contrast-agent 3.13.2 → 3.14.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (211) hide show
  1. checksums.yaml +4 -4
  2. data/exe/contrast_service +1 -7
  3. data/ext/cs__assess_active_record_named/cs__active_record_named.c +8 -7
  4. data/ext/cs__assess_array/cs__assess_array.c +6 -5
  5. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +5 -5
  6. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -1
  7. data/ext/cs__assess_hash/cs__assess_hash.c +18 -17
  8. data/ext/cs__assess_hash/cs__assess_hash.h +2 -1
  9. data/ext/cs__assess_kernel/cs__assess_kernel.c +7 -8
  10. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +4 -5
  11. data/ext/cs__assess_module/cs__assess_module.c +6 -6
  12. data/ext/cs__assess_regexp/cs__assess_regexp.c +4 -4
  13. data/ext/cs__assess_string/cs__assess_string.c +20 -4
  14. data/ext/cs__assess_string/cs__assess_string.h +4 -1
  15. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +4 -2
  16. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +2 -2
  17. data/ext/cs__common/cs__common.c +44 -37
  18. data/ext/cs__common/cs__common.h +15 -20
  19. data/ext/cs__contrast_patch/cs__contrast_patch.c +27 -25
  20. data/ext/cs__contrast_patch/cs__contrast_patch.h +5 -7
  21. data/ext/cs__protect_kernel/cs__protect_kernel.c +11 -12
  22. data/ext/cs__protect_kernel/cs__protect_kernel.h +2 -2
  23. data/lib/contrast-agent.rb +1 -1
  24. data/lib/contrast.rb +13 -23
  25. data/lib/contrast/agent.rb +39 -39
  26. data/lib/contrast/agent/assess.rb +11 -12
  27. data/lib/contrast/agent/assess/contrast_event.rb +11 -9
  28. data/lib/contrast/agent/assess/events/event_factory.rb +2 -2
  29. data/lib/contrast/agent/assess/events/source_event.rb +2 -2
  30. data/lib/contrast/agent/assess/finalizers/finalize.rb +21 -0
  31. data/lib/contrast/agent/assess/finalizers/freeze.rb +13 -0
  32. data/lib/contrast/agent/assess/finalizers/hash.rb +53 -0
  33. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  34. data/lib/contrast/agent/assess/policy/patcher.rb +5 -5
  35. data/lib/contrast/agent/assess/policy/policy.rb +9 -9
  36. data/lib/contrast/agent/assess/policy/policy_node.rb +2 -2
  37. data/lib/contrast/agent/assess/policy/policy_scanner.rb +3 -3
  38. data/lib/contrast/agent/assess/policy/preshift.rb +15 -5
  39. data/lib/contrast/agent/assess/policy/propagation_method.rb +25 -22
  40. data/lib/contrast/agent/assess/policy/propagation_node.rb +2 -2
  41. data/lib/contrast/agent/assess/policy/propagator.rb +18 -18
  42. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  43. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -1
  44. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  45. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +5 -0
  46. data/lib/contrast/agent/assess/policy/propagator/split.rb +4 -4
  47. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +5 -4
  48. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +5 -5
  49. data/lib/contrast/agent/assess/policy/source_method.rb +5 -14
  50. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +1 -1
  51. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/trigger_method.rb +5 -5
  54. data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -3
  55. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +2 -2
  56. data/lib/contrast/agent/assess/properties.rb +13 -5
  57. data/lib/contrast/agent/assess/property/evented.rb +2 -2
  58. data/lib/contrast/agent/assess/property/tagged.rb +4 -4
  59. data/lib/contrast/agent/assess/rule.rb +2 -2
  60. data/lib/contrast/agent/assess/rule/base.rb +3 -4
  61. data/lib/contrast/agent/assess/rule/provider.rb +3 -3
  62. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
  63. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -2
  64. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  65. data/lib/contrast/agent/class_reopener.rb +7 -6
  66. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  67. data/lib/contrast/agent/deadzone/policy/policy.rb +2 -2
  68. data/lib/contrast/agent/disable_reaction.rb +1 -1
  69. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  70. data/lib/contrast/agent/inventory/policy/datastores.rb +2 -2
  71. data/lib/contrast/agent/inventory/policy/policy.rb +3 -3
  72. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  73. data/lib/contrast/agent/middleware.rb +33 -32
  74. data/lib/contrast/agent/patching/policy/after_load_patch.rb +4 -4
  75. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -5
