contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,70 +8,92 @@ module Contrast
         module Propagator
           # This class is specifically for String#tr(_s) propagation
           #
-          # Disclaimer: there may be a better way, but we're
-          # in a 'get it work' state. hopefully, we'll be in
-          # a 'get it right' state soon.
-          class Trim
+          # Disclaimer: there may be a better way, but we're in a 'get it work' state. hopefully, we'll be in a 'get it
+          # right' state soon.
+          module Trim
             class << self
-              def tr_tagger patcher, preshift, ret, _block
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def tr_tagger policy_node, preshift, ret, _block
                 return ret unless ret && !ret.empty?
+                return ret unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                source = preshift.object
-                args = preshift.args
-                ret.cs__copy_from(source)
-                replace_string = args[1]
-                source_chars = source.chars
-                # if the replace string is empty, then there's a bunch of deletes. this
-                # functions the same as the Removal propagation.
-                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
-                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(source_chars, ret)
-                else
-                  remove_ranges = []
-                  ret_chars = ret.chars
-                  curr_span = nil
-                  source_chars.each_with_index do |char, idx|
-                    if ret_chars[idx] == char
-                      next unless curr_span
-
-                      curr_span.stop = idx
-                      remove_ranges << curr_span
-                      curr_span = nil
-                    else
-                      curr_span ||= Contrast::Agent::Assess::AdjustedSpan.new(idx)
-                    end
-                  end
-                  # account for the last char being different
-                  if curr_span
-                    curr_span.stop = source_chars.length
-                    remove_ranges << curr_span
-                  end
-                  ret.cs__properties.delete_tags_at_ranges(remove_ranges, false)
-                end
-
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args,
-                    1)
+                properties.copy_from(preshift.object, ret)
+                handle_tr(policy_node, preshift, ret, properties)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
               def tr_s_tagger patcher, preshift, ret, _block
                 return unless ret && !ret.empty?
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
                 source = preshift.object
                 args = preshift.args
-                source.cs__splat_tags(ret)
-                ret.cs__properties.build_event(
-                    patcher,
-                    ret,
-                    source,
-                    ret,
-                    args)
+                properties.splat_from(source, ret)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
                 ret
               end
+
+              private
+
+              # @param policy_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [String] the target to which to propagate.
+              # @param properties [Contrast::Agent::Assess::Properties] the properties of the ret
+              def handle_tr policy_node, preshift, ret, properties
+                source = preshift.object
+                replace_string = preshift.args[1]
+
+                # if the replace string is empty, then there's a bunch of deletes. this functions the same as the
+                # Removal propagation.
+                if replace_string == Contrast::Utils::ObjectShare::EMPTY_STRING
+                  Contrast::Agent::Assess::Policy::Propagator::Remove.handle_removal(policy_node, source, ret)
+                  return
+                end
+
+                # Otherwise, we need to target each insertion point. Based on the spec for #tr & #tr_s, the find is
+                # treated as a regexp range, excepting the `\` character, which we'll need to escape. This converts to
+                # that form, wrapping the input in `[]`.
+                find_string = preshift.args[0]
+                find_string += '\\' if find_string.end_with?('\\')
+                find_regexp = Regexp.new("[#{ find_string }]")
+
+                # Find the first instance to be replaced. If there isn't one, than nothing changed here.
+                idx = source.index(find_regexp)
+                return unless idx
+
+                # Iterate over each change and record where it happened. B/c this is a one to one replace, the index of
+                # the replacement is always one; however, there may be adjacent replacements which become a single
+                # range.
+                start = idx
+                stop = idx + 1
+                remove_ranges = []
+                while (idx = source.index(find_regexp, idx + 1))
+                  # If the previous range ends at this index, we can expand that range to include this index.
+                  # Otherwise, we need to record the held range and start a new one.
+                  if stop != idx
+                    remove_ranges << (start...stop)
+                    start = idx
+                  end
+                  stop = idx + 1
+                end
+                # Be sure to capture the last range in the holder.
+                remove_ranges << (start...stop)
+                properties.delete_tags_at_ranges(remove_ranges, shift: false)
+              end
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,24 +10,27 @@ module Contrast
         # functionality. Any class under this namespace should be required
         # here, providing a single point of require for this functionality.
         module Propagator
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/base'
+          require 'contrast/agent/assess/policy/propagator/base'
 
