contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'
@@ -27,6 +27,9 @@ module Contrast
               class_name = klass.cs__name
               instance_methods = klass.instance_methods
               instance_methods.concat(klass.private_instance_methods)
+              current_context = Contrast::Agent::REQUEST_TRACKER.current
+              current_request = current_context&.request
+
               tainted_columns.each_pair do |field, properties|
                 next unless properties
 
@@ -34,14 +37,14 @@ module Contrast
                 # Move on if we already know about this Dynamic Source
                 next if Contrast::Agent::Assess::Policy::Policy.instance.find_source_node(class_name, method_name, true)
 
-                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys))
+                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys),
+                                                         current_request)
                 Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
                 method_policy = build_source_policy(method_name, dynamic_source_node)
                 Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
-                current_context = Contrast::Agent::REQUEST_TRACKER.current
                 next unless current_context
 
-                dynamic_source = create_dynamic_source(current_context, dynamic_source_node, field, properties)
+                dynamic_source = create_dynamic_source(current_request, dynamic_source_node, field, properties)
                 node_id = Contrast::Utils::StringUtils.force_utf8(dynamic_source_node.id)
                 current_context.activity.dynamic_sources[node_id] = dynamic_source
               end
@@ -56,8 +59,10 @@ module Contrast
             # @param class_name [String] the name of the Class to patch
             # @param method_name [Symbol] the name of the Method to patch
             # @param tags [Set<String>] the tags this event should apply
+            # @param request [Contrast::Agent::Request] the request during
+            #  which this source is to be created.
             # @return [Contrast::Agent::Assess::Policy::SourceNode]
-            def create_source_node class_name, method_name, tags
+            def create_source_node class_name, method_name, tags, request
               node = Contrast::Agent::Assess::Policy::SourceNode.new
               node.class_name = class_name
               node.instance_method = true
@@ -72,8 +77,7 @@ module Contrast
               node.add_property(READ_TABLE, class_name)
               node.add_property(READ_COLUMN, method_name)
               node.add_property(WRITE_QUERY_TIME, Contrast::Utils::Timer.now_ms)
-              url = Contrast::Agent::REQUEST_TRACKER.current&.request&.normalized_uri
-              node.add_property(WRITE_QUERY_URL, url)
+              node.add_property(WRITE_QUERY_URL, request&.normalized_uri)
               node
             end
 
@@ -92,8 +96,8 @@ module Contrast
               method_policy
             end
 
-            # @param current_context [Contrast::Agent::RequestContext] the
-            #   context of the request in which this source is to be created.
+            # @param request [Contrast::Agent::Request] the request during
+            #   which this source is to be created.
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
             #   the SourceNode that applies to this method
             # @param field [String] the name of the method to which this source
@@ -104,13 +108,13 @@ module Contrast
             # @return [Contrast::Api::Dtm::DynamicSource] the message to send
             #   to the Service to allow it to report the events leading up to
             #   the creation of the Dynamic Source
-            def create_dynamic_source current_context, source_node, field, properties
+            def create_dynamic_source request, source_node, field, properties
               dynamic_source = Contrast::Api::Dtm::DynamicSource.new
               dynamic_source.class_name = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
               dynamic_source.method_name = Contrast::Utils::StringUtils.force_utf8(field)
               dynamic_source.instance_method = source_node.instance_method?
               dynamic_source.target = Contrast::Utils::StringUtils.force_utf8(source_node.target_string)
-              append_properties!(dynamic_source, current_context, source_node, field)
+              append_properties!(dynamic_source, request, source_node, field)
               append_events!(dynamic_source, properties.event)
               dynamic_source
             end
@@ -119,18 +123,18 @@ module Contrast
             # in TeamServer
             #
             # @param dynamic_source [Contrast::Api::Dtm::DynamicSource] the message to send to the Service to allow it
-            #   to report the events leading up to the creation of the Dynamic Source
-            # @param current_context [Contrast::Agent::RequestContext] the context of the request in which this source
-            #   is to be created.
+            #   to report the events leading up to the creation of the Dynamic Source.
+            # @param request [Contrast::Agent::Request] the request during which this source is to be created.
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the SourceNode that applies to this
-            #   method
-            # @param field [String] the name of the method to which this source applies
-            def append_properties! dynamic_source, current_context, source_node, field
+            #   method.
+            # @param field [String] the name of the method to which this source applies.
+            def append_properties! dynamic_source, request, source_node, field
               dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
               dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.properties[WRITE_QUERY_TIME] = Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
-              url = current_context.request.normalized_uri
-              dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(url)
+              dynamic_source.properties[WRITE_QUERY_TIME] =
+                Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
+              dynamic_source.properties[WRITE_QUERY_URL] =
+                Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
             end
 