  76. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  77. data/lib/contrast/agent/patching/policy/patch.rb +15 -15
  78. data/lib/contrast/agent/patching/policy/patcher.rb +30 -22
  79. data/lib/contrast/agent/patching/policy/policy.rb +6 -6
  80. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  81. data/lib/contrast/agent/patching/policy/trigger_node.rb +2 -2
  82. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +3 -3
  83. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +2 -2
  84. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +2 -2
  85. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +3 -3
  86. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +2 -2
  87. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +3 -3
  88. data/lib/contrast/agent/protect/policy/policy.rb +8 -8
  89. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  90. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  91. data/lib/contrast/agent/protect/rule.rb +18 -18
  92. data/lib/contrast/agent/protect/rule/base.rb +4 -3
  93. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  94. data/lib/contrast/agent/protect/rule/cmd_injection.rb +5 -5
  95. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  96. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  97. data/lib/contrast/agent/protect/rule/no_sqli.rb +1 -1
  98. data/lib/contrast/agent/protect/rule/path_traversal.rb +4 -5
  99. data/lib/contrast/agent/protect/rule/sqli.rb +2 -2
  100. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  101. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  102. data/lib/contrast/agent/protect/rule/xxe.rb +3 -5
  103. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +2 -2
  104. data/lib/contrast/agent/railtie.rb +1 -1
  105. data/lib/contrast/agent/reaction_processor.rb +2 -2
  106. data/lib/contrast/agent/request.rb +11 -9
  107. data/lib/contrast/agent/request_context.rb +10 -6
  108. data/lib/contrast/agent/response.rb +6 -6
  109. data/lib/contrast/agent/rewriter.rb +5 -6
  110. data/lib/contrast/agent/service_heartbeat.rb +2 -2
  111. data/lib/contrast/agent/static_analysis.rb +3 -3
  112. data/lib/contrast/agent/thread.rb +1 -1
  113. data/lib/contrast/agent/thread_watcher.rb +2 -2
  114. data/lib/contrast/agent/tracepoint_hook.rb +1 -1
  115. data/lib/contrast/agent/version.rb +1 -1
  116. data/lib/contrast/api.rb +4 -4
  117. data/lib/contrast/api/communication.rb +9 -9
  118. data/lib/contrast/api/communication/messaging_queue.rb +2 -2
  119. data/lib/contrast/api/communication/response_processor.rb +1 -1
  120. data/lib/contrast/api/communication/socket_client.rb +5 -5
  121. data/lib/contrast/api/communication/speedracer.rb +1 -1
  122. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  123. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  124. data/lib/contrast/api/decorators.rb +14 -14
  125. data/lib/contrast/api/decorators/address.rb +7 -6
  126. data/lib/contrast/api/decorators/application_settings.rb +3 -2
  127. data/lib/contrast/api/decorators/application_update.rb +5 -4
  128. data/lib/contrast/api/decorators/http_request.rb +13 -12
  129. data/lib/contrast/api/decorators/input_analysis.rb +3 -2
  130. data/lib/contrast/api/decorators/message.rb +3 -2
  131. data/lib/contrast/api/decorators/rasp_rule_sample.rb +2 -1
  132. data/lib/contrast/api/decorators/route_coverage.rb +3 -2
  133. data/lib/contrast/api/decorators/server_features.rb +3 -2
  134. data/lib/contrast/api/decorators/trace_event.rb +3 -2
  135. data/lib/contrast/api/decorators/trace_event_object.rb +6 -5
  136. data/lib/contrast/api/decorators/trace_event_signature.rb +5 -4
  137. data/lib/contrast/api/decorators/trace_taint_range.rb +4 -3
  138. data/lib/contrast/api/decorators/user_input.rb +4 -4
  139. data/lib/contrast/common_agent_configuration.rb +2 -2
  140. data/lib/contrast/components/agent.rb +2 -2
  141. data/lib/contrast/components/app_context.rb +1 -1
  142. data/lib/contrast/components/config.rb +4 -4
  143. data/lib/contrast/components/contrast_service.rb +1 -1
  144. data/lib/contrast/components/interface.rb +15 -15
  145. data/lib/contrast/components/logger.rb +1 -1
  146. data/lib/contrast/components/scope.rb +3 -3
  147. data/lib/contrast/config.rb +18 -18
  148. data/lib/contrast/config/base_configuration.rb +2 -2
  149. data/lib/contrast/config/protect_rule_configuration.rb +1 -1
  150. data/lib/contrast/configuration.rb +5 -5
  151. data/lib/contrast/extension/assess.rb +22 -21
  152. data/lib/contrast/extension/assess/array.rb +4 -4
  153. data/lib/contrast/extension/assess/assess_extension.rb +27 -29
  154. data/lib/contrast/extension/assess/eval_trigger.rb +3 -3
  155. data/lib/contrast/extension/assess/exec_trigger.rb +1 -1
  156. data/lib/contrast/extension/assess/fiber.rb +3 -3
  157. data/lib/contrast/extension/assess/hash.rb +5 -3
  158. data/lib/contrast/extension/assess/kernel.rb +7 -6
  159. data/lib/contrast/extension/assess/marshal.rb +62 -0
  160. data/lib/contrast/extension/assess/regexp.rb +3 -3
  161. data/lib/contrast/extension/assess/string.rb +5 -5
  162. data/lib/contrast/extension/inventory.rb +4 -4
  163. data/lib/contrast/extension/kernel.rb +1 -1
  164. data/lib/contrast/extension/module.rb +1 -1
  165. data/lib/contrast/extension/protect.rb +3 -3
  166. data/lib/contrast/extension/protect/kernel.rb +2 -2
  167. data/lib/contrast/extension/protect/psych.rb +2 -2
  168. data/lib/contrast/framework/manager.rb +7 -8
  169. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  170. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  171. data/lib/contrast/framework/rack/support.rb +2 -2
  172. data/lib/contrast/framework/rails/patch/assess_configuration.rb +2 -2
  173. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  174. data/lib/contrast/framework/rails/patch/support.rb +3 -3
  175. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +2 -2
  176. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +2 -2
  177. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +2 -2
  178. data/lib/contrast/framework/rails/support.rb +62 -14
  179. data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
  180. data/lib/contrast/framework/sinatra/patch/support.rb +1 -1
  181. data/lib/contrast/framework/sinatra/support.rb +2 -2
  182. data/lib/contrast/funchook/funchook.rb +1 -1
  183. data/lib/contrast/logger/application.rb +2 -2
  184. data/lib/contrast/logger/format.rb +22 -9
  185. data/lib/contrast/logger/log.rb +10 -8
  186. data/lib/contrast/logger/request.rb +30 -0
  187. data/lib/contrast/tasks/config.rb +1 -1
  188. data/lib/contrast/tasks/service.rb +2 -2
  189. data/lib/contrast/utils/assess/sampling_util.rb +2 -2
  190. data/lib/contrast/utils/assess/tracking_util.rb +1 -1
  191. data/lib/contrast/utils/boolean_util.rb +1 -1
  192. data/lib/contrast/utils/class_util.rb +2 -2
  193. data/lib/contrast/utils/freeze_util.rb +1 -1
  194. data/lib/contrast/utils/gemfile_reader.rb +5 -5
  195. data/lib/contrast/utils/hash_digest.rb +2 -1
  196. data/lib/contrast/utils/heap_dump_util.rb +2 -2
  197. data/lib/contrast/utils/invalid_configuration_util.rb +1 -1
  198. data/lib/contrast/utils/inventory_util.rb +4 -4
  199. data/lib/contrast/utils/io_util.rb +1 -1
  200. data/lib/contrast/utils/os.rb +1 -1
  201. data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
  202. data/lib/contrast/utils/sha256_builder.rb +2 -2
  203. data/lib/contrast/utils/stack_trace_utils.rb +2 -2
  204. data/lib/contrast/utils/string_utils.rb +1 -1
  205. data/ruby-agent.gemspec +5 -5
  206. data/service_executables/VERSION +1 -1
  207. data/service_executables/linux/contrast-service +0 -0
  208. data/service_executables/mac/contrast-service +0 -0
  209. metadata +22 -19
  210. data/lib/contrast/agent/assess/insulator.rb +0 -49
  211. data/lib/contrast/agent/require_state.rb +0 -61
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c0ae3e021f55160aef8f9a1c3beec72a68e4b6f2751284573a154251cc1f4483
4
- data.tar.gz: 3e774fcb756fede7c319c38767354fc6cb7453bdf1d6c733983b1e5729ec5e2e
3
+ metadata.gz: c3ef67bfca5c3d772078af285e4b3fa1ab314b06af04355db1aa50cce0d284e8
4
+ data.tar.gz: 5eb0fe6b5dba8f64b5947c1c7cade90718b18224b62b5e02eed470613e6fbe6d
5
5
  SHA512:
6
- metadata.gz: 4567fdb2323be1884bca5e0369fd135dfc6ffb0b87ecd5d4aac1ef808d0388c68e5c333f56134ee85230eeba587e56a0e692b8cbda0c447ef53f209cf7e67621
7
- data.tar.gz: 784af7ef08e6e830525b2947270da6d1918fc2b924cd6f8efb7c2d2661b993929a6cb2aaf9db8806ac7411155b50ba4be24348005b1893d16e27a9edfdd56441
6
+ metadata.gz: caf748a141fe652cbb1cb3e658969820b22ca4e58a11cdc46ee9bc94932c00e031b186b96e8c44b884d6f658951e8936a75444aa4d52cb9d0d5e563ab29ef26b
7
+ data.tar.gz: b3235852bb77977f244beed747b032bfa6e80eb86ebdcfab622a8dba7acc7a939f87e08022a07e795d2c455ec3d3107771e5cdae0d5b893a4c6019f09945db43
@@ -3,19 +3,13 @@
3
3
  # frozen_string_literal: true
4
4
 
5
5
  def mac?
6
- RUBY_PLATFORM.match?(/darwin/)
7
- end
8
-
9
- def windows?
10
- RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
6
+ RUBY_PLATFORM.include?('darwin')
11
7
  end
12
8
 
13
9
  def path
14
10
  base_path = "#{ File.dirname(__FILE__) }/.."
15
11
  if mac?
16
12
  "#{ base_path }/service_executables/mac/contrast-service"
17
- elsif windows?
18
- "#{ base_path }/service_executables/windows/contrast-service.exe"
19
13
  else
20
14
  "#{ base_path }/service_executables/linux/contrast-service"
21
15
  end
@@ -2,8 +2,8 @@
2
2
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
3
3
 
4
4
  #include "cs__active_record_named.h"
5
- #include <ruby.h>
6
5
  #include "../cs__common/cs__common.h"
6
+ #include <ruby.h>
7
7
 
8
8
  VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
9
9
  const VALUE self) {
@@ -19,7 +19,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
19
19
  */
20
20
  VALUE new_body, ret;
21
21
  VALUE new_args[3];
22
- new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self, argv[0], argv[1]);
22
+ new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
23
+ argv[0], argv[1]);
23
24
  new_args[0] = argv[0];
24
25
  if (NIL_P(new_body)) {
25
26
  new_args[1] = argv[1];
@@ -36,10 +37,10 @@ void Init_cs__assess_active_record_named(void) {
36
37
  framework = rb_define_module_under(contrast, "Framework");
37
38
  rails = rb_define_module_under(framework, "Rails");
38
39
  rewrite = rb_define_module_under(rails, "Rewrite");
39
- active_record_named = rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
40
+ active_record_named =
41
+ rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
40
42
  rb_sym_assess_rewrite = rb_intern("rewrite");
41
- rb_sym_assess_scope = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
42
- "scope",
43
- contrast_assess_active_record_scope);
43
+ rb_sym_assess_scope =
44
+ contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
45
+ "scope", contrast_assess_active_record_scope);
44
46
  }
45
-
@@ -23,15 +23,16 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
23
23
  /* Finally, default to empty String. Implicit since nil.to_s is ''*/
24
24
 
25
25
  result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
26
- result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3, ary, sep, result);
26
+ result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
27
+ ary, sep, result);
27
28
 
28
29
  return result;
29
30
  }
30
31
 
31
32
  void Init_cs__assess_array(void) {
32
- array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
33
+ array_propagator =
34
+ rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
33
35
  rb_sym_assess_track_array_join = rb_intern("cs__track_join");
34
- rb_sym_assess_array_join = contrast_register_patch("Array",
35
- "join",
36
- contrast_assess_array_join);
36
+ rb_sym_assess_array_join =
37
+ contrast_register_patch("Array", "join", contrast_assess_array_join);
37
38
  }
@@ -7,7 +7,8 @@
7
7
 
8
8
  void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
9
9
  VALUE ret) {
10
- rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self, source, ret);
10
+ rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
11
+ source, ret);
11
12
  }
12
13
 
13
14
  VALUE
@@ -36,7 +37,8 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
36
37
  }
37
38
 
38
39
  void Init_cs__assess_basic_object(void) {
39
- basic_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
40
+ basic_eval_trigger =
41
+ rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
40
42
  instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
41
43
 
