contrast-agent 3.8.4

data/lib/contrast/utils/tag_util.rb

@@ -0,0 +1,139 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Utility methods for working with tag ranges
+    class TagUtil
+      class << self
+        # Determine if the given array of tags is covered by the other
+        # remaining_ranges: the tags left that haven't been covered by those given
+        # ranges: the tags that are covering the first
+        def covered? remaining_ranges, ranges
+          return true unless remaining_ranges&.any?
+
+          tag = remaining_ranges[0]
+          ranges.each do |range|
+            # If we covered the tag before using all the ranges, break
+            break if tag.length <= 0
+
+            relationship = tag.compare_range(range.start_idx, range.end_idx)
+            case relationship
+            when Contrast::Agent::Assess::Tag::BELOW
+              # since the tags are ordered, if we're below, nope out
+              return false
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              # if we ever get a low span, that means a low part
+              # won't be covered. there's no need to continue
+              return false
+            when Contrast::Agent::Assess::Tag::WITHOUT
+              # if we ever get a without, that means a low part won't
+              # be covered. there's no need to continue
+              return false
+            when Contrast::Agent::Assess::Tag::WITHIN
+              # if we're within, then 0 out this tag since it is
+              # completely covered
+              tag.update_start(0)
+              tag.update_end(0)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN
+              tag.update_start(range.end_idx)
+            when Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/EmptyWhen
+            end
+          end
+          return false unless tag.length <= 0
+
+          remaining_ranges.shift
+          covered?(remaining_ranges, ranges)
+        end
+
+        # Given an array of tags, add all new tags to that array
+        #
+        # The addition is done such that the new entry(ies)
+        # are inserted so that the range they cover is in order
+        # Any overlapping ranges are merged before returning
+        #
+        # arr: the array of tags to which we are adding
+        # new_arr: misnomer. either an array of or a single Tag to be added
+        def ordered_merge arr, new_arr
+          # [Contrast::Agent::Assess::Tag, ...]
+          if new_arr.is_a?(Array)
+            return arr unless new_arr.any?
+            return new_arr unless arr&.any?
+
+            new_arr.each { |new_element| single_ordered_merge(arr, new_element) }
+          # Contrast::Agent::Assess::Tag
+          else
+            return arr unless new_arr
+            return [new_arr] unless arr
+
+            single_ordered_merge(arr, new_arr)
+          end
+          smallerize(arr)
+        end
+
+        # Given a collection of tags, merge any tags that are continuous
+        #
+        # If tags is a hash, it should be in the format label => [tags]
+        # The array of tags will each be merged
+        #
+        # If tags is an array in the format [tags], the array will be
+        # merged
+        #
+        # The original object is returned, although setters should not be
+        # necessary since tags is a collection in either case
+        def merge_tags tags
+          if tags.is_a?(Hash)
+            tags.each_value { |value| smallerize(value) }
+          else
+            smallerize(tags)
+          end
+        end
+
+        private
+
+        # Add one new element to the given array
+        #
+        # The addition is done such that the new entry(ies)
+        # are inserted so that the range they cover is in order
+        # Any overlapping ranges are merged before returning
+        #
+        # arr: the array to which the element is added
+        # new_element: the element to be added to the array
+        def single_ordered_merge arr, new_element
+          idx = 0
+          arr.each do |existing|
+            break unless existing.start_idx < new_element.start_idx
+
+            if existing.overlaps?(new_element)
+              existing.merge(new_element)
+              return # rubocop:disable Lint/NonLocalExitFromIterator
+            end
+            idx += 1
+          end
+          arr.insert(idx, new_element)
+        end
+
+        # Given an arry of tags, merge any that overlap
+        # The tag that was higher up is removed from the
+        # list of tags.
+        # ranges like [0-3][3-6]-6-9] that should become [0-9]
+        def smallerize tags
+          smallered = []
+          curr = nil
+          tags.each do |tag|
+            if curr.nil?
