scnr-introspector 0.2 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '06581df63125568c3bcd2c6f996bc81e20426d750397806e47ccf7d31a6a6ff2'
-  data.tar.gz: 814cd55b04084b83615ffcd3433b336ee5ffd3e5b65539b0bcdd7d75d9e16c8b
+  metadata.gz: a055f5743ec95419ddfdc219f5ccac33cd598915e9ae31cc01630af3f7862492
+  data.tar.gz: 70bf4d9e143be5226a668582f4771ca39e53de67d5492ce1caebc8988c180bc6
 SHA512:
-  metadata.gz: bc324b142de05b4152a54d1e501e018fbc84ec3264edadc4b4640ad02253667755b28f2ed2c68929c11f305ba57c5584f9efda5784c74859d8154ca700ad0ef2
-  data.tar.gz: 8c6d81443c7b86f417a86fb671719863fc2c9e463644b5b9811d902e26e7e680d72bef7cfe9793d89814d5cae8700b6cca6edd1a44ed88d49815c0a9e01a6490
+  metadata.gz: 84cf6bc2e52be2da63cb471a905c633f8e4722439ca7eb4c79ce83dc350a070fe490ad4165eab940af30f7c71e5a35d27adb0824c06ed5d783e695b51b2bb342
+  data.tar.gz: 323c5dd53eb5b8488c15e07db278f82fb306acb298824f646da4929b99728b99a3e8310365a1f51159d4ab94ab3cad01cc18041f28cbd2a829958b4c067b3a19

data/lib/scnr/introspector/execution_flow/point.rb

@@ -29,6 +29,7 @@ class Point
     attr_accessor :event
 
     attr_accessor :source
+    attr_accessor :file_contents
 
     # @param    [Hash]  options
     def initialize( options = {} )
@@ -81,7 +82,8 @@ class Point
                 class_name:  defined_class,
                 method_name: tp.method_id,
                 event:       tp.event,
-                source:      source_line( tp.path, tp.lineno )
+                source:      source_line( tp.path, tp.lineno ),
+                file_contents: IO.read( tp.path )
             })
         end
 

data/lib/scnr/introspector/version

@@ -1 +1 @@
-0.2
+0.3.1

data/lib/scnr/introspector.rb

@@ -1,6 +1,7 @@
 require 'rbconfig'
 require 'securerandom'
 require 'rack/utils'
+require 'base64'
 require 'pp'
 
 module SCNR
@@ -30,6 +31,13 @@ class Introspector
             method_source_location = object.allocate.method(m).source_location
             rnd = SecureRandom.hex(10)
 
+            msg = "[INTROSPECTOR] Injecting trace code for #{object}##{m}"
+            if method_source_location
+                msg << " in #{method_source_location.join(':')}"
+            end
+
+            puts msg
+
             ov = <<EORUBY
         module Overloads
         module #{object.to_s.split( '::' ).join}#{rnd}Overload
@@ -45,20 +53,20 @@ EORUBY
             eval ov
         rescue => e
             # puts ov
-            # pp e
+            # pp   e
             # pp e.backtrace
         end
 
         def taint_seed=( t )
-            @taint = t
+            Thread.current[:taint] = t
         end
 
         def taint_seed
-            @taint
+            Thread.current[:taint]
         end
 
         def data_flows
-            @data_flows ||= {}
+            Thread.current[:data_flows] ||= {}
         end
 
         def synchronize( &block )
@@ -71,6 +79,12 @@ EORUBY
             end
         end
 
+        def flush_sinks( taint )
+            synchronize do
+                self.data_flows.delete taint
+            end
+        end
+
         def filter_caller( a )
             dir = File.dirname( __FILE__ )
             a.reject do |c|
@@ -79,7 +93,7 @@ EORUBY
         end
 
         def find_and_log_taint( object, method, method_source_location, args )
-            taint = @taint
+            taint = self.taint_seed
             return if !taint
 
             tainted = find_taint_in_arguments( taint, args )
@@ -161,6 +175,8 @@ EORUBY
         @app     = app
         @options = options
 
+        puts "[INTROSPECTOR] Codename SCNR Introspector Initialized."
+
         overload_application
         overload_rails if rails?
 
@@ -204,10 +220,13 @@ EORUBY
         info << :platforms
 
         if env.delete( 'HTTP_X_SCNR_INTROSPECTOR_TRACE' )
-            info << :data_flow
             info << :execution_flow
         end
 
+        if env['HTTP_X_SCNR_INTROSPECTOR_TAINT']
+            info << :data_flow
+        end
+
         inject( env, info )
 
     rescue => e
@@ -217,7 +236,12 @@ EORUBY
 
     def inject( env, info = [] )
         self.class.taint_seed = env.delete( 'HTTP_X_SCNR_INTROSPECTOR_TAINT' )
-        seed                  = env.delete( 'HTTP_X_SCNR_ENGINE_SCAN_SEED' )
+        if self.class.taint_seed
+            self.class.taint_seed = Base64.decode64( self.class.taint_seed )
+            self.class.taint_seed = nil if self.class.taint_seed.empty?
+        end
+
+        seed = env.delete( 'HTTP_X_SCNR_ENGINE_SCAN_SEED' )
 
         data = {}
 
@@ -245,20 +269,25 @@ EORUBY
         end
 
         if info.include?( :data_flow ) && self.class.taint_seed
-            data['data_flow'] = self.class.data_flows.delete( self.class.taint_seed )&.to_rpc_data
+            data['data_flow'] = self.class.flush_sinks( self.class.taint_seed )&.to_rpc_data
         end
 
         code    = response.shift
         headers = response.shift
         body    = response.shift
-        body    = body.respond_to?( :body ) ? body.body : body
 
-        body = [body].flatten
-        body << "<!-- #{seed}\n#{JSON.dump( data )}\n#{seed} -->"
+        if headers['Content-Type'] && headers['Content-Type'].include?( 'html' )
+            body = body.respond_to?( :body ) ? body.body : body
+            body = [body].flatten
+            body << "<!-- #{seed}\n#{JSON.dump( data )}\n#{seed} -->"
 
-        headers['Content-Length'] = body.map(&:bytesize).inject(:+)
+            headers['Content-Length'] = body.map(&:bytesize).inject(:+)
+        end
 
         [code, headers, [body].flatten ]
+    rescue => e
+        pp e
+        pp e.backtrace
     end
 
     def platforms

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scnr-introspector
 version: !ruby/object:Gem::Version
-  version: '0.2'
+  version: 0.3.1
 platform: ruby
 authors:
 - Tasos Laskos
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-28 00:00:00.000000000 Z
+date: 2025-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler