contrast-agent 5.2.0 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa7aa416c6a15843424449814734c462a46e2951cbe41f010bd2570c03717cc5
-  data.tar.gz: ade4eac9f0f32d9aa339d6429a30728f0b7950a68db8b8b1aad2e0e5cfe52d71
+  metadata.gz: 456cd00d5b3c07ec1a845a6dbcb26d6d5b2891b03a352f06d290d405ff695596
+  data.tar.gz: 06ce1572dc8403fdf57ab6cbaa9ea51d8b7e52c4090d64badda5001aabb608ac
 SHA512:
-  metadata.gz: fd24331e49a9d2826628613ccc3f1bcf5c3ba337ba866ea321fd5a795d9b585507d935b92e64bffca5d70f83d4dbac7a978b484b372ae9c590c2d82ca3a57e91
-  data.tar.gz: cc3b03f3b101658f74006af2b4ef4c81256c2890372727fcd6f5d300926ca6454a6da64be5500cd0d5cc103e36d92a5c8f24495677558e33856fe5e8f99e71f9
+  metadata.gz: 8ab067665857065d8325547faa13c3f41679e9a9a9de9a70245e310a2229b1d1097ee2198ae45ab9be5804835764c9004372ec03c8a7f2e2ce8ee3bafda332b1
+  data.tar.gz: cda25e738349d4ba06e6ada4fbb146341f883b92a444b9179dcb8e1e21d21d5c6fcd50503a599a9a55248e40078213f521dac5bdd610480650034455dce90f03

data/ext/cs__assess_array/cs__assess_array.c

@@ -22,7 +22,9 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     }
     /* Finally, default to empty String. Implicit since nil.to_s is ''*/
 
+    /* call the Array.join but patched one */
     result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
+    /* call the Contrast::Extensions::Assess::ArrayPropagator#cs__track_join */
     result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
                         ary, sep, result);
 
@@ -33,6 +35,11 @@ void Init_cs__assess_array(void) {
     array_propagator =
         rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
+    /*
+     * Here we need to check before using the alias or prepend spec
+     * This patch is happening here, we register the cs__track_join
+     * method of the Array propagator, and call it here from Ruby.
+     */
     rb_sym_assess_array_join =
         contrast_register_patch("Array", "join", contrast_assess_array_join);
 }

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -3,8 +3,20 @@
 
 #include "cs__assess_basic_object.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
+/*
+ * Source code of instance_eval:
+ *
+ *                static VALUE
+ *  rb_obj_instance_eval_internal(int argc, const VALUE *argv, VALUE self)
+ *  {
+ *      VALUE klass = singleton_class_for_eval(self);
+ *      return specific_eval(argc, argv, klass, self, RB_PASS_CALLED_KEYWORDS);
+ *  }
+ */
+
 void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
                                                  VALUE ret) {
     rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
@@ -19,19 +31,21 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
         return rb_obj_instance_eval(argc, argv, self);
     }
 
-    int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+    VALUE nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
-    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    /* Enter scope */
+    inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
+    /* Call the source: */
     VALUE ret = rb_obj_instance_eval(argc, argv, self);
 
-    if (!nested_scope && argc > 0) {
+    if (nested_scope == Qfalse && argc > 0) {
         VALUE data = argv[0];
         contrast_assess_instance_eval_trigger_check(self, data, ret);
     }
 
-    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    /* Exit scope */
+    inst_methods_exit_cntr_scope(contrast_patcher(), 0);
 
     return ret;
 }

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -30,7 +30,7 @@ VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
             ID meth;
         };
 
-        /* underlying object is first entry in Enumerator struct def.
+        /*  underlying object is first entry in Enumerator struct def.
          *  that's all statically defined w/in enumerator.c, so we can't
          *  reference the data types and be safe about it.  (yippee.)
          *  we cut out the TypedData_Get_Struct middleman & just go for it.