+              curr = tag
+              smallered << curr
+            elsif tag.start_idx <= curr.end_idx
+              curr.update_end(tag.end_idx) if tag.end_idx > curr.end_idx
+            else
+              curr = tag
+              smallered << curr
+            end
+          end
+          tags.delete_if { |tag| !smallered.include?(tag) }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/thread_tracker.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # ThreadTracker allows tracking of singleton objects across threads
+    class ThreadTracker
+      def initialize logger = nil
+        @logger = logger
+      end
+
+      # Note about Ruby -- thread#[] is fiber-local,
+      # #thread_variables is not.
+
+      def get key, default = nil
+        log(key)
+        Thread.current[key] || default
+      end
+
+      def set key, value
+        Thread.current[key] = value
+      end
+
+      def delete key
+        Thread.current[key] = nil
+      end
+
+      def lifespan obj
+        set(:current_context, obj)
+        response = yield(obj)
+        delete(:current_context)
+        response
+      end
+
+      def current
+        get(:current_context)
+      end
+
+      def update_current_context context
+        set(:current_context, context)
+      end
+
+      # logger may be nil so use this utility method instead
+      def log key, msg = nil
+        return unless @logger
+        return unless @logger.debug?
+
+        @logger.debug("Thread Tracker[#{ key }] :: #{ Process.pid }.#{ Thread.current.object_id } => #{ msg }")
+      rescue StandardError
+        false # NOOP
+      end
+    end
+  end
+end

data/lib/contrast/utils/timer.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Timer is class that can track state about when an event starts and how long it takes
+    # Also containes utility methods to get time values in milliseconds
+    class Timer
+      attr_reader :start_at, :start_ms, :events
+
+      def initialize time = Time.now
+        @start_at = time
+        @start_ms = (@start_at.to_f * 1000).to_i
+        @events = {}
+      end
+
+      def elapsed label
+        before = Time.now
+        result = yield if block_given?
+        events[label.to_s] = ((Time.now - before) * 1000).to_i
+        result
+      end
+
+      def ms key
+        events[key.to_s] || 0
+      end
+
+      def abs key
+        start_ms + (events[key.to_s] || 0)
+      end
+
+      def to_s
+        pairs = events.to_a.map { |pair| "#{ pair[0] }=#{ pair[1] }ms" }
+        start_at.strftime('%Y-%m-%d %H:%M:%S.%L') + pairs.join(Contrast::Utils::ObjectShare::SPACE)
+      end
+
+      def diff_s start_ms
+        (now_ms - start_ms) / 1000
+      end
+
+      def now_ms
+        (Time.now.to_f * 1000).to_i
+      end
+
+      def self.now_ms
+        (Time.now.to_f * 1000).to_i
+      end
+
+      def self.earliest lhs, rhs
+        if lhs && rhs
+          [lhs, rhs].min
+        elsif lhs
+          lhs
+        else
+          rhs
+        end
+      end
+
+      def self.latest lhs, rhs
+        if lhs && rhs
+          [lhs, rhs].max
+        elsif lhs
+          lhs
+        else
+          rhs
+        end
+      end
+
+      def now_sec
+        now_ms / 1000
+      end
+
+      def elapsed_ms
+        now_ms - start_ms
+      end
+    end
+  end
+end

data/resources/assess/policy.json

@@ -0,0 +1,1673 @@
+{
+  "tracked_classes": [
+    "ActionDispatch::Http::UploadedFile",
+    "Symbol",
+    "Pathname",
+    "File",
+    "MatchData",
+    "URI::Generic",
+    "Rack::File::Iterator"
+  ],
+  "sources":[
+    {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"params",
+      "target":"R",
+      "type":"PARAMETER",
+      "tags":["CROSS_SITE"]
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"body",
+      "target":"R",
+      "type":"BODY"
+    }, {
+      "class_name":"Rack::Request::Env",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"get_header",
+      "target":"R",
+      "type":"HEADER",
+      "tags":["NO_NEWLINES"]
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "raw_post",
+      "target": "R",
+      "type": "BODY",
+      "tags":["NO_NEWLINES"]
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"POST",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"GET",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"cookies",
+      "target":"R",
+      "type":"PARAMETER",
+      "tags":["NO_NEWLINES"]
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"url",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"query_string",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"body",
+      "target":"R",
+      "type":"BODY"
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"query_string",
+      "target":"R",
+      "type":"BODY"
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"GET",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"POST",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"cookies",
+      "target":"R",
+      "type":"PARAMETER",
+      "tags":["NO_NEWLINES"]
+    }, {
+      "class_name":"Rack::Request",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"url",
+      "target":"R",
+      "type":"BODY"
+    }, {
+      "class_name":"ActionController::Metal",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"params",
+      "target":"R",
+      "type":"PARAMETER"
+    }, {
+      "class_name":"ActionController::StrongParameters",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"params",
+      "target":"R",
