contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/request_context.rb

@@ -1,51 +1,66 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/comment_range'
-cs__scoped_require 'contrast/utils/inventory_util'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/timer'
+require 'contrast/agent/request'
+require 'contrast/agent/response'
+require 'contrast/agent/inventory/database_config'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/request_utils'
+require 'contrast/agent/request_context_extend'
+require 'contrast/agent/reporting/reporting_events/observed_route'
+require 'contrast/agent/reporting/input_analysis/input_analysis'
+require 'contrast/agent/reporting/reporting_events/application_activity'
 
 module Contrast
   module Agent
-    # This class acts to encapsulate information about the currently executed
-    # request, making it available to the Agent for the duration of the request
-    # in a standardized and normalized format which the Agent understands.
+    # This class acts to encapsulate information about the currently executed request, making it available to the Agent
+    # for the duration of the request in a standardized and normalized format which the Agent understands.
     class RequestContext
-      include Contrast::Components::Interface
-      access_component :logging, :analysis, :scope, :contrast_service
-
-      EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
-
-      attr_reader :timer,
-                  :speedracer_input_analysis,
-                  :request,
-                  :response,
-                  :activity,
-                  :server_activity,
-                  :route,
-                  :observed_route
-
-      def initialize rack_request, app_loaded = true
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
+      include Contrast::Utils::RequestUtils
+      include Contrast::Agent::RequestContextExtend
+
+      INPUT_ANALYSIS = Contrast::Agent::Reporting::InputAnalysis.new
+
+      # @return [Contrast::Agent::Reporting:ApplicationActivity] the application activity found in this request
+      attr_reader :activity
+      # @return [Hash] context used to log the request
+      attr_reader :logging_hash
+      # @return [Contrast::Agent::Reporting::ObservedRoute] the route, used for coverage, of this request
+      attr_reader :observed_route
+      # @return [Contrast::Agent::Request] our wrapper around the Rack::Request for this context
+      attr_reader :request
+      # @return [Contrast::Agent::Response] our wrapper around the Rack::Response or Array for this context,
+      #   only available after the application has finished its processing
+      attr_reader :response
+      # @return [Contrast::Agent::Reporting::RouteDiscovery] the route, used for findings, of this request
+      attr_reader :discovered_route
+      # @return [Contrast::Agent::Reporting::InputAnalysis]
+      attr_reader :agent_input_analysis
+      # @return [Array<String>] the hash of findings already reported fro this request
+      attr_reader :reported_findings
+      # @return [Contrast::Utils::Timer] when the context was created
+      attr_reader :timer
+
+      attr_accessor :propagation_event_count, :source_event_count
+
+      def initialize rack_request, app_loaded: true
         with_contrast_scope do
-          # all requests get a timer
+          # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new
+          @logging_hash = { request_id: __id__ }
 
           # instantiate helper for request and response
-          @request = Contrast::Agent::Request.new(rack_request)
-
-          @activity = Contrast::Api::Dtm::Activity.new
-          @activity.http_request = request.dtm
-
-          @server_activity = Contrast::Api::Dtm::ServerActivity.new
-
-          @observed_route = Contrast::Api::Dtm::ObservedRoute.new
+          @request = Contrast::Agent::Request.new(rack_request) if rack_request
+          @activity = Contrast::Agent::Reporting::ApplicationActivity.new
 
           # build analyzer
           @do_not_track = false
-          @speedracer_input_analysis = EMPTY_INPUT_ANALYSIS_PB
+          @agent_input_analysis = INPUT_ANALYSIS
+          agent_input_analysis.request = request
 
           # flag to indicate whether the app is fully loaded
           @app_loaded = !!app_loaded
@@ -53,13 +68,19 @@ module Contrast
           # generic holder for properties that can be set throughout this request
           @_properties = {}
 
-          @sample = true
+          # count of propagation events
+          @propagation_event_count = 0
 
-          @sample_request, @sample_response = Contrast::Utils::Assess::SamplingUtil.instance.sample?(@request) if ASSESS.enabled?
+          # count of source events
+          @source_event_count = 0
 
-          @sample_response &&= ASSESS.scan_response?
+          if ::Contrast::ASSESS.enabled?
+            @sample_req, @sample_res = Contrast::Utils::Assess::SamplingUtil.instance.sample?(@request)
+          end
 
-          append_route_coverage(Contrast::Utils::PathUtil.get_route(@request))
+          @reported_findings = []
+
+          handle_routes
         end
       end
 
