contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,16 +1,17 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
     # This utility allows us to report invalid configurations detected in
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
-      include Contrast::Components::Interface
-      access_component :analysis, :app_context, :logging, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'

data/lib/contrast/utils/inventory_util.rb

@@ -1,16 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/timer'
 require 'contrast/utils/object_share'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Utilities for getting inventory information from the application
     class InventoryUtil
-      include Contrast::Components::Interface
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       # TeamServer only accepts certain values for ArchitectureComponents.
       # DO NOT CHANGE THIS!

data/lib/contrast/utils/io_util.rb

@@ -1,15 +1,13 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Util for information about an IO
     class IOUtil
-      include Contrast::Components::Interface
-
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
@@ -20,7 +18,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -1,13 +1,14 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Utils
     # A module that detects whether any job servers attached to
     # the application are running
     module JobServersRunning
-      include Contrast::Components::Interface
-      access_component :app_context, :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       class << self
         def job_servers_running?
@@ -24,12 +25,17 @@ module Contrast
         end
 
         def rake_running?
-          return unless defined?(Rake) &&
-              Rake.cs__respond_to?(:application) &&
-              Rake.application.cs__respond_to?(:top_level_tasks)
+          unless defined?(Rake) &&
+                Rake.cs__respond_to?(:application) &&
+                Rake.application.cs__respond_to?(:top_level_tasks)
+
+            return
+          end
 
-          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
-          has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
+          disabled_rake_tasks = ::Contrast::APP_CONTEXT.disabled_agent_rake_tasks
+          has_disabled_task = Rake.application.top_level_tasks.any? do |top_level_task|
+            disabled_rake_tasks.include?(top_level_task)
+          end
           return false unless has_disabled_task
 
           logger.trace('Detected startup within Rake task')

data/lib/contrast/utils/object_share.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # rubocop:disable Security/Object/Freeze

data/lib/contrast/utils/os.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
@@ -9,8 +9,7 @@ module Contrast
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
-      include Contrast::Components::Interface
-      access_component :scope
+      extend Contrast::Components::Scope::InstanceMethods
 
       class << self
         def running?
@@ -27,7 +26,8 @@ module Contrast
         # returns an array of zombie process PIDs as strings; empty array if there are none
         def zombie_pids
           with_contrast_scope do
-            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
+            # retrieve pid of service processes
+            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'`
             zombie_pid_list.split("\n")
           end
         end

data/lib/contrast/utils/preflight_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/resource_loader.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'parser/current'
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 
+require 'parser/current'
 module Contrast
   module Utils
     # This utility allows us to parse and rewrite the AST in Ruby 2.5,

data/lib/contrast/utils/sha256_builder.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'

data/lib/contrast/utils/stack_trace_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/utils/string_utils.rb

@@ -1,14 +1,13 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP_'

data/lib/contrast/utils/tag_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,8 +7,9 @@ module Contrast
     class TagUtil
       class << self
         # Determine if the given array of tags is covered by the other
-        # remaining_ranges: the tags left that haven't been covered by those given
-        # ranges: the tags that are covering the first
+        #
+        # @param remaining_ranges [Array<Contrast::Agent::Assess::Tag>] the tags left that haven't been covered by those given
+        # @param ranges Array<Contrast::Agent::Assess::Tag> the tags that are covering the first
         def covered? remaining_ranges, ranges
           return true unless remaining_ranges&.any?
 
@@ -74,14 +75,14 @@ module Contrast
 
         # Given a collection of tags, merge any tags that are continuous
         #
-        # If tags is a hash, it should be in the format label => [tags]
-        # The array of tags will each be merged
+        # If tags is a hash, it should be in the format label => [tags]. The array of tags will each be merged
+        # If tags is an array in the format [tags], the array will be merged
         #
-        # If tags is an array in the format [tags], the array will be
-        # merged
+        # The original object is returned, although setters should not be necessary since tags is a collection in
+        # either case
         #
-        # The original object is returned, although setters should not be
-        # necessary since tags is a collection in either case
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
         def merge_tags tags
           if tags.is_a?(Hash)
             tags.each_value { |value| smallerize(value) }
@@ -90,6 +91,12 @@ module Contrast
           end
         end
 
+        # Merge the given set of tags such that any overlap combines. For any tag which extends beyond the size of the
+        # target_object, the end will be updated to the target_object's length.
+        #
+        # @param target_object [Object] the thing to which the tags apply
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
         def size_aware_merge target_object, tags
           max_size = target_object.to_s.length
           tags = merge_tags(tags)
@@ -100,14 +107,12 @@ module Contrast
 
         private
 
-        # Add one new element to the given array
+        # Add one new element to the given array. The addition is done such that the new entry is inserted so that the
+        # range they cover is in order. Any overlapping ranges are merged before returning.
         #
-        # The addition is done such that the new entry(ies)
-        # are inserted so that the range they cover is in order
-        # Any overlapping ranges are merged before returning
-        #
-        # arr: the array to which the element is added
-        # new_element: the element to be added to the array
+        # @param arr [Array<Contrast::Agent::Assess::Tag>]
+        # @param new_element []Contrast::Agent::Assess::Tag]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def single_ordered_merge arr, new_element
           idx = 0
           arr.each do |existing|
@@ -122,10 +127,11 @@ module Contrast
           arr.insert(idx, new_element)
         end
 
-        # Given an arry of tags, merge any that overlap
-        # The tag that was higher up is removed from the
-        # list of tags.
-        # ranges like [0-3][3-6]-6-9] that should become [0-9]
+        # Given an arry of tags, merge any that overlap. The tag that was higher up is removed from the list of tags.
+        # ranges like [0-3][3-6]-6-9] become [0-9]
+        #
+        # @param tags [Array<Contrast::Agent::Assess::Tag>]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def smallerize tags
           smallered = []
           curr = nil

data/lib/contrast/utils/thread_tracker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/timer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/resources/assess/policy.json

@@ -1026,6 +1026,61 @@
        "action": "CUSTOM",
        "patch_class": "ERBPropagator",
        "patch_method": "result_tagger"
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "strip_tags",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rack::Protection::EscapedParams",
+      "method_name": "escape_string",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::RackProtection",
+      "patch_method": "escaped_params"
+    },
+    {
+      "class_name": "Rails::Html::FullSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rails::Html::SafeListSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
     }
   ],
   "rules":[
@@ -1174,7 +1229,6 @@
           "method_visibility": "public",
           "method_name":"match",
           "source":"P0"
-
         }, {
           "class_name":"String",
           "instance_method": true,
@@ -1187,7 +1241,6 @@
           "method_visibility": "public",
           "method_name":"=~",
           "source":"P0"
-
         }
       ]
     }, {
@@ -1423,6 +1476,11 @@
           "instance_method": true,
           "method_visibility": "public",
           "method_name":"rand"
+        }, {
+          "class_name":"Random::Base",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"rand"
         }
       ]
     }, {

data/resources/deadzone/policy.json

@@ -5,16 +5,6 @@
       "instance_method":true,
       "method_visibility": "public",
       "method_name":"content_type"
-    }, {
-      "class_name":"Rack::Request::Helpers",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"host_authority"
-    }, {
-      "class_name":"Rack::Request::Helpers",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"host_with_port"
     }, {
       "class_name":"Rack::Request::Helpers",
       "instance_method":true,
@@ -61,18 +51,18 @@
       "method_visibility": "private",
       "method_name":"session_exists?",
       "code": "https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L334"
-    }, {
-      "class_name":"ActionDispatch::Http::MimeNegotiation",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"formats",
-      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
     }, {
       "class_name":"ActionDispatch::FileHandler",
       "instance_method":true,
       "method_visibility": "public",
       "method_name":"match?",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/static.rb#L30"
+    }, {
+      "class_name":"ActionDispatch::Http::MimeNegotiation",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"formats",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
     }, {
       "class_name":"ActionDispatch::Journey::Router",
       "instance_method":true,
@@ -83,7 +73,7 @@
       "class_name":"ActionDispatch::Request",
       "instance_method":true,
       "method_visibility": "public",
-      "method_name":"controler_class_for",
+      "method_name":"controller_class_for",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L84"
     }, {
       "class_name":"ActionDispatch::Request",