+      "type":"PARAMETER"
+    }
+  ],
+  "propagators":[
+    {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"dup",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "split",
+      "source": "O,P0",
+      "target": "R",
+      "action": "SPLIT"
+    },{
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "grapheme_clusters",
+      "source": "O",
+      "target": "R",
+      "action": "SPLIT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"clone",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "private",
+      "method_name":"initialize",
+      "source":"P0",
+      "target":"O",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": false,
+      "method_visibility": "public",
+      "method_name":"try_convert",
+      "source":"P0",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"+@",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"capitalize",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"capitalize!",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"downcase",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"downcase!",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"swapcase",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"swapcase!",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"to_s",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"to_str",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"upcase",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"upcase!",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"insert",
+      "source":"P1",
+      "target":"O",
+      "action":"INSERT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"prepend",
+      "source":"O,P0",
+      "target":"O",
+      "action":"PREPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"rjust",
+      "source":"O,P1",
+      "target":"R",
+      "action":"PREPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"+",
+      "source":"O,P0",
+      "target":"R",
+      "action":"APPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"concat",
+      "source":"O,P0",
+      "target":"O",
+      "action":"APPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"<<",
+      "source":"O,P0",
+      "target":"O",
+      "action":"APPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"ljust",
+      "source":"O,P1",
+      "target":"R",
+      "action":"APPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"*",
+      "source":"O",
+      "target":"R",
+      "action":"APPEND"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"center",
+      "source":"O,P1",
+      "target":"R",
+      "action":"CENTER"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"inspect",
+      "source":"O",
+      "target":"R",
+      "action":"CENTER"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"chomp",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"chomp!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"chop",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"chop!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"rstrip",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"rstrip!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"lstrip",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"lstrip!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"strip",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"strip!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete!",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    },{
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete_prefix",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    },{
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete_suffix",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete_prefix!",
+      "source":"O",
+      "target":"O",
+      "action":"REMOVE"
+    },{
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"delete_suffix!",
+      "source":"O",
+      "target":"O",
+      "action":"REMOVE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"dump",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    },
+    {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"undump",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    },
+    {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"replace",
+      "source":"P0",
+      "target":"R",
+      "action":"REPLACE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"next",
+      "source":"O",
+      "target":"R",
+      "action":"NEXT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"next!",
+      "source":"O",
+      "target":"O",
+      "action":"NEXT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"succ",
+      "source":"O",
+      "target":"R",
+      "action":"NEXT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"succ!",
+      "source":"O",
+      "target":"O",
+      "action":"NEXT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"reverse",
+      "source":"O",
+      "target":"R",
+      "action":"REVERSE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"reverse!",
+      "source":"O",
+      "target":"O",
+      "action":"REVERSE"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"%",
+      "source":"O,P0",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"Regexp",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"match",
+      "source":"P0",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"post_match",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"pre_match",
+      "source":"O",
+      "target":"R",