@@ -67,105 +88,32 @@ module Contrast
         @app_loaded
       end
 
-      def analyze?
-        @sample_request || @sample_response
-      end
-
       def analyze_request?
-        @sample_request
+        analyze_request_assess? || analyze_req_res_protect?
       end
 
       def analyze_response?
-        @sample_response
+        analyze_response_assess? || analyze_req_res_protect?
       end
 
-      # Convert the discovered route for this request to appropriate forms and
-      # disseminate it to those locations where it is necessary for our route
-      # coverage and finding vulnerability discovery features to function.
-      def append_route_coverage route
-        return unless route
-
-        # For our findings
-        @route = route
-
-        # For SR findings
-        @activity.routes << route
-
-        # For TS routes
-        @observed_route.signature  = route.route
-        @observed_route.verb       = route.verb
-        @observed_route.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-
-        # TODO: SPEED-273: deprecate when SR handles this. ContrastUI API currently does not allow empty url, so we have to provide a default
-        @observed_route.url        = route.url.empty? ? Contrast::Utils::ObjectShare::SLASH : route.url
+      def analyze_req_res_protect?
+        ::Contrast::PROTECT.enabled?
       end
 
-      # Collect the results for the given rule with the given action
-      #
-      # @param rule [String] the id of the rule to which the results apply
-      # @param response_type [Symbol] the result of the response, matching a
-      #   value of Contrast::Api::Dtm::AttackResult::ResponseType
-      # @return [Array<Contrast::Api::Dtm::AttackResult>]
-      def results_for rule, response_type = nil
-        if response_type.nil?
-          activity.results.select { |r| r.rule_id == rule }
-        else
-          activity.results.select { |r| r.rule_id == rule && r.response == response_type }
-        end
-      end
+      def analyze_request_assess?
+        return false unless analyze_req_res_assess?
 
-      def service_extract_request
-        return false if @do_not_track
-
-        service_response = CONTRAST_SERVICE.send_message(@activity.http_request)
-        return false unless service_response
-
-        handle_protect_state(service_response)
-        ia = service_response.input_analysis
-        if ia
-          logger.debug(nil, "Analysis from Contrast Service: evaluations=#{ ia.results.length }")
-          logger.debug(nil, "IA=#{ ia.inspect }")
-          @speedracer_input_analysis = ia
-        else
-          logger.debug(nil, 'Analysis from Contrast Service was empty.')
-          false
-        end
-      rescue Contrast::SecurityException
-        raise
-      rescue StandardError => e
-        logger.warn(e, 'Unable to extract Contrast Service information from request')
-        false
+        @sample_req
       end
 
-      # NOTE: this method is only used as a backstop if Speedracer sends Input Evaluations
-      # when the protect state indicates a security exception should be thrown. This method
-      # ensures that the attack reports are generated. Normally these should be generated on
-      # Speedracer for any attacks detected during prefilter.
-      def handle_protect_state agent_settings
-        return unless agent_settings
-        return unless agent_settings.protect_state
-
-        @uuid = agent_settings.protect_state.uuid
-        @do_not_track = true unless agent_settings.protect_state.track_request
+      def analyze_response_assess?
+        return false unless analyze_req_res_assess?
 
-        return unless agent_settings.protect_state.security_exception
-
-        # If Contrast Service has NOT handled the input analysis, handle them here
-        build_attack_results(agent_settings)
-
-        msg = agent_settings.protect_state.security_message
-        logger.warn(nil, 'Contrast Service said to block this request')
-        raise Contrast::SecurityException.new(nil, (msg || 'Blocking suspicious behavior'))
+        @sample_res &&= ::Contrast::ASSESS.scan_response?
       end
 
-      # append anything we've learned to the request seen message
-      # this is the sum-total of all inventory information that has
-      # been accumulated since the last request
-      def extract_after rack_response
-        @response = Contrast::Agent::Response.new(rack_response)
-        activity.http_response = @response.dtm if @sample_response
-      rescue StandardError => e
-        logger.error(e, 'Unable to extract information after request')
+      def analyze_req_res_assess?
+        ::Contrast::ASSESS.enabled?
       end
 
       def add_property key, value
@@ -177,48 +125,16 @@ module Contrast
       end
 
       def reset_activity
-        @activity = Contrast::Api::Dtm::Activity.new(http_request: request.dtm)
-        @server_activity = Contrast::Api::Dtm::ServerActivity.new # it doesn't look like this is ever actually used?
-        @observed_route = Contrast::Api::Dtm::ObservedRoute.new
+        @activity = Contrast::Agent::Reporting::ApplicationActivity.new
+        @observed_route = Contrast::Agent::Reporting::ObservedRoute.new
       end
 