42
44
  /* We don't keep a reference to the underlying method.
@@ -45,8 +47,6 @@ void Init_cs__assess_basic_object(void) {
45
47
  * but if someone else patched BasicObject#instance_eval,
46
48
  * IDK if this is intentional... noting it. -ajm
47
49
  */
48
- contrast_register_patch("BasicObject",
49
- "instance_eval",
50
+ contrast_register_patch("BasicObject", "instance_eval",
50
51
  contrast_assess_basic_object_instance_eval);
51
-
52
52
  }
@@ -73,7 +73,8 @@ int install_fiber_hooks() {
73
73
  }
74
74
 
75
75
  void Init_cs__assess_fiber_track(void) {
76
- fiber_propagator = rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
76
+ fiber_propagator =
77
+ rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
77
78
  track_rb_fiber_new = rb_intern("track_rb_fiber_new");
78
79
  track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
79
80
  rb_sym_next = rb_intern("next");
@@ -12,23 +12,24 @@
12
12
  * This method instruments that unique bracket-construction style
13
13
  * of initializing a hash.
14
14
  */
15
- static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
16
- const VALUE hash) {
15
+ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
16
+ VALUE *argv,
17
+ const VALUE hash) {
17
18
  VALUE result;
18
19
 
19
20
  /* Array of Arrays: Hash[ [ [key, value], ... ] ] -> new_hash */
20
21
  if (RB_TYPE_P(argv[0], T_ARRAY)) {
21
22
  int i;
22
23
  for (i = 0; i < argc; i++) {
23
- argv[i] =
24
- rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
24
+ argv[i] = rb_funcall(hash_propagator,
25
+ rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
25
26
  }
26
27
  /* Hash[ key, value, ... ] -> new_hash */
27
28
  } else if (argc > 1) {
28
29
  int i;
29
30
  for (i = 0; i < argc; i += 2) {
30
- argv[i] =
31
- rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
31
+ argv[i] = rb_funcall(hash_propagator,
32
+ rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
32
33
  }
33
34
  }
34
35
 
@@ -36,7 +37,8 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *arg
36
37
  * String keys
37
38
  * # Hash[ object ] -> new_hash
38
39
  */
39
- result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
40
+ result =
41
+ rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
40
42
 
41
43
  return result;
42
44
  }
@@ -61,8 +63,9 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
61
63
  * We haven't revisited this approach since we started more extensively
62
64
  * hooking public C functions.)
63
65
  */
64
- if(argc > 0) {
65
- argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[0]);
66
+ if (argc > 0) {
67
+ argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
68
+ 1, argv[0]);
66
69
  }
67
70
  /* This is the underlying assignment, w/ our instrumented key. */
68
71
  result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
@@ -71,17 +74,15 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
71
74
  }
72
75
 
73
76
  void Init_cs__assess_hash(void) {
74
- hash_propagator = rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
77
+ hash_propagator =
78
+ rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
75
79
  rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
76
80
 
77
81
  VALUE hash_class = rb_define_class("Hash", rb_cObject);
78
82
 
79
- rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch("Hash",
80
- "[]",
81
- contrast_assess_hash_bracket_constructor);
82
-
83
- rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
84
- "[]=",
85
- contrast_assess_hash_bracket_set);
83
+ rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
84
+ "Hash", "[]", contrast_assess_hash_bracket_constructor);
86
85
 
86
+ rb_sym_assess_hash_bracket_equals = contrast_register_patch(
87
+ "Hash", "[]=", contrast_assess_hash_bracket_set);
87
88
  }
@@ -13,7 +13,8 @@ static VALUE hash_propagator;
13
13
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
14
14
  * -HM
15
15
  */
16
- static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
16
+ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
17
+ VALUE *argv,
17
18
  const VALUE hash);
18
19
 
19
20
  static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
@@ -18,8 +18,9 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
18
18
  rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
19
19
  }
20
20
 
21
- /* maybe this should be rb_funcall2. this works right now because *argv == argv[0].
22
- * exec shouldn't ever be called with != 1 argc, so not a huge problem */
21
+ /* maybe this should be rb_funcall2. this works right now because *argv ==
22
+ * argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
23
+ * problem */
23
24
  return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
24
25
  }
25
26
 
@@ -27,12 +28,10 @@ void Init_cs__assess_kernel(void) {
27
28
  kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
28
29
  exec_apply_trigger = rb_intern("apply_trigger");
29
30
 
30
- rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
31
- "exec",
32
- contrast_patched_kernel_exec);
31
+ rb_sym_assess_kernel_exec =
32
+ contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
33
33
 
34
34
  /* should return the same value as above */
35
- rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
36
- "exec",
37
- contrast_patched_kernel_exec);
35
+ rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
36
+ "Kernel", "exec", contrast_patched_kernel_exec);
38
37
  }
@@ -9,7 +9,6 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
9
9
  const VALUE *argv) {
10
10
  VALUE result;
11
11
  VALUE source_string;
12
-
13
12
  result = rb_call_super(argc, argv);
14
13
 