+      "action":"REMOVE"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"to_a",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"[]",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"captures",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"values_at",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"to_sym",
+      "source":"O",
+      "target":"R",
+      "action":"KEEP"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "gsub",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
+      "patch_method": "gsub_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "gsub!",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
+      "patch_method": "gsub_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "sub",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
+      "patch_method": "sub_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "sub!",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Substitution",
+      "patch_method": "sub_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "tr",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
+      "patch_method": "tr_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "tr!",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
+      "patch_method": "tr_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "tr_s",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
+      "patch_method": "tr_s_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "tr_s!",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Trim",
+      "patch_method": "tr_s_tagger"
+    }, {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "[]",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Select",
+      "patch_method": "select_tagger"
+    }, {
+      "class_name":"CGI::Util",
+      "method_name":"escapeHTML",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"CGI::Util",
+      "method_name":"escape_html",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"CGI::Util",
+      "method_name":"h",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"CGI::Util",
+      "method_name":"unescapeHTML",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_DECODED"],
+      "untags":["HTML_ENCODED"]
+    }, {
+      "class_name":"CGI::Util",
+      "method_name":"unescape_html",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_DECODED"],
+      "untags":["HTML_ENCODED"]
+    }, {
+      "class_name":"ERB::Util",
+      "method_name":"html_escape",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"ERB::Util",
+      "method_name":"h",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"ERB::Util",
+      "method_name":"html_escape_once",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source":"P0",
+      "target":"R",
+      "action":"SPLAT",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    }, {
+      "class_name":"Pathname",
+      "method_name":"initialize",
+      "instance_method": true,
+      "method_visibility": "private",
+      "source":"P0",
+      "target":"O",
+      "action":"SPLAT"
+    }, {
+      "class_name":"File",
+      "method_name":"initialize",
+      "instance_method": true,
+      "method_visibility": "private",
+      "source":"P0",
+      "target":"O",
+      "action":"SPLAT"
+    }, {
+      "class_name":"File",
+      "method_name":"path",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name":"File",
+      "method_name":"to_path",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source":"O",
+      "target":"R",
+      "action":"SPLAT"
+    }, {
+      "class_name": "ActiveModel::AttributeAssignment",
+      "method_name": "assign_attributes",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "O",
+      "action": "DB_WRITE",
+      "tags": ["DATABASE_WRITE"]
+    }, {
+      "class_name": "ActiveModel::AttributeAssignment",
+      "method_name": "attributes=",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "O",
+      "action": "DB_WRITE",
+      "tags": ["DATABASE_WRITE"]
+    }, {
+      "class_name": "JSON",
+      "method_name": "parse",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "JSON",
+      "method_name": "[]",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "O",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "JSON",
+      "method_name": "dump",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "Zlib::Deflate",
+      "method_name": "deflate",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "Zlib::Inflate",
+      "method_name": "inflate",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "Base64",
+      "method_name": "decode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_DECODED"],
+      "untags":["BASE64_ENCODED"]
+    }, {
+      "class_name": "Base64",
+      "method_name": "encode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_ENCODED"],
+      "untags":["BASE64_DECODED"]
+    }, {
+      "class_name": "Base64",
+      "method_name": "strict_decode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_DECODED"],
+      "untags":["BASE64_ENCODED"]
+    }, {
+      "class_name": "Base64",
+      "method_name": "strict_encode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_ENCODED"],
+      "untags":["BASE64_DECODED"]
+    }, {
+      "class_name": "Base64",
+      "method_name": "urlsafe_decode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_DECODED"],
+      "untags":["BASE64_ENCODED"]
+    }, {
+      "class_name": "Base64",
+      "method_name": "urlsafe_encode64",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["BASE64_ENCODED"],
+      "untags":["BASE64_DECODED"]