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -17,7 +17,6 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
                                                       const VALUE hash) {
     VALUE result;
 
-
     /* Array of Arrays: Hash[ [ [key, value], ... ] ]   -> new_hash */
     if (RB_TYPE_P(argv[0], T_ARRAY)) {
         int i;
@@ -34,13 +33,13 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
         }
     }
 
-    const VALUE * argv_final = argv;
+    const VALUE *argv_final = argv;
     /* unhandled case - shouldn't need it since issue is only unfrozen
      * String keys
      * # Hash[ object ]                  -> new_hash
      */
-    result =
-        rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv_final);
+    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc,
+                         argv_final);
 
     return result;
 }

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -9,8 +9,7 @@
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,
                              const VALUE self) {
-    int nested_scope =
-        inst_methods_in_cntr_scope(contrast_patcher(), 0);
+    VALUE nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
     if (nested_scope == Qfalse && argc > 0) {
         /* enter scope */

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -5,36 +5,50 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_marshal_module_load(const int argc,
-                                                 const VALUE *argv) {
+/*
+ * Marshal#load source:
+ * static VALUE
+ * marshal_load(int argc, VALUE *argv)
+ *  {
+ *     VALUE port, proc;
+ *
+ *     rb_check_arity(argc, 1, 2);
+ *     port = argv[0];
+ *     proc = argc > 1 ? argv[1] : Qnil;
+ *     return rb_marshal_load_with_proc(port, proc);
+ * }
+ */
+static VALUE contrast_marshal_module_load(const int argc, const VALUE *argv) {
     VALUE result;
     VALUE source_string;
 
-    // Our patches only need only apply in the case where there was valid input.
+    /* Our patches need to apply only in the case where there was valid input.
+     */
     if (argc >= 1) {
         source_string = argv[0];
     } else {
         source_string = Qnil;
     }
 
-    // Run our protect code ahead of the original method
+    /* Run our protect code ahead of the original method */
     if (source_string != Qnil) {
-        rb_funcall(marshal_propagator, rb_sym_protect_marshal_load, 1, source_string);
+        rb_funcall(marshal_propagator, rb_sym_protect_marshal_load, 1,
+                   source_string);
     }
 
-    // Invoke the original method
+    /* Invoke the original method */
     result = rb_call_super(argc, argv);
 
-    // Run our assess code after the original method
+    /* Run our assess code after the original method */
     if (source_string != Qnil) {
         VALUE tracked =
             rb_funcall(properties_hash, rb_sym_hash_tracked, 1, source_string);
 
-        // Assuming the source is tracked and needs assess checks
+        /* Assuming the source is tracked and needs assess checks */
         if (tracked == Qtrue) {
             VALUE skip =
                 rb_funcall(contrast_patcher(), rb_sym_skip_assess_analysis, 0);
-            // And Assess is enabled and applies to this request
+            /* And Assess is enabled and applies to this request */
             if (skip == Qfalse) {
                 rb_funcall(marshal_propagator, rb_sym_assess_marshal_load, 2,
                            source_string, result);
@@ -45,7 +59,7 @@ static VALUE contrast_marshal_module_load(const int argc,
 }
 
 void Init_cs__assess_marshal_module(void) {
-    // Contrast::Agent::Assess::Tracker::PROPERTIES_HASH
+    /* Contrast::Agent::Assess::Tracker::PROPERTIES_HASH */
     VALUE tracker = rb_define_class_under(assess, "Tracker", rb_cObject);
     properties_hash = rb_const_get(tracker, rb_intern("PROPERTIES_HASH"));
     marshal_propagator =
@@ -53,6 +67,6 @@ void Init_cs__assess_marshal_module(void) {
     rb_sym_assess_marshal_load = rb_intern("cs__load_assess");
     rb_sym_protect_marshal_load = rb_intern("cs__load_protect");
 
-    contrast_register_singleton_prepend_patch(
-        "Marshal", "load", &contrast_marshal_module_load);
+    contrast_register_singleton_prepend_patch("Marshal", "load",
+                                              &contrast_marshal_module_load);
 }

data/ext/cs__assess_module/cs__assess_module.c

@@ -13,7 +13,7 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
     }
 
     int nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
-     /* enter scope */
+    /* enter scope */
     inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
     if (nested_scope == Qfalse) {

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -3,8 +3,20 @@
 
 #include "cs__assess_regexp.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__contrast_patch/cs__contrast_patch.h"
 #include <ruby.h>
 
