contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,7 +1,12 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/reporting/details/xxe_details'
+require 'contrast/agent/reporting/details/xxe_match'
+require 'contrast/agent/reporting/details/xxe_wrapper'
+require 'contrast/utils/timer'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -10,51 +15,72 @@ module Contrast
         # Implementation of the XXE Protect Rule used to evaluate XML calls for exploit
         # of unsafe external entity resolution.
         class Xxe < Contrast::Agent::Protect::Rule::Base
+          include Contrast::Components::Logger::InstanceMethods
+          INPUT_NAME = 'XML Prolog'
+
           NAME = 'xxe'
-          EXPLOIT_CHARACTERS = Contrast::Utils::ObjectShare::EMPTY_ARRAY
           BLOCK_MESSAGE = 'XXE rule triggered. Response blocked.'
           EXTERNAL_ENTITY_PATTERN = /<!ENTITY\s+[a-zA-Z0-f]+\s+(?:SYSTEM|PUBLIC)\s+(.*?)>/.cs__freeze
 
-          def name
+          def rule_name
             NAME
           end
 
+          # Given an xml, evaluate it for an XXE attack. There's no return here
+          # as this method handles appending the evaluation to the request
+          # context, connecting it to the reporting mechanism at request end.
+          #
+          # @param context [Contrast::Agent::RequestContext] the context of the
+          #   request in which this input is evaluated.
+          # @param framework [Object] the name of the Parser being used.
+          # @param xml [Object] the container of the XML to be checked.
+          # @raise [Contrast::SecurityException] Security exception if an XXE
+          #   attack is found and the rule is in block mode.
           def infilter context, framework, xml
+            return if protect_excluded_by_url?(context)
+
             result = find_attacker(context, xml, framework: framework)
-            return nil unless result
+            return unless result
 
             append_to_activity(context, result)
             return unless blocked?
 
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE)
+            cef_logging(result, :successful_attack, value: xml)
+            raise(Contrast::SecurityException.new(self, BLOCK_MESSAGE))
           end
 
           protected
 
-          def find_attacker context, xml, **kwargs
-            return nil unless xml
-            return nil if protect_excluded_by_code?
+          # Given an XML, find any externally resolved entities and create an
+          # Attack Result for them
+          #
+          # @param context [Contrast::Agent::RequestContext] the context of the
+          #   request in which this input is evaluated.
+          # @param xml [String] the literal value of the XML being checked for
+          #   external entity resolution
+          # @param _kwargs [Hash]
+          # @return [Contrast::Agent::Reporting, nil] the determination
+          #   as to whether or not this XML has an XXE attack in it.
+          def find_attacker context, xml, **_kwargs
+            return unless xml
+            return if protect_excluded_by_code?
+
+            xxe_details = build_details(xml)
+            return unless xxe_details
 
-            logger.debug("checking: #{ name } in '#{ kwargs[:framework] }'")
-
-            xxe_details, last_idx = build_details(xml)
-            return nil unless xxe_details
-
-            # For our definition, the prolog goes from the start of the XML
-            # string to the end of the last entity declaration.
-            xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx])
             ia_result = build_evaluation(xxe_details.xml)
-            result = build_attack_with_match(
-                context,
-                ia_result,
-                nil,
-                nil,
-                details: xxe_details)
-
-            result
+            build_attack_with_match(context, ia_result, nil, nil, details: xxe_details)
           end
 
-          def build_details xml, _evaluation = nil
+          # Given an XML determined to be unsafe, build out the details of the
+          # attack. The details will include a substring of the given XML up to
+          # the end of the prolog, where the external entities are declared.
+          #
+          # @param xml [String] the literal value of the XML being checked for
+          #   external entity resolution
+          # @return [Contrast::Api::Dtm::XxeDetails] The details of
+          #   the XXE attack and the index of the last entity discovered
+          def build_details xml
             last_idx = 0
             ss = StringScanner.new(xml)
             while ss.scan_until(EXTERNAL_ENTITY_PATTERN)
@@ -62,22 +88,26 @@ module Contrast
               entity_wrapper = Contrast::Agent::Protect::Rule::Xxe::EntityWrapper.new(ss.matched)
               next unless entity_wrapper.external_entity?
 