+    }, {
+      "class_name": "Marshal",
+      "method_name": "dump",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    },  {
+      "class_name": "Marshal",
+      "method_name": "load",
+      "instance_method": false,
+      "method_visibility": "public",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT"
+    }, {
+      "class_name": "URI::Generic",
+      "method_name": "initialize",
+      "instance_method": true,
+      "method_visibility": "private",
+      "source": "P0",
+      "target": "O",
+      "action": "SPLAT"
+    }, {
+      "class_name": "Kernel",
+      "instance_method": true,
+      "method_visibility": "private",
+      "method_name": "sprintf",
+      "action": "CUSTOM",
+      "patch_class": "KernelPropagator",
+      "patch_method": "sprintf_tagger"
+    }, {
+      "class_name":"SQLite3::Statement",
+      "instance_method": true,
+      "method_visibility": "private",
+      "method_name":"initialize",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
+      "patch_method": "csrf_tagger",
+      "source": "P1"
+    }, {
+      "class_name":"PG::Connection",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"sync_exec",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
+      "patch_method": "csrf_tagger"
+    }, {
+      "class_name":"PG::Connection",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"sync_exec_params",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
+      "patch_method": "csrf_tagger"
+    }, {
+      "class_name":"PG::Connection",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"async_exec",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
+      "patch_method": "csrf_tagger"
+    }, {
+      "class_name":"PG::Connection",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"async_exec_params",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
+      "patch_method": "csrf_tagger"
+    }, {
+      "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"quote",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["SQL_ENCODED"],
+      "untags":["SQL_DECODED"]
+    }, {
+      "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"quote_string",
+      "source": "P0",
+      "target": "R",
+      "action": "SPLAT",
+      "tags":["SQL_ENCODED"],
+      "untags":["SQL_DECODED"]
+    },
+    {
+      "class_name":"IO",
+      "method_name":"initialize",
+      "instance_method": true,
+      "method_visibility": "private",
+      "source":"P0",
+      "target":"O",
+      "action":"SPLAT"
+    },
+    {
+       "class_name": "ERB",
+       "method_name": "result",
+       "method_visibility": "public",
+       "instance_method": true,
+       "source": "P0",
+       "target": "O",
+       "action": "CUSTOM",
+       "patch_class": "ERBPropagator",
+       "patch_method": "result_tagger"
+    }
+  ],
+  "rules":[
+    {
+      "name":"cmd-injection",
+      "disallowed_tags":["BASE64_ENCODED", "CSS_ENCODED", "CSV_ENCODED", "HTML_ENCODED", "JAVASCRIPT_ENCODED", "JAVA_ENCODED", "LDAP_ENCODED", "OS_ENCODED", "SQL_ENCODED", "URL_ENCODED", "VBSCRIPT_ENCODED", "XML_ENCODED", "XPATH_ENCODED"],
+      "triggers":[
+        {
+          "class_name":"IO",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"popen",
+          "source":"P0"
+        }, {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"`",
+          "source":"P0"
+        }, {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"exec",
+          "source":"P0",
+          "custom_patch": true
+        }, {
+          "class_name":"Kernel",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"exec",
+          "source":"P0",
+          "custom_patch": true
+        }, {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"spawn",
+          "source":"P0"
+        }, {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"system",
+          "source":"P0"
+        },
+        {
+          "class_name":"Kernel",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"`",
+          "source":"P0"
+        }, {
+          "class_name":"Kernel",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"spawn",
+          "source":"P0"
+        },
+        {
+          "class_name":"Kernel",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"system",
+          "source":"P0"
+        }
+      ]
+    },{
+      "name":"path-traversal",
+      "disallowed_tags":["BASE64_ENCODED", "CSS_ENCODED", "CSV_ENCODED", "HTML_ENCODED", "JAVASCRIPT_ENCODED", "JAVA_ENCODED", "LDAP_ENCODED", "OS_ENCODED", "SQL_ENCODED", "URL_ENCODED", "VBSCRIPT_ENCODED", "XML_ENCODED", "XPATH_ENCODED", "NO_CONTROL_CHARS"],
+      "triggers":[
+        {
+          "class_name":"IO",
+          "method_name":"open",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"initialize",
+          "instance_method": true,
+          "method_visibility": "private",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"binread",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"binwrite",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"read",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"readlines",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"copy_stream",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0,P1"
+        }, {
+          "class_name":"IO",
+          "method_name":"foreach",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"sysopen",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"IO",
+          "method_name":"write",
