contrast-agent 4.9.1 → 4.13.0

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -0,0 +1,138 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module will include all methods for some internal validations/appliers in the TriggerMethod module
+      # and some other module methods from the same place, so we can ease the main module
+      module TriggerMethodUtils
+        # A request is reportable if it is not from ActionController::Live
+        #
+        # @param env [Hash] the env of the Request
+        # @return [Boolean]
+        def reportable? env
+          !(defined?(ActionController::Live) &&
+            env &&
+            env['action_controller.instance'].cs__class.included_modules.include?(ActionController::Live))
+        end
+
+        # Find the request for this finding. This assumes, for now, that if there is an active request, then that
+        # is the request to report. Otherwise, we'll use the first request found in the events of the
+        # source_object.
+        #
+        # @param source [Object,nil] some Object used as the source of a trigger event
+        # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
+        def find_request source
+          return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
+
+          find_event_request(properties.event)
+        end
+
+        # Finds the first request along the left most tree of parent events
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent|Contrast::Agent::Assess::Events::SourceEvent]
+        # @return [Contrast::Agent::Request, nil]
+        def find_event_request event
+          return event.request if event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
+
+          idx = 0
+          while idx <= event.parent_events.length
+            found = find_event_request(event.parent_events[idx])
+            return found if found
+
+            idx += 1
+            return event.request if event.request
+          end
+          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
+
+          event.request
+        end
+
+        # ===== APPLIERS =====
+        # This is our method that actually checks the taint on the object our trigger_node targets.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+        #   trigger event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_trigger trigger_node, source, object, ret, *args
+          return unless trigger_node
+          return if trigger_node.rule_disabled?
+          return if trigger_node.dataflow? && source.nil?
+
+          if trigger_node.regexp_rule?
+            apply_regexp_rule(trigger_node, source, object, ret, *args)
+          elsif trigger_node.custom_trigger?
+            trigger_node.apply_custom_trigger(trigger_node, source, object, ret, *args)
+          elsif trigger_node.dataflow?
+            apply_dataflow_rule(trigger_node, source, object, ret, *args)
+          else # trigger rule - just calling the method is dangerous
+            build_finding(trigger_node, source, object, ret, *args)
+          end
+        rescue StandardError => e
+          logger.warn('Unable to apply trigger', e, node_id: trigger_node.id)
+        end
+
+        # This is our method that actually checks the taint on the object our trigger_node targets for our Regexp
+        # based rules.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+        #   trigger event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_regexp_rule trigger_node, source, object, ret, *args
+          return unless source.is_a?(String)
+          return if trigger_node.good_value && source.match?(trigger_node.good_value)
+          return if trigger_node.bad_value && source !~ trigger_node.bad_value
+
+          build_finding(trigger_node, source, object, ret, *args)
+        end
+
+        # This is our method that actually checks the taint on the object our trigger_node targets for our Dataflow
+        # based rules.
+        #
+        # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+        #   trigger event
+        # @param source [Object] the source of the Trigger Event
+        # @param object [Object] the Object on which the method was invoked
+        # @param ret [Object] the Return of the invoked method
+        # @param args [Array<Object>] the Arguments with which the method was invoked
+        def apply_dataflow_rule trigger_node, source, object, ret, *args
+          return unless source
+
+          if Contrast::Agent::Assess::Tracker.trackable?(source)
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+            return unless trigger_node.violated?(source)
+
+            build_finding(trigger_node, source, object, ret, *args)
+          elsif Contrast::Utils::DuckUtils.iterable_hash?(source)
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+
+            source.each_pair do |key, value|
+              apply_dataflow_rule(trigger_node, key, object, ret, *args)
+              apply_dataflow_rule(trigger_node, value, object, ret, *args)
+            end
+          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(source)
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+
+            source.each do |value|
+              apply_dataflow_rule(trigger_node, value, object, ret, *args)
+            end
+          else
+            logger.debug('Trigger source is untrackable. Unable to inspect.',
+                         node_id: trigger_node.id,
+                         source_id: source.__id__,
+                         source_type: source.cs__class.cs__name,
+                         frozen: source.cs__frozen?)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/class_util.rb

