contrast-agent 4.6.0 → 4.9.1

data/lib/contrast/utils/class_util.rb

@@ -9,14 +9,6 @@ module Contrast
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
       class << self
-        # Given a module, return all of its descendants
-        #
-        # @param mod [Module] the module whose descendants you want to find.
-        # @return [Array<Module>] those Modules that inherit from the given.
-        def descendants mod
-          ObjectSpace.each_object(mod).to_a
-        end
-
         # some classes have had things prepended to them, like Marshal in Rails
         # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
         # our alias patching approach, as will any other prepend on something

data/lib/contrast/utils/hash_digest.rb

@@ -15,10 +15,7 @@ module Contrast
       include Digest::Instance
 
       CONTENT_LENGTH_HEADER = 'Content-Length'
-      CRYPTO_RULES = %w[
-        crypto-bad-ciphers
-        crypto-bad-mac
-      ].cs__freeze
+      CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
       CONFIG_PATH_KEY = 'path'
       CONFIG_SESSION_ID_KEY = 'sessionId'
       CLASS_SOURCE_KEY = 'source'
@@ -111,7 +108,7 @@ module Contrast
         events.each do |event|
           event.event_sources.each do |source|
             update(source.type)
-            update(source.name)
+            update(source.name) # rubocop:disable Security/Module/Name -- API attribute.
           end
         end
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -3,14 +3,16 @@
 
 require 'objspace'
 require 'singleton'
-require 'contrast/components/interface'
+require 'contrast/components/heap_dump'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil < Contrast::Agent::WorkerThread
-      include Contrast::Components::Interface
-      access_component :heap_dump, :logging
+      extend Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::HeapDump::InstanceMethods
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -2,15 +2,16 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
     # This utility allows us to report invalid configurations detected in
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
-      include Contrast::Components::Interface
-      access_component :analysis, :app_context, :logging, :scope
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'

data/lib/contrast/utils/inventory_util.rb

@@ -3,14 +3,13 @@
 
 require 'contrast/utils/timer'
 require 'contrast/utils/object_share'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Utilities for getting inventory information from the application
     class InventoryUtil
-      include Contrast::Components::Interface
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       # TeamServer only accepts certain values for ArchitectureComponents.
       # DO NOT CHANGE THIS!

data/lib/contrast/utils/io_util.rb

@@ -1,15 +1,13 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Util for information about an IO
     class IOUtil
-      include Contrast::Components::Interface
-
-      access_component :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
@@ -20,7 +18,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -1,13 +1,14 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Utils
     # A module that detects whether any job servers attached to
     # the application are running
     module JobServersRunning
-      include Contrast::Components::Interface
-      access_component :app_context, :logging
+      extend Contrast::Components::Logger::InstanceMethods
 
       class << self
         def job_servers_running?
@@ -24,12 +25,17 @@ module Contrast
         end
 
         def rake_running?
-          return unless defined?(Rake) &&
-              Rake.cs__respond_to?(:application) &&
-              Rake.application.cs__respond_to?(:top_level_tasks)
+          unless defined?(Rake) &&
+                Rake.cs__respond_to?(:application) &&
+                Rake.application.cs__respond_to?(:top_level_tasks)
+
+            return
+          end
 
-          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
-          has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
+          disabled_rake_tasks = ::Contrast::APP_CONTEXT.disabled_agent_rake_tasks
+          has_disabled_task = Rake.application.top_level_tasks.any? do |top_level_task|
+            disabled_rake_tasks.include?(top_level_task)
+          end
           return false unless has_disabled_task
 
           logger.trace('Detected startup within Rake task')

data/lib/contrast/utils/os.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
@@ -9,8 +9,7 @@ module Contrast
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
-      include Contrast::Components::Interface
-      access_component :scope
+      extend Contrast::Components::Scope::InstanceMethods
 
       class << self
         def running?
@@ -27,7 +26,8 @@ module Contrast
         # returns an array of zombie process PIDs as strings; empty array if there are none
         def zombie_pids
           with_contrast_scope do
-            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
+            # retrieve pid of service processes
+            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'`
             zombie_pid_list.split("\n")
           end
         end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'parser/current'
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 
+require 'parser/current'
 module Contrast
   module Utils
     # This utility allows us to parse and rewrite the AST in Ruby 2.5,

data/lib/contrast/utils/string_utils.rb

@@ -1,14 +1,13 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP_'

data/lib/contrast/utils/tag_util.rb

@@ -7,8 +7,9 @@ module Contrast
     class TagUtil
       class << self
         # Determine if the given array of tags is covered by the other
-        # remaining_ranges: the tags left that haven't been covered by those given
-        # ranges: the tags that are covering the first
+        #
+        # @param remaining_ranges [Array<Contrast::Agent::Assess::Tag>] the tags left that haven't been covered by those given
+        # @param ranges Array<Contrast::Agent::Assess::Tag> the tags that are covering the first
         def covered? remaining_ranges, ranges
           return true unless remaining_ranges&.any?
 
@@ -74,14 +75,14 @@ module Contrast
 
         # Given a collection of tags, merge any tags that are continuous
         #
-        # If tags is a hash, it should be in the format label => [tags]
-        # The array of tags will each be merged
+        # If tags is a hash, it should be in the format label => [tags]. The array of tags will each be merged
+        # If tags is an array in the format [tags], the array will be merged
         #
-        # If tags is an array in the format [tags], the array will be
-        # merged
+        # The original object is returned, although setters should not be necessary since tags is a collection in
+        # either case
         #
-        # The original object is returned, although setters should not be
-        # necessary since tags is a collection in either case
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
         def merge_tags tags
           if tags.is_a?(Hash)
             tags.each_value { |value| smallerize(value) }
@@ -90,6 +91,12 @@ module Contrast
           end
         end
 
+        # Merge the given set of tags such that any overlap combines. For any tag which extends beyond the size of the
+        # target_object, the end will be updated to the target_object's length.
+        #
+        # @param target_object [Object] the thing to which the tags apply
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
         def size_aware_merge target_object, tags
           max_size = target_object.to_s.length
           tags = merge_tags(tags)
@@ -100,14 +107,12 @@ module Contrast
 
         private
 
-        # Add one new element to the given array
+        # Add one new element to the given array. The addition is done such that the new entry is inserted so that the
+        # range they cover is in order. Any overlapping ranges are merged before returning.
         #
-        # The addition is done such that the new entry(ies)
-        # are inserted so that the range they cover is in order
-        # Any overlapping ranges are merged before returning
-        #
-        # arr: the array to which the element is added
-        # new_element: the element to be added to the array
+        # @param arr [Array<Contrast::Agent::Assess::Tag>]
+        # @param new_element []Contrast::Agent::Assess::Tag]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def single_ordered_merge arr, new_element
           idx = 0
           arr.each do |existing|
@@ -122,10 +127,11 @@ module Contrast
           arr.insert(idx, new_element)
         end
 
-        # Given an arry of tags, merge any that overlap
-        # The tag that was higher up is removed from the
-        # list of tags.
-        # ranges like [0-3][3-6]-6-9] that should become [0-9]
+        # Given an arry of tags, merge any that overlap. The tag that was higher up is removed from the list of tags.
+        # ranges like [0-3][3-6]-6-9] become [0-9]
+        #
+        # @param tags [Array<Contrast::Agent::Assess::Tag>]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def smallerize tags
           smallered = []
           curr = nil

data/resources/assess/policy.json

@@ -1026,6 +1026,61 @@
        "action": "CUSTOM",
        "patch_class": "ERBPropagator",
        "patch_method": "result_tagger"
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "strip_tags",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rack::Protection::EscapedParams",
+      "method_name": "escape_string",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::RackProtection",
+      "patch_method": "escaped_params"
+    },
+    {
+      "class_name": "Rails::Html::FullSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rails::Html::SafeListSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
     }
   ],
   "rules":[

data/ruby-agent.gemspec

@@ -22,7 +22,7 @@ end
 def self.add_dev_dependencies spec
   add_builders(spec)
   add_debuggers(spec)
-  add_linters(spec)
+  add_linters(spec) # if RUBY_VERSION >= '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
   add_specs(spec)
 end
 
@@ -41,15 +41,17 @@ end
 
 # Dependencies used for framework testing.
 def self.add_frameworks spec
+  spec.add_development_dependency 'rack-protection', '>= 2'
   spec.add_development_dependency 'rails', '6.0.3.5'
   spec.add_development_dependency 'sinatra', '>= 2'
 end
 