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/append'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/center'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/custom'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/database_write'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/insert'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/keep'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/next'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/prepend'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/remove'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/replace'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/reverse'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/select'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/splat'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/split'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/substitution'
-          cs__scoped_require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/append'
+          require 'contrast/agent/assess/policy/propagator/center'
+          require 'contrast/agent/assess/policy/propagator/custom'
+          require 'contrast/agent/assess/policy/propagator/database_write'
+          require 'contrast/agent/assess/policy/propagator/insert'
+          require 'contrast/agent/assess/policy/propagator/keep'
+          require 'contrast/agent/assess/policy/propagator/match_data'
+          require 'contrast/agent/assess/policy/propagator/next'
+          require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/rack_protection'
+          require 'contrast/agent/assess/policy/propagator/remove'
+          require 'contrast/agent/assess/policy/propagator/replace'
+          require 'contrast/agent/assess/policy/propagator/reverse'
+          require 'contrast/agent/assess/policy/propagator/select'
+          require 'contrast/agent/assess/policy/propagator/splat'
+          require 'contrast/agent/assess/policy/propagator/split'
+          require 'contrast/agent/assess/policy/propagator/substitution'
+          require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/buffer'
         end
       end
     end

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,205 +1,204 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the origination of traces. A Source is any method
-# that returns an untrusted value. In general, these sources are request methods
-# as the request object is user controlled.
-#
-# Going forward, we may add in Dynamic sources (determined at runtime) based on
-# database configs or other variables (used for Stored XSS or other persisted
-# vulnerability detection rules)
-cs__scoped_require 'set'
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/adjusted_span'
-
-cs__scoped_require 'contrast/components/interface'
+require 'set'
+require 'contrast/agent/assess/policy/source_validation/source_validation'
+require 'contrast/agent/excluder'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
+require 'contrast/utils/assess/source_method_utils'
+require 'contrast/utils/assess/event_limit_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # This class controls the actions we take on Sources, as determined by
-        # our Assess policy. It indicates what actions we should take in order
-        # to mark data as User Input and treat it as untrusted, starting the
-        # dataflows used in Assess vulnerability detection.
+        # This class controls the actions we take on Sources, as determined by our Assess policy. It indicates what
+        # actions we should take in order to mark data as User Input and treat it as untrusted, starting the dataflows
+        # used in Assess vulnerability detection.
         module SourceMethod
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def self.determine_target source_node, object, ret, args
-            source_target = source_node.targets[0]
-            case source_target
-            when Contrast::Utils::ObjectShare::RETURN_KEY
-              ret
-            when Contrast::Utils::ObjectShare::OBJECT_KEY
-              object
-            else
-              if source_target.is_a?(Integer)
-                args[source_target]
-                # If this isn't an index param, it's a named one. R.I.P.
-              else
-                arg = nil
-                args.each do |search|
-                  next unless search.is_a?(Hash)
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Utils::Assess::SourceMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
-                  arg = search[source_target]
-                  break if arg
-                end
-                arg
+          PARAMETER_TYPE     = 'PARAMETER'
+          PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
+          HEADER_TYPE        = 'HEADER'
+          HEADER_KEY_TYPE    = 'HEADER_KEY'
+          COOKIE_TYPE        = 'COOKIE'
+          COOKIE_KEY_TYPE    = 'COOKIE_KEY'
+          BODY_TYPE          = 'BODY'
+          QUERYSTRING_TYPE   = 'QUERYSTRING'
+
+          class << self
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack application.
+            #
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
+            #   method being called
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_source method_policy, object, ret, args
+              logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
+                return unless analyze?(method_policy, object, ret, args)
+                return if event_limit?(method_policy)
+                return unless (source_node = method_policy.source_node)
+                return if excluded_by_url?
+
+                # used to hold the object and ret
+                source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
+
+                return unless (target = determine_target(source_node, source_data, args))
+                return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
+
+                process_source(source_node, target, source_data, source_node.type, nil, *args)
               end
             end
-          end
 
-          # This is called from within our woven proc. It will be called as if it
-          # were inline in the Rack application.
-          def self.source_patchers method_policy, object, ret, args
-            return if method_policy.source_node.nil?
-
-            current_context = Contrast::Agent::REQUEST_TRACKER.current
-            return unless current_context&.analyze_request? && ASSESS.enabled?
-
-            replaced_return = nil
-            source_node = method_policy.source_node
-
-            target = determine_target(source_node, object, ret, args)
-
-            # We don't propagate to frozen things that haven't been tracked
-            # before. By definition, something that is a source has not
-            # previously been tracked; therefore, we can break out early.
-            if target.cs__frozen?
-              # That being said, we don't have enough context to know if we
-              # can make this assumption and still function, so we'll allow for
-              # source tracking of frozen things by a common config setting.
-              #
-              # Rails' StrongParameters make a case for this to be default
-              # behavior
-              return replaced_return unless ASSESS.track_frozen_sources?
-
-              # If we're tracking the frozen target, we need to unfreeze
-              # (dup) it to track and then freeze that result. For
-              # simplicities sake, we ONLY do this if the return is the
-              # target (I don't want to have to deal with unfreezing self)
-              return replaced_return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-
-              restore_frozen_state = true
-              ret = Contrast::Utils::FreezeUtil.unfreeze_dup(ret)
-              target = ret
+            private
+
+            # This is our method that actually taints the object our source_node targets.
+            #
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def process_source source_node, target, source_data, source_type, source_name = nil, *args # rubocop:disable Metrics/PerceivedComplexity
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context && source_node && target
+
+              increment_event_count(source_node)
+
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
+
+              return if excluded_by_input?(source_type, source_name)
+
+              # We know we only work on certain things.
+              # Skip if this isn't one of them
+              if Contrast::Agent::Assess::Tracker.trackable?(target)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
+              elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
+                # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
+                # values back to ourselves and try again
+              elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
+                target.each do |value|
+                  process_source(source_node, value, source_data, source_type, source_name, *args)
+                end
+              end
+            rescue StandardError => e
+              logger.warn('Unable to apply source', e, node_id: source_node.id)
             end
 
-            SourceMethod.cs__apply_source(current_context, source_node, target, object, ret, *args)
-
-            ret.cs__freeze if restore_frozen_state
-            ret
-          end
-
-          # This is our method that actually taints the object our source_node
-          # targets.
-          def self.cs__apply_source context, source_node, target, object, ret, *args
-            return unless context
-
-            source_node_source = source_node.sources[0]
-            source_name = case source_node_source
-                          when nil
-                            nil
-                          when Contrast::Utils::ObjectShare::RETURN_KEY
-                            ret
-                          when Contrast::Utils::ObjectShare::OBJECT_KEY
-                            self
-                          else
-                            args[source_node_source]
-                          end
-            _cs__apply_source context, source_node, target, object, ret, source_node.type, source_name, 0, *args
-          end
-
-          # I lied above. We had to figure out what the target of the source was.
-          # Now that we know, we'll actually tag it.
-          def self._cs__apply_source context, source_node, target, object, ret, source_type, source_name = nil, invoked = 0, *args
-            return unless context && source_node && target
-
-            # We know we only work on certain things.
-            # Skip if this isn't one of them
-            if Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-
-              # don't apply second source -- probably needs tuning later if we
-              # use more than 'UNTRUSTED' in our sources
-              return if target.cs__tracked? || target.cs__frozen?
+            # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
+            # values back to ourselves and try again
+            #
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_hash_tags source_node, target, source_data, source_type, *args
+              target.each_pair do |key, value|
+                process_source(source_node, key, source_data, key_type(source_type), key, *args)
+                process_source(source_node, value, source_data, source_type, key, *args)
+              end
+            end
 
-              # otherwise for each tag this source_node applies, create a tag range
-              # on the target object
-              # I realize this looping is counter-intuitive from the above
-              # message, that's why we're revisiting.
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
+              # don't apply tags if we can't track the thing
+              return unless Contrast::Agent::Assess::Tracker.trackable?(target)
+              # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
+              return if Contrast::Agent::Assess::Tracker.tracked?(target)
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+              # otherwise for each tag this source_node applies, create a tag range on the target object. I realize
+              # this looping is counter-intuitive from the above message, that's why we're revisiting.
               source_node.tags.each do |tag|
+                next unless Contrast::Agent::Assess::Policy::SourceValidation.valid?(tag, source_type, source_name)
+
                 length = Contrast::Utils::StringUtils.ret_length(target)
-                target.cs__properties.add_tag(tag, Contrast::Agent::Assess::AdjustedSpan.new(0, length))
-                target.cs__properties.add_properties(source_node.properties)
-                logger.debug(nil, "Source #{ source_node.id } detected: #{ target.__id__ } tagged with #{ tag }")
+                properties.add_tag(tag, 0...length)
+                properties.add_properties(source_node.properties)
+                logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
-
               # make a representation of this method that TeamServer can render
-              target.cs__properties.build_event(source_node, target, object, ret, args, invoked, source_type, source_name)
-
-              # While we don't taint hashes themselves, we may taint the things
-              # they hold. Let's pass their keys and values back to ourselves and
-              # try again
-            elsif Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(target)
-              source_key_type = invoked.zero? ? key_type(source_type) : source_type
-              invoked += 1
-              to_replace = []
-              target.each_pair do |key, value|
-                # We only do this for Strings b/c of the way Hash lookup works.
-                # To replace another object would break hash lookup and,
-                # therefore, the application
-                if ASSESS.track_frozen_sources? &&
-                      key.is_a?(String) &&
-                      Contrast::Utils::DuckUtils.quacks_to?(target, :delete)
-                  key = Contrast::Utils::FreezeUtil.unfreeze_dup(key)
-                  to_replace << key
-                end
-                _cs__apply_source(context, source_node, key, object, ret, source_key_type, key, invoked, *args)
-                _cs__apply_source(context, source_node, value, object, ret, source_type, key, invoked, *args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
+            end
+
+            # Find the literal target of the propagation
+            #
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Object] the target to which this source event applies
+            def determine_target source_node, source_data, args
+              source_target = source_node.targets[0]
+              case source_target
+              when Contrast::Utils::ObjectShare::RETURN_KEY
+                source_data.ret
+              when Contrast::Utils::ObjectShare::OBJECT_KEY
+                source_data.object
+              else
+                args[source_target]
               end
+            end
 
-              # Hash is designed to keep one instance of the string key in it.
-              # We need to remove the existing one and replace it with our new
-              # tracked one.
-              to_replace.each do |key|
-                key.cs__freeze
-                value = target[key]
-                target.delete(key)
-                target[key] = value
+            # Simple helper method to flip the type from value to key when the source is the key of a Hash
+            #
+            # @param source_type [String] the original value source type
+            # @return [String] the key form of the source type, if one exists, else the original source type
+            def key_type source_type
+              case source_type
+              when PARAMETER_TYPE
+                PARAMETER_KEY_TYPE
+              when HEADER_TYPE
+                HEADER_KEY_TYPE
+              when COOKIE_TYPE
+                COOKIE_KEY_TYPE
+              else
+                source_type
               end
-              # While we don't taint arrays themselves, we may taint the things
-              # they hold. Let's pass their keys and values back to ourselves and
-              # try again
-            elsif Contrast::Utils::DuckUtils.quacks_like_tracked_enumerable?(target)
-              invoked += 1
-              target.each { |value| _cs__apply_source(context, source_node, value, object, ret, source_type, source_name, invoked, *args) }
             end
-          rescue StandardError => e
-            logger.warn(e, "Unable to apply source for source_node #{ source_node.id }")
-          end
 
-          # Silly helper method so that TeamServer can properly mark up
-          # the source of this trace, if this source ends up in a trigger
-          PARAMETER_TYPE     = 'PARAMETER'
-          PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
-          HEADER_TYPE        = 'HEADER'
-          HEADER_KEY_TYPE    = 'HEADER_KEY'
-          COOKIE_TYPE        = 'COOKIE'
-          COOKIE_KEY_TYPE    = 'COOKIE_KEY'
+            # Should a source be excluded because it matches one of the input exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_input? source_type, source_name
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_input?(context.request, source_type, source_name)
+            end
 
-          def self.key_type source_type
-            case source_type
-            when PARAMETER_TYPE
-              PARAMETER_KEY_TYPE
-            when HEADER_TYPE
-              HEADER_KEY_TYPE
-            when COOKIE_TYPE
-              COOKIE_KEY_TYPE
-            else
-              source_type
+            # Should a source be excluded because it matches one of the url exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_url?
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_url?(context.request)
             end
           end
         end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,30 +13,15 @@ module Contrast
         class SourceNode < PolicyNode
           attr_accessor :type
 
-          DB_SOURCE_TYPE = 'TAINTED_DATABASE'
-          def self.build_dynamic_source _id, dynamic_source
-            dynamic_source_hash = {
-                JSON_CLASS_NAME => dynamic_source.class_name,
-                JSON_METHOD_NAME => dynamic_source.method_name,
-                JSON_INSTANCE_METHOD => dynamic_source.instance_method,
-                JSON_TYPE => DB_SOURCE_TYPE,
-                JSON_METHOD_VISIBILITY => 'public',
-                JSON_TARGET => dynamic_source.target,
-                JSON_PROPERTIES => dynamic_source.properties
-            }
-            Contrast::Agent::Assess::Policy::SourceNode.new(dynamic_source_hash)
-          end
-
           JSON_TYPE = 'type'
-          JSON_SOURCE_NAME = 'source_name'
           SOURCE_TAG = 'UNTRUSTED'
+          SOURCE = 'Source'
           def initialize source_hash = {}
             super(source_hash)
             @type = source_hash[JSON_TYPE]
             @tags << SOURCE_TAG
           end
 
-          SOURCE = 'Source'
           def node_class
             SOURCE
           end
@@ -50,6 +35,7 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source and type
+          # @raise[ArgumentError] raises if any of the required fields is missing or invalid
           def validate
             super
             raise(ArgumentError, "Source #{ id } did not have a proper target. Unable to create.") unless targets&.any?