/sha256_builder.rb +1 -1
  298. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  299. data/lib/contrast/utils/string_utils.rb +1 -1
  300. data/lib/contrast/utils/tag_util.rb +1 -1
  301. data/lib/contrast/utils/thread_tracker.rb +1 -1
  302. data/lib/contrast/utils/timer.rb +1 -1
  303. data/resources/assess/policy.json +60 -2
  304. data/resources/deadzone/policy.json +7 -23
  305. data/ruby-agent.gemspec +22 -20
  306. data/service_executables/VERSION +1 -1
  307. data/service_executables/linux/contrast-service +0 -0
  308. data/service_executables/mac/contrast-service +0 -0
  309. data/sonar-project.properties +9 -0
  310. metadata +94 -50
  311. data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +0 -38
  312. data/lib/contrast/agent/railtie.rb +0 -31
  313. data/lib/contrast/common_agent_configuration.rb +0 -87
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -68,7 +68,10 @@ module Contrast
68
68
  def set_info_for mod, method, method_policy, is_instance_method, cs_method
69
69
  mod.instance_variable_set(method_info_key, {}) unless mod.instance_variable_defined?(method_info_key)
70
70
  holder = mod.instance_variable_get(method_info_key)
71
- holder[method_name_key(method, is_instance_method)] = [method_policy, cs_method] unless holder.key?(method)
71
+ # if we already have this information, then we don't need to set it as we'll update the info on access
72
+ return if holder.key?(method)
73
+
74
+ holder[method_name_key(method, is_instance_method)] = [method_policy, cs_method]
72
75
  end
73
76
 
74
77
  private
@@ -153,9 +156,7 @@ module Contrast
153
156
  end
154
157
 
155
158
  def patched?
156
- @patch_status == :PATCHED ||
157
- @patch_status == :NONE ||
158
- @patch_status == :FAILED
159
+ @patch_status == :PATCHED || @patch_status == :NONE || @patch_status == :FAILED
159
160
  end
160
161
 
161
162
  def rewriting!
@@ -179,9 +180,7 @@ module Contrast
179
180
  end
180
181
 
181
182
  def rewritten?
182
- @rewrite_status == :REWRITTEN ||
183
- @rewrite_status == :NO_REWRITE ||
184
- @rewrite_status == :FAILED_REWRITE
183
+ @rewrite_status == :REWRITTEN || @rewrite_status == :NO_REWRITE || @rewrite_status == :FAILED_REWRITE
185
184
  end
186
185
  end
187
186
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'monitor'
@@ -13,7 +13,8 @@ require 'contrast/utils/class_util'
13
13
  # assess
14
14
  require 'contrast/agent/assess/policy/policy'
15
15
  require 'contrast/agent/assess/policy/policy_scanner'
16
- require 'contrast/agent/assess/policy/rewriter_patch'
16
+ # TODO: RUBY-714 remove guard w/ EOL of 2.5
17
+ require 'contrast/agent/assess/policy/rewriter_patch' if RUBY_VERSION < '2.6.0'
17
18
  require 'contrast/agent/assess/policy/source_method'
18
19
  require 'contrast/agent/assess/policy/trigger_method'
19
20
 
@@ -53,7 +54,7 @@ module Contrast
53
54
  def patch
54
55
  catchup_after_load_patches
55
56
  catchup_loaded_methods
56
- Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations
57
+ Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
57
58
  end
58
59
 
59
60
  # Hook to only monkeypatch Contrast. This will not trigger any
@@ -85,7 +86,7 @@ module Contrast
85
86
 
86
87
  load_patches_for_module(mod_name)
87
88
 
88
- return unless all_module_names.any? { |name| name == mod_name }
89
+ return unless all_module_names.any?(mod_name)
89
90
 
90
91
  module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
91
92
  patch_into_module(module_data)
@@ -143,7 +144,8 @@ module Contrast
143
144
  # @return [Array<String>] the names of all the Modules for which
144
145
  # there patches in our policies
145
146
  def all_module_names
146
- @_all_module_names ||= POLICIES.each_with_object(Set.new) { |policy, set| set.merge(policy.instance.module_names) }
147
+ @_all_module_names ||=
148
+ POLICIES.each_with_object(Set.new) { |policy, set| set.merge(policy.instance.module_names) }
147
149
  end
148
150
 
149
151
  # Hook to only monkeypatch Contrast. This will not trigger any
@@ -179,7 +181,7 @@ module Contrast
179
181
 
