contrast-agent 3.13.2 → 3.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (211) hide show
  1. checksums.yaml +4 -4
  2. data/exe/contrast_service +1 -7
  3. data/ext/cs__assess_active_record_named/cs__active_record_named.c +8 -7
  4. data/ext/cs__assess_array/cs__assess_array.c +6 -5
  5. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +5 -5
  6. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -1
  7. data/ext/cs__assess_hash/cs__assess_hash.c +18 -17
  8. data/ext/cs__assess_hash/cs__assess_hash.h +2 -1
  9. data/ext/cs__assess_kernel/cs__assess_kernel.c +7 -8
  10. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +4 -5
  11. data/ext/cs__assess_module/cs__assess_module.c +6 -6
  12. data/ext/cs__assess_regexp/cs__assess_regexp.c +4 -4
  13. data/ext/cs__assess_string/cs__assess_string.c +20 -4
  14. data/ext/cs__assess_string/cs__assess_string.h +4 -1
  15. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +4 -2
  16. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +2 -2
  17. data/ext/cs__common/cs__common.c +44 -37
  18. data/ext/cs__common/cs__common.h +15 -20
  19. data/ext/cs__contrast_patch/cs__contrast_patch.c +27 -25
  20. data/ext/cs__contrast_patch/cs__contrast_patch.h +5 -7
  21. data/ext/cs__protect_kernel/cs__protect_kernel.c +11 -12
  22. data/ext/cs__protect_kernel/cs__protect_kernel.h +2 -2
  23. data/lib/contrast-agent.rb +1 -1
  24. data/lib/contrast.rb +13 -23
  25. data/lib/contrast/agent.rb +39 -39
  26. data/lib/contrast/agent/assess.rb +11 -12
  27. data/lib/contrast/agent/assess/contrast_event.rb +11 -9
  28. data/lib/contrast/agent/assess/events/event_factory.rb +2 -2
  29. data/lib/contrast/agent/assess/events/source_event.rb +2 -2
  30. data/lib/contrast/agent/assess/finalizers/finalize.rb +21 -0
  31. data/lib/contrast/agent/assess/finalizers/freeze.rb +13 -0
  32. data/lib/contrast/agent/assess/finalizers/hash.rb +53 -0
  33. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  34. data/lib/contrast/agent/assess/policy/patcher.rb +5 -5
  35. data/lib/contrast/agent/assess/policy/policy.rb +9 -9
  36. data/lib/contrast/agent/assess/policy/policy_node.rb +2 -2
  37. data/lib/contrast/agent/assess/policy/policy_scanner.rb +3 -3
  38. data/lib/contrast/agent/assess/policy/preshift.rb +15 -5
  39. data/lib/contrast/agent/assess/policy/propagation_method.rb +25 -22
  40. data/lib/contrast/agent/assess/policy/propagation_node.rb +2 -2
  41. data/lib/contrast/agent/assess/policy/propagator.rb +18 -18
  42. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  43. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -1
  44. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  45. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +5 -0
  46. data/lib/contrast/agent/assess/policy/propagator/split.rb +4 -4
  47. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +5 -4
  48. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +5 -5
  49. data/lib/contrast/agent/assess/policy/source_method.rb +5 -14
  50. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +1 -1
  51. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/trigger_method.rb +5 -5
  54. data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -3
  55. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +2 -2
  56. data/lib/contrast/agent/assess/properties.rb +13 -5
  57. data/lib/contrast/agent/assess/property/evented.rb +2 -2
  58. data/lib/contrast/agent/assess/property/tagged.rb +4 -4
  59. data/lib/contrast/agent/assess/rule.rb +2 -2
  60. data/lib/contrast/agent/assess/rule/base.rb +3 -4
  61. data/lib/contrast/agent/assess/rule/provider.rb +3 -3
  62. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
  63. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -2
  64. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  65. data/lib/contrast/agent/class_reopener.rb +7 -6
  66. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  67. data/lib/contrast/agent/deadzone/policy/policy.rb +2 -2
  68. data/lib/contrast/agent/disable_reaction.rb +1 -1
  69. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  70. data/lib/contrast/agent/inventory/policy/datastores.rb +2 -2
  71. data/lib/contrast/agent/inventory/policy/policy.rb +3 -3
  72. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  73. data/lib/contrast/agent/middleware.rb +33 -32
  74. data/lib/contrast/agent/patching/policy/after_load_patch.rb +4 -4
  75. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -5
