contrast-agent 6.12.0 → 6.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6772cdef949fd96dd24342c5f4a9a7b813a4d77873a9aa117c1a6750088a647f
-  data.tar.gz: 8008b5a90911e19594a32a5dba27079d0f7f5e857e34b1cedb974a4e8422fb2d
+  metadata.gz: bf537fe7f51e1701577cb567c81862d9ed3b9eaadf89d45da26ddc65e9135afb
+  data.tar.gz: b344f21256b15416fb395ed6f91880d4579b39d9bdb331df9492965ddf385129
 SHA512:
-  metadata.gz: e70042ce2030918ecbafedfc2b254fd15ff9bc8316fecbd2901e0d8a6581e46505b039d5c21a932b595423565a36b16872362897bc344dc77d61ef8ac41ec8e8
-  data.tar.gz: 3d8cf2341b2258470ec334be4b81efccbea5a27c26c49b5ca0106e3b44e29f6c878aee0c28dcb7b0c0a84887fb1f298978f0419522503ee8293e0053f9a63bc9
+  metadata.gz: cab435e1cfaf07a8f5c101805d3ca0046062071e10d61e3fcef4012e989e145bca2d586113176c89a96019eb32c2a6487de7149a01b4139d95c3b31d648a3ec5
+  data.tar.gz: 5270af8f8b5c398d974857194adff85b826c75cd603006eac060d8762985220f13d095cd4b01ae94976b22a261c6250daa4ee05176b2bc635f7455bbd5eeeaf0

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -10,6 +10,10 @@ module Contrast
           # before serializing that finding as a DTM to report to the TeamServer.
           module REDOSValidator
             RULE_NAME = 'redos'
+            # If Regexp is set to Float::Infinite this is the maximum number it will receive
+            POSITIVE_INFINITY = 18_446_744_073.709553
+            # We are checking and for negative infinity (-1.0/0.0 )
+            NEGATIVE_INFINITY = -POSITIVE_INFINITY
 
             class << self
               def valid? _patcher, object, _ret, args
@@ -49,8 +53,42 @@ module Contrast
 
                 # Use #match? because it doesn't fill out global variables
                 # in the way match or =~ do.
+                #
+                # Since ruby 3.2.0 the Regexp now have a timeout option. we need to check and see if the timeout
+                # is set. If so we can assume that the regexp is safe.
+                # puts "SAFE #{regexp_timeout_safe?(regexp)}"
+                return false if regexp_timeout_safe?(regexp)
+
+                # report only if pattern is bad:
                 VULNERABLE_PATTERN.match?(regexp.source)
               end
+
+              # Check and see if a regexp is with safely set Timeout or not.
+              #
+              # @param regexp [Regexp]
+              # @return [Boolean]
+              def regexp_timeout_safe? regexp
+                return false if RUBY_VERSION < '3.2.0'
+                # Global
+                return false if Regexp.timeout.nil? || regexp_infinite?(Regexp)
+
+                # Local
+                return false if regexp.cs__is_a?(Regexp) && !(regexp.timeout.nil? || regexp_infinite?(regexp))
+
+                true
+              end
+
+              private
+
+              # Check and see if the set timeout is set to infinity:
+              #
+              # @param regexp[Regexp] Instance or class
+              # @return[Boolean]
+              def regexp_infinite? regexp
+                return false unless regexp.timeout == POSITIVE_INFINITY || regexp.timeout == NEGATIVE_INFINITY
+
+                true
+              end
             end
           end
         end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '6.12.0'
+    VERSION = '6.13.0'
   end
 end

data/resources/assess/policy.json

@@ -932,6 +932,22 @@
       "source":"O",
       "target":"R",
       "action":"SPLAT"
+    }, {
+      "class_name":"IO",
+      "method_name":"to_path",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"IO",
+      "method_name":"path",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
     }, {
       "class_name": "ActiveModel::AttributeAssignment",
       "method_name": "assign_attributes",
@@ -1177,6 +1193,16 @@
       "action": "BUFFER",
       "patch_method": "buffer_keep_splat"
     },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "read",
+      "source":"P0,O",
+      "target":"O",
+      "action": "BUFFER",
+      "patch_method": "buffer_keep_splat"
+    },
     {
        "class_name": "ERB",
        "method_name": "result",

data/ruby-agent.gemspec

@@ -178,7 +178,7 @@ Gem::Specification.new do |spec|
                       'Testing and Protection.'
   spec.homepage     = 'https://www.contrastsecurity.com'
   spec.license      = 'CONTRAST SECURITY (see license file)'
-  spec.required_ruby_version = ['>= 2.7.0', '< 3.2.0']
+  spec.required_ruby_version = ['>= 2.7.0', '< 3.3.0']
 
   spec.bindir        = 'exe'
   # Keep cs__common first, it handles funchook.h right now.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.12.0
+  version: 6.13.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-01-10 00:00:00.000000000 Z
+date: 2023-01-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -684,22 +684,22 @@ email:
 executables: []
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_module/extconf.rb
-- ext/cs__scope/extconf.rb
-- ext/cs__assess_string_interpolation/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_basic_object/extconf.rb
-- ext/cs__assess_test/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__assess_hash/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
+- ext/cs__assess_string_interpolation/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_string/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
 - ext/cs__tests/extconf.rb
+- ext/cs__assess_module/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
-- ext/cs__assess_array/extconf.rb
+- ext/cs__scope/extconf.rb
+- ext/cs__assess_test/extconf.rb
 - ext/cs__os_information/extconf.rb
 - ext/cs__assess_marshal_module/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_array/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -1349,7 +1349,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.7.0
   - - "<"
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="