contrast-agent 3.8.4

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: da212693eda842e7117b2c758361ea67915854a4888b3ea0315c51f33951fea3
+  data.tar.gz: d43b26947e6eb4219f97bf90542a3948077578617f925fa90a94d4151674e88e
+SHA512:
+  metadata.gz: 017607d5a9cc4be26f5b970ae072851fb50a3487c9da3d625ed72d346bbbff29daec0dfd5cf2a9b5dcb1445512d9d951a77360980c9ec9f2c37f9759ff706598
+  data.tar.gz: 2a17b8dd9099c3558c5d8d1a2ba085eaec28149ef0def59d04e129e0cd2f863e2e2a6e27ae9defa873163df7b539d6600a620d7674553a71a3899e3e1d426b60

data/.clang-format

@@ -0,0 +1,5 @@
+BasedOnStyle: LLVM
+IndentWidth: 4
+AllowShortFunctionsOnASingleLine: None
+NamespaceIndentation: All
+IncludeBlocks: Preserve

data/.dockerignore

@@ -0,0 +1,10 @@
+dist/
+tmp/
+docker/
+code-deploy/
+
+Jenkinsfile
+bitbucket-pipelines.yml
+docker-compose.yml
+.rubocop.yml
+.travis.yml

data/.gitignore

@@ -0,0 +1,58 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/Gemfile.lock
+/coverage/
+/data/*
+/doc/
+/log/
+/pkg/
+/spec/reports/
+/tmp/
+/shared_libraries/*
+/vendor/
+
+# Built files
+/lib/**/*.so
+/lib/**/*.bundle
+/ext/**/*.so
+/ext/**/*.bundle
+
+# Funchook artifacts
+/ext/**/funchook.h
+/ext/**/libfunchook.dylib
+/ext/*/funchook.h
+/ext/*/libfunchook.dylib
+
+# logs
+security.log
+contrast*.log
+contrast*.yaml
+
+# rspec failure tracking
+.rspec_status
+results.xml
+
+# Mac
+.DS_Store
+/test-output/
+/.factorypath
+/target/
+
+# Intellij
+.idea/
+*.iml
+*.iws
+*.ipr
+
+contrast-agent-*.gem
+
+.ruby-version
+.ruby-gemset
+service_executables/*-*
+
+# Generated Protobuf files
+/lib/contrast/api/*_pb.rb
+
+# IDE stuff
+tags

data/.gitmodules

@@ -0,0 +1,6 @@
+[submodule "agent-service-api"]
+	path = agent-service-api
+	url = git@bitbucket.org:contrastsecurity/agent-service-api
+[submodule "funchook"]
+	path = funchook
+	url = https://github.com/kubo/funchook.git

data/.rspec

@@ -0,0 +1,6 @@
+--require spec_helper
+--order rand
+--format documentation
+--format RspecJunitFormatter
+--out ./test-results/results.xml
+--color

data/.simplecov

@@ -0,0 +1,4 @@
+SimpleCov.minimum_coverage 92.30
+SimpleCov.start do
+  add_filter '/spec/'
+end

data/Gemfile

@@ -0,0 +1,7 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in ruby-agent.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,12 @@
+Copyright: 2020 Contrast Security, Inc
+Contact: support@contrastsecurity.com
+License: Commercial
+
+NOTICE: This Software and the patented inventions embodied within may only be
+used as part of Contrast Security’s commercial offerings. Even though it is
+made available through public repositories, use of this Software is subject to
+the applicable End User Licensing Agreement found at
+https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+between Contrast Security and the End User. The Software may not be reverse
+engineered, modified, repackaged, sold, redistributed or otherwise used in a
+way not consistent with the End User License Agreement.