@@ -3,21 +3,21 @@
 
 require 'contrast/extension/module'
 require 'contrast/utils/object_share'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Utils
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
+      @lru_cache = LRUCache.new(300)
+      @string_cache = LRUCache.new(300)
       class << self
-        # some classes have had things prepended to them, like Marshal in Rails
-        # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
-        # our alias patching approach, as will any other prepend on something
-        # that we touch. Prepend and Alias are inherently incompatible monkey
-        # patching approaches. As such, we need to know if something has been
-        # prepended to.
+        # some classes have had things prepended to them, like Marshal in Rails 5 and higher. Their
+        # ActiveSupport::MarshalWithAutoloading will break our alias patching approach, as will any other prepend on
+        # something that we touch. Prepend and Alias are inherently incompatible monkey patching approaches. As such,
+        # we need to know if something has been prepended to.
         #
-        # @param mod [Module] the Module to check to see if it has had something
-        #   prepended
+        # @param mod [Module] the Module to check to see if it has had something prepended
         # @param ancestors [Array<Module>] the array of ancestors for the mod
         # @return [Boolean] if the mod has been prepended or not
         def prepended? mod, ancestors = nil
@@ -25,8 +25,13 @@ module Contrast
           ancestors[0] != mod
         end
 
-        # return true if the given method is overwritten by one of the ancestors
-        # in the ancestor change that comes before the given module
+        # return true if the given method is overwritten by one of the ancestors in the ancestor change that comes
+        # before the given module
+        #
+        # @param mod [Module] the Module to check to see if it has had something prepended
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that holds the method we
+        #   need to check
+        # @return [Boolean] if this method specifically was prepended
         def prepended_method? mod, method_policy
           target_module = determine_target_class mod, method_policy.instance_method
           ancestors = target_module.ancestors
@@ -41,44 +46,49 @@ module Contrast
           false
         end
 
-        # Return a String representing the object invoking this method in the
-        # form expected by our dataflow events.
+        # Return a String representing the object invoking this method in the form expected by our dataflow events.
+        # After implementing the LRU Cache, we firstly need to check if already had that object cached and if we have
+        # it - we can return it directly; otherwise we'll calculate and store the result before returning.
+        #
+        # TODO: RUBY-1327
+        # Once we move to 2.7+, we can combine the caches using ID b/c the memory location stops being the id
         #
         # @param object [Object, nil] the entity to convert to a String
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          # Only treat object like a string if it actually is a string
-          # some subclasses of String override string methods we depend on
+          # Only treat object like a string if it actually is a string+ some subclasses of String override string
+          # methods we depend on
           if object.cs__class == String
-            cached = to_cached_string(object)
-            return cached if cached
-
-            object.dup
-          elsif object.nil?
-            Contrast::Utils::ObjectShare::NIL_STRING
-          elsif object.cs__is_a?(Symbol)
-            ":#{ object }"
-          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
-            "#{ object.cs__name }@#{ object.__id__ }"
-          elsif object.cs__is_a?(Regexp)
-            object.source
-          elsif use_to_s?(object)
-            object.to_s
+            return @string_cache[object] if @string_cache.key? object
+
+            @string_cache[object] = to_cached_string(object) || object.dup
           else
-            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+            return @lru_cache[object.__id__] if @lru_cache.key? object.__id__
+
+            @lru_cache[object.__id__] = if object.nil?
+                                          Contrast::Utils::ObjectShare::NIL_STRING
+                                        elsif object.cs__is_a?(Symbol)
+                                          ":#{ object }"
+                                        elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+                                          "#{ object.cs__name }@#{ object.__id__ }"
+                                        elsif object.cs__is_a?(Regexp)
+                                          object.source
+                                        elsif use_to_s?(object)
+                                          object.to_s
+                                        else
+                                          "#{ object.cs__class.cs__name }@#{ object.__id__ }"
+                                        end
           end
         end
 
-        # The method const_defined? can cause autoload, which is bad for us.
-        # The method autoload? doesn't traverse namespaces. This method lets us
-        # provide a constant, as a String, and parse it to determine if it has
-        # been truly truly defined, meaning it existed before this method was
-        # invoked, not as a result of it.
+        # The method const_defined? can cause autoload, which is bad for us. The method autoload? doesn't traverse
+        # namespaces. This method lets us provide a constant, as a String, and parse it to determine if it has been
+        # truly truly defined, meaning it existed before this method was invoked, not as a result of it.
         #
-        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop
-        # support for 2.6.X, we should remove this code.
-        # https://bugs.ruby-lang.org/issues/10741
+        # TODO: RUBY-1326
+        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop support for 2.6.X, we should remove
+        # this code. https://bugs.ruby-lang.org/issues/10741
         # @param name [String] the name of the constant to look up
         # @return [Boolean]
         def truly_defined? name
@@ -101,7 +111,8 @@ module Contrast
         private
 
         # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
-        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list approach.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list
+        # approach.
         #
         # @param object [Object] something that may have a safe to_s method
         # @return [Boolean] if we should invoke to_s to represent the object
@@ -112,6 +123,11 @@ module Contrast
           false
         end
 
+        # Find the target class based on the instance, or module, provided. If a module, return it.
+        #
+        # @param mod [Module] the Module, or instance of a Module, that we need to check
+        # @param is_instance [Boolean] is the object provided an instance of a class, requiring lookup by class
+        # @return [Module]
         def determine_target_class mod, is_instance
           return mod if mod.singleton_class?
 
@@ -120,13 +136,11 @@ module Contrast
           mod
         end
 
-        # If the String matches a common String in our ObjectShare, return that
-        # rather that for use as the representation of the String rather than
-        # forcing a duplication of the String.
+        # If the String matches a common String in our ObjectShare, return that rather that for use as the
+        # representation of the String rather than forcing a duplication of the String.
         #
-        # @param string [String] some string of which we want a Contrast
-        #   representation.
-        # @return [String,nil] the ObjectShare version of the String or nil
+        # @param string [String] some string of which we want a Contrast representation.
+        # @return [String, nil] the ObjectShare version of the String or nil
         def to_cached_string string
           return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
           return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH

data/lib/contrast/utils/exclude_key.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Determine if configuration keys is excluded from logging
+    module ExcludeKey
+      EXCLUDE_FROM_LOG = %w[api api_key url service_key user_name].cs__freeze
+      class << self
+        # Check if a config key can be logged or not
+        #
+        # @param key [String] key to check
+        # @return[Boolean] true | false
+        def excludable? key
+          EXCLUDE_FROM_LOG.any? { |exclude_key| key.include? exclude_key }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/io_util.rb

@@ -6,43 +6,51 @@ require 'contrast/components/logger'
 module Contrast
   module Utils
     # Util for information about an IO
-    class IOUtil
+    module IOUtil
       extend Contrast::Components::Logger::InstanceMethods
 
-      # We're only going to call rewind on things that we believe are safe to
-      # call it on. This method white lists those cases and returns false in
-      # all others.
-      def self.should_rewind? potential_io
-        return true if potential_io.is_a?(StringIO)
-        return false unless io?(potential_io)
-
-        should_rewind_io?(potential_io)
-      rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
-        false
-      end
-
-      # IO cannot be used with streams such as pipes, ttys, and sockets.
-      def self.should_rewind_io? io
-        return false if io.tty?
-
-        status = io.stat
-        return false unless status
-        return false if status.pipe?
-        return false if status.socket?
-
-        true
-      end
-
-      # A class is IO if it is a decedent or delegate of IO
-      def self.io? object
-        return true if object.is_a?(IO)
-
-        # DelegateClass, which is a Delegator, defines __getobj__ as a way to
-        # get the object that the class wraps around (delegates to)
-        return false unless object.is_a?(Delegator)
-
-        object.__getobj__.is_a?(IO)
+      class << self
+        # We're only going to call rewind on things that we believe are safe to
+        # call it on. This method white lists those cases and returns false in
+        # all others.
+        def should_rewind? potential_io
+          return true if potential_io.is_a?(StringIO)
+          return false unless io?(potential_io)
+
+          should_rewind_io?(potential_io)
+        rescue StandardError => e
+          logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
+          false
+        end
+
+        # A class is IO if it is a decedent or delegate of IO
+        def io? object
+          return true if object.is_a?(IO)
+
+          # DelegateClass, which is a Delegator, defines __getobj__ as a way to
+          # get the object that the class wraps around (delegates to)
+          return false unless object.is_a?(Delegator)
+
+          object.__getobj__.is_a?(IO)
+        end
+
+        private
+
+        # IO rewind cannot be used with streams such as pipes, ttys, and sockets or for ones which have been closed.
+        #
+        # @param io [IO] the input to check for the ability to rewind
+        # @return [Boolean] if the given IO can be rewound
+        def should_rewind_io? io
+          return false if io.closed?
+          return false if io.tty?
+
+          status = io.stat
+          return false unless status
+          return false if status.pipe?
+          return false if status.socket?
+
+          true
+        end
       end
     end
   end