  76. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  77. data/lib/contrast/agent/patching/policy/patch.rb +15 -15
  78. data/lib/contrast/agent/patching/policy/patcher.rb +30 -22
  79. data/lib/contrast/agent/patching/policy/policy.rb +6 -6
  80. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  81. data/lib/contrast/agent/patching/policy/trigger_node.rb +2 -2
  82. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +3 -3
  83. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +2 -2
  84. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +2 -2
  85. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +3 -3
  86. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +2 -2
  87. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +3 -3
  88. data/lib/contrast/agent/protect/policy/policy.rb +8 -8
  89. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  90. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  91. data/lib/contrast/agent/protect/rule.rb +18 -18
  92. data/lib/contrast/agent/protect/rule/base.rb +4 -3
  93. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  94. data/lib/contrast/agent/protect/rule/cmd_injection.rb +5 -5
  95. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  96. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  97. data/lib/contrast/agent/protect/rule/no_sqli.rb +1 -1
  98. data/lib/contrast/agent/protect/rule/path_traversal.rb +4 -5
  99. data/lib/contrast/agent/protect/rule/sqli.rb +2 -2
  100. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  101. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  102. data/lib/contrast/agent/protect/rule/xxe.rb +3 -5
  103. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +2 -2
  104. data/lib/contrast/agent/railtie.rb +1 -1
  105. data/lib/contrast/agent/reaction_processor.rb +2 -2
  106. data/lib/contrast/agent/request.rb +11 -9
  107. data/lib/contrast/agent/request_context.rb +10 -6
  108. data/lib/contrast/agent/response.rb +6 -6
  109. data/lib/contrast/agent/rewriter.rb +5 -6
  110. data/lib/contrast/agent/service_heartbeat.rb +2 -2
  111. data/lib/contrast/agent/static_analysis.rb +3 -3
  112. data/lib/contrast/agent/thread.rb +1 -1
  113. data/lib/contrast/agent/thread_watcher.rb +2 -2
  114. data/lib/contrast/agent/tracepoint_hook.rb +1 -1
  115. data/lib/contrast/agent/version.rb +1 -1
  116. data/lib/contrast/api.rb +4 -4
  117. data/lib/contrast/api/communication.rb +9 -9
  118. data/lib/contrast/api/communication/messaging_queue.rb +2 -2
  119. data/lib/contrast/api/communication/response_processor.rb +1 -1
  120. data/lib/contrast/api/communication/socket_client.rb +5 -5
  121. data/lib/contrast/api/communication/speedracer.rb +1 -1
  122. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  123. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  124. data/lib/contrast/api/decorators.rb +14 -14
  125. data/lib/contrast/api/decorators/address.rb +7 -6
  126. data/lib/contrast/api/decorators/application_settings.rb +3 -2
  127. data/lib/contrast/api/decorators/application_update.rb +5 -4
  128. data/lib/contrast/api/decorators/http_request.rb +13 -12
  129. data/lib/contrast/api/decorators/input_analysis.rb +3 -2
  130. data/lib/contrast/api/decorators/message.rb +3 -2
  131. data/lib/contrast/api/decorators/rasp_rule_sample.rb +2 -1
  132. data/lib/contrast/api/decorators/route_coverage.rb +3 -2
  133. data/lib/contrast/api/decorators/server_features.rb +3 -2
  134. data/lib/contrast/api/decorators/trace_event.rb +3 -2
  135. data/lib/contrast/api/decorators/trace_event_object.rb +6 -5
  136. data/lib/contrast/api/decorators/trace_event_signature.rb +5 -4
  137. data/lib/contrast/api/decorators/trace_taint_range.rb +4 -3
  138. data/lib/contrast/api/decorators/user_input.rb +4 -4
  139. data/lib/contrast/common_agent_configuration.rb +2 -2
  140. data/lib/contrast/components/agent.rb +2 -2
  141. data/lib/contrast/components/app_context.rb +1 -1
  142. data/lib/contrast/components/config.rb +4 -4
  143. data/lib/contrast/components/contrast_service.rb +1 -1
  144. data/lib/contrast/components/interface.rb +15 -15
  145. data/lib/contrast/components/logger.rb +1 -1
  146. data/lib/contrast/components/scope.rb +3 -3
  147. data/lib/contrast/config.rb +18 -18
  148. data/lib/contrast/config/base_configuration.rb +2 -2
  149. data/lib/contrast/config/protect_rule_configuration.rb +1 -1
  150. data/lib/contrast/configuration.rb +5 -5
  151. data/lib/contrast/extension/assess.rb +22 -21
  152. data/lib/contrast/extension/assess/array.rb +4 -4
  153. data/lib/contrast/extension/assess/assess_extension.rb +27 -29
  154. data/lib/contrast/extension/assess/eval_trigger.rb +3 -3
  155. data/lib/contrast/extension/assess/exec_trigger.rb +1 -1
  156. data/lib/contrast/extension/assess/fiber.rb +3 -3
  157. data/lib/contrast/extension/assess/hash.rb +5 -3
  158. data/lib/contrast/extension/assess/kernel.rb +7 -6
  159. data/lib/contrast/extension/assess/marshal.rb +62 -0
  160. data/lib/contrast/extension/assess/regexp.rb +3 -3
  161. data/lib/contrast/extension/assess/string.rb +5 -5
  162. data/lib/contrast/extension/inventory.rb +4 -4
  163. data/lib/contrast/extension/kernel.rb +1 -1
  164. data/lib/contrast/extension/module.rb +1 -1
  165. data/lib/contrast/extension/protect.rb +3 -3
  166. data/lib/contrast/extension/protect/kernel.rb +2 -2
  167. data/lib/contrast/extension/protect/psych.rb +2 -2
  168. data/lib/contrast/framework/manager.rb +7 -8
  169. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  170. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  171. data/lib/contrast/framework/rack/support.rb +2 -2
  172. data/lib/contrast/framework/rails/patch/assess_configuration.rb +2 -2
  173. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +1 -1
  174. data/lib/contrast/framework/rails/patch/support.rb +3 -3
  175. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +2 -2
  176. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +2 -2
  177. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +2 -2
  178. data/lib/contrast/framework/rails/support.rb +62 -14
  179. data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
  180. data/lib/contrast/framework/sinatra/patch/support.rb +1 -1
  181. data/lib/contrast/framework/sinatra/support.rb +2 -2
  182. data/lib/contrast/funchook/funchook.rb +1 -1
  183. data/lib/contrast/logger/application.rb +2 -2
  184. data/lib/contrast/logger/format.rb +22 -9
  185. data/lib/contrast/logger/log.rb +10 -8
  186. data/lib/contrast/logger/request.rb +30 -0
  187. data/lib/contrast/tasks/config.rb +1 -1
  188. data/lib/contrast/tasks/service.rb +2 -2
  189. data/lib/contrast/utils/assess/sampling_util.rb +2 -2
  190. data/lib/contrast/utils/assess/tracking_util.rb +1 -1
  191. data/lib/contrast/utils/boolean_util.rb +1 -1
  192. data/lib/contrast/utils/class_util.rb +2 -2
  193. data/lib/contrast/utils/freeze_util.rb +1 -1
  194. data/lib/contrast/utils/gemfile_reader.rb +5 -5
  195. data/lib/contrast/utils/hash_digest.rb +2 -1
  196. data/lib/contrast/utils/heap_dump_util.rb +2 -2
  197. data/lib/contrast/utils/invalid_configuration_util.rb +1 -1
  198. data/lib/contrast/utils/inventory_util.rb +4 -4
  199. data/lib/contrast/utils/io_util.rb +1 -1
  200. data/lib/contrast/utils/os.rb +1 -1
  201. data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
  202. data/lib/contrast/utils/sha256_builder.rb +2 -2
  203. data/lib/contrast/utils/stack_trace_utils.rb +2 -2
  204. data/lib/contrast/utils/string_utils.rb +1 -1
  205. data/ruby-agent.gemspec +5 -5
  206. data/service_executables/VERSION +1 -1
  207. data/service_executables/linux/contrast-service +0 -0
  208. data/service_executables/mac/contrast-service +0 -0
  209. metadata +22 -19
  210. data/lib/contrast/agent/assess/insulator.rb +0 -49
  211. data/lib/contrast/agent/require_state.rb +0 -61
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c0ae3e021f55160aef8f9a1c3beec72a68e4b6f2751284573a154251cc1f4483
4
- data.tar.gz: 3e774fcb756fede7c319c38767354fc6cb7453bdf1d6c733983b1e5729ec5e2e
3
+ metadata.gz: c3ef67bfca5c3d772078af285e4b3fa1ab314b06af04355db1aa50cce0d284e8
4
+ data.tar.gz: 5eb0fe6b5dba8f64b5947c1c7cade90718b18224b62b5e02eed470613e6fbe6d
5
5
  SHA512:
6
- metadata.gz: 4567fdb2323be1884bca5e0369fd135dfc6ffb0b87ecd5d4aac1ef808d0388c68e5c333f56134ee85230eeba587e56a0e692b8cbda0c447ef53f209cf7e67621
7
- data.tar.gz: 784af7ef08e6e830525b2947270da6d1918fc2b924cd6f8efb7c2d2661b993929a6cb2aaf9db8806ac7411155b50ba4be24348005b1893d16e27a9edfdd56441
6
+ metadata.gz: caf748a141fe652cbb1cb3e658969820b22ca4e58a11cdc46ee9bc94932c00e031b186b96e8c44b884d6f658951e8936a75444aa4d52cb9d0d5e563ab29ef26b
7
+ data.tar.gz: b3235852bb77977f244beed747b032bfa6e80eb86ebdcfab622a8dba7acc7a939f87e08022a07e795d2c455ec3d3107771e5cdae0d5b893a4c6019f09945db43
@@ -3,19 +3,13 @@
3
3
  # frozen_string_literal: true
4
4
 
