contrast-agent 5.0.0 → 5.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4976ba07d49361d91d44561f93031bfbe6b0aaff32921c62c8a6841e1e9581ad
-  data.tar.gz: 510081d49ac928d43cd2f97ab310b6f6dcd122c1227e52d35c40f6ff5f423723
+  metadata.gz: bfca6df4def9f2366f7a92651aa9cd2fc40f3ced6784228844d8025cee5a4850
+  data.tar.gz: b66b10e1d892adee985f070963e08945fd9dd4faf641f4f06a8372683129facd
 SHA512:
-  metadata.gz: e1dff81a71f5162d2f217ef061ae060b77d825a85fc0666e667b845e62f5e209b8d409bb2fe554af774f904d3586461a35c264fedb5c63c4f1d9a1130c7ed0c0
-  data.tar.gz: '013393f427c6539d164f7f647d2b8635ef4c7093e8dbd517631c03ae2ad3a5b7e8529bce82e80cea5f5c3ad630c537abd7114f98042f01b4977059ebb5ad1aaf'
+  metadata.gz: '08a6989482a82249d3fb906b2f79788e03d5c5ffa03973beabe591292fa780cd2bd3a6f459e8b7eedf58181a729720da0e95b1afa069e8869511b6ff4338625d'
+  data.tar.gz: b460cad0b10b3355bfafa3be8c49ba41d0174e5a5d0524bbab273cf51c3d9fed6348027b9658dd3dadddcace9012f0ce119566f46899ee71f8712aebf56a98bf

data/.simplecov

@@ -1,9 +1,8 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-SimpleCov.minimum_coverage line: 94.75
+SimpleCov.minimum_coverage line: 95
 SimpleCov.start do
   add_filter '/spec/'
-  add_filter '/lib/contrast/extension/assess/erb.rb'
   enable_coverage :branch
 end

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -3,19 +3,22 @@
 
 #include "cs__assess_kernel.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,
                              const VALUE self) {
     int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+        inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
-    if (!nested_scope && argc > 0) {
-        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    if (nested_scope == Qfalse && argc > 0) {
+        /* enter scope */
+        inst_methods_enter_cntr_scope(contrast_patcher(), 0);
         VALUE data = argv[0];
         rb_funcall(kernel_propagator, exec_apply_trigger, 1, data);
-        rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+        /* exit scope */
+        inst_methods_exit_cntr_scope(contrast_patcher(), 0);
     }
 
     /* maybe this should be rb_funcall2.  this works right now because *argv ==

data/ext/cs__assess_module/cs__assess_module.c

@@ -3,6 +3,7 @@
 
 #include "cs__assess_module.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
 void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
@@ -11,12 +12,11 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
         return;
     }
 
-    int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+    int nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
+     /* enter scope */
+    inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
-    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
-
-    if (!nested_scope) {
+    if (nested_scope == Qfalse) {
         VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
@@ -24,8 +24,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
         rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
                    ret, method);
     }
-
-    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    /* exit scope */
+    inst_methods_exit_cntr_scope(contrast_patcher(), 0);
 }
 
 VALUE
@@ -61,39 +61,39 @@ VALUE
 contrast_assess_module_prepend(const int argc, const VALUE *argv,
                                const VALUE self) {
 
-    rb_prepend_module(self, argv[0]);
+    //    rb_prepend_module(self, argv[0]);
 
     VALUE module_at;
     VALUE rb_incl_in_mod_ary = rb_funcall(self, rb_intern("included_in"), 0);
 
     if (RB_TYPE_P(rb_incl_in_mod_ary, T_ARRAY)) {
-       int i = 0;
-       int size = rb_funcall(rb_incl_in_mod_ary, rb_intern("length"), 0);
-       for (i = 0; i < size; ++i) {
-           module_at = rb_ary_entry(rb_incl_in_mod_ary, i);
-           if (RB_TYPE_P(module_at, T_MODULE)) {
-              rb_include_module(module_at, argv[0]);
-           }
-       }
+        int i = 0;
+        int size = rb_funcall(rb_incl_in_mod_ary, rb_intern("length"), 0);
+        for (i = 0; i < size; ++i) {
+            module_at = rb_ary_entry(rb_incl_in_mod_ary, i);
+            if (RB_TYPE_P(module_at, T_MODULE)) {
+                rb_include_module(module_at, argv[0]);
+            }
+        }
     }
     return self;
 }
 
 VALUE
 contrast_assess_module_included(const int argc, const VALUE *argv,
-                               const VALUE self) {
-   VALUE frozen;
-   if (RB_TYPE_P(self, T_MODULE)) {
-       // check if frozen
-       frozen = rb_funcall(self, rb_intern("cs__frozen?"), 0);
-       if (frozen == Qfalse) {
-           VALUE ary = rb_funcall(self, rb_intern("included_in"), 0);
-           if (RB_TYPE_P(ary, T_ARRAY)) {
-              rb_ary_push(ary, argv[0]);
-           }
-       }
-   }
-   return self;
+                                const VALUE self) {
+    VALUE frozen;
+    if (RB_TYPE_P(self, T_MODULE)) {
+        // check if frozen
+        frozen = rb_funcall(self, rb_intern("cs__frozen?"), 0);
+        if (frozen == Qfalse) {
+            VALUE ary = rb_funcall(self, rb_intern("included_in"), 0);
+            if (RB_TYPE_P(ary, T_ARRAY)) {
+                rb_ary_push(ary, argv[0]);
+            }
+        }
+    }
+    return self;
 }
 
 void Init_cs__assess_module(void) {
@@ -115,13 +115,23 @@ void Init_cs__assess_module(void) {
 
     contrast_register_patch("Module", "module_eval",
                             contrast_assess_module_module_eval);
-   /*
-    * We patch these for better ancestors handling, and only for older ruby versions.
-    */
-  if (rb_ver_below_three()) {
-     contrast_register_patch("Module", "included",
-                             contrast_assess_module_included);
-     contrast_register_patch("Module", "prepend",
-                             contrast_assess_module_prepend);
-     }
+    /*
+     * We patch these for better ancestors handling, and only for older ruby
+     * versions.
+     */
+    //  if (rb_ver_below_three()) {
+    /*
+     * `included` is a private method. We should make it public, patch it,
+     * and make our new method public
+     */
+    //     contrast_register_patch("Module", "included",
+    //                             contrast_assess_module_included);
+    /*
+     * The `prepend` patch may actually be the issue, if we're not properly
+     * passing along the call/context. It could be that my attempt to fix
+     * `included` left this section unreachable.
+     */
+    //     contrast_register_patch("Module", "prepend",
+    //                             contrast_assess_module_prepend);
+    //     }
 }

data/ext/cs__common/cs__common.c

@@ -10,6 +10,7 @@
 VALUE contrast, agent, patching, policy, assess;
 VALUE core_extensions, core_assess;
 VALUE assess_policy, assess_propagator;
+VALUE components;
 VALUE funchook_path;
 
 VALUE rb_sym_enter_scope;
@@ -175,6 +176,9 @@ void Init_cs__common(void) {
     contrast = rb_define_module("Contrast");
     agent = rb_define_module_under(contrast, "Agent");
 
+    /* components => Contrast::Components */
+    components = rb_define_module_under(contrast, "Components");
+
     assess = rb_define_module_under(agent, "Assess");
 
     patching = rb_define_module_under(agent, "Patching");

data/ext/cs__common/cs__common.h

@@ -17,6 +17,7 @@ extern VALUE contrast, agent, patching, policy, assess;
 extern VALUE core_extensions, core_assess;
 extern VALUE assess_policy, assess_propagator;
 extern VALUE funchook_path;
+extern VALUE components;
 
 extern VALUE rb_sym_enter_scope;
 extern VALUE rb_sym_exit_scope;

data/ext/cs__contrast_patch/cs__contrast_patch.c

@@ -3,6 +3,7 @@
 
 #include "cs__contrast_patch.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
 VALUE build_preshift(const VALUE method_policy, const VALUE object,
@@ -84,15 +85,22 @@ VALUE contrast_call_post_patch(const VALUE method_policy, const VALUE preshift,
                       method_policy, preshift, object, ret, send, block);
 }
 
-VALUE contrast_patch_call_rescue(const VALUE *args) {
-    int argc;
-    VALUE exception, object, preshift, method_policy, method;
-    VALUE *argv;
-
+/* wrap rb_ensure so we can rescue an exception */
+VALUE rescue_func(VALUE arg1) {
+    VALUE exception;
     /* rb_errinfo() gives the value of $!, the exception that
      * triggered a rescue block.
      */
     exception = rb_errinfo();
+    rb_exc_raise(exception);
+
+	return Qnil;
+}
+
+VALUE contrast_patch_call_ensure(const VALUE *args) {
+    int argc;
+    VALUE object, preshift, method_policy, method;
+    VALUE *argv;
 
     object = args[0];
     method = args[1];
@@ -103,12 +111,19 @@ VALUE contrast_patch_call_rescue(const VALUE *args) {
 
     contrast_call_post_patch(method_policy, preshift, object, Qnil, argc, argv);
 
-    /* reraise the exception that got us here */
-    rb_exc_raise(exception);
-
     return Qnil;
 }
 
+VALUE ensure_wrapper(const VALUE *args) {
+    VALUE original_method, original_args, ensure_args;
+
+    original_method = args[0];
+    original_args = (VALUE)args[1];
+    ensure_args = (VALUE)args[2];
+
+	return rb_ensure(original_method, original_args, contrast_patch_call_ensure, (VALUE)ensure_args);
+}
+
 VALUE contrast_call_super(const VALUE *args) {
     int argc;
     VALUE *argv;
@@ -122,7 +137,8 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
     VALUE impl, method, method_policy, object, original_args, original_ret, preshift, transformed_ret;
     int argc;
     VALUE *argv;
-    VALUE rescue_args[6];
+    VALUE ensure_args[6];
+    VALUE rescue_wrapper_args[3];
 
     impl = wrapped_args[0];
     original_args = wrapped_args[1];
@@ -132,18 +148,22 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
     argc = NUM2INT(wrapped_args[5]);
     argv = (VALUE *)wrapped_args[6];
 
