Module: Contrast::Agent::Assess::Policy::PropagationMethod

Includes:
Components::Interface
Included in:
Patching::Policy::Patch
Defined in:
lib/contrast/agent/assess/policy/propagation_method.rb

Overview

This class is responsible for the continuation of traces. A Propagator is any method that transforms an untrusted value. In general, these methods work on the String class or a holder of Strings

Constant Summary collapse

APPEND_ACTION = 
'APPEND'
CENTER_ACTION = 
'CENTER'
INSERT_ACTION = 
'INSERT'
KEEP_ACTION = 
'KEEP'
NEXT_ACTION = 
'NEXT'
NOOP_ACTION = 
'NOOP'
PREPEND_ACTION = 
'PREPEND'
REPLACE_ACTION = 
'REPLACE'
REMOVE_ACTION = 
'REMOVE'
REVERSE_ACTION = 
'REVERSE'
SPLAT_ACTION = 
'SPLAT'
SPLIT_ACTION = 
'SPLIT'
DB_WRITE_ACTION = 
'DB_WRITE'
CUSTOM_ACTION = 
'CUSTOM'
PROPAGATION_ACTIONS = 
{
    APPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Append,
    CENTER_ACTION => Contrast::Agent::Assess::Policy::Propagator::Center,
    INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
    KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
    NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
    NOOP_ACTION => nil,
    PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
    REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
    REMOVE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Remove,
    REVERSE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Reverse,
    SPLAT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Splat,
    SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
}.cs__freeze
ZERO_LENGTH_ACTIONS = 
[
  DB_WRITE_ACTION,
  CUSTOM_ACTION,
  KEEP_ACTION,
  REPLACE_ACTION,
  SPLAT_ACTION
].cs__freeze

Class Method Summary collapse

Methods included from Components::Interface

included

Class Method Details

.apply_propagation(method_policy, preshift, object, ret, args, block) ⇒ Object?

Returns the tracked Return or nil if no changes were made; will replace the return of the original function if not nil.

Parameters:

  • method_policy (Contrast::Agent::Patching::Policy::MethodPolicy) —

    the policy that governs the patches to this method

  • preshift (Contrast::Agent::Assess::PreShift) —

    The capture of the state of the code just prior to the invocation of the patched method.

  • object (Object) —

    the Object on which the method was invoked

  • ret (Object) —

    the Return of the invoked method

  • args (Array<Object>) —

    the Arguments with which the method was invoked

  • block (Block) —

    the Block passed to the original method

Returns:

  • (Object, nil) —

    the tracked Return or nil if no changes were made; will replace the return of the original function if not nil



69
70
71
72
73
74
75
76
77
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 69

def apply_propagation method_policy, preshift, object, ret, args, block
  return unless method_policy.propagation_node
  return unless preshift

  propagation_node = method_policy.propagation_node

  target = determine_target(propagation_node, ret, object, args)
  PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
end

.apply_propagator(propagation_node, preshift, target, object, ret, args, block) ⇒ Object?

I lied above. We had to figure out what the target of the propagation was. Now that we know, we’ll actually do things to it. Note that the return of this method will replace the original return of the patched function unless it is nil, so be sure you’re returning what you intend.

Parameters:

  • propagation_node (Contrast::Agent::Assess::Policy::PropagationNode) —

    the node that governs this propagation event.

  • preshift (Contrast::Agent::Assess::PreShift) —

    The capture of the state of the code just prior to the invocation of the patched method.

  • target (Object) —

    the Target to which to propagate.

  • object (Object) —

    the Object on which the method was invoked

  • ret (Object) —

    the Return of the invoked method

  • args (Array<Object>) —

    the Arguments with which the method was invoked

  • block (Block) —

    the Block passed to the original method

Returns:

  • (Object, nil) —

    the tracked Return or nil if no changes were made; will replace the return of the original function if not nil



118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 118

def apply_propagator propagation_node, preshift, target, object, ret, args, block
  return unless propagation_possible?(propagation_node, target)

  if propagation_node.action == DB_WRITE_ACTION
    Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
  elsif propagation_node.action == CUSTOM_ACTION
    Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
  elsif propagation_node.action == SPLIT_ACTION
    Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
  elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
    handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
  elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
    handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
  else
    handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
  end
rescue StandardError => e
  logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
  nil
end

