Class: Contrast::Extension::Assess::MarshalPropagator

Inherits:
Object
  • Object
show all
Extended by:
Components::Logger::InstanceMethods, Components::Scope::InstanceMethods
Defined in:
lib/contrast/extension/assess/marshal.rb,
ext/cs__assess_marshal_module/cs__assess_marshal_module.c

Overview

This is our patch of the Marshal class Disclaimer: there may be a better way, but we’re in a ‘get it work’ state. Hopefully, we’ll be in a ‘get it right’ state soon. This module is used for our Marshal.load patches

Class Method Summary collapse

Methods included from Components::Scope::InstanceMethods

contrast_enter_method_scopes!, contrast_exit_method_scopes!, with_app_scope, with_contrast_scope, with_deserialization_scope, with_split_scope

Methods included from Components::Logger::InstanceMethods

cef_logger, logger

Class Method Details

.cs__load_assess(source, ret) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'lib/contrast/extension/assess/marshal.rb', line 31

def cs__load_assess source, ret
  with_contrast_scope do
    return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current

    args = [source]
    # source might not be all the args passed in, but it is the one we care
    # about. we could pass in all the args in the last param here if it
    # becomes an issue in rendering on TS
    finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load),
                                                                           source, self, ret, *args)
    Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
    return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))

    properties.copy_from(source, ret)

    node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
    event_data = Contrast::Agent::Assess::Events::EventData.new(node, ret, self, ret, args)
    properties.build_event(event_data)
  rescue StandardError => e
    logger.error('Unable to run Assess for Marshal.load', e)
  end
end

.cs__load_protect(arg) ⇒ Object 



22
23
24
25
26
27
28
29
 
# File 'lib/contrast/extension/assess/marshal.rb', line 22

def cs__load_protect arg
  return if in_contrast_scope?

  with_contrast_scope do
    Contrast::Agent::Protect::Policy::AppliesDeserializationRule.prepended_invoke(arg)
  end
  nil
end

.trigger_node(clazz, method) ⇒ Object 



54
55
56
57
58
59
 
# File 'lib/contrast/extension/assess/marshal.rb', line 54

def trigger_node clazz, method
  triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
  return unless triggers

  triggers.find { |node| node.class_name == clazz && node.method_name == method }
end