scnr-introspector 0.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '06581df63125568c3bcd2c6f996bc81e20426d750397806e47ccf7d31a6a6ff2'
-  data.tar.gz: 814cd55b04084b83615ffcd3433b336ee5ffd3e5b65539b0bcdd7d75d9e16c8b
+  metadata.gz: 8725bd56ebb19d4dc43d75c4c19a2fde62996e6b0df84ac074f7baf5049f95db
+  data.tar.gz: b5b35b5cd86bbb75554b2ba8b144f87606b17990c90351df37417f3ec79cd3f2
 SHA512:
-  metadata.gz: bc324b142de05b4152a54d1e501e018fbc84ec3264edadc4b4640ad02253667755b28f2ed2c68929c11f305ba57c5584f9efda5784c74859d8154ca700ad0ef2
-  data.tar.gz: 8c6d81443c7b86f417a86fb671719863fc2c9e463644b5b9811d902e26e7e680d72bef7cfe9793d89814d5cae8700b6cca6edd1a44ed88d49815c0a9e01a6490
+  metadata.gz: 2ce2e0fa5215945851e1249a00f258a9ad542e090fe5f64402d2f804e1944f472c46438468a86b3fbf6cbb7d2e4aa2a092b89f5a7d50a90b92007b9a1bd1ca88
+  data.tar.gz: 5f281728c6423aa8222eb3b362dbac6a5715c60361a8d52666ea37a9b075542bac4fa4342e3b26e2aff80bb57bedaa7da44c8eb57ffc8e56cfb26467c3018b6d

data/lib/scnr/introspector/execution_flow/point.rb

@@ -29,6 +29,7 @@ class Point
     attr_accessor :event
 
     attr_accessor :source
+    attr_accessor :file_contents
 
     # @param    [Hash]  options
     def initialize( options = {} )
@@ -81,7 +82,8 @@ class Point
                 class_name:  defined_class,
                 method_name: tp.method_id,
                 event:       tp.event,
-                source:      source_line( tp.path, tp.lineno )
+                source:      source_line( tp.path, tp.lineno ),
+                file_contents: IO.read( tp.path )
             })
         end
 

data/lib/scnr/introspector/version

@@ -1 +1 @@
-0.2
+0.3.0

data/lib/scnr/introspector.rb

@@ -1,6 +1,7 @@
 require 'rbconfig'
 require 'securerandom'
 require 'rack/utils'
+require 'base64'
 require 'pp'
 
 module SCNR
@@ -50,15 +51,15 @@ EORUBY
         end
 
         def taint_seed=( t )
-            @taint = t
+            Thread.current[:taint] = t
         end
 
         def taint_seed
-            @taint
+            Thread.current[:taint]
         end
 
         def data_flows
-            @data_flows ||= {}
+            Thread.current[:data_flows] ||= {}
         end
 
         def synchronize( &block )
@@ -71,6 +72,12 @@ EORUBY
             end
         end
 
+        def flush_sinks( taint )
+            synchronize do
+                self.data_flows.delete taint
+            end
+        end
+
         def filter_caller( a )
             dir = File.dirname( __FILE__ )
             a.reject do |c|
@@ -79,7 +86,7 @@ EORUBY
         end
 
         def find_and_log_taint( object, method, method_source_location, args )
-            taint = @taint
+            taint = self.taint_seed
             return if !taint
 
             tainted = find_taint_in_arguments( taint, args )
@@ -204,10 +211,13 @@ EORUBY
         info << :platforms
 
         if env.delete( 'HTTP_X_SCNR_INTROSPECTOR_TRACE' )
-            info << :data_flow
             info << :execution_flow
         end
 
+        if env['HTTP_X_SCNR_INTROSPECTOR_TAINT']
+            info << :data_flow
+        end
+
         inject( env, info )
 
     rescue => e
@@ -217,7 +227,12 @@ EORUBY
 
     def inject( env, info = [] )
         self.class.taint_seed = env.delete( 'HTTP_X_SCNR_INTROSPECTOR_TAINT' )
-        seed                  = env.delete( 'HTTP_X_SCNR_ENGINE_SCAN_SEED' )
+        if self.class.taint_seed
+            self.class.taint_seed = Base64.decode64( self.class.taint_seed )
+            self.class.taint_seed = nil if self.class.taint_seed.empty?
+        end
+
+        seed = env.delete( 'HTTP_X_SCNR_ENGINE_SCAN_SEED' )
 
         data = {}
 
@@ -245,20 +260,25 @@ EORUBY
         end
 
         if info.include?( :data_flow ) && self.class.taint_seed
-            data['data_flow'] = self.class.data_flows.delete( self.class.taint_seed )&.to_rpc_data
+            data['data_flow'] = self.class.flush_sinks( self.class.taint_seed )&.to_rpc_data
         end
 
         code    = response.shift
         headers = response.shift
         body    = response.shift
-        body    = body.respond_to?( :body ) ? body.body : body
 
-        body = [body].flatten
-        body << "<!-- #{seed}\n#{JSON.dump( data )}\n#{seed} -->"
+        if headers['Content-Type'] && headers['Content-Type'].include?( 'html' )
+            body = body.respond_to?( :body ) ? body.body : body
+            body = [body].flatten
+            body << "<!-- #{seed}\n#{JSON.dump( data )}\n#{seed} -->"
 
-        headers['Content-Length'] = body.map(&:bytesize).inject(:+)
+            headers['Content-Length'] = body.map(&:bytesize).inject(:+)
+        end
 
         [code, headers, [body].flatten ]
+    rescue => e
+        pp e
+        pp e.backtrace
     end
 
     def platforms

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scnr-introspector
 version: !ruby/object:Gem::Version
-  version: '0.2'
+  version: 0.3.0
 platform: ruby
 authors:
 - Tasos Laskos
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-28 00:00:00.000000000 Z
+date: 2025-01-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler