contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/disable_reaction.rb

@@ -1,23 +1,19 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
     # A Reaction from TeamServer which indicates the Agent should be disabled,
     # typically because some configuration setting did not satisfy requirements
     # set by the Organization's Administrator
-    class DisableReaction
-      include Contrast::Components::Interface
-      access_component :logging, :agent
+    module DisableReaction
+      extend Contrast::Components::Logger::InstanceMethods
 
       def self.run _reaction, level
-        logger.with_level(
-            nil,
-            'Contrast received instructions to disable itself - Disabling now',
-            level)
-        AGENT.disable!
+        logger.with_level(level, 'Contrast received instructions to disable itself - Disabling now')
+        ::Contrast::AGENT.disable!
       end
     end
   end

data/lib/contrast/agent/excluder.rb

@@ -0,0 +1,224 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/url_exclusion'
+
+module Contrast
+  module Agent
+    # Given an array of exclusion matcher instances provides methods to
+    # determine if the exclusions apply to particular urls.
+    class Excluder # rubocop:disable Metrics/ClassLength
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      attr_reader :exclusions
+
+      # @param exclusions [Array<Contrast::Agent::ExclusionMatcher>]
+      def initialize exclusions = []
+        @exclusions = exclusions
+      end
+
+      # If an assess URL exclusion rule applies to the current url, *and* is defined as "All Rules"
+      # then we can avoid any tracking for the request.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @return [Boolean]
+      def assess_excluded_by_url? request
+        request_path = request.path
+
+        assess_url_exclusions_for_all_rules.any? do |exclusion_matcher|
+          path_match?(exclusion_matcher, request_path)
+        end
+      end
+
+      # If an assess URL exclusion rule applies to the current url, *and* also covers the
+      # provided rule_id, then we can avoid tracking this entry.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param rule_id [String]
+      # return [Boolean]
+      def assess_excluded_by_url_and_rule? request, rule_id
+        request_path = request.path
+
+        assess_url_exclusions.any? do |exclusion_matcher|
+          path_match?(exclusion_matcher, request_path) &&
+              (exclusion_matcher.assess_rules.empty? || exclusion_matcher.assess_rules.include?(rule_id))
+        end
+      end
+
+      # If an assess INPUT exclusion rule applies to the current url, *and* also covers all
+      # rules, then we can avoid tracking this entry.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param source_type [String]
+      # @param source_name [String]
+      # return [Boolean]
+      def assess_excluded_by_input? request, source_type, source_name
+        request_path = request.path
+
+        assess_input_exclusions_for_all_rules.any? do |exclusion_matcher|
+          input_match?(exclusion_matcher, source_type, source_name) && path_match?(exclusion_matcher, request_path)
+        end
+      end
+
+      # If an assess INPUT exclusion rule covers the provided rule_id *for all finding event sources*, then we
+      # can avoid tracking this entry. If any event source *isn't excluded* then we don't exclude the finding.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param finding [Contrast::Agent::Reporting::Finding]
+      # @param rule [String]
+      # return [Boolean]
+      def assess_excluded_by_input_and_rule? request, finding, rule
+        return false if finding.events.empty?
+
+        # We need to check for url exclusions here for the input rules as the url exclusions
+        # that have already been checked didn't include the INPUT exclusions. So we look for
+        # any INPUT exclusions that apply to the current url and the supplied rule.
+        path = request.path
+        rule_input_exclusions = assess_input_exclusions.select do |exclusion_matcher|
+          (exclusion_matcher.protection_rules.empty? || exclusion_matcher.protection_rules.include?(rule)) &&
+              path_match?(exclusion_matcher, path)
+        end
+        return false if rule_input_exclusions.empty?
+
+        event_sources = finding.events.flat_map(&:event_sources)
+        event_sources.each do |event_source|
+          return false unless rule_input_exclusions.any? do |exclusion|
+            input_match?(exclusion, event_source.source_type, event_source.source_name)
+          end
+        end
+
+        # If we reach here, and we have event sources then all of them matched so we should exclude
+        # this finding. On the other hand, if there were no event sources we have nothing to exclude.
+        event_sources.any?
+      end
+
+      # If a protect URL exclusion rule applies to the current url, *and* is defined as "All Rules"
+      # then we can avoid using the rule for the request.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # return [Boolean]
+      def protect_excluded_by_url? request
+        request_path = request.path
+
+        protect_url_exclusions_for_all_rules.any? do |exclusion_matcher|
+          path_match?(exclusion_matcher, request_path)
+        end
+      end
+
+      private
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_url_exclusions_for_all_rules
+        @_assess_url_exclusions_for_all_rules ||= assess_url_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.assess_rules.empty?
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_url_exclusions
+        @_assess_url_exclusions ||= assess_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.type == :URL
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_input_exclusions_for_all_rules
+        @_assess_input_exclusions_for_all_rules ||= assess_input_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.assess_rules.empty?
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_input_exclusions
+        @_assess_input_exclusions ||= assess_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.type == :INPUT
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_exclusions
+        @_assess_exclusions ||= @exclusions.select(&:assess)
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_url_exclusions_for_all_rules
+        @_protect_url_exclusions_for_all_rules ||= protect_url_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.protect_rules.empty?
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_url_exclusions
+        @_protect_url_exclusions ||= protect_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.type == :URL
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_exclusions
+        @_protect_exclusions ||= @exclusions.select(&:protect)
+      end
+
+      # @return [Boolean]
+      def path_match? exclusion_matcher, path
+        exclusion_matcher.wildcard_url || exclusion_matcher.urls.any? { |url| url.match?(path) }
+      end
+
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_type [String]
+      # @param source_name [String]
+      # @return [Boolean]
+      def input_match? exclusion, source_type, source_name
+        case exclusion.input_type
+        when 'PARAMETER'
+          input_match_parameter?(exclusion, source_type, source_name)
+        when 'COOKIE'
+          input_match_cookie?(exclusion, source_type, source_name)
+        when 'HEADER'
+          input_match_header?(exclusion, source_type, source_name)
+        when 'BODY'
+          Contrast::Agent::Assess::Policy::SourceMethod::BODY_TYPE == source_type
+        when 'QUERYSTRING'
+          Contrast::Agent::Assess::Policy::SourceMethod::QUERYSTRING_TYPE == source_type
+        else
+          false
+        end
+      end
+
+      def input_match_parameter? exclusion, source_type, source_name
+        return false unless [
+          Contrast::Agent::Assess::Policy::SourceMethod::PARAMETER_TYPE,
+          Contrast::Agent::Assess::Policy::SourceMethod::PARAMETER_KEY_TYPE
+        ].include?(source_type)
+
+        exclusion.wildcard_input || (exclusion.input_name == source_name) || regexp_match?(exclusion.input_name,
+                                                                                           source_name)
+      end
+
+      def input_match_cookie? exclusion, source_type, source_name
+        return false unless [
+          Contrast::Agent::Assess::Policy::SourceMethod::COOKIE_TYPE,
+          Contrast::Agent::Assess::Policy::SourceMethod::COOKIE_KEY_TYPE
+        ].include?(source_type)
+
+        exclusion.wildcard_input || exclusion.input_name == source_name || regexp_match?(exclusion.input_name,
+                                                                                         source_name)
+      end
+
+      def input_match_header? exclusion, source_type, source_name
+        return false unless [
+          Contrast::Agent::Assess::Policy::SourceMethod::HEADER_TYPE,
+          Contrast::Agent::Assess::Policy::SourceMethod::HEADER_KEY_TYPE
+        ].include?(source_type)
+
+        exclusion.wildcard_input || exclusion.input_name.casecmp(source_name).zero? || regexp_match?(
+            exclusion.input_name, source_name)
+      end
+
+      def regexp_match? possible_pattern, source_name
+        Regexp.new("^#{ possible_pattern }$").match?(source_name)
+      rescue RegexpError
+        false
+      end
+    end
+  end
+end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,7 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/settings/exclusion_base'
+require 'contrast/agent/reporting/settings/code_exclusion'
+require 'contrast/agent/reporting/settings/input_exclusion'
+require 'contrast/agent/reporting/settings/url_exclusion'
 
 module Contrast
   module Agent
@@ -9,17 +13,34 @@ module Contrast
     # the Application. If a request or an event matches one of these, the
     # functions of the Agent are suppressed for that request or event.
     class ExclusionMatcher
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
 
+      extend Forwardable
+
+      attr_reader :protect, :assess, :type, :urls, :wildcard_url, :wildcard_input
+
+      def_delegators :@exclusion, :protect_rules, :assess_rules, :input_type, :input_name
+
+      # Create a matcher around an exclusion sent from TeamServer.
+      #
+      # @param excl [Contrast::Agent::Reporting::Settings::ExclusionBase]
+      # @return [Contrast::Agent::ExclusionMatcher]
       def initialize excl
         @exclusion = excl
         @protect = @exclusion.protect
         @assess = @exclusion.assess
 
-        handle_wildcard_input
-        handle_wildcard_url
-        handle_wildcard_code
+        case excl
+        when Contrast::Agent::Reporting::Settings::CodeExclusion
+          handle_wildcard_code
+          @type = :CODE
+        when Contrast::Agent::Reporting::Settings::InputExclusion
+          handle_wildcard_input
+          @type = :INPUT
+        when Contrast::Agent::Reporting::Settings::UrlExclusion
+          handle_wildcard_url
+          @type = :URL
+        end
       end
 
       # According to the docs for exclusions, user input applies to all inputs if
@@ -43,12 +64,12 @@ module Contrast
         return if @wildcard_url
         return unless @exclusion.urls&.any?
 
-        @wildcard_url ||= @exclusion.urls.any? { |test| test == '/.*' }
+        @wildcard_url ||= @exclusion.urls.any?('/.*')
         return if @wildcard_url
 
         @urls = []
         @exclusion.urls.each do |url|
-          url_pattern = build_regexp(url, true, true)
+          url_pattern = build_regexp(url, start_anchor: true, end_anchor: true)
           @urls << url_pattern if url_pattern
         end
       end
@@ -58,12 +79,12 @@ module Contrast
       # Contrast UI, these comparisons must be done at the end of the input.
       # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
       def handle_wildcard_code
-        return unless @exclusion.blacklist&.any?
+        return unless @exclusion.denylist&.any?
 
         @wildcard_exclusions = []
-        @exclusion.blacklist.each do |code|
+        @exclusion.denylist.each do |code|
           class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
-          class_pattern = build_regexp(class_name, false, true)
+          class_pattern = build_regexp(class_name, start_anchor: false, end_anchor: true)
           method_pattern = build_regexp(method_name)
           next unless class_pattern && method_pattern
 
@@ -71,12 +92,12 @@ module Contrast
         end
       end
 
-      def build_regexp pattern, start_anchor = false, end_anchor = false
+      def build_regexp pattern, start_anchor: false, end_anchor: false
         pattern = Contrast::Utils::ObjectShare::CARROT + pattern if start_anchor
         pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
         Regexp.compile(pattern)
       rescue RegexpError => e
-        logger.error(e, "Unable to generate a pattern for #{ pattern }. It will not be used for exclusion matching.")
+        logger.error('Unable to generate a pattern for exclusion matching.', e, pattern: pattern)
       end
 
       def protect?
@@ -87,36 +108,21 @@ module Contrast
         @assess
       end
 
-      def url?
-        @exclusion.type == :URL
-      end
-
-      def input?
-        @exclusion.type == :INPUT
-      end
-
       def code?
-        @exclusion.type == :CODE
-      end
-
-      def name
-        @exclusion.name
+        @type == :CODE
       end
 
       def match_all?
-        @exclusion.match_strategy == :ALL
+        @exclusion.urls.nil? || @exclusion.urls.empty?
       end
 
       # Determine if the given rule is excluded by this exclusion.
-      # In this case, the `protection_rules` being empty means apply to all rules,
+      # In this case, the `protect_rules` being empty means apply to all rules,
       # not no rules
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def protection_rule? rule
-        protect? &&
-            (@exclusion.protection_rules.empty? ||
-                @exclusion.protection_rules.include?(rule)
-            )
+        protect? && (@exclusion.protect_rules.empty? || @exclusion.protect_rules.include?(rule))
       end
 
       # Determine if the given rule is excluded by this exclusion.
@@ -125,47 +131,7 @@ module Contrast
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def assess_rule? rule
-        assess? &&
-            (@exclusion.assessment_rules.empty? ||
-                @exclusion.assessment_rules.include?(rule)
-            )
-      end
-
-      def match_url? url
-        return false unless url?
-        return true if @wildcard_url
-
-        @urls.any? { |test| url.match?(test) }
-      end
-
-      def match_input? value, type
-        return false unless input?
-
-        exclusion_type = @exclusion.input_type
-        case type
-        when :PARAMETER_NAME, :PARAMETER_VALUE
-          return exclusion_type == :PARAMETER && value_match?(value)
-        when :COOKIE_NAME, :COOKIE_VALUE
-          return exclusion_type == :COOKIE && value_match?(value)
-        when :HEADER
-          return exclusion_type == :HEADER && value_match?(value, false)
-        when :BODY
-          return exclusion_type == :BODY
-        when :QUERYSTRING
-          return exclusion_type == :QUERYSTRING
-        end
-
-        false
-      end
-
-      def value_match? value, case_sensitive = true
-        return true if @wildcard_input
-
-        if case_sensitive
-          value == @exclusion.input_name
-        else
-          @exclusion.input_name.casecmp(value).zero?
-        end
+        assess? && (@exclusion.assessment_rules.empty? || @exclusion.assessment_rules.include?(rule))
       end
 
       def match_code? stack_trace

data/lib/contrast/agent/inventory/database_config.rb

@@ -0,0 +1,174 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Methods used for parsing database connection configurations
+      # for getting inventory information from the application
+      module DatabaseConfig
+        extend Contrast::Components::Logger::InstanceMethods
+
+        # TeamServer only accepts certain values for FlowMap Services.
+        # DO NOT CHANGE THIS
+        ADAPTER = 'adapter'
+        HOST = 'host'
+        PORT = 'port'
+        DATABASE = 'database'
+        DEFAULT = 'default'
+        LOCALHOST = 'localhost'
+
+        class << self
+          # Append the available database connection information to the message being sent to TeamServer.
+          #
+          # @param activity_or_update [Contrast::Agent::Reporting::ApplicationUpdate]
+          # @param hash_or_str [Hash, String] the database connection information
+          def append_db_config activity_or_update, hash_or_str = active_record_config
+            arr = build_from_db_config(hash_or_str)
+            return unless arr&.any?
+
+            arr.each do |component|
+              next unless component
+
+              if activity_or_update.cs__is_a?(Contrast::Agent::Reporting::ApplicationUpdate)
+                activity_or_update.components << component
+              else
+                activity_or_update.attach_inventory(component)
+              end
+            end
+          rescue StandardError => e
+            logger.warn('Unable to append db config', e)
+            nil
+          end
+
+          private
+
+          # We capture the active record configuration used by this application, as reported by
+          # ActiveRecord::Base.connection_db_config, so that we can record it once and report it as needed.
+          #
+          # @return [Hash]
+          def active_record_config
+            return @_active_record_config if instance_variable_defined?(:@_active_record_config)
+
+            @_active_record_config = if ActiveRecord::Base.cs__respond_to?(:connection_db_config)
+                                       ActiveRecord::Base.connection_db_config
+                                     else
+                                       # TODO: RUBY-99999 - Remove when Rails 6.0 is not supported
+                                       ActiveRecord::Base.connection_config
+                                     end
+          rescue StandardError => e
+            logger.error('Unable to detect db config connection', e)
+            nil
+          end
+
+          # The classes we instrument in order to determine which, if any, database(s) an application connects to take
+          # either a Hash or a String as a parameter. We install this one patch into all of those methods, letting our
+          # code here, rather than at the patch level, make the determination of which path to call. We'll make that
+          # decision and then parse the given configuration to create a
+          # Contrast::Agent::Reporting::ArchitectureComponent for reporting.
+          #
+          # @param hash_or_str [Hash, String]
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>, nil]
+          def build_from_db_config hash_or_str
+            return unless hash_or_str
+
+            # we need to handle types of HashConfig, which != Hash
+            # for example ActiveRecord::DatabaseConfigurations::HashConfig is type of active_record config
+            # but the method is not handling it properly
+            # so we need to handle it here and extract the hash
+            hash_or_str = hash_or_str.configuration_hash if hash_or_str.cs__respond_to?(:configuration_hash)
+            if hash_or_str.is_a?(Hash)
+              build_from_db_hash(hash_or_str)
+            else
+              build_from_db_string(hash_or_str.to_s)
+            end
+          end
+
+          # Convert the Hash used to create a database connection into a
+          # Contrast::Agent::Reporting::ArchitectureComponent understandable by TeamServer.
+          #
+          # @param hash [Hash] the information used to open a database connection
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+          def build_from_db_hash hash
+            ac = Contrast::Agent::Reporting::ArchitectureComponent.build_database
+            ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
+            ac.remote_host = host_from_hash(hash)
+            ac.remote_port = port_from_hash(hash)
+            ac.url = hash[:database] || hash[DATABASE] || DEFAULT
+            [ac]
+          end
+
+          # Retrieve the host from the given connection Hash
+          #
+          # @param hash [Hash]
+          # @return [String]
+          def host_from_hash hash
+            hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Retrieve the port from the given connection Hash
+          #
+          # @param hash [Hash]
+          # @return [integer]
+          def port_from_hash hash
+            p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
+            p.to_i
+          end
+
+          # Examples:
+          # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
+          # postgresql://scott:tiger@localhost/mydatabase # pragma: allowlist secret
+          # mysql+mysqlconnector://scott:tiger@localhost/foo # pragma: allowlist secret
+          #
+          # @param str [String] the DB connection string
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>, nil]
+          def build_from_db_string str
+            adapter, hosts, database = split_connection_str(str)
+            return unless adapter && hosts && database
+
+            acs = []
+            hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
+              host, port = s.split(Contrast::Utils::ObjectShare::COLON)
+
+              ac = Contrast::Agent::Reporting::ArchitectureComponent.build_database
+              ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
+              ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
+              ac.remote_port = port.to_i
+              ac.url = Contrast::Utils::StringUtils.force_utf8(database)
+              acs << ac
+            end
+            acs
+          end
+
+          # Parse the given string used to connect to a database into its composite components, allowing for the
+          # generation of a Contrast::Agent::Reporting::ArchitectureComponent
+          #
+          # @param str [String] the DB connection string
+          # @return [Array<String>, nil] the adapter, hosts, and database
+          def split_connection_str str
+            adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
+            return unless str
+
+            _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
+            return unless str
+
+            # Not currently used
+            # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
+            hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
+            return unless db_and_options
+
+            hosts << LOCALHOST if hosts.empty?
+            database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
+
+            [adapter, hosts, database]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependencies.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # this module is included in classes that need access to the applications dependencies
+      module Dependencies
+        CONTRAST_AGENT = 'contrast-agent'
+
+        # the #clone is necessary here, as a require in another thread could
+        # potentially result in adding a key to the loaded_specs hash during
+        # iteration.  (as in RUBY-330)
+        # this takes care of filtering out contrast-only dependencies
+        def loaded_specs
+          specs = Gem.loaded_specs.clone
+          specs.delete_if { |name, _v| contrast?(name) }
+        end
+
+        private
+
+        def contrast_gems
+          @_contrast_gems ||= find_contrast_gems
+        end
+
+        def contrast? name
+          contrast_gems.include?(name)
+        end
+
+        # Go through all dependents, given as a pair from the DependencyList: `dependency`
+        # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
+        # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
+        # then contrast depends on it. If its array of dependents is 1, then contrast is the
+        # only dependency in that list. Since only contrast depends on it, we should ignore it.
+        def find_contrast_gems
+          # rubocop:disable Security/Module/Name -- here name is part of Ruby Gems.
+          ignore = Set.new([CONTRAST_AGENT])
+          contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
+            dependency.name == CONTRAST_AGENT
+          end
+          contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
+
+          Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
+            ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
+          end
+          ignore
+          # rubocop:enable Security/Module/Name
+        end
+      end
+    end
+  end
+end