5
5
  def mac?
6
- RUBY_PLATFORM.match?(/darwin/)
7
- end
8
-
9
- def windows?
10
- RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
6
+ RUBY_PLATFORM.include?('darwin')
11
7
  end
12
8
 
13
9
  def path
14
10
  base_path = "#{ File.dirname(__FILE__) }/.."
15
11
  if mac?
16
12
  "#{ base_path }/service_executables/mac/contrast-service"
17
- elsif windows?
18
- "#{ base_path }/service_executables/windows/contrast-service.exe"
19
13
  else
20
14
  "#{ base_path }/service_executables/linux/contrast-service"
21
15
  end
@@ -2,8 +2,8 @@
2
2
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
3
3
 
4
4
  #include "cs__active_record_named.h"
5
- #include <ruby.h>
6
5
  #include "../cs__common/cs__common.h"
6
+ #include <ruby.h>
7
7
 
8
8
  VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
9
9
  const VALUE self) {
@@ -19,7 +19,8 @@ VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
19
19
  */
20
20
  VALUE new_body, ret;
21
21
  VALUE new_args[3];
22
- new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self, argv[0], argv[1]);
22
+ new_body = rb_funcall(active_record_named, rb_sym_assess_rewrite, 3, self,
23
+ argv[0], argv[1]);
23
24
  new_args[0] = argv[0];
24
25
  if (NIL_P(new_body)) {
25
26
  new_args[1] = argv[1];
@@ -36,10 +37,10 @@ void Init_cs__assess_active_record_named(void) {
36
37
  framework = rb_define_module_under(contrast, "Framework");
37
38
  rails = rb_define_module_under(framework, "Rails");
38
39
  rewrite = rb_define_module_under(rails, "Rewrite");
39
- active_record_named = rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
40
+ active_record_named =
41
+ rb_define_class_under(rewrite, "ActiveRecordNamed", rb_cObject);
40
42
  rb_sym_assess_rewrite = rb_intern("rewrite");
41
- rb_sym_assess_scope = contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
42
- "scope",
43
- contrast_assess_active_record_scope);
43
+ rb_sym_assess_scope =
44
+ contrast_register_patch("ActiveRecord::Scoping::Named::ClassMethods",
45
+ "scope", contrast_assess_active_record_scope);
44
46
  }
45
-
@@ -23,15 +23,16 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
23
23
  /* Finally, default to empty String. Implicit since nil.to_s is ''*/
24
24
 
25
25
  result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
26
- result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3, ary, sep, result);
26
+ result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
27
+ ary, sep, result);
27
28
 
28
29
  return result;
29
30
  }
30
31
 
31
32
  void Init_cs__assess_array(void) {
32
- array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
33
+ array_propagator =
34
+ rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
33
35
  rb_sym_assess_track_array_join = rb_intern("cs__track_join");
34
- rb_sym_assess_array_join = contrast_register_patch("Array",
35
- "join",
36
- contrast_assess_array_join);
36
+ rb_sym_assess_array_join =
37
+ contrast_register_patch("Array", "join", contrast_assess_array_join);
37
38
  }
@@ -7,7 +7,8 @@
7
7
 
8
8
  void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
9
9
  VALUE ret) {
10
- rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self, source, ret);
10
+ rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
11
+ source, ret);
11
12
  }
12
13
 
13
14
  VALUE
@@ -36,7 +37,8 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
36
37
  }
37
38
 
38
39
  void Init_cs__assess_basic_object(void) {
39
- basic_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
40
+ basic_eval_trigger =
41
+ rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
40
42
  instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
41
43
 
42
44
  /* We don't keep a reference to the underlying method.
@@ -45,8 +47,6 @@ void Init_cs__assess_basic_object(void) {
45
47
  * but if someone else patched BasicObject#instance_eval,
46
48
  * IDK if this is intentional... noting it. -ajm
47
49
  */
48
- contrast_register_patch("BasicObject",
49
- "instance_eval",
50
+ contrast_register_patch("BasicObject", "instance_eval",
50
51
  contrast_assess_basic_object_instance_eval);
51
-
52
52
  }
@@ -73,7 +73,8 @@ int install_fiber_hooks() {
73
73
  }
74
74
 
75
75
  void Init_cs__assess_fiber_track(void) {
76
- fiber_propagator = rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
76
+ fiber_propagator =
77
+ rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
77
78
  track_rb_fiber_new = rb_intern("track_rb_fiber_new");
78
79
  track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
79
80
  rb_sym_next = rb_intern("next");
@@ -12,23 +12,24 @@
12
12
  * This method instruments that unique bracket-construction style
13
13
  * of initializing a hash.
14
14
  */
15
- static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
16
- const VALUE hash) {
15
+ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
16
+ VALUE *argv,
17
+ const VALUE hash) {
17
18
  VALUE result;
18
19
 