.apply_tags(propagation_node, target) ⇒ Object

If this patcher has tags, apply them to the entire target



209
210
211
212
213
214
215
216
217
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 209

def apply_tags propagation_node, target
  return unless propagation_node.tags

  properties = Contrast::Agent::Assess::Tracker.properties(target)
  length = Contrast::Utils::StringUtils.ret_length(target)
  propagation_node.tags.each do |tag|
    properties.add_tag(tag, 0...length)
  end
end

.apply_untags(propagation_node, target) ⇒ Object

If this patcher has tags, remove them from the entire target



220
221
222
223
224
225
226
227
228
229
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 220

def apply_untags propagation_node, target
  return unless propagation_node.untags

  properties = Contrast::Agent::Assess::Tracker.properties(target)
  return unless properties

  propagation_node.untags.each do |tag|
    properties.delete_tags(tag)
  end
end

.appropriate_target?(propagation_node, target) ⇒ Boolean

We cannot propagate to frozen things that have not been updated to work with our property tracking, unless they’re duplicable and the return. We probably shouldn’t propagate to frozen things at all, as they’re supposed to be immutable, but third parties do jenky things, so allow it as long as it is safe to do.

Parameters:

Returns:

  • (Boolean) —

    if the target can be propagated to



201
202
203
204
205
206
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 201

def appropriate_target? propagation_node, target
  # special handle Returns b/c we can do unfreezing magic during propagation
  return true if propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY

  Contrast::Agent::Assess::Tracker.trackable?(target)
end

.can_propagate?(propagation_node, preshift, target) ⇒ Boolean

Before we do any work, we should check if we even need to. If the source of this patcher is not tracked, there’s no need to do anything. A copy of nothing is still nothing.

Returns:

  • (Boolean) 


174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 174

def can_propagate? propagation_node, preshift, target
  return false unless appropriate_target?(propagation_node, target)
  return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
  return false unless preshift

  propagation_node.sources.each do |source|
    case source
    when Contrast::Utils::ObjectShare::OBJECT_KEY
      return true if Contrast::Utils::Assess::TrackingUtil.tracked?(preshift.object)
    else # has to be P, there's no ret source type (yet? ever?)
      return true if preshift.args && Contrast::Utils::Assess::TrackingUtil.tracked?(preshift.args[source])
    end
  end
  false
end

.context_available? ⇒ Boolean

Returns:

  • (Boolean) 


94
95
96
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 94

def context_available?
  !!Contrast::Agent::REQUEST_TRACKER.current
end

.determine_target(propagation_node, ret, object, args) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 39

def determine_target propagation_node, ret, object, args
  target_key = propagation_node.targets[0]
  return ret if target_key == Contrast::Utils::ObjectShare::RETURN_KEY
  return object if target_key == Contrast::Utils::ObjectShare::OBJECT_KEY

  return args[target_key] if target_key.is_a?(Integer)

  arg = nil
  args.each do |search|
    next unless search.is_a?(Hash)

    arg = search[target_key]
    break if arg
  end
  arg
end

.valid_length?(target, action) ⇒ Boolean

If the action required needs a length and the target does not have one, the length is not valid

Returns:

  • (Boolean) 


161
162
163
164
165
166
167
168
169
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 161

def valid_length? target, action
  return true if ZERO_LENGTH_ACTIONS.include?(action)

  if Contrast::Utils::DuckUtils.quacks_to?(target, :length)
    target.length != 0 # rubocop:disable Style/ZeroLengthPredicate
  else
    !target.to_s.empty?
  end
end

.valid_target?(target, propagation_node) ⇒ Boolean

Custom actions tend to be the more complex of our propagations. Often, the method has to make decisions about the target based on the context with which the method was called. As such, defer determining if the target is valid to that method.

In all other cases, a target is valid for propagation if it is not nil

Returns:

  • (Boolean) 


146
147
148
149
150
 
# File 'lib/contrast/agent/assess/policy/propagation_method.rb', line 146

def valid_target? target, propagation_node
  return true if propagation_node.action == CUSTOM_ACTION

  !!target
end