 # Dependencies used for linting prior to commit.
 def self.add_linters spec
-  spec.add_development_dependency 'debride'
-  spec.add_development_dependency 'fasterer'
-  spec.add_development_dependency 'flay'
+  spec.add_development_dependency 'debride', '1.8.2'
+  spec.add_development_dependency 'fasterer', '0.9.0'
+  spec.add_development_dependency 'flay', '2.12.1'
+  # spec.add_development_dependency 'steep', '0.44.1' # TODO: RUBY-714 uncomment w/ EOL of 2.5
   add_rubocop(spec)
 end
 
@@ -68,29 +70,29 @@ def self.add_specs spec
   spec.add_development_dependency 'rspec-benchmark'
   spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
   spec.add_development_dependency 'rspec-rails', '5.0'
+  spec.add_development_dependency 'warning'
   spec.add_development_dependency 'tzinfo-data' # Alpine rspec-rails requirement.
 end
 
 def self.add_coverage spec
-  spec.add_development_dependency 'codecov'
-  spec.add_development_dependency 'simplecov', '0.20.0'
+  spec.add_development_dependency 'simplecov', '0.21.2'
 end
 
 # Dependencies used to run all of our Rubocop during the linting phase.
 def self.add_rubocop spec
-  spec.add_development_dependency 'rubocop', '1.6.1'
-  spec.add_development_dependency 'rubocop-performance', '1.9.1'
+  spec.add_development_dependency 'rubocop', '1.13.0'
+  spec.add_development_dependency 'rubocop-performance', '1.11.0'
   spec.add_development_dependency 'rubocop-rails', '2.9.1'
   spec.add_development_dependency 'rubocop-rake', '0.5.1'
-  spec.add_development_dependency 'rubocop-rspec', '2.1.0'
+  spec.add_development_dependency 'rubocop-rspec', '2.2.0'
 end
 
 # Dependencies not mocked out during RSpec that we test real code of, beyond just frameworks.
 def self.add_tested_gems spec
   spec.add_development_dependency 'async'
   spec.add_development_dependency 'execjs'
+  spec.add_development_dependency 'rhino'
   spec.add_development_dependency 'sqlite3'
-  spec.add_development_dependency 'therubyracer'
   spec.add_development_dependency 'tilt'
   spec.add_development_dependency 'xpath'
 end
@@ -102,7 +104,7 @@ end
 # corresponding update to the fake gem server data in TeamServer.
 def self.add_dependencies spec
   spec.add_dependency 'ougai', '~> 1.8'
-  spec.add_dependency 'parser', '~> 2.6' # TODO: RUBY-714 remove w/ EOL of 2.5
+  spec.add_dependency 'parser', '>= 2.6' # if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
   spec.add_dependency 'protobuf', '~> 3.10'
   spec.add_dependency 'rack', '~> 2.0'
 end
@@ -113,7 +115,7 @@ def self.add_files spec
     # Directories used for testing:
     f.match(%r{^(spec|test)/}) ||
         # Directories used in pipelines
-        f.match(%r{^(\.github|bin|internal_resources|vendor)/}) ||
+        f.match(%r{^(\.github|bin|internal_resources|sig|vendor)/}) ||
         # Configuration and other files that don't belong to one directory
         f.match(/(Dockerfile)/)  ||
         f.match(/(.*\.csv)/)     ||
@@ -154,9 +156,7 @@ Gem::Specification.new do |spec|
   spec.name    = 'contrast-agent'
   spec.version = Contrast::Agent::VERSION
 
-  spec.email = %w[
-    ruby@contrastsecurity.com
-  ]
+  spec.email = %w[ruby@contrastsecurity.com]
 
   spec.summary      = 'Contrast Security\'s agent for rack-based applications.'
   spec.description  = 'This gem instantiates a Rack middleware for rack-based ' \
@@ -173,7 +173,8 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   unless File.exist?(File.join(Dir.pwd, 'contrast_security.yaml'))
-    spec.post_install_message = 'To generate the required contrast_security.yaml file you can run: bundle exec rake contrast:config:create'
+    spec.post_install_message = 'To generate the required contrast_security.yaml file you can run: '\
+                                'bundle exec rake contrast:config:create'
   end
 
   add_authors(spec)