19
20
  /* Array of Arrays: Hash[ [ [key, value], ... ] ] -> new_hash */
20
21
  if (RB_TYPE_P(argv[0], T_ARRAY)) {
21
22
  int i;
22
23
  for (i = 0; i < argc; i++) {
23
- argv[i] =
24
- rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
24
+ argv[i] = rb_funcall(hash_propagator,
25
+ rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
25
26
  }
26
27
  /* Hash[ key, value, ... ] -> new_hash */
27
28
  } else if (argc > 1) {
28
29
  int i;
29
30
  for (i = 0; i < argc; i += 2) {
30
- argv[i] =
31
- rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
31
+ argv[i] = rb_funcall(hash_propagator,
32
+ rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
32
33
  }
33
34
  }
34
35
 
@@ -36,7 +37,8 @@ static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *arg
36
37
  * String keys
37
38
  * # Hash[ object ] -> new_hash
38
39
  */
39
- result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
40
+ result =
41
+ rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc, argv);
40
42
 
41
43
  return result;
42
44
  }
@@ -61,8 +63,9 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
61
63
  * We haven't revisited this approach since we started more extensively
62
64
  * hooking public C functions.)
63
65
  */
64
- if(argc > 0) {
65
- argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze, 1, argv[0]);
66
+ if (argc > 0) {
67
+ argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
68
+ 1, argv[0]);
66
69
  }
67
70
  /* This is the underlying assignment, w/ our instrumented key. */
68
71
  result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
@@ -71,17 +74,15 @@ static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
71
74
  }
72
75
 
73
76
  void Init_cs__assess_hash(void) {
74
- hash_propagator = rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
77
+ hash_propagator =
78
+ rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
75
79
  rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
76
80
 
77
81
  VALUE hash_class = rb_define_class("Hash", rb_cObject);
78
82
 
79
- rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch("Hash",
80
- "[]",
81
- contrast_assess_hash_bracket_constructor);
82
-
83
- rb_sym_assess_hash_bracket_equals = contrast_register_patch("Hash",
84
- "[]=",
85
- contrast_assess_hash_bracket_set);
83
+ rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
84
+ "Hash", "[]", contrast_assess_hash_bracket_constructor);
86
85
 
86
+ rb_sym_assess_hash_bracket_equals = contrast_register_patch(
87
+ "Hash", "[]=", contrast_assess_hash_bracket_set);
87
88
  }
@@ -13,7 +13,8 @@ static VALUE hash_propagator;
13
13
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
14
14
  * -HM
15
15
  */
16
- static VALUE contrast_assess_hash_bracket_constructor(const int argc, VALUE *argv,
16
+ static VALUE contrast_assess_hash_bracket_constructor(const int argc,
17
+ VALUE *argv,
17
18
  const VALUE hash);
18
19
 
19
20
  static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
@@ -18,8 +18,9 @@ contrast_patched_kernel_exec(const int argc, const VALUE *argv,
18
18
  rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
19
19
  }
20
20
 
21
- /* maybe this should be rb_funcall2. this works right now because *argv == argv[0].
22
- * exec shouldn't ever be called with != 1 argc, so not a huge problem */
21
+ /* maybe this should be rb_funcall2. this works right now because *argv ==
22
+ * argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
23
+ * problem */
23
24
  return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
24
25
  }
25
26
 
@@ -27,12 +28,10 @@ void Init_cs__assess_kernel(void) {
27
28
  kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
28
29
  exec_apply_trigger = rb_intern("apply_trigger");
29
30
 
30
- rb_sym_assess_kernel_exec = contrast_register_patch("Kernel",
31
- "exec",
32
- contrast_patched_kernel_exec);
31
+ rb_sym_assess_kernel_exec =
32
+ contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
33
33
 
34
34
  /* should return the same value as above */
35
- rb_sym_assess_kernel_exec = contrast_register_singleton_patch("Kernel",
36
- "exec",
37
- contrast_patched_kernel_exec);
35
+ rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
36
+ "Kernel", "exec", contrast_patched_kernel_exec);
38
37
  }
@@ -9,7 +9,6 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
9
9
  const VALUE *argv) {
10
10
  VALUE result;
11
11
  VALUE source_string;
12
-
13
12
  result = rb_call_super(argc, argv);
14
13
 
15
14
  if (argc >= 1) {
@@ -27,7 +26,7 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
27
26
  rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
28
27
  rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
29
28
  2, source_string, result);
30
- rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
29
+ rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
31
30
  }
32
31
  }
33
32
  }
@@ -36,9 +35,9 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
36
35
  }
37
36
 
38
37
  void Init_cs__assess_marshal_module(void) {
38
+ marshal_module = rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
39
39
  rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
40
40
 
41
- contrast_register_singleton_prepend_patch("Marshal",
42
- "load",
43
- &contrast_assess_marshal_module_load);
41
+ contrast_register_singleton_prepend_patch(
42
+ "Marshal", "load", &contrast_assess_marshal_module_load);
44
43
  }
@@ -21,7 +21,8 @@ void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
21
21
  /* If this method ever throws an exception, the scope-leave
22
22
  * needs to be moved within a rescue call.
23
23
  */
24
- rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source, ret, method);
24
+ rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
25
+ ret, method);
25
26
  }
26
27
 
27
28
  rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
@@ -57,7 +58,8 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
57
58
  }
58
59
 
59
60
  void Init_cs__assess_module(void) {
60
- module_eval_trigger = rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
61
+ module_eval_trigger =
62
+ rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
61
63
  trigger_check_method = rb_intern("eval_trigger_check");
62
64
 
63
65
  rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
@@ -69,11 +71,9 @@ void Init_cs__assess_module(void) {
69
71
  * See similar comments in basic_object C ext patch.
70
72
  */
71
73
 
72
- contrast_register_patch("Module",
73
- "class_eval",
74
+ contrast_register_patch("Module", "class_eval",
74
75
  contrast_assess_module_class_eval);
75
76
 
76
- contrast_register_patch("Module",
77
- "module_eval",
77
+ contrast_register_patch("Module", "module_eval",
78
78
  contrast_assess_module_module_eval);
79
79
  }
@@ -29,7 +29,8 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
29
29
  }
30
30
 
31
31
  void Init_cs__assess_regexp(void) {
32
- regexp_propagator = rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
32
+ regexp_propagator =
33
+ rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
33
34
  rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
34
35
 
35
36
  /* These are the keys we use to define our hash of
@@ -46,7 +47,6 @@ void Init_cs__assess_regexp(void) {
46
47
  rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
47
48
  rb_global_variable(&rb_sym_back_ref);
48
49
 
49
- rb_sym_assess_regexp_equal_squiggle = contrast_register_patch("Regexp",
50
- "=~",
51
- contrast_assess_regexp_equal_squiggle);
50
+ rb_sym_assess_regexp_equal_squiggle = contrast_register_patch(
51
+ "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
52
52
  }
@@ -6,7 +6,7 @@
6
6
  #include <ruby.h>
7
7
 
8
8
  static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
9
- const VALUE obj) {
9
+ const VALUE obj) {
10
10
  VALUE dup, tracked;
11
11
  if (!OBJ_FROZEN(obj)) {
12
12
  tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
@@ -17,6 +17,7 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
17
17
  * string.c, but we ignore any other monkey patches on String#-@
18
18
  */
19
19
  dup = rb_funcall(obj, rb_sym_dup, 0);
20
+ rb_funcall(obj, rb_intern("cs__transfer_properties"), 1, dup);
20
21
  rb_funcall(dup, rb_sym_freeze, 0);
21
22
  return dup;
22
23
  }
@@ -25,11 +26,26 @@ static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
25
26
  return rb_funcall(obj, rb_sym_assess_string_uminus, 0);
26
27
  }
27
28
 
29
+ static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
30
+ const VALUE obj) {
31
+ if (!OBJ_FROZEN(obj)) {
32
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH.pre_freeze(self)
33
+ rb_funcall(properties_hash, rb_intern("pre_freeze"), 1, obj);
34
+ }
35
+ return rb_funcall(obj, rb_sym_assess_string_freeze, 0);
36
+ }
37
+
28
38
  void Init_cs__assess_string(void) {
29
39
  rb_sym_dup = rb_intern("dup");
30
40
  rb_sym_freeze = rb_intern("freeze");
31
41
 
32
- rb_sym_assess_string_uminus = contrast_register_patch("String",
33
- "-@",
34
- &contrast_assess_string_uminus);
42
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
43
+ VALUE finalizers = rb_define_module_under(assess, "Finalizers");
44
+ VALUE finalize = rb_define_module_under(finalizers, "Finalize");
45
+ properties_hash = rb_const_get(finalize, rb_intern("PROPERTIES_HASH"));
46
+
47
+ rb_sym_assess_string_uminus =
48
+ contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
49
+ rb_sym_assess_string_freeze = contrast_register_patch(
50
+ "String", "freeze", &contrast_assess_string_freeze);
35
51
  }
@@ -1,6 +1,9 @@
1
1
  #include <ruby.h>
2
2
 