+          "instance_method": false,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"File",
+          "method_name":"initialize",
+          "instance_method": true,
+          "method_visibility": "private",
+          "source":"P0"
+        }
+      ]
+    }, {
+      "name": "redos",
+      "triggers": [
+        {
+          "class_name":"Regexp",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"match",
+          "source":"P0",
+          "trigger_class": "Contrast::Agent::Assess::Rule::Redos",
+          "trigger_method": "regexp_complexity_check"
+
+        }, {
+          "class_name":"String",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"=~",
+          "source":"O",
+          "trigger_class": "Contrast::Agent::Assess::Rule::Redos",
+          "trigger_method": "regexp_complexity_check"
+        }, {
+          "class_name":"Regexp",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"=~",
+          "source":"P0",
+          "trigger_class": "Contrast::Agent::Assess::Rule::Redos",
+          "trigger_method": "regexp_complexity_check"
+
+        }
+      ]
+    }, {
+      "name":"reflected-xss",
+      "disallowed_tags":["BASE64_ENCODED", "CSS_ENCODED", "CSV_ENCODED", "HTML_ENCODED", "JAVASCRIPT_ENCODED", "JAVA_ENCODED", "LDAP_ENCODED", "OS_ENCODED", "SQL_ENCODED", "URL_ENCODED", "VBSCRIPT_ENCODED", "XML_ENCODED", "XPATH_ENCODED"],
+      "triggers":[
+        {
+          "class_name": "Tilt::Template",
+          "method_name": "evaluate",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"O",
+          "trigger_class": "TiltTemplateTrigger",
+          "trigger_method": "render_trigger_check"
+        },
+        {
+          "class_name":"String",
+          "method_name":"html_safe",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"O"
+        }, {
+          "class_name":"ActionView::Helpers::OutputSafetyHelper",
+          "method_name":"raw",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"ActionView::Helpers::RawOutputHelper",
+          "method_name":"raw",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"ActionDispatch::Response",
+          "method_name":"body=",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"ActionDispatch::Response::Buffer",
+          "method_name":"write",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"Sinatra::Helpers",
+          "method_name":"body",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }, {
+          "class_name":"Sinatra::Response",
+          "method_name":"body=",
+          "instance_method": true,
+          "method_visibility": "public",
+          "source":"P0"
+        }
+      ]
+    }, {
+      "name":"sql-injection",
+      "disallowed_tags":["SQL_ENCODED"],
+      "triggers":[
+        {
+          "class_name":"SQLite3::Database",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"execute",
+          "source":"P0"
+        }, {
+          "class_name":"SQLite3::Statement",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"initialize",
+          "source":"P1"
+        }, {
+          "class_name":"Mysql2::Client",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"query",
+          "source":"P0"
+        }, {
+          "class_name":"Mysql2::Statement",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"execute",
+          "source":"P0"
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"exec",
+          "source":"P0"
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"exec_params",
+          "source":"P0"
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"async_exec",
+          "source":"P0"
+        }, {
+          "class_name":"ActiveRecord::Querying",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"select",
+          "source":"P0"
+        }
+      ]
+    }, {
+      "name": "reflection-injection",
+      "triggers": [
+        {
+          "class_name":"String",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"constantize",
+          "source":"O"
+        },{
+          "class_name":"String",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"safe_constantize",
+          "source":"O"
+        }, {
+          "class_name":"Module",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"const_get",
+          "source":"P0"
+        },
+        {
+          "class_name":"Module",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"const_get",
+          "source":"P0"
+        }
+      ]
+    },{
+      "name":"unsafe-code-execution",
+      "triggers":[
+        {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"eval",
+          "source":"P0"
+        },{
+          "class_name": "Kernel",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "eval",
+          "source": "P0"
+        }, {
+          "class_name": "ActiveSupport::Tryable",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"try",
+          "source":"P0"
+        }, {
+          "class_name": "ActiveSupport::Tryable",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"try!",
+          "source":"P0"
+        }, {
+          "class_name": "BasicObject",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"instance_eval",
+          "source":"P0",
+          "custom_patch": true
+        }, {
+          "class_name": "Module",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"class_eval",
+          "source":"P0",
+          "custom_patch": true
+        }, {
+          "class_name": "Module",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"module_eval",
+          "source":"P0",
+          "custom_patch": true