data/lib/contrast/utils/lru_cache.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # A LRU(Least Recently Used) Cache store.
+    class LRUCache
+      def initialize capacity = 500
+        raise StandardError 'Capacity must be bigger than 0' if capacity <= 0
+
+        @capacity = capacity
+        @cache = {}
+      end
+
+      def [] key
+        val = @cache.delete(key)
+        @cache[key] = val if val
+        val
+      end
+
+      def []= key, value
+        @cache.delete(key)
+        @cache[key] = value
+        @cache.shift if @cache.size > @capacity
+        value # rubocop:disable Lint/Void
+      end
+
+      def keys
+        @cache.keys
+      end
+
+      def key? key
+        @cache.key?(key)
+      end
+
+      def values
+        @cache.values
+      end
+
+      def clear
+        @cache.clear
+      end
+    end
+  end
+end

data/lib/contrast/utils/metrics_hash.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Utils
+    # This is the MetricsHash, which will take data type, so we now what is introduced/included
+    # in the TelemetryEvent
+    class MetricsHash < Hash
+      include Contrast::Components::Logger::InstanceMethods
+
+      attr_reader :data_type
+
+      ERROR_MESSAGES = [
+        'The key is not string or does not meet the requirements.',
+        'The key extends the allowed length.',
+        'VThe provided value is not the right data type'
+      ].cs__freeze
+      KEY_REGEXP = /[a-zA-Z0-9_-]{1,63}/.cs__freeze
+
+      def initialize data_type, *several_variants
+        super
+        @data_type = data_type
+      end
+
+      def []= key, value
+        key_val = key.dup
+        value_val = value.dup
+        key_val.strip! if key_val.cs__is_a?(String)
+        value_val.strip! if value_val.cs__is_a?(String)
+        return unless valid_pair? key_val, value_val
+
+        key_val.downcase!
+        key_val.strip!
+        super(key_val, value_val)
+      end
+
+      def valid_pair? key, value
+        if !key.cs__is_a?(String) || (KEY_REGEXP =~ key).nil?
+          logger.warn('The following key will be omitted', key: key, error: ERROR_MESSAGES[0])
+          return false
+        end
+        unless key.length <= 28
+          logger.warn('The following key will be omitted', key: key, error: ERROR_MESSAGES[1])
+          return false
+        end
+        unless value.cs__is_a?(data_type)
+          logger.warn('The following key will be omitted', value: value, error: ERROR_MESSAGES[2])
+          return false
+        end
+        return false if value.cs__is_a?(String) && value.empty?
+        return false if value.cs__is_a?(String) && value.length > 200
+
+        true
+      end
+    end
+  end
+end

data/lib/contrast/utils/os.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/scope'
+require 'cs__os_information/cs__os_information'
 
 module Contrast
   module Utils
@@ -31,6 +32,28 @@ module Contrast
             zombie_pid_list.split("\n")
           end
         end
+
+        # Check current OS type
+        # returns true if check is correct or false if not
+        def windows?
+          (/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM) != nil
+        end
+
+        def mac?
+          RUBY_PLATFORM.include? 'darwin'
+        end
+
+        def unix?
+          !windows?
+        end
+
+        def linux?
+          unix? and !mac?
+        end
+
+        def jruby?
+          RUBY_ENGINE == 'jruby'
+        end
       end
     end
   end