3
3
  static VALUE rb_sym_assess_string_uminus;
4
+ static VALUE rb_sym_assess_string_freeze;
5
+ // Contrast::Agent::Assess::Finalizers::Finalize::PROPERTIES_HASH
6
+ static VALUE properties_hash;
4
7
  static VALUE rb_sym_dup;
5
8
  static VALUE rb_sym_freeze;
6
9
 
@@ -15,6 +18,6 @@ static VALUE rb_sym_freeze;
15
18
  * -HM
16
19
  */
17
20
  static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
18
- const VALUE obj);
21
+ const VALUE obj);
19
22
 
20
23
  void Init_cs__assess_string(void);
@@ -14,13 +14,15 @@ static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
14
14
 
15
15
  static int install_hooks() {
16
16
  rb_str_concat_literals_original = rb_str_concat_literals;
17
- patch_via_funchook(&rb_str_concat_literals_original, &rb_str_concat_literals_hook);
17
+ patch_via_funchook(&rb_str_concat_literals_original,
18
+ &rb_str_concat_literals_hook);
18
19
 
19
20
  return 0;
20
21
  }
21
22
 
22
23
  void Init_cs__assess_string_interpolation26(void) {
23
- string_propagator = rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
24
+ string_propagator =
25
+ rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
24
26
  track_interpolation = rb_intern("track_interpolation");
25
27
  install_hooks();
26
28
  }
@@ -8,7 +8,7 @@
8
8
  static VALUE rb_yield_hook(VALUE val, const VALUE self) {
9
9
  VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
10
10
 
11
- if(method == split_method && RB_TYPE_P(val, T_STRING)) {
11
+ if (method == split_method && RB_TYPE_P(val, T_STRING)) {
12
12
  rb_funcall(split_class, propagate_yield, 1, val);
13
13
  }
14
14
  VALUE result = rb_yield_original(val);
@@ -25,6 +25,6 @@ void Init_cs__assess_yield_track(void) {
25
25
  VALUE base = rb_define_class_under(assess_propagator, "Base", rb_cObject);
26
26
  split_class = rb_define_class_under(assess_propagator, "Split", base);
27
27
  propagate_yield = rb_intern("propagate_yield");
28
- split_method = ID2SYM(rb_intern("split"));
28
+ split_method = ID2SYM(rb_intern("split"));
29
29
  install_yield_hooks();
30
30
  }
@@ -2,8 +2,8 @@
2
2
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
3
3
 
4
4
  #include "cs__common.h"
5
- #include <ruby.h>
6
5
  #include <dlfcn.h>
6
+ #include <ruby.h>
7
7
 
8
8
  /* Globals */
9
9
  /* These are defined w/ `extern` in the header */
@@ -27,19 +27,24 @@ void patch_via_funchook(void *original_function, void *hook_function) {
27
27
 
28
28
  void *funchook_lib_handle;
29
29
  void *funchook_reference, *(*funchook_create)(void);
30
- int prepareResult, (*funchook_prepare)(void*, void**, void*);
31
- int installResult, (*funchook_install)(void*, int);
30
+ int prepareResult, (*funchook_prepare)(void *, void **, void *);
31
+ int installResult, (*funchook_install)(void *, int);
32
32
 
33
- funchook_lib_handle = dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
33
+ funchook_lib_handle =
34
+ dlopen(StringValueCStr(funchook_path), RTLD_NOW | RTLD_GLOBAL);
34
35
 
35
36
  /* Load the funchook methods we need */
36
- funchook_create = (void* (*)(void))dlsym(funchook_lib_handle, "funchook_create");
37
- funchook_prepare = (int (*)(void*, void**, void*))dlsym(funchook_lib_handle, "funchook_prepare");
38
- funchook_install = (int (*)(void*, int))dlsym(funchook_lib_handle, "funchook_install");
37
+ funchook_create =
38
+ (void *(*)(void))dlsym(funchook_lib_handle, "funchook_create");
39
+ funchook_prepare = (int (*)(void *, void **, void *))dlsym(
40
+ funchook_lib_handle, "funchook_prepare");
41
+ funchook_install =
42
+ (int (*)(void *, int))dlsym(funchook_lib_handle, "funchook_install");
39
43
 
40
- funchook_reference = (void*)(*funchook_create)();
44
+ funchook_reference = (void *)(*funchook_create)();
41
45
 
42
- prepareResult = (*funchook_prepare)(funchook_reference, (void**)original_function, hook_function);
46
+ prepareResult = (*funchook_prepare)(
47
+ funchook_reference, (void **)original_function, hook_function);
43
48
  installResult = (*funchook_install)(funchook_reference, 0);
44
49
  }
45
50
 
@@ -53,33 +58,32 @@ VALUE contrast_patcher() {
53
58
  return patcher;
54
59
  }
55
60
 