15
14
  if (argc >= 1) {
@@ -27,7 +26,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
27
26
  rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
28
27
  rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
29
28
  2, source_string, result);
30
- rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
29
+ rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
31
30
  }
32
31
  }
33
32
  }
@@ -36,9 +35,9 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
36
35
  }
37
36
 
38
37
  void Init_cs__assess_marshal_module(void) {
38
+ marshal_module = rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
39
39
  rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
40
40
 
41
- contrast_register_singleton_prepend_patch("Marshal",
42
- "load",
43
- &contrast_assess_marshal_module_load);
41
+ contrast_register_singleton_prepend_patch(
42
+ "Marshal", "load", &contrast_assess_marshal_module_load);
44
43
  }
@@ -21,7 +21,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
21
21
  /* If this method ever throws an exception, the scope-leave
22
22
  * needs to be moved within a rescue call.
23
23
  */
24
- rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
24
+ rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
25
+ ret, method);
25
26
  }
26
27
 
27
28
  rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -57,7 +58,8 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
57
58
  }
58
59
 
59
60
  void Init_cs__assess_module(void) {
60
- module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
61
+ module_eval_trigger =
62
+ rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
61
63
  trigger_check_method = rb_intern("eval_trigger_check");
62
64
 
63
65
  rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
@@ -69,11 +71,9 @@ void Init_cs__assess_module(void) {
69
71
  * See similar comments in basic_object C ext patch.
70
72
  */
71
73
 
72
- contrast_register_patch("Module",
73
- "class_eval",
74
+ contrast_register_patch("Module", "class_eval",
74
75
  contrast_assess_module_class_eval);
75
76
 
76
- contrast_register_patch("Module",
77
- "module_eval",
77
+ contrast_register_patch("Module", "module_eval",
78
78
  contrast_assess_module_module_eval);
79
79
  }
@@ -29,7 +29,8 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
29
29
  }
30
30
 
31
31
  void Init_cs__assess_regexp(void) {
32
- regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
32
+ regexp_propagator =
33
+ rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
33
34
  rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
34
35
 
35
36
  /* These are the keys we use to define our hash of
@@ -46,7 +47,6 @@ void Init_cs__assess_regexp(void) {
46
47
  rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
47
48
  rb_global_variable(&rb_sym_back_ref);
48
49
 
49
- rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
50
- "=~",
51
- contrast_assess_regexp_equal_squiggle);
50
+ rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
51
+ "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
52
52
  }
@@ -6,7 +6,7 @@
6
6
  #include <ruby.h>
7
7
 
8
8
  static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
9
- const VALUE obj) {
9
+ const VALUE obj) {
10
10
  VALUE dup, tracked;
11
11
  if (!OBJ_FROZEN(obj)) {
12
12
  tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -17,6 +17,7 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
17
17
  * string.c, but we ignore any other monkey patches on String#-@
18
18
  */
19
19
  dup = rb_funcall(obj, rb_sym_dup, 0);
20
+ rb_funcall(obj, rb_intern("cs__transfer_properties"), 1, dup);
20
21
  rb_funcall(dup, rb_sym_freeze, 0);
21
22
  return dup;
22
23
  }
@@ -25,11 +26,26 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
25
26
  return rb_funcall(obj, rb_sym_assess_string_uminus, 0);
26
27
  }
27
28
 
29
+ static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
30
+ const VALUE obj) {
31
+ if (!OBJ_FROZEN(obj)) {
32
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
33
+ rb_funcall(properties_hash, rb_intern("pre_freeze"), 1, obj);
34
+ }
35
+ return rb_funcall(obj, rb_sym_assess_string_freeze, 0);
36
+ }
37
+
28
38
  void Init_cs__assess_string(void) {
29
39
  rb_sym_dup = rb_intern("dup");
30
40
  rb_sym_freeze = rb_intern("freeze");
31
41
 
32
- rb_sym_assess_string_uminus = contrast_register_patch("String",
33
- "-@",
34
- &contrast_assess_string_uminus);
42
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
43
+ VALUE finalizers = rb_define_module_under(assess, "Finalizers");
44
+ VALUE finalize = rb_define_module_under(finalizers, "Finalize");
45
+ properties_hash = rb_const_get(finalize, rb_intern("PROPERTIES_HASH"));
46
+
47
+ rb_sym_assess_string_uminus =
48
+ contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
49
+ rb_sym_assess_string_freeze = contrast_register_patch(
50
+ "String", "freeze", &contrast_assess_string_freeze);
35
51
  }
@@ -1,6 +1,9 @@
1
1
  #include <ruby.h>
2
2
 