180
182
  # Begin patching our sources into the given module. Any patcher that has the name of the module will be
181
183
  # evaluated for patching. Find all the patchers that apply to this class, sorted by type.
182
- module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.create_module_policy(module_data.name)
184
+ module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.create_module_policy(module_data.mod_name)
183
185
  # If there's nothing to match, then set that status and exit
184
186
  if module_policy.empty?
185
187
  status.no_patch!
@@ -189,8 +191,7 @@ module Contrast
189
191
  status.patching!
190
192
  num_applied_patches = patch_into_instance_methods(module_data, module_policy)
191
193
  num_applied_patches += patch_into_singleton_methods(module_data, module_policy)
192
- if adjust_for_prepend(module_data) ||
193
- module_policy.num_expected_patches == num_applied_patches
194
+ if adjust_for_prepend(module_data) || module_policy.num_expected_patches == num_applied_patches
194
195
 
195
196
  status.patched!
196
197
  else
@@ -198,12 +199,12 @@ module Contrast
198
199
  end
199
200
  rescue StandardError => e
200
201
  status&.failed_patch!
201
- logger.warn('Patching failed', e, module: module_data.name)
202
+ logger.warn('Patching failed', e, module: module_data.mod_name)
202
203
  ensure
203
204
  logger.trace('Patching complete',
204
- module: module_data.name,
205
- result: Contrast::Agent::Patching::Policy::PatchStatus.get_status(
206
- module_data.mod).patch_status)
205
+ module: module_data.mod_name,
206
+ result:
207
+ Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod).patch_status)
207
208
  end
208
209
 
209
210
  # Get all of the instance methods on the given module, excluding
@@ -260,19 +261,19 @@ module Contrast
260
261
  # We've found the patchers that apply to this class (or module). Now we'll
261
262
  # filter on the given method.
262
263
  #
263
- # @param mod [Module] The module from which to retrieve instance
264
- # methods.
265
- # @param methods [Array<Symbol>] The names of all the methods in
266
- # in this module
267
- # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy]
268
- # All the patchers that apply to this class, sorted by type.
269
- # @param is_instance_method [Boolean] Indicates if these methods
270
- # are the instance or singleton methods for this module.
271
- # @return [Integer] number of methods patched
264
+ # @param mod [Module] The module from which to retrieve instance methods.
265
+ # @param methods [Array<Symbol>] The names of all the methods in in this module
266
+ # @param module_policy [Contrast::Agent::Patching::Policy::ModulePolicy] All the patchers that apply to
267
+ # this class, sorted by type.
268
+ # @param is_instance_method [Boolean] Indicates if these methods are the instance or singleton methods for
269
+ # this module.
270
+ # @return [Integer] number of methods patched.
272
271
  def patch_into_methods mod, methods, module_policy, is_instance_method
273
272
  count = 0
274
273
  methods.each do |method|
275
- method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.build_method_policy(method, module_policy, is_instance_method)
274
+ method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.build_method_policy(method,
275
+ module_policy,
276
+ is_instance_method)
276
277
  next if method_policy.empty?
277
278
 
278
279
  patched = patch_method(mod, methods, method_policy)
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'json'
@@ -13,8 +13,9 @@ module Contrast
13
13
  module Agent
14
14
  module Patching
15
15
  module Policy
16
- # This is just a holder for our policy. Takes the policy JSON and
17
- # converts it into hashes that we can access nicely
16
+ # This is just a holder for our policy. Takes the policy JSON and converts it into hashes that we can access
17
+ # nicely.
18
+ #
18
19
  # @abstract
19
20
  class Policy
20
21
  include Singleton
@@ -25,8 +26,8 @@ module Contrast
25
26
  raise(NoMethodError, 'specify policy_folder for patching')
26
27
  end
27
28
 
28
- # Indicates is this feature has been disabled by the configuration,
29
- # read at startup, and therefore can never be enabled.
29
+ # Indicates is this feature has been disabled by the configuration, read at startup, and therefore can never
30
+ # be enabled.
30
31
  def disabled_globally?
31
32
  raise(NoMethodError, 'specify disabled_globally? conditions for patching')
32
33
  end
@@ -58,17 +59,15 @@ module Contrast
58
59
  from_hash_string(json)
59
60
  end
60
61
 