+extern VALUE contrast_force_patch(const int argc, VALUE *argv) {
+  return contrast_check_and_register_instance_patch(
+        "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
+}
+
+/* check if method is prepended and register instance alias or prepend patch */
+VALUE contrast_check_and_register_instance_patch(const char *module_name,
+                                                  const char *method_name,
+                                                  VALUE(c_fn)(const int, VALUE *,
+                                                              const VALUE));
+
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 
@@ -46,7 +58,8 @@ void Init_cs__assess_regexp(void) {
     rb_global_variable(&rb_sym_string);
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
+    rb_define_singleton_method(assess, "contrast_force_repatch_regexp", contrast_force_patch, 0);
 
-    rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
-        "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
+    rb_sym_assess_regexp_equal_squiggle = contrast_check_and_register_instance_patch(
+      "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -20,4 +20,6 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
                                                    const VALUE *argv,
                                                    const VALUE regexp);
 
+extern VALUE contrast_force_patch(const int argc, VALUE *argv);
+
 void Init_cs__assess_regexp(void);

data/ext/cs__assess_string/cs__assess_string.c

@@ -5,6 +5,25 @@
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
+/*
+ * The -@ method source:
+ *
+ *                static VALUE
+ * str_uminus(VALUE str)
+ * {
+ *     if (!BARE_STRING_P(str) && !rb_obj_frozen_p(str)) {
+ *         str = rb_str_dup(str);
+ *     }
+ *     return rb_fstring(str);
+ * }
+ */
+
+/*
+ * This patch won't do the Prepend. We would call to the String instance'
+ * uminus directly and skip other propagation from prepended modules.
+ * We could come back to this one and rethink it's prepend patching.
+ */
+
 static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
                                            const VALUE obj) {
     if (!OBJ_FROZEN(obj)) {
@@ -39,10 +58,11 @@ void Init_cs__assess_string(void) {
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
     rb_sym_pre_freeze = rb_intern("pre_freeze");
-    // Contrast::Agent::Assess::Tracker::PROPERTIES_HASH
+    /* Contrast::Agent::Assess::Tracker::PROPERTIES_HASH */
     VALUE tracker = rb_define_class_under(assess, "Tracker", rb_cObject);
     properties_hash = rb_const_get(tracker, rb_intern("PROPERTIES_HASH"));
 
+    /* We only do alias for this one */
     rb_sym_assess_string_uminus =
         contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
     rb_sym_assess_string_freeze = contrast_register_patch(

data/ext/cs__assess_test/cs__assess_test.h

@@ -0,0 +1,9 @@
+#include <ruby.h>
+
+static VALUE dummy_regexp;
+static VALUE test_regexp;
+
+VALUE rb_equal_squiggle(const int argc, const VALUE *argv)
+void rb_force_prepend(void);
+
+void Init_cs__assess_test(void)

data/ext/cs__assess_test/cs__assess_tests.c

@@ -0,0 +1,22 @@
+#include "../cs__common/cs__common.h";
+#include "ruby.h"
+#include <ruby/re.h>
+
+static VALUE dummy_regexp;
+static VALUE test_regexp;
+
+VALUE rb_equal_squiggle(const int argc, const VALUE *argv) {
+    return rb_call_super(argc, argv);
+}
+
+void rb_force_prepend(void) {
+    rb_prepend_module(rb_cRegexp, dummy_regexp);
+}
+
+void Init_cs__assess_test(void) {
+    test_regexp = rb_define_module("ForcePrepend");
+    rb_define_singleton_method(test_regexp, "cs__force_prepend",
+                               rb_force_prepend, 0);
+    dummy_regexp = rb_define_module("DummyMod");
+    rb_define_method(dummy_regexp, "=~", rb_equal_squiggle, -1);
+}

data/ext/cs__assess_test/extconf.rb

@@ -0,0 +1,5 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__common/cs__common.c

@@ -59,13 +59,14 @@ VALUE contrast_patcher() {
     return patcher;
 }
 
+/* register instance alias patch */
 VALUE contrast_register_patch(const char *module_name, const char *method_name,
-                              VALUE(c_fn)(const int, VALUE *,
-                                          const VALUE)) {
+                              VALUE(c_fn)(const int, VALUE *, const VALUE)) {
     return _contrast_register_patch(module_name, method_name, c_fn,
                                     IMPL_ALIAS_INSTANCE);
 }
 
+/* register singleton alias patch */
 VALUE contrast_register_singleton_patch(const char *module_name,
                                         const char *method_name,
                                         VALUE(c_fn)(const int, VALUE *,
@@ -74,22 +75,49 @@ VALUE contrast_register_singleton_patch(const char *module_name,
                                     IMPL_ALIAS_SINGLETON);
 }
 
+/* register instance prepend patch */
 VALUE contrast_register_prepend_patch(const char *module_name,
-                              const char *method_name,
-                              VALUE(c_fn)(const int, VALUE *,
-                                          const VALUE)) {
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, VALUE *,
+                                                  const VALUE)) {
     return _contrast_register_patch(module_name, method_name, c_fn,
                                     IMPL_PREPEND_INSTANCE);
 }
 
+/* register singleton prepend patch */
 VALUE contrast_register_singleton_prepend_patch(const char *module_name,
-                              const char *method_name,
-                              VALUE(c_fn)(const int, VALUE *,
-                                          const VALUE)) {
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, VALUE *,
+                                                            const VALUE)) {
     return _contrast_register_patch(module_name, method_name, c_fn,
                                     IMPL_PREPEND_SINGLETON);
 }
 
+/* check if method is prepended and register instance alias or prepend patch */
+/* module name c_char "Module"; */
+/* method name c_char  "method"; */
+/* c_func => pointer */
+VALUE contrast_check_and_register_instance_patch(
+    const char *module_name, const char *method_name,
+    VALUE(c_fn)(const int, VALUE *, const VALUE)) {
+
+    VALUE object, method, is_prepended, patch_type;
+    /* check if method is prepended */
+    object = rb_const_get(rb_cObject, rb_intern(module_name));
+    method = ID2SYM(rb_intern(method_name));
+    is_prepended = contrast_check_prepended(object, method, Qtrue);
+
+    if (is_prepended == Qtrue) {
+        /* prepend patch */
+        return _contrast_register_patch(module_name, method_name, c_fn,
+                                        IMPL_PREPEND_INSTANCE);
+    } else {
+        /* alias patch */
+        return _contrast_register_patch(module_name, method_name, c_fn,
+                                        IMPL_ALIAS_INSTANCE);
+    }
+}
+
 static VALUE
 _contrast_register_patch(const char *module_name, const char *method_name,
                          VALUE(c_fn)(const int, VALUE *, const VALUE),
@@ -134,8 +162,9 @@ _contrast_register_patch(const char *module_name, const char *method_name,
         break;
     case IMPL_PREPEND_INSTANCE:
         impl = ID2SYM(rb_sym_prepend_instance);
+        break;
     case IMPL_PREPEND_SINGLETON:
-         impl = ID2SYM(rb_sym_prepend_singleton);
+        impl = ID2SYM(rb_sym_prepend_singleton);
         break;
     }
 
@@ -146,8 +175,75 @@ _contrast_register_patch(const char *module_name, const char *method_name,
 }
 