             def append_events! dynamic_source, event

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,11 +1,12 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy'
 require 'contrast/agent/patching/policy/patcher'
 require 'contrast/agent/patching/policy/method_policy'
 require 'contrast/agent/patching/policy/module_policy'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Agent
@@ -16,8 +17,9 @@ module Contrast
         # provides a map for which methods our renamed functions need to call
         # and how.
         module Patcher
-          include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :scope
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
+
 
           class << self
             def policy
@@ -34,24 +36,18 @@ module Contrast
             # called. This hook is provided so that patches to those methods can
             # pass us execution flow once a new method has been made available.
             def patch_assess_on_eval mod
-              return unless ASSESS.enabled?
+              return unless ::Contrast::ASSESS.enabled?
               return if in_contrast_scope?
 
               patcher.patch_specific_module(mod)
             rescue StandardError => e
-              logger.warn(
-                  'Unable to patch assess during eval',
-                  e,
-                  module: mod.cs__name)
+              logger.warn('Unable to patch assess during eval', e, module: mod.cs__name)
             end
 
             # Exposed so that methods can be dynamically patched on creation at
             # runtime, like those generated by
             # ActiveRecord::AttributeMethods::Read::ClassMethods#define_method_attribute
-            CLASS_TYPES = [
-              Contrast::Utils::ObjectShare::CLASS,
-              Contrast::Utils::ObjectShare::MODULE
-            ].cs__freeze
+            CLASS_TYPES = [Contrast::Utils::ObjectShare::CLASS, Contrast::Utils::ObjectShare::MODULE].cs__freeze
             def patch_assess_method mod, method_name
               # Module.define_method is called a lot in Class and Module. We
               # currently do not expect these define_methods to result in methods
@@ -62,7 +58,8 @@ module Contrast
               return if CLASS_TYPES.include?(class_name)
               return unless ASSESS.enabled?
 
-              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources, class_name)
+              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources,
+                                                                                              class_name)
               return if source_nodes.empty?
 
               method_array = []
@@ -70,17 +67,15 @@ module Contrast
               source_nodes.each do |source_node|
                 next unless source_node.method_name.to_s == method_name
 
-                method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
-                                                                                    method_name: source_node.method_name,
-                                                                                    method_visibility: source_node.method_visibility,
-                                                                                    instance_method: true)
+                method_policy =
+                  Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
+                                                                      method_name: source_node.method_name,
+                                                                      method_visibility: source_node.method_visibility,
+                                                                      instance_method: true)
                 patcher.patch_method(mod, method_array, method_policy)
               end
             rescue StandardError => e
-              logger.warn(
-                  'Unable to patch assess during define_method_attribute',
-                  e,
-                  module: mod.cs__name)
+              logger.warn('Unable to patch assess during define_method_attribute', e, module: mod.cs__name)
             end
           end
         end

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'json'
@@ -26,7 +26,7 @@ module Contrast
           # Indicates is this feature has been disabled by the configuration,
           # read at startup, and therefore can never be enabled.
           def disabled_globally?
-            ASSESS.forcibly_disabled?
+            ::Contrast::ASSESS.forcibly_disabled?
           end
 
           def node_type

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'
@@ -35,16 +35,6 @@ module Contrast
             :TYPE_METHOD
           end
 