+        },{
+          "class_name": "Object",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "try",
+          "source": "P0"
+        }, {
+          "class_name": "Object",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "try!",
+          "source": "P0"
+        }
+      ]
+    }, {
+      "name":"crypto-weak-randomness",
+      "dataflow": false,
+      "triggers":[
+        {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"rand"
+        }, {
+          "class_name":"Kernel",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"srand"
+        }, {
+          "class_name":"Random",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"rand"
+        }, {
+          "class_name":"Random",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name":"srand"
+        }, {
+          "class_name":"Random",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"rand"
+        }
+      ]
+    }, {
+      "name":"crypto-bad-mac",
+      "dataflow": false,
+      "triggers":[
+        {
+          "class_name":"OpenSSL::Digest",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"initialize",
+          "source":"P0",
+          "good_value":"^(?:MDC2|RIPEMD160|SHA224|SHA256|SHA384|SHA512)"
+        }, {
+          "class_name":"Digest::MD5",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"initialize"
+        },{
+          "class_name":"Digest::SHA1",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"initialize"
+        }
+      ]
+    }, {
+      "name":"crypto-bad-ciphers",
+      "dataflow": false,
+      "triggers":[
+        {
+          "class_name":"OpenSSL::Cipher",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name":"initialize",
+          "source":"P0",
+          "good_value":"^(?:AES|CAMELLIA|CAST|DES-EDE|DES-EDE3|DES3|DESX|SEED).*"
+        }
+      ]
+    },
+    {
+      "name": "ssrf",
+      "triggers": [
+        {
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "get",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "post",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "head",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "put",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "patch",
+          "source": "P0"
+        },{
+          "class_name": "Net::HTTP",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "delete",
+          "source": "P0"
+        },{
+          "class_name": "Excon",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P0"
+        },
+        {
+          "class_name": "Typhoeus::Request",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P0"
+        }
+      ]
+    },
+    {
+      "name": "nosql-injection",
+      "disallowed_tags":["JAVASCRIPT_ENCODED"],
+      "triggers": [
+        {
+          "class_name": "Mongo::Protocol::Query",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P2"
+        },
+        {
+          "class_name": "Mongo::Operation::Specifiable",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P0"
+        }
+      ]
+    },
+    {
+      "name": "xxe",
+      "dataflow": "true",
+      "triggers": [
+        {
+          "class_name": "Ox",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name": "parse",
+          "source": "P0"
+        },
+        {
+          "class_name": "Ox",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name": "load",
+          "source": "P0"
+        },
+        {
+          "class_name": "Oga::XML::Parser",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P0"
+        },
+        {
+          "class_name": "Oga::XML::SaxParser",
+          "instance_method": true,
+          "method_visibility": "private",
+          "method_name": "initialize",
+          "source": "P1"
+        }, {
+          "class_name": "Nokogiri::XML::Document",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name": "parse",
+          "source": "P0"
+        }, {
+          "class_name": "Nokogiri::XML::SAX::Parser",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "parse",
+          "source": "P0"
+        }
+      ]
+    }, {
+      "name": "trust-boundary-violation",
+      "triggers": [
+        {
+          "class_name": "ActionDispatch::Request::Session",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "[]=",
+          "source": "P0,P1"
+        },{
+          "class_name": "Rack::Session::Cookie::Identity",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "encode",
+          "source": "P0"
+        },{
+          "class_name": "Rack::Session::Cookie::Base64",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "encode",
+          "source": "P0"
+        }
+      ]
+    }, {
+      "name": "unvalidated-redirect",
+      "disallowed_tags":["URL_ENCODED"],
+      "triggers": [
+        {
+          "class_name": "Sinatra::Helpers",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "redirect",
+          "source": "P0"
+        },
+        {
+          "class_name": "ActionController::Redirecting",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "redirect_to",
+          "source": "P0"
+        }
+      ]
+    }, {
+      "name": "untrusted-deserialization",
+      "triggers": [
+        {
+          "class_name": "Marshal",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name": "load",
+          "source": "P0"
+        },
+        {
+          "class_name": "Psych",
+          "instance_method": false,
+          "method_visibility": "public",
+          "method_name": "load",
+          "source": "P0"
+        }
+      ]
+    }
+  ]
+}