data/Rakefile

@@ -0,0 +1,15 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+require 'rake/extensiontask'
+
+CLOBBER << 'shared_libraries/*'
+
+Dir['ext/cs__*'].each do |extension|
+  name = extension.split('/')[1]
+  Rake::ExtensionTask.new name do |ext|
+    ext.lib_dir = "lib/#{ name }"
+  end
+end

data/exe/contrast_service

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+def mac?
+  RUBY_PLATFORM.match?(/darwin/)
+end
+
+def windows?
+  RUBY_PLATFORM.match?(/cygwin|mswin|mingw|bccwin|wince|emx/)
+end
+
+def path
+  base_path = "#{ File.dirname(__FILE__) }/.."
+  if mac?
+    "#{ base_path }/service_executables/mac/contrast-service"
+  elsif windows?
+    "#{ base_path }/service_executables/windows/contrast-service.exe"
+  else
+    "#{ base_path }/service_executables/linux/contrast-service"
+  end
+end
+
+executable_path = path
+if File.exist?(executable_path)
+  Kernel.exec(executable_path)
+else
+  puts "Service executable not found at: #{ executable_path }"
+end

data/ext/build_funchook.rb

@@ -0,0 +1,48 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'fileutils'
+
+unless find_header('funchook.h', ext_path)
+
+  FUNCHOOK_DIR_NAME = 'funchook'
+  FUNCHOOK_DIR = File.expand_path(File.join(File.dirname(File.expand_path(__FILE__)), '..', FUNCHOOK_DIR_NAME))
+
+  COMMANDS = ['./autogen.sh', './configure', 'make clean', 'make'].freeze
+
+  puts 'Building funchook'
+  COMMANDS.each do |command|
+    puts "executing: #{ command } in #{ FUNCHOOK_DIR }"
+    Dir.chdir(FUNCHOOK_DIR) do
+      `#{ command }`
+    end
+  end
+
+  SOURCE_PATHS = [
+    File.join('include', 'funchook.h'),
+    File.join('src',     'libfunchook.dylib'),
+    File.join('src',     'libfunchook.so')
+  ].freeze
+
+  TARGET_PATHS = [
+    File.expand_path(File.join(File.expand_path(__dir__), '..', 'shared_libraries')),
+    File.expand_path(__dir__) # should be ext/
+  ].freeze
+
+  puts 'Copying required files'
+
+  SOURCE_PATHS.each do |source_file|
+    source_file_path = File.join(FUNCHOOK_DIR, source_file)
+    unless File.exist?(source_file_path)
+      puts "Skipping #{ source_file_path }, file doesn't exist"
+      next
+    end
+
+    TARGET_PATHS.each do |target_path|
+      puts "Copying #{ source_file_path } into #{ target_path }"
+      FileUtils.cp(source_file_path, target_path)
+    end
+  end
+end
+
+have_header('funchook.h', ext_path)

data/ext/cs__assess_active_record_named/cs__active_record_named.c

@@ -0,0 +1,47 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__active_record_named.h"
+#include <ruby.h>
+
+VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
+                                          const VALUE self) {
+    /*
+     * The ActiveRecord::Scoping::Named::ClassMethods#scope method allows for
+     * the creation of methods at runtime. In order to trigger on interpolation
+     * within that new method, we must rewrite the method body BEFORE it can be
+     * used in the original #scope method, replacing interpolations with our
+     * String append logic. As this deviates from standard Assess behavior
+     * (changes the application behavior and acts on an input BEFORE it can be
+     * passed to the original method), I think it deserves to be in a custom
+     * call. -HM
+     */
+    VALUE new_body, ret;
+    VALUE new_args[3];
+    new_body = rb_funcall(self, rb_sym_assess_rewrite, 2, argv[0], argv[1]);
+    new_args[0] = argv[0];
+    if (NIL_P(new_body)) {
+        new_args[1] = argv[1];
+    } else {
+        new_args[1] = new_body;
+    }
+    new_args[2] = argv[2];
+    ret = rb_funcall2(self, rb_sym_assess_scope, argc, new_args);
+    return ret;
+}
+
+void Init_cs__assess_active_record_named(void) {
+    rb_sym_assess_rewrite = rb_intern("_cs__rewrite");
+    rb_sym_assess_scope = rb_intern("cs__patched_scope");
+
+    VALUE active_record_module = rb_define_module("ActiveRecord");
+    VALUE scoping_module =
+        rb_define_module_under(active_record_module, "Scoping");
+    VALUE named_module = rb_define_module_under(scoping_module, "Named");
+    VALUE class_methods_module =
+        rb_define_module_under(named_module, "ClassMethods");
+
+    contrast_alias_method(class_methods_module, "cs__patched_scope", "scope");
+    rb_define_method(class_methods_module, "scope",
+                     contrast_assess_active_record_scope, -1);
+}