-          def target
-            @_target ||= begin
-              if targets&.any?
-                targets[0]
-              elsif sources&.any?
-                sources[0]
-              end
-            end
-          end
-
           def target_string= value
             @target_string = value
             @targets = convert_policy_markers(value)
@@ -85,8 +75,7 @@ module Contrast
               next if Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
                   Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
-              raise(ArgumentError,
-                    "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
+              raise(ArgumentError, "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
             end
           end
 
@@ -100,27 +89,26 @@ module Contrast
           # Trigger (trigger nodes) don't have targets (they are the target)
           # Everything else (propagation nodes) are Source2Target
           def build_action
-            @event_action ||= begin
-              case node_class
-              when Contrast::Agent::Assess::Policy::SourceNode::SOURCE
-                :CREATION
-              when Contrast::Agent::Assess::Policy::TriggerNode::TRIGGER
-                :TRIGGER
-              else
-                if source_string.nil?
-                  :CREATION
-                elsif target_string.nil?
-                  :TRIGGER
-                else
-                  # TeamServer can't handle the multi-source or multi-target
-                  # values. Give it some help by changing them to 'A'
-                  source = source_string.include?(Contrast::Utils::ObjectShare::COMMA) ? ALL_TYPE : source_string
-                  target = target_string.include?(Contrast::Utils::ObjectShare::COMMA) ? ALL_TYPE : target_string
-                  str = source[0] + TO_MARKER + target[0]
-                  str.to_sym
-                end
-              end
-            end
+            @event_action ||= case node_class
+                              when Contrast::Agent::Assess::Policy::SourceNode::SOURCE
+                                :CREATION
+                              when Contrast::Agent::Assess::Policy::TriggerNode::TRIGGER
+                                :TRIGGER
+                              else
+                                if source_string.nil?
+                                  :CREATION
+                                elsif target_string.nil?
+                                  :TRIGGER
+                                else
+                                  # TeamServer can't handle the multi-source or multi-target values. Give it some help
+                                  # by changing them to 'A'
+                                  source = all_type?(source_string) ? ALL_TYPE : source_string
+                                  target = all_type?(target_string) ? ALL_TYPE : target_string
+                                  str = source[0] + TO_MARKER + target[0]
+                                  str.to_sym
+                                end
+                              end
+
             @event_action
           end
 
@@ -158,6 +146,10 @@ module Contrast
             end
             converted
           end
+
+          def all_type? marker
+            marker.include?(Contrast::Utils::ObjectShare::COMMA)
+          end
         end
       end
     end

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -13,8 +12,7 @@ module Contrast
         # of a file vs data flow, such as the detection of Hardcoded Passwords
         # or Keys.
         module PolicyScanner
-          include Contrast::Components::Interface
-          access_component :analysis
+
 
           class << self
             # Use the given trace_point, built from an :end event, to determine
@@ -24,8 +22,8 @@ module Contrast
             # @param trace_point [TracePoint] the TracePoint generated by an
             #   :end event at the end of a Module definition.
             def scan trace_point
-              return unless ASSESS.enabled?
-              return unless ASSESS.require_scan?
+              return unless ::Contrast::ASSESS.enabled?
+              return unless ::Contrast::ASSESS.require_scan?
 
               provider_values = policy.providers.values
               return if provider_values.all?(&:disabled?)

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -9,8 +9,8 @@ module Contrast
       # In order to properly shift tags to account for the changes this method
       # caused, we'll need to store the state before the change occurred.
       class PreShift
-        include Contrast::Components::Interface
-        access_component :analysis, :logging
+        include Contrast::Components::Logger::InstanceMethods
+
 
         UNDUPLICABLE_MODULES = [
           Enumerator # dup'ing results in 'can't copy execution context'
@@ -37,7 +37,7 @@ module Contrast
           #   being called or nil if one is not required.
           def build_preshift propagation_node, object, args
             return unless propagation_node
-            return unless ASSESS.enabled?
+            return unless ::Contrast::ASSESS.enabled?
 
