Class: Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite

Inherits:
Base
  • Object
show all
Extended by:
Utils::Assess::EventLimitUtils
Defined in:
lib/contrast/agent/assess/policy/propagator/database_write.rb

Overview

Propagation that results in all the tags of the source being applied to the target. Unlike other propagators, this actually results in new source nodes to track which columns in the database have been tainted.

Class Method Summary collapse

Methods included from Utils::Assess::EventLimitUtils

event_limit?, event_limit_for_rule?, increment_event_count

Methods included from Components::Logger::InstanceMethods

#cef_logger, #logger

Methods inherited from Base

find_source, tracked_value?

Class Method Details

.propagate(propagation_node, preshift, target) ⇒ Object

propagation action required by this method.

Parameters:

Returns:

  • (Object) —

    the target with the tags applied



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/contrast/agent/assess/policy/propagator/database_write.rb', line 24

def propagate propagation_node, preshift, target
  return unless Contrast::ASSESS.require_dynamic_sources?

  class_type = preshift.object.cs__class
  class_name = class_type.cs__name
  tainted_columns = {}

  known_tainted = ::Contrast::ASSESS.tainted_columns[class_name]
  propagation_node.sources.each do |source|
    handle_write(propagation_node, source, preshift, target, known_tainted, tainted_columns)
    increment_event_count(propagation_node)
  end
  return if tainted_columns.empty?

  if known_tainted
    known_tainted.concat(tainted_columns.keys)
  else
    ::Contrast::ASSESS.tainted_columns[class_name] = tainted_columns.keys
  end

  Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources(class_type, tainted_columns)
end