data/ext/cs__assess_active_record_named/cs__active_record_named.h

@@ -0,0 +1,10 @@
+#include <ruby.h>
+
+static VALUE rb_sym_assess_rewrite;
+static VALUE rb_sym_assess_scope;
+
+void contrast_alias_method(const VALUE target, const char *to,
+                           const char *from);
+
+VALUE contrast_assess_active_record_scope(const int argc, const VALUE *argv,
+                                          const VALUE self);

data/ext/cs__assess_active_record_named/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_array/cs__assess_array.c

@@ -0,0 +1,38 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_array.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+/*
+ * If String#split is called without an argument, it defaults to use `$;`.
+ * We have to make this patch in C so as not to change that value.
+ * -HM
+ */
+static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
+                                        const VALUE ary) {
+    VALUE sep, result;
+    /* We need to figure out the separator the join method actually used. */
+    /* First, check if one was provided. */
+    rb_scan_args(argc, argv, "01", &sep);
+    /* Second, check to see if `$;` is set*/
+    if (NIL_P(sep)) {
+        sep = rb_output_fs;
+    }
+    /* Finally, default to empty String. Implicit since nil.to_s is ''*/
+
+    result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
+    result = rb_funcall(ary, rb_sym_assess_track_array_join, 2, sep, result);
+
+    return result;
+}
+
+void Init_cs__assess_array(void) {
+    rb_sym_assess_array_join = rb_intern("cs__patched_join");
+    rb_sym_assess_track_array_join = rb_intern("__cs_track_join");
+
+    VALUE array_class = rb_define_class("Array", rb_cObject);
+    contrast_alias_method(array_class, "cs__patched_join", "join");
+    rb_define_method(array_class, "join", contrast_assess_array_join, -1);
+}

data/ext/cs__assess_array/cs__assess_array.h

@@ -0,0 +1,9 @@
+#include <ruby.h>
+
+static VALUE rb_sym_assess_array_join;
+static VALUE rb_sym_assess_track_array_join;
+
+static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
+                                        const VALUE ary);
+
+void Init_cs__assess_array(void);

data/ext/cs__assess_array/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -0,0 +1,50 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_basic_object.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+void contrast_assess_instance_eval_trigger_check(VALUE module, VALUE source,
+                                                 VALUE ret) {
+    VALUE has_trigger_check =
+        rb_respond_to(rb_cBasicObject, instance_trigger_check_method);
+    if (has_trigger_check) {
+        rb_funcall(rb_cBasicObject, instance_trigger_check_method, 2, source,
+                   ret);
+    }
+}
+
+VALUE
+contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
+                                           const VALUE self) {
+
+    if (RTEST(rb_funcall(contrast_patcher(), rb_sym_skip_assess_analysis, 0))) {
+        return rb_obj_instance_eval(argc, argv, self);
+    }
+
+    int nested_scope =
+        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+
+    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+
+    VALUE ret = rb_obj_instance_eval(argc, argv, self);
+
+    if (!nested_scope && argc > 0) {
+        VALUE data = argv[0];
+        contrast_assess_instance_eval_trigger_check(self, data, ret);
+    }
+
+    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+
+    return ret;
+}
+
+void Init_cs__assess_basic_object(void) {
+    instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
+
+    contrast_alias_method(rb_cBasicObject, "cs__patched_instance_eval",
+                          "instance_eval");
+    rb_define_method(rb_cBasicObject, "instance_eval",
+                     contrast_assess_basic_object_instance_eval, -1);
+}