61
- # Our policy for patching rules is a 'dope ass' JSON file. Rather than
62
- # hard code in a bunch of things to monkey patch, we let the JSON file
63
- # define the conditions in which modifications are applied.
64
- # This let's us be flexible and extensible.
62
+ # Our policy for patching rules is a 'dope ass' JSON file. Rather than hard code in a bunch of things to
63
+ # monkey patch, we let the JSON file define the conditions in which modifications are applied. This let's us
64
+ # be flexible and extensible.
65
65
  def from_hash_string string
66
- # The default behavior of the agent is to load the policy on startup,
67
- # as at this point we do not know in which mode we'll be run.
66
+ # The default behavior of the agent is to load the policy on startup, as at this point we do not know in
67
+ # which mode we'll be run.
68
68
  #
69
- # If the configuration file explicitly disables a feature, we know
70
- # that we will not ever be able to enable it, so in that case, we
71
- # can skip policy loading.
69
+ # If the configuration file explicitly disables a feature, we know that we will not ever be able to enable
70
+ # it, so in that case, we can skip policy loading.
72
71
  return if disabled_globally?
73
72
 
74
73
  policy_data = JSON.parse(string)
@@ -110,13 +109,7 @@ module Contrast
110
109
  end
111
110
 
112
111
  def module_names
113
- @_module_names ||= begin
114
- m = Set.new
115
- sources.each { |source| m << source.class_name }
116
- propagators.each { |propagator| m << propagator.class_name }
117
- triggers.each { |trigger| m << trigger.class_name }
118
- m
119
- end
112
+ @_module_names ||= Set.new([sources, propagators, triggers].flatten.map!(&:class_name))
120
113
  end
121
114
 
122
115
  def find_triggers_by_rule rule_id
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -44,10 +44,20 @@ module Contrast
44
44
  # later on. Really, if they don't have these things, they couldn't have
45
45
  # done their jobs anyway.
46
46
  def validate
47
- raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.") unless class_name
48
- raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.") unless method_name
49
- raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.") unless method_name.is_a?(Symbol)
50
- raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.") unless method_visibility.is_a?(Symbol)
47
+ unless class_name
48
+ raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.")
49
+ end
50
+ unless method_name
51
+ raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.")
52
+ end
53
+ unless method_name.is_a?(Symbol)
54
+ raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.")
55
+ end
56
+
57
+ unless method_visibility.is_a?(Symbol)
58
+ raise(ArgumentError,
59
+ "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.")
60
+ end
51
61
  unless method_scope.nil? || Contrast::Agent::Scope.valid_scope?(method_scope)
52
62
  raise(ArgumentError, "#{ node_class } #{ id } requires an undefined scope. Unable to create.")
53
63
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/extension/module'
@@ -21,7 +21,8 @@ module Contrast
21
21
  JSON_OPTIONAL_PROPS = 'optional_properties'
22
22
  JSON_ON_EXCEPTION = 'on_exception'
23
23
 
24
- attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties, :rule_id
24
+ attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties,
25
+ :rule_id
25
26
 
26
27
  def initialize trigger_hash = {}, rule_hash = {}
27
28
  super(trigger_hash)
@@ -42,9 +43,10 @@ module Contrast
42
43
 
43
44
  def validate
44
45
  super
45
- unless applicator.public_methods(false).any? { |method| method == applicator_method }
46
+ unless applicator.public_methods(false).any?(applicator_method)
46
47
  raise(ArgumentError,
47
- "#{ id } did not have a proper applicator method: #{ applicator } does not respond to #{ applicator_method }. Unable to create.")
48
+ "#{ id } did not have a proper applicator method: "\
49
+ "#{ applicator } does not respond to #{ applicator_method }. Unable to create.")
48
50
  end
49
51
  validate_properties
50
52
  validate_rule
@@ -52,20 +54,31 @@ module Contrast
52
54
 
53
55
  def validate_properties
54
56
  if (required_properties & optional_properties).any?
55
- raise(ArgumentError, "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
57
+ raise(ArgumentError,
58
+ "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
56
59
  end
57
60
  if (properties.keys - (required_properties | optional_properties)).any?
58
61
  raise(ArgumentError, "#{ id } had an unexpected property. Unable to create.")
59
62
  end
60
- raise(ArgumentError, "#{ id } did not have a required property. Unable to create.") if (required_properties - properties.keys).any?
63
+
64
+ return unless (required_properties - properties.keys).any?
65
+
66
+ raise(ArgumentError, "#{ id } did not have a required property. Unable to create.")
61
67
  end
62
68
 