-    rescue_args[0] = object;
-    rescue_args[1] = method;
-    rescue_args[2] = INT2NUM(argc);
-    rescue_args[3] = (VALUE)argv;
-    rescue_args[4] = method_policy;
+    rescue_wrapper_args[0] = contrast_patch_call_original;
+    rescue_wrapper_args[1] = original_args;
+    rescue_wrapper_args[2] = ensure_args;
+
+    ensure_args[0] = object;
+    ensure_args[1] = method;
+    ensure_args[2] = INT2NUM(argc);
+    ensure_args[3] = (VALUE)argv;
+    ensure_args[4] = method_policy;
 
     /* Tracking, triggering, and propagation here. */
     contrast_call_pre_patch(method_policy, method, object, argc, argv, Qnil);
 
     /* Capture pre-call state */
     preshift = build_preshift(method_policy, object, argc, argv);
-    rescue_args[5] = preshift;
+    ensure_args[5] = preshift;
 
     /* We wrap a call to the original method with a rescue block, and we use
      * rb_rescue2 to capture all Exception-inheriting exceptions (and if your
@@ -178,15 +198,12 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
     switch (impl) {
     case IMPL_ALIAS_INSTANCE:
     case IMPL_ALIAS_SINGLETON:
-        original_ret = rb_rescue2(contrast_patch_call_original, original_args,
-                                  contrast_patch_call_rescue,
-                                  (VALUE)rescue_args, rb_eException, 0);
+        original_ret = rb_rescue(ensure_wrapper, rescue_wrapper_args, rescue_func, Qnil);
         break;
     case IMPL_PREPEND_INSTANCE:
     case IMPL_PREPEND_SINGLETON:
-        original_ret = rb_rescue2(contrast_call_super, original_args,
-                                  contrast_patch_call_rescue,
-                                  (VALUE)rescue_args, rb_eException, 0);
+        rescue_wrapper_args[0] = contrast_call_super;
+        original_ret = rb_rescue(ensure_wrapper, rescue_wrapper_args, rescue_func, Qnil);
         break;
     };
 
@@ -214,8 +231,10 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
 
 VALUE contrast_ensure_function(const VALUE method_policy) {
     /* exit scope */
-    rb_funcall(contrast_patcher(), rb_sym_exit_method_scope, 1, method_policy);
-    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    VALUE scopes = rb_funcall(method_policy, rb_sym_scopes_to_exit, 0);
+
+    inst_methods_exit_method_scope(contrast_patcher(), scopes);
+    inst_methods_exit_cntr_scope(contrast_patcher(), 0);
 
     return Qnil;
 }
@@ -235,10 +254,10 @@ VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
      * which is unnecessary, or run Contrast analysis on Contrast code,
      * which will never terminate.
      */
-    nested_scope = RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+    nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
     /* enter scope */
-    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
     /* Get the name of the calling method */
     method = rb_funcall(object, rb_sym_method, 0);
@@ -270,7 +289,7 @@ VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
     }
 
     /* Check conditions for not doing Contrast analysis */
-    if (nested_scope) {
+    if (nested_scope == Qtrue) {
         /* if we were in scope */
         do_contrast = 0;
     } else if (!RTEST(known)) {
@@ -299,7 +318,9 @@ VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
     }
 
     /* Enter any scopes specific to method policy */
-    rb_funcall(contrast_patcher(), rb_sym_enter_method_scope, 1, method_policy);
+    VALUE scopes = rb_funcall(method_policy, rb_sym_scopes_to_enter, 0);
+
+    inst_methods_enter_method_scope(contrast_patcher(), scopes);
 
     /* If we're not doing Contrast analysis, exit scope and treat as normal. */
     if (!do_contrast) {
@@ -488,6 +509,9 @@ void Init_cs__contrast_patch(void) {
 
     rb_sym_enter_method_scope = rb_intern("enter_method_scope!");
     rb_sym_exit_method_scope = rb_intern("exit_method_scope!");
+    rb_sym_scopes_to_enter = rb_intern("scopes_to_enter");
+    rb_sym_scopes_to_exit = rb_intern("scopes_to_exit");
+
 
     rb_define_module_function(contrast_patcher(), "contrast_define_method",
                               contrast_patch_define_method, 3);
@@ -500,4 +524,5 @@ void Init_cs__contrast_patch(void) {
 
     /* preshift_class = Contrast::Agent::Assess::PreShift */
     preshift_class = rb_define_class_under(assess, "PreShift", rb_cObject);
+
 }

data/ext/cs__contrast_patch/cs__contrast_patch.h

@@ -18,6 +18,8 @@ static VALUE rb_sym_cs_to_s;
 
 static VALUE rb_sym_enter_method_scope;
 static VALUE rb_sym_exit_method_scope;
+static VALUE rb_sym_scopes_to_enter;
+static VALUE rb_sym_scopes_to_exit;
 
 static VALUE rb_sym_build_method_name;
 static VALUE rb_sym_info_for;