       private
 
-      # Generate attack results directly from any evaluations on the
-      # agent settings object.
-      def build_attack_results agent_settings
-        return unless agent_settings&.input_analysis&.results&.any?
-
-        attack_results_by_rule = {}
-        agent_settings.input_analysis.results.each do |ia_result|
-          rule_id = ia_result.rule_id
-          rule = PROTECT.rule(rule_id)
-          next unless rule
-
-          logger.debug(nil, "Building attack result from Contrast Service input analysis: result=#{ ia_result.inspect }")
-
-          attack_result = if rule.mode == :BLOCK
-                            # special case for rules (like reflected xss)
-                            # that used to have an infilter / block
-                            # mode but now are just block at perimeter
-                            rule.build_attack_with_match(
-                                self,
-                                ia_result,
-                                attack_results_by_rule[rule_id],
-                                ia_result.value)
-                          else
-                            rule.build_attack_without_match(
-                                self,
-                                ia_result,
-                                attack_results_by_rule[rule_id])
-                          end
-          attack_results_by_rule[rule_id] = attack_result
-        end
-
-        attack_results_by_rule.each_pair do |_, attack_result|
-          logger.debug(nil, "Blocking for #{ attack_result.rule_id }")
-          activity.results << attack_result
-        end
+      def handle_routes
+        @observed_route = Contrast::Agent::Reporting::ObservedRoute.new
+        reporting_route = Contrast::Agent.framework_manager.get_route_information(@request)
+        append_to_observed_route(reporting_route)
       end
     end
   end

data/lib/contrast/agent/request_context_extend.rb

@@ -0,0 +1,85 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/auto_complete_rule'
+require 'contrast/agent/assess/rule/response/cache_control_header_rule'
+require 'contrast/agent/assess/rule/response/click_jacking_header_rule'
+require 'contrast/agent/assess/rule/response/csp_header_insecure_rule'
+require 'contrast/agent/assess/rule/response/csp_header_missing_rule'
+require 'contrast/agent/assess/rule/response/hsts_header_rule'
+require 'contrast/agent/assess/rule/response/parameters_pollution_rule'
+require 'contrast/agent/assess/rule/response/x_content_type_header_rule'
+require 'contrast/agent/assess/rule/response/x_xss_protection_header_rule'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/components/logger'
+require 'contrast/utils/log_utils'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    # This class extends RequestContexts: this class acts to encapsulate information about the currently
+    # executed request, making it available to the Agent for the duration of the request in a standardized
+    # and normalized format which the Agent understands.
+    module RequestContextExtend
+      include Contrast::Utils::CEFLogUtils
+      include Contrast::Components::Logger::InstanceMethods
+      # Convert the discovered route for this request to appropriate forms and disseminate it to those locations
+      # where it is necessary for our route coverage and finding vulnerability discovery features to function.
+      #
+      # @param route [Contrast::Agent::Reporting::RouteCoverage]
+      def append_to_observed_route route
+        return unless route
+
+        @observed_route.signature  = route.route
+        @observed_route.verb       = route.verb
+        @observed_route.url        = route.url if route.url
+        @request.observed_route    = @observed_route
+
+        observation = Contrast::Agent::Reporting::RouteDiscoveryObservation.new(route.url, route.verb)
+        @discovered_route = Contrast::Agent::Reporting::RouteDiscovery.new(route.route, observation)
+        @request.discovered_route = @discovered_route
+      end
+
+      # If protect is enabled for this request, examine said request for any possible attack input. If those inputs
+      # provided match a rule which should block at the perimeter, that will be raised here.
+      #
+      # @raise [Contrast::SecurityException]
+      def protect_input_analysis
+        return false unless ::Contrast::AGENT.enabled?
+        return false unless ::Contrast::PROTECT.enabled?
+        return false if @do_not_track
+
+        if (ia = Contrast::Agent::Protect::InputAnalyzer.analyse(request))
+          @agent_input_analysis = ia
+        else
+          logger.trace('Analysis from Agent was empty.')
+        end
+      rescue Contrast::SecurityException => e
+        raise(e)
+      rescue StandardError => e
+        logger.warn('Unable to extract protect information from request', e)
+      end
+
+      # append anything we've learned to the request seen message this is the sum-total of all inventory information
+      # that has been accumulated since the last request
+      def extract_after