56
- VALUE contrast_register_patch(const char *module_name,
57
- const char *method_name,
58
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
59
- ) {
60
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_INSTANCE);
61
+ VALUE contrast_register_patch(const char *module_name, const char *method_name,
62
+ VALUE(c_fn)(const int, const VALUE *,
63
+ const VALUE)) {
64
+ return _contrast_register_patch(module_name, method_name, c_fn,
65
+ IMPL_ALIAS_INSTANCE);
61
66
  }
62
67
 
63
-
64
68
  VALUE contrast_register_singleton_patch(const char *module_name,
65
69
  const char *method_name,
66
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
67
- ) {
68
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_ALIAS_SINGLETON);
70
+ VALUE(c_fn)(const int, const VALUE *,
71
+ const VALUE)) {
72
+ return _contrast_register_patch(module_name, method_name, c_fn,
73
+ IMPL_ALIAS_SINGLETON);
69
74
  }
70
75
 
71
- VALUE contrast_register_singleton_prepend_patch(const char *module_name,
72
- const char *method_name,
73
- VALUE(c_fn)(const int, const VALUE*, const VALUE)
74
- ) {
75
- return _contrast_register_patch(module_name, method_name, c_fn, IMPL_PREPEND);
76
+ VALUE contrast_register_singleton_prepend_patch(
77
+ const char *module_name, const char *method_name,
78
+ VALUE(c_fn)(const int, const VALUE *, const VALUE)) {
79
+ return _contrast_register_patch(module_name, method_name, c_fn,
80
+ IMPL_PREPEND);
76
81
  }
77
82
 
78
- static VALUE _contrast_register_patch(const char *module_name,
79
- const char *method_name,
80
- VALUE(c_fn)(const int, const VALUE*, const VALUE),
81
- patch_impl patch
82
- ) {
83
+ static VALUE
84
+ _contrast_register_patch(const char *module_name, const char *method_name,
85
+ VALUE(c_fn)(const int, const VALUE *, const VALUE),
86
+ patch_impl patch) {
83
87
  VALUE contrast_bind_module = rb_funcall(rb_cModule, rb_intern("new"), 0);
84
88
  VALUE unbound_method = Qnil;
85
89
  VALUE rb_str_module_name = rb_str_new_cstr(module_name);
@@ -105,24 +109,27 @@ static VALUE _contrast_register_patch(const char *module_name,
105
109
  */
106
110
  rb_define_method(contrast_bind_module, method_name, (VALUE(*)())c_fn, -1);
107
111
  VALUE rb_sym_instance_method = rb_intern("instance_method");
108
- unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1, rb_str_method_name);
112
+ unbound_method = rb_funcall(contrast_bind_module, rb_sym_instance_method, 1,
113
+ rb_str_method_name);
109
114
  rb_undef_method(contrast_bind_module, method_name);
110
115
 
111
116
  /* map impl enum -> ruby symbol */
112
117
  VALUE impl = Qnil;
113
- switch(patch) {
114
- case IMPL_ALIAS_INSTANCE:
118
+ switch (patch) {
119
+ case IMPL_ALIAS_INSTANCE:
115
120
  impl = ID2SYM(rb_sym_alias_instance);
116
121
  break;
117
- case IMPL_ALIAS_SINGLETON:
122
+ case IMPL_ALIAS_SINGLETON:
118
123
  impl = ID2SYM(rb_sym_alias_singleton);
119
124
  break;
120
- case IMPL_PREPEND:
125
+ case IMPL_PREPEND:
121
126
  impl = ID2SYM(rb_sym_prepend);
122
127
  break;
123
128
  }
124
129
 
125
- VALUE underlying_method_name = rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3, rb_str_module_name, unbound_method, impl);
130
+ VALUE underlying_method_name =
131
+ rb_funcall(contrast_patcher(), rb_sym_register_c_patch, 3,
132
+ rb_str_module_name, unbound_method, impl);
126
133
  return SYM2ID(underlying_method_name);
127
134
  }
128
135
 
@@ -141,9 +148,9 @@ void Init_cs__common(void) {
141
148
 
142
149
  /* Used for returning unbound C functions */
143
150
  rb_sym_register_c_patch = rb_intern("register_c_patch");
144
- rb_sym_alias_instance = rb_intern("alias_instance");
145
- rb_sym_alias_singleton = rb_intern("alias_singleton");
146
- rb_sym_prepend = rb_intern("prepend");
151
+ rb_sym_alias_instance = rb_intern("alias_instance");
152
+ rb_sym_alias_singleton = rb_intern("alias_singleton");
153
+ rb_sym_prepend = rb_intern("prepend");
147
154
 
148
155
  /* Ensure definition of core Contrast instrumentation modules */
149
156
  contrast = rb_define_module("Contrast");