Class: Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite

Inherits:
Base
  • Object
show all
Includes:
Components::Interface
Defined in:
lib/contrast/agent/assess/policy/propagator/database_write.rb

Overview

Propagation that results in all the tags of the source being applied to the target. Unlike other propagators, this actually results in new source nodes to track which columns in the database have been tainted.

Class Method Summary collapse

Methods included from Components::Interface

included

Methods inherited from Base

find_source, tracked_value?

Class Method Details

.propagate(propagation_node, preshift, target) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/contrast/agent/assess/policy/propagator/database_write.rb', line 20

def propagate propagation_node, preshift, target
  class_type = preshift.object.cs__class
  class_name = class_type.cs__name
  tainted_columns = {}

  known_tainted = ASSESS.tainted_columns[class_name]
  propagation_node.sources.each do |source|
    arg = preshift.args[source]
    next unless arg.cs__respond_to?(:each_pair)

    arg.each_pair do |key, value|
      next unless value
      next if known_tainted&.include?(key)

      properties = Contrast::Agent::Assess::Tracker.properties(value)
      next unless properties

      # TODO: RUBY-540 handle sanitization, handle nested objects
      Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
      properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
      next unless tracked_value?(value)

      tainted_columns[key] = properties
    end
  end

  return if tainted_columns.empty?

  if known_tainted
    known_tainted.concat(tainted_columns.keys)
  else
    ASSESS.tainted_columns[class_name] = tainted_columns.keys
  end

  Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns
end