3
3
  static VALUE rb_sym_assess_string_uminus;
4
+ static VALUE rb_sym_assess_string_freeze;
5
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
6
+ static VALUE properties_hash;
4
7
  static VALUE rb_sym_dup;
5
8
  static VALUE rb_sym_freeze;
6
9
 
@@ -15,6 +18,6 @@ static VALUE rb_sym_freeze;
15
18
  * -HM
16
19
  */
17
20
  static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
18
- const VALUE obj);
21
+ const VALUE obj);
19
22
 
20
23
  void Init_cs__assess_string(void);
@@ -14,13 +14,15 @@ static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
14
14
 
15
15
  static int install_hooks() {
16
16
  rb_str_concat_literals_original = rb_str_concat_literals;
17
- patch_via_funchook(&rb_str_concat_literals_original, &rb_str_concat_literals_hook);
17
+ patch_via_funchook(&rb_str_concat_literals_original,
18
+ &rb_str_concat_literals_hook);
18
19
 
19
20
  return 0;
20
21
  }
21
22
 
22
23
  void Init_cs__assess_string_interpolation26(void) {
23
- string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
24
+ string_propagator =
25
+ rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
24
26
  track_interpolation = rb_intern("track_interpolation");
25
27
  install_hooks();
26
28
  }
@@ -8,7 +8,7 @@
8
8
  static VALUE rb_yield_hook(VALUE val, const VALUE self) {
9
9
  VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
10
10
 
11
- if(method == split_method && RB_TYPE_P(val, T_STRING)) {
11
+ if (method == split_method && RB_TYPE_P(val, T_STRING)) {
12
12
  rb_funcall(split_class, propagate_yield, 1, val);
13
13
  }
14
14
  VALUE result = rb_yield_original(val);
@@ -25,6 +25,6 @@ void Init_cs__assess_yield_track(void) {
25
25
  VALUE base = rb_define_class_under(assess_propagator, "Base", rb_cObject);
26
26
  split_class = rb_define_class_under(assess_propagator, "Split", base);
27
27
  propagate_yield = rb_intern("propagate_yield");
28
- split_method = ID2SYM(rb_intern("split"));
28
+ split_method = ID2SYM(rb_intern("split"));
29
29
  install_yield_hooks();
30
30
  }
@@ -2,8 +2,8 @@
2
2
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
3
3
 
4
4
  #include "cs__common.h"
5
- #include <ruby.h>
6
5
  #include <dlfcn.h>
6
+ #include <ruby.h>
7
7
 
8
8
  /* Globals */
9
9
  /* These are defined w/ `extern` in the header */
@@ -27,19 +27,24 @@ void patch_via_funchook(void *original_function, void *hook_function) {
27
27
 
28
28
  void *funchook_lib_handle;
29
29
  void *funchook_reference, *(*funchook_create)(void);
30
- int prepareResult, (*funchook_prepare)(void*, void**, void*);
31
- int installResult, (*funchook_install)(void*, int);
30
+ int prepareResult, (*funchook_prepare)(void *, void **, void *);
31
+ int installResult, (*funchook_install)(void *, int);
32
32
 
33
- funchook_lib_handle = dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
33
+ funchook_lib_handle =
34
+ dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
34
35
 
35
36
  /* Load the funchook methods we need */
36
- funchook_create = (void* (*)(void))dlsym(funchook_lib_handle, "funchook_create");
37
- funchook_prepare = (int (*)(void*, void**, void*))dlsym(funchook_lib_handle, "funchook_prepare");
38
- funchook_install = (int (*)(void*, int))dlsym(funchook_lib_handle, "funchook_install");
37
+ funchook_create =
38
+ (void *(*)(void))dlsym(funchook_lib_handle, "funchook_create");
39
+ funchook_prepare = (int (*)(void *, void **, void *))dlsym(
40
+ funchook_lib_handle, "funchook_prepare");
41
+ funchook_install =
42
+ (int (*)(void *, int))dlsym(funchook_lib_handle, "funchook_install");
39
43
 
40
- funchook_reference = (void*)(*funchook_create)();
44
+ funchook_reference = (void *)(*funchook_create)();
41
45
 