63
69
  def validate_rule
64
70
  raise(ArgumentError, 'Unknown rule did not have a proper name. Unable to create.') unless rule_id
65
71
  raise(ArgumentError, "#{ id } did not have a proper applicator. Unable to create.") unless applicator
66
- raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.") unless applicator_method
67
- raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.") unless required_properties
68
- raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.") unless optional_properties
72
+
73
+ unless applicator_method
74
+ raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.")
75
+ end
76
+ unless required_properties
77
+ raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.")
78
+ end
79
+ return if optional_properties
80
+
81
+ raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.")
69
82
  end
70
83
 
71
84
  private
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/cmd_injection'
@@ -37,7 +37,7 @@ module Contrast
37
37
 
38
38
  protected
39
39
 
40
- def name
40
+ def rule_name
41
41
  Contrast::Agent::Protect::Rule::CmdInjection::NAME
42
42
  end
43
43
 
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/deserialization'
@@ -71,7 +71,7 @@ module Contrast
71
71
 
72
72
  protected
73
73
 
74
- def name
74
+ def rule_name
75
75
  Contrast::Agent::Protect::Rule::Deserialization::NAME
76
76
  end
77
77
 
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/no_sqli'
@@ -34,7 +34,7 @@ module Contrast
34
34
 
35
35
  protected
36
36
 
37
- def name
37
+ def rule_name
38
38
  Contrast::Agent::Protect::Rule::NoSqli::NAME
39
39
  end
40
40
 
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/path_traversal'
@@ -42,15 +42,14 @@ module Contrast
42
42
 
43
43
  protected
44
44
 
45
- def name
45
+ def rule_name
46
46
  Contrast::Agent::Protect::Rule::PathTraversal::NAME
47
47
  end
48
48
 
49
49
  private
50
50
 
51
51
  def possible_write? input
52
- input.cs__respond_to?(:to_s) &&
53
- input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
52
+ input.cs__respond_to?(:to_s) && input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
54
53
  end
55
54
 
56
55
  READ = 'read'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/sqli'
@@ -34,7 +34,7 @@ module Contrast
34
34
 
35
35
  protected
36
36
 
37
- def name
37
+ def rule_name
38
38
  Contrast::Agent::Protect::Rule::Sqli::NAME
39
39
  end
40
40
 
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/xxe'
@@ -49,16 +49,15 @@ module Contrast
49
49
 
50
50
  protected
51
51
 
52
- def name
52
+ def rule_name
53
53
  Contrast::Agent::Protect::Rule::Xxe::NAME
54
54
  end
55
55
 
56
56
  private
57
57
 
58
- DATA_KEY = '@data'.to_sym
58
+ DATA_KEY = :@data
59
59
  def valid_data_input? object
60
- object.instance_variable_defined?(DATA_KEY) &&
61
- object.instance_variable_get(DATA_KEY)
60
+ object.instance_variable_defined?(DATA_KEY) && object.instance_variable_get(DATA_KEY)
62
61
  end
63
62
 
64
63
  NOKOGIRI_MARKER = 'Nokogiri::'
@@ -115,11 +114,8 @@ module Contrast
115
114
  raise e
116
115
  rescue StandardError => e
117
116
  parser ||= Contrast::Utils::ObjectShare::UNKNOWN
118
- logger.error(
119
- 'Error applying xxe',
120
- e,
121
- module: potential_parser.cs__class.cs__name,
122
- method: method, parser: parser)
117
+ logger.error('Error applying xxe', e, module: potential_parser.cs__class.cs__name, method: method,
118
+ parser: parser)
123
119
  end
124
120
  end
125
121
  end
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/patching/policy/policy'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -42,7 +42,8 @@ module Contrast
42
42
  rescue Contrast::SecurityException => e
43
43
  raise e
44
44
  rescue StandardError => e
45
- logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method, rule: name)
45
+ logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method,
46
+ rule: rule_name)
46
47
  end
47
48
 
48
49
  protected
@@ -68,11 +69,10 @@ module Contrast
68
69
  raise NoMethodError, 'This is abstract, override it.'
69
70
  end
70
71
 
71
- # The name of the rule, as expected by the Contrast Service and
72
- # Contrast UI.
72
+ # The name of the rule, as expected by the Contrast Service and Contrast UI.
73
73
  #
74
74
  # @return [String]
75
- def name
75
+ def rule_name
76
76
  raise NoMethodError, 'This is abstract, override it.'
77
77
  end
78
78
 
@@ -82,7 +82,7 @@ module Contrast
82
82
  #
83
83
  # @return [Contrast::Agent::Protect::Rule::Base]
84
84
  def rule
85
- PROTECT.rule name
85
+ PROTECT.rule rule_name
86
86
  end
87
87
 
88
88
  # Should we skip analysis for this rule for this method invocation?