             initializing = propagation_node.method_name == :initialize
             return if unsafe_io_object?(object, initializing)
@@ -91,7 +91,9 @@ module Contrast
 
               Contrast::Agent::Assess::Tracker.copy(original_arg, preshift_arg)
             end
-            preshift.arg_lengths = preshift.args.map { |preshift_arg| Contrast::Utils::DuckUtils.quacks_to?(preshift_arg, :length) ? preshift_arg.length : 0 }
+            preshift.arg_lengths = preshift.args.map do |preshift_arg|
+              Contrast::Utils::DuckUtils.quacks_to?(preshift_arg, :length) ? preshift_arg.length : 0
+            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
 
 require 'contrast/agent/assess/policy/propagator'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 
@@ -17,8 +17,8 @@ module Contrast
         # general, these methods work on the String class or a holder of
         # Strings
         module PropagationMethod
-          include Contrast::Components::Interface
-          access_component :analysis, :logging
+          extend Contrast::Components::Logger::InstanceMethods
+
 
           APPEND_ACTION = 'APPEND'
           CENTER_ACTION = 'CENTER'
@@ -86,10 +86,6 @@ module Contrast
                 SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
             }.cs__freeze
 
-            def context_available?
-              !!Contrast::Agent::REQUEST_TRACKER.current
-            end
-
             # I lied above. We had to figure out what the target of the
             # propagation was. Now that we know, we'll actually do things to
             # it. Note that the return of this method will replace the original
@@ -144,13 +140,7 @@ module Contrast
               !!target
             end
 
-            ZERO_LENGTH_ACTIONS = [
-              DB_WRITE_ACTION,
-              CUSTOM_ACTION,
-              KEEP_ACTION,
-              REPLACE_ACTION,
-              SPLAT_ACTION
-            ].cs__freeze
+            ZERO_LENGTH_ACTIONS = [DB_WRITE_ACTION, CUSTOM_ACTION, KEEP_ACTION, REPLACE_ACTION, SPLAT_ACTION].cs__freeze
             # If the action required needs a length and the target does not have
             # one, the length is not valid
             def valid_length? target, action
@@ -225,7 +215,7 @@ module Contrast
 
             # This is checked right before actual propagation
             def propagation_possible? propagation_node, target
-              return false unless context_available? && propagation_node && valid_target?(target, propagation_node)
+              return false unless propagation_node && valid_target?(target, propagation_node)
               return false unless valid_length?(target, propagation_node.action)
 
               true
@@ -249,7 +239,7 @@ module Contrast
 
             def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
               target.each do |value|
-                next if target == value # Some Enumerable#each are overridden to return self the first time which leads to infinite propagation
+                next if target == value
 
                 apply_propagator(propagation_node, preshift, value, object, ret, args, block)
               end
@@ -287,9 +277,7 @@ module Contrast
 
               properties.add_properties(propagation_node.properties)
               properties.build_event(propagation_node, target, object, ret, args)
-              logger.trace('Propagation detected',
-                           node_id: propagation_node.id,
-                           target_id: target.__id__)
+              logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
               restore_frozen_state ? ret : nil
             end
 
@@ -300,10 +288,9 @@ module Contrast
             # @return [Contrast::Agent::Assess::Policy::Propagator, nil]
             def find_propagation_class propagation_node
               unless (propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil))
-                logger.warn(
-                    'Unknown propagation action received. Unable to propagate.',
-                    node_id: propagation_node.id,
-                    action: propagation_node.action)
+                logger.warn('Unknown propagation action received. Unable to propagate.',
+                            node_id: propagation_node.id,
+                            action: propagation_node.action)
               end
               propagation_class
             end
@@ -315,7 +302,7 @@ module Contrast
             #   propagation event.
             # @return [Boolean]
             def can_handle_frozen? propagation_node
-              ASSESS.track_frozen_sources? && propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+              ::Contrast::ASSESS.track_frozen_sources? && propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
             end
           end
         end