-              xxe_details ||= Contrast::Api::Dtm::XxeDetails.new
+              xxe_details ||= Contrast::Agent::Reporting::Details::XxeDetails.new
               xxe_details.declared_entities << build_match(ss)
               xxe_details.entities_resolved << build_wrapper(entity_wrapper)
             end
-            [xxe_details, last_idx]
+            # For our definition, the prolog goes from the start of the XML
+            # string to the end of the last entity declaration.
+            xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx]) if xxe_details
+
+            xxe_details
           end
 
           def build_sample context, ia_result, _url, **kwargs
             sample = build_base_sample(context, ia_result)
-            sample.xxe = kwargs[:details]
+            sample.user_input = build_user_input(ia_result)
+            sample.details = kwargs[:details]
             sample
           end
 
-          INPUT_NAME = 'XML Prolog'
           def build_user_input ia_result
-            input = Contrast::Api::Dtm::UserInput.new
+            input = Contrast::Agent::Reporting::UserInput.new
             input.key = INPUT_NAME
             input.input_type = :UNKNOWN
             input.document_type = :XML
@@ -90,27 +120,27 @@ module Contrast
           # We know that this attack happened, so the result is always matched
           # and the level is always critical. Only variable is the XML value
           # supplied by the attacker.
+          #
+          # @return [Contrast::Agent::Reporting::InputAnalysisResult]
           def build_evaluation xml
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.rule_id = name
+            ia_result = Contrast::Agent::Reporting::InputAnalysisResult.new
+            ia_result.rule_id = rule_name
             ia_result.input_type = :UNKNOWN
             ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(xml)
             ia_result
           end
 
           def build_match string_scanner
-            match = Contrast::Api::Dtm::XxeMatch.new
+            match = Contrast::Agent::Reporting::Details::XxeMatch.new
             match.end_idx = string_scanner.pos.to_i
             match.start_idx = match.end_idx - string_scanner.matched_size
             match
           end
 
           def build_wrapper entity_wrapper
-            wrapper = Contrast::Api::Dtm::XxeWrapper.new
-            wrapper.system_id = Contrast::Utils::StringUtils.protobuf_safe_string(
-                entity_wrapper.system_id)
-            wrapper.public_id = Contrast::Utils::StringUtils.protobuf_safe_string(
-                entity_wrapper.public_id)
+            wrapper = Contrast::Agent::Reporting::Details::XxeWrapper.new
+            wrapper.system_id = Contrast::Utils::StringUtils.protobuf_safe_string(entity_wrapper.system_id)
+            wrapper.public_id = Contrast::Utils::StringUtils.protobuf_safe_string(entity_wrapper.public_id)
             wrapper
           end
         end

data/lib/contrast/agent/protect/rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -15,44 +15,41 @@ module Contrast
 end
 
 # The classes required for All Rasp Rules
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base_service'
 
 # The classes required for the XSS Rasp Rule
-cs__scoped_require 'contrast/agent/protect/rule/xss'
+require 'contrast/agent/protect/rule/xss'
 
 # The classes required for the SQLI
-cs__scoped_require 'contrast/agent/protect/rule/default_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
-cs__scoped_require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
+require 'contrast/agent/protect/rule/default_scanner'
+require 'contrast/agent/protect/rule/sqli'
+require 'contrast/agent/protect/rule/sqli/default_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/mysql_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/postgres_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/sqlite_sql_scanner'
+require 'contrast/agent/protect/rule/sqli/sqli_semantic/sqli_dangerous_functions'
 
 # The classes required for Path Traversal
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
+require 'contrast/agent/protect/rule/path_traversal'
 
-# The classes required for Command Injection
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
-
-# The classes required for CSRF
-cs__scoped_require 'contrast/agent/protect/rule/csrf'
-cs__scoped_require 'contrast/agent/protect/rule/csrf/csrf_evaluator'
-cs__scoped_require 'contrast/agent/protect/rule/csrf/csrf_token_injector'
+# The classes required for Command Injection and sub-rules
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/rule/cmdi/cmdi_backdoors'
 
 # The classes required for XXE
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/agent/protect/rule/xxe/entity_wrapper'
+require 'contrast/agent/protect/rule/xxe'
+require 'contrast/agent/protect/rule/xxe/entity_wrapper'
 
 # The classes required for Untrusted Deserialization
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/rule/deserialization'
 
 # The classes required for the NoSQLi
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner'
 
 # The classes required for Http Method Tampering
-cs__scoped_require 'contrast/agent/protect/rule/http_method_tampering'
+require 'contrast/agent/protect/rule/http_method_tampering'
 
 # The classes required for Unsafe File Upload
-cs__scoped_require 'contrast/agent/protect/rule/unsafe_file_upload'
+require 'contrast/agent/protect/rule/unsafe_file_upload'

data/lib/contrast/agent/reporting/attack_result/attack_result.rb

@@ -0,0 +1,71 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/timer'
+require 'contrast/agent/reporting/attack_result/response_type'
+require 'contrast/agent/reporting/attack_result/rasp_rule_sample'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the new Attacks results generated by our
+      # protect rules.
+      class AttackResult
+        RESPONSE_TYPE = Contrast::Agent::Reporting::ResponseType
+        # Generated the attack result
+        #
+        # @return @_response_type [Contrast::Agent::Reporting::ResponseType]
+        def response
+          @_response ||= RESPONSE_TYPE::NO_ACTION
+        end
+
+        # sets the response_type
+        #
+        # @param response_type [Contrast::Agent::Reporting::Settings::InputAnalysisResult]
+        # @return @_response_type []
+        def response= response_type
+          @_response = response_type if RESPONSE_TYPE.to_a.include?(response_type)
+        end
+
+        # @return @_rule_id [String]
+        def rule_id
+          @_rule_id ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param rule_id [String]
+        # @return @_rule_id [String]
+        def rule_id= rule_id
+          @_rule_id = rule_id if rule_id.is_a?(String)
+        end
+
+        # @return @_samples [Array<Contrast::Agent::Reporting::RaspRuleSample>]
+        def samples
+          @_samples ||= []
+        end
+
+        # @param samples [Array<Contrast::Agent::Reporting::RaspRuleSample>]
+        # @return @_samples [Array<Contrast::Agent::Reporting::RaspRuleSample>]
+        def samples= samples
+          @_samples = samples if samples.is_a?(Array)
+        end
+
+        def tags
+          @_tags ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        def tags= tags
+          @_tags = tags if tags.is_a?(String)
+        end
+
+        def details
+          @_details ||= {}
+        end
+
+        def details= protect_details
+          @_details = protect_details if protect_details.is_a?(Contrast::Agent::Reporting::Details::ProtectRuleDetails)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb

@@ -0,0 +1,86 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/timer'
+require 'contrast/agent/reporting/attack_result/user_input'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/details/protect_rule_details'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample_stack'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the new RaspRuleSample.
+      # It is mainly used to build samples for each
+      # protect rule, and translate data from SP IA.
+      # It is not a reporting event.
+      class RaspRuleSample
+        # Any rules specific details
+        #
+        # @return [Contrast::Agent::Reporting::Details::ProtectRuleDetails, nil]
+        attr_accessor :details
+
+        class << self
+          # @param context [Contrast::Agent::RequestContext]
+          # @param ia_result [Contrast::Agent::Reporting::Settings::InputAnalysisResult] the analysis of the input that
+          #   was determined to be an attack
+          # @return [Contrast::Agent::Reporting::RaspRuleSample]
+          def build context, ia_result
+            sample = new
+            sample.time_stamp = context&.timer&.start_ms || Contrast::Utils::Timer.now_ms
+            sample.user_input = build_user_input_from_ia(ia_result)
+            sample.user_input.document_type = if context&.request
+                                                Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
+                                              end
+            sample
+          end
+
+          # @param ia_result [Contrast::Agent::Reporting::Settings::InputAnalysisResult] the analysis of the input that
+          #   was determined to be an attack
+          def build_user_input_from_ia ia_result
+            user_input = Contrast::Agent::Reporting::UserInput.new
+            return user_input unless ia_result
+
+            user_input.input_type = ia_result.input_type
+            user_input.matcher_ids = ia_result.ids
+            user_input.path = ia_result.path
+            user_input.key = ia_result.key if ia_result.key
+            user_input.value = ia_result.value if ia_result.value
+            user_input
+          end
+        end
+
+        def time_stamp
+          @_time_stamp ||= Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
+        end
+
+        def time_stamp= timestamp_ms
+          @_time_stamp = timestamp_ms
+        end
+
+        def user_input
+          @_user_input ||= Contrast::Agent::Reporting::UserInput.new
+        end
+
+        def user_input= input
+          @_user_input = input if input.is_a?(Contrast::Agent::Reporting::UserInput)
+        end
+
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>,Array]
+        def stack
+          @_stack ||= []
+        end
+
+        def to_controlled_hash
+          {
+              timeStamp: Time.at(time_stamp).iso8601,
+              userInput: user_input.to_controlled_hash,
+              details: details&.to_controlled_hash,
+              stack: stack.map(&:to_controlled_hash)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/attack_result/response_type.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the response types used to generate
+      # attack result.
+      module ResponseType
+        BLOCKED               = :BLOCKED.cs__freeze
+        MONITORED             = :MONITORED.cs__freeze
+        PROBED                = :PROBED.cs__freeze
+        BLOCKED_AT_PERIMETER  = :BLOCKED_AT_PERIMETER.cs__freeze
+        SUSPICIOUS            = :SUSPICIOUS.cs__freeze
+        AGGREGATED            = :AGGREGATED.cs__freeze
+        EXPLOITED             = :EXPLOITED.cs__freeze
+        NO_ACTION             = :NO_ACTION.cs__freeze
+
+        class << self
+          def to_a
+            [NO_ACTION, BLOCKED, MONITORED, PROBED, BLOCKED_AT_PERIMETER, EXPLOITED, SUSPICIOUS, AGGREGATED]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/attack_result/user_input.rb

@@ -0,0 +1,98 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/request_context'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the new Sqli detail used by RaspRuleSample
+      class UserInput
+        INPUT_TYPE = Contrast::Agent::Reporting::InputType
+        DOCUMENT_TYPE = { XML: :XML, JSON: :JSON, NORMAL: :NORMAL }.cs__freeze
+
+        # @return @_path [String]
+        def path
+          @_path ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param path [String]
+        # @return @_path [String]
+        def path= path
+          @_path = path if path.is_a?(String)
+        end
+
+        # @return @_key [String]
+        def key
+          @_key ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param key [String]
+        # @return @_key [String]
+        def key= key
+          @_key = key if key.is_a?(String)
+        end
+
+        # @return value [String]
+        def value
+          @_value ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param value [String]
+        # @return value [String]
+        def value= value
+          @_value = value if value.is_a?(String)
+        end
+
+        # @return @_input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        def input_type
+          @_input_type ||= INPUT_TYPE::UNDEFINED_TYPE
+        end
+
+        # @param input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        # @return @_input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        def input_type= input_type
+          @_input_type = input_type if INPUT_TYPE.to_a.include?(input_type)
+        end
+
+        # type [Symbol<:XML, :JSON, :NORMAL>]
+        def document_type
+          @_document_type ||= DOCUMENT_TYPE[:NORMAL]
+        end
+
+        def document_type= type
+          @_document_type = type if DOCUMENT_TYPE.value?(type)
+        end
+
+        # Matchers IDs
+        # @return @_ids [Array<String>]
+        def matcher_ids
+          @_matcher_ids ||= []
+        end
+
+        # Matchers IDs
+        # @param ids [Array<String>]
+        # @return @_ids [Array<String>]
+        def matcher_ids= ids
+          @_matcher_ids = ids if ids.is_a?(Array) && ids.any?(String)
+        end
+
+        def to_controlled_hash
+          {
+              path: path,
+              key: key,
+              value: value,
+              inputType: input_type.to_s,
+              documentType: document_type.to_s,
+              matcherIds: matcher_ids&.map(&:to_s)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/bot_blocker_details.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Bot blocker IA result details info.
+        class BotBlockerDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :bot
+          # User agent header value
+          #
+          # @return [String]
+          attr_accessor :user_agent
+
+          def to_controlled_hash
+            {
+                bot: bot,
+                userAgent: user_agent
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/cmd_injection_details.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # CMDI IA result details info.
+        class CmdInjectionDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :cmd
+          # @return [Integer]
+          attr_accessor :start_idx
+          # @return [Integer]
+          attr_accessor :end_idx
+
+          def to_controlled_hash
+            {
+                command: cmd,
+                startIndex: start_idx,
+                endIndex: end_idx
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/details.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/bot_blocker_details'
+require 'contrast/agent/reporting/details/cmd_injection_details'
+require 'contrast/agent/reporting/details/http_method_tempering_details'
+require 'contrast/agent/reporting/details/no_sqli_details'
+require 'contrast/agent/reporting/details/path_traversal_details'
+require 'contrast/agent/reporting/details/protect_rule_details'
+require 'contrast/agent/reporting/details/sqli_details'
+require 'contrast/agent/reporting/details/untrusted_deserialization_details'
+require 'contrast/agent/reporting/details/xss_match'
+require 'contrast/agent/reporting/details/xss_details'
+require 'contrast/agent/reporting/details/xxe_details'
+require 'contrast/agent/reporting/details/xxe_match'
+require 'contrast/agent/reporting/details/xxe_wrapper'
+require 'contrast/agent/reporting/details/virtual_patch_details'
+require 'contrast/agent/reporting/details/ip_denylist_details'

data/lib/contrast/agent/reporting/details/http_method_tempering_details.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # HttpMethodTemperingDetails IA result details info.
+        class HttpMethodTemperingDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :method
+          # @return [Integer]
+          attr_accessor :response_code
+
+          def to_controlled_hash
+            {
+                method: method, # rubocop:disable Security/Object/Method
+                responseCode: response_code
+            }
+          end
+        end
+      end
+    end
+  end
+end