 int rb_ver_below_three() {
-  int ruby_version = FIX2INT(rb_funcall(rb_const_get(rb_cObject, rb_intern("RUBY_VERSION")), rb_intern("to_i"), 0));
-  return ruby_version < 3;
+    int ruby_version =
+        FIX2INT(rb_funcall(rb_const_get(rb_cObject, rb_intern("RUBY_VERSION")),
+                           rb_intern("to_i"), 0));
+    return ruby_version < 3;
+}
+
+/* used for direct check on object: String.cs__prepended? *args  */
+extern VALUE contrast_check_prepended(VALUE self, VALUE method_name,
+                                      VALUE is_instance) {
+    return _contrast_check_prepended(self, method_name, is_instance);
+}
+
+/* used for passing object to look if not called on itself.
+Contrast::Agent::Assess.cs__object_method_prepended? object, :method_name,
+true/false */
+extern VALUE contrast_lookout_prepended(VALUE self, VALUE object_name,
+                                        VALUE method_name, VALUE is_instance) {
+    /* object_name must be the object, the self value is needed to prevent
+     lookout for self, since is always passed first we skip it */
+    VALUE result =
+        _contrast_check_prepended(object_name, method_name, is_instance);
+    return result;
+}
+
+static VALUE _contrast_check_prepended(VALUE object, VALUE method_name,
+                                       VALUE is_instance) {
+    VALUE entry, ancestors, object_idx, entry_methods;
+    VALUE result = Qfalse;
+    int i;
+    int y;
+
+    /* get self ancestors */
+    ancestors = rb_mod_ancestors(object);
+    /* get the size of the array */
+    int length = RARRAY_LEN(ancestors);
+    /* Locate self in ancestors: */
+    for (i = 0; i < length; ++i) {
+        entry = rb_ary_entry(ancestors, i);
+        if (entry == object) {
+            object_idx = i;
+            break;
+        }
+    }
+
+    /* find all the prepended modules */
+    /* we have the object place in ancestors: */
+    /* [suspect, suspect, object, ...] */
+    for (i = 0; i < object_idx; ++i) {
+        entry = rb_ary_entry(ancestors, i);
+        if (is_instance == Qtrue) {
+            entry_methods = rb_class_instance_methods(1, entry, entry);
+        } else {
+            entry_methods = rb_obj_singleton_methods(1, entry, entry);
+        }
+
+        /* Loop through the instance/singleton methods of the prepended modules
+         */
+        int entry_methods_length = RARRAY_LEN(entry_methods);
+        for (y = 0; y <= entry_methods_length; ++y) {
+            if (rb_ary_entry(entry_methods, y) == method_name) {
+                result = Qtrue;
+                break;
+            }
+        }
+        if (result == Qtrue) {
+            break;
+        }
+    }
+    return result;
 }
 
 void Init_cs__common(void) {
@@ -190,4 +286,10 @@ void Init_cs__common(void) {
 
     core_extensions = rb_define_module_under(contrast, "Extension");
     core_assess = rb_define_module_under(core_extensions, "Assess");
+    /* defined for direct object check */
+    rb_define_singleton_method(rb_cObject, "cs__prepended?",
+                               contrast_check_prepended, 2);
+    /* defined for object lookout */
+    rb_define_singleton_method(assess, "cs__object_method_prepended?",
+                               contrast_lookout_prepended, 4);
 }

data/ext/cs__common/cs__common.h

@@ -57,15 +57,39 @@ VALUE contrast_register_singleton_patch(const char *module_name,
                                         VALUE(c_fn)(const int, VALUE *,
                                                     const VALUE));
 
-VALUE contrast_register_singleton_prepend_patch(
-    const char *module_name, const char *method_name,
-    VALUE(c_fn)(const int, VALUE *, const VALUE));
+VALUE contrast_register_prepend_patch(const char *module_name,
+                                      const char *method_name,
+                                      VALUE(c_fn)(const int, VALUE *,
+                                                  const VALUE));
 
-static VALUE
-_contrast_register_patch(const char *module_name, const char *method_name,
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, VALUE *,
+                                                             const VALUE));
+
+VALUE contrast_register_prepend_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, VALUE *,
+                                                             const VALUE));
+
+static VALUE _contrast_register_patch(const char *module_name, const char *method_name,
                          VALUE(c_fn)(const int, VALUE *, const VALUE),
                          patch_impl patch_impl);
 
+static VALUE _contrast_check_prepended(VALUE self, VALUE method_name, VALUE is_instance);
+
+extern VALUE contrast_check_prepended(VALUE self, VALUE method_name, VALUE is_instance);
+
+extern VALUE contrast_lookout_prepended(VALUE self, VALUE object_name, VALUE method_name,
+                               VALUE is_instance);
+
+/* check if method is prepended and register instance alias or prepend patch */
+VALUE contrast_check_and_register_instance_patch(const char *module_name,
+                                                const char *method_name,
+                                                VALUE(c_fn)(const int, VALUE *,
+                                                            const VALUE));
+
 VALUE contrast_patcher();
 
 void Init_cs__common(void);