42
- prepareResult = (*funchook_prepare)(funchook_reference, (void**)original_function, hook_function);
46
+ prepareResult = (*funchook_prepare)(
47
+ funchook_reference, (void **)original_function, hook_function);
43
48
  installResult = (*funchook_install)(funchook_reference, 0);
44
49
  }
45
50
 
@@ -53,33 +58,32 @@ VALUE contrast_patcher() {
53
58
  return patcher;
54
59
  }
55
60
 
56
- VALUE contrast_register_patch(const char *module_name,
57
- const char *method_name,
58
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
59
- ) {
60
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
61
+ VALUE contrast_register_patch(const char *module_name, const char *method_name,
62
+ VALUE(c_fn)(const int, const VALUE *,
63
+ const VALUE)) {
64
+ return _contrast_register_patch(module_name, method_name, c_fn,
65
+ IMPL_ALIAS_INSTANCE);
61
66
  }
62
67
 
63
-
64
68
  VALUE contrast_register_singleton_patch(const char *module_name,
65
69
  const char *method_name,
66
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
67
- ) {
68
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
70
+ VALUE(c_fn)(const int, const VALUE *,
71
+ const VALUE)) {
72
+ return _contrast_register_patch(module_name, method_name, c_fn,
73
+ IMPL_ALIAS_SINGLETON);
69
74
  }
70
75
 
71
- VALUE contrast_register_singleton_prepend_patch(const char *module_name,
72
- const char *method_name,
73
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
74
- ) {
75
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
76
+ VALUE contrast_register_singleton_prepend_patch(
77
+ const char *module_name, const char *method_name,
78
+ VALUE(c_fn)(const int, const VALUE *, const VALUE)) {
79
+ return _contrast_register_patch(module_name, method_name, c_fn,
80
+ IMPL_PREPEND);
76
81
  }
77
82
 
78
- static VALUE _contrast_register_patch(const char *module_name,
79
- const char *method_name,
80
- VALUE(c_fn)(const int, const VALUE*, const VALUE),
81
- patch_impl patch
82
- ) {
83
+ static VALUE
84
+ _contrast_register_patch(const char *module_name, const char *method_name,
85
+ VALUE(c_fn)(const int, const VALUE *, const VALUE),
86
+ patch_impl patch) {
83
87
  VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
84
88
  VALUE unbound_method = Qnil;
85
89
  VALUE rb_str_module_name = rb_str_new_cstr(module_name);
@@ -105,24 +109,27 @@ static VALUE _contrast_register_patch(const char *module_name,
105
109
  */
106
110
  rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
107
111
  VALUE rb_sym_instance_method = rb_intern("instance_method");
108
- unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
112
+ unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1,
113
+ rb_str_method_name);
109
114
  rb_undef_method(contrast_bind_module, method_name);
110
115
 
111
116
  /* map impl enum -> ruby symbol */
112
117
  VALUE impl = Qnil;
113
- switch(patch) {
114
- case IMPL_ALIAS_INSTANCE:
118
+ switch (patch) {
119
+ case IMPL_ALIAS_INSTANCE:
115
120
  impl = ID2SYM(rb_sym_alias_instance);
116
121
  break;
117
- case IMPL_ALIAS_SINGLETON:
122
+ case IMPL_ALIAS_SINGLETON:
118
123
  impl = ID2SYM(rb_sym_alias_singleton);
119
124
  break;
120
- case IMPL_PREPEND:
125
+ case IMPL_PREPEND:
121
126
  impl = ID2SYM(rb_sym_prepend);
122
127
  break;
123
128
  }
124
129
 
125
- VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
130
+ VALUE underlying_method_name =
131
+ rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3,
132
+ rb_str_module_name, unbound_method, impl);
126
133
  return SYM2ID(underlying_method_name);
127
134
  }
128
135
 
@@ -141,9 +148,9 @@ void Init_cs__common(void) {
141
148
 
142
149
  /* Used for returning unbound C functions */
143
150
  rb_sym_register_c_patch = rb_intern("register_c_patch");
144
- rb_sym_alias_instance = rb_intern("alias_instance");
145
- rb_sym_alias_singleton = rb_intern("alias_singleton");
146
- rb_sym_prepend = rb_intern("prepend");
151
+ rb_sym_alias_instance = rb_intern("alias_instance");
152
+ rb_sym_alias_singleton = rb_intern("alias_singleton");
153
+ rb_sym_prepend = rb_intern("prepend");
147
154
 
148
155
  /* Ensure definition of core Contrast instrumentation modules */
149
156
  contrast = rb_define_module("Contrast");