data/ext/cs__assess_basic_object/cs__assess_basic_object.h

@@ -0,0 +1,17 @@
+#include <ruby.h>
+
+/* Contrast::Agent::Patching::Policy::Patcher */
+static VALUE instance_trigger_check_method;
+
+void contrast_alias_method(const VALUE target, const char *to,
+                           const char *from);
+
+/* c.f. cs__assess_module.c for more context on how eval is patched. */
+void contrast_assess_instance_eval_trigger_check(VALUE module, VALUE source,
+                                                 VALUE ret);
+
+VALUE
+contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
+                                           const VALUE self);
+
+void Init_cs__assess_basic_object(void);

data/ext/cs__assess_basic_object/extconf.rb

@@ -0,0 +1,2 @@
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -0,0 +1,86 @@
+/* Copyright (c) 2020 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_fiber_track.h"
+#include <funchook.h>
+#include <ruby.h>
+
+VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
+    /* This is a truncated copy of the enumerator struct definition
+     * from ruby's enumerator.c.
+     * The values should generally align, though there is a nonzero chance
+     * that the compiler will optimize struct padding in such a way that
+     * we're not reading what we think we're reading, and likely segfault.
+     * TODO to be rigorous about compiler flags, but it's not an urgent matter
+     * as most compiler defaults should serve us OK.
+     */
+
+    VALUE fiber = rb_fiber_new_original(func, obj);
+
+    /* This is the most proximate Ruby method that's asking for this fiber.
+     * In our case, we're looking for #next.
+     * Other invocations are not particularly interesting to us.
+     */
+    VALUE calling_method = rb_funcall(rb_cObject, rb_intern("__method__"), 0);
+
+    if (RTEST(rb_obj_is_kind_of(obj, rb_cEnumerator)) &&
+        SYM2ID(calling_method) == rb_sym_next) {
+        struct enumerator {
+            VALUE obj;
+            ID meth;
+        };
+
+        /* underlying object is first entry in Enumerator struct def.
+         *  that's all statically defined w/in enumerator.c, so we can't
+         *  reference the data types and be safe about it.  (yippee.)
+         *  we cut out the TypedData_Get_Struct middleman & just go for it.
+         */
+        struct enumerator *enum_ptr = ((struct enumerator *)DATA_PTR(obj));
+
+        /* This is the object the enumerator is operating upon. */
+        VALUE underlying = enum_ptr->obj;
+        /* This is the method the enumerator uses to operate upon that object.
+         */
+        VALUE enumerator_method = ID2SYM(enum_ptr->meth);
+        /* e.g.: 1..100, #each_value.  Should reflect #inspect on the enum. */
+
+        rb_funcall(fiber_class, track_rb_fiber_new, 5, fiber, obj,
+                   enumerator_method, underlying, calling_method);
+    }
+
+    return fiber;
+}
+
+VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
+    VALUE calling_method = rb_funcall(rb_cObject, rb_intern("__method__"), 0);
+    VALUE yielding_fiber = rb_fiber_current();
+
+    /* propagate from yielding_fiber -> result */
+    rb_funcall(fiber_class, track_rb_fiber_yield, 3, yielding_fiber,
+               calling_method, *argv);
+
+    return rb_fiber_yield_original(argc, argv);
+}
+
+int install_fiber_hooks() {
+    funchook_t *funchook = funchook_create();
+
+    rb_fiber_new_original = rb_fiber_new;
+    funchook_prepare(funchook, (void **)&rb_fiber_new_original,
+                     rb_fiber_new_hook);
+
+    rb_fiber_yield_original = rb_fiber_yield;
+    funchook_prepare(funchook, (void **)&rb_fiber_yield_original,
+                     rb_fiber_yield_hook);
+
+    funchook_install(funchook, 0);
+    return 0;
+}
+
+void Init_cs__assess_fiber_track(void) {
+    fiber_class = rb_define_class("Fiber", rb_cObject);
+    track_rb_fiber_new = rb_intern("track_rb_fiber_new");
+    track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
+    rb_sym_next = rb_intern("next");
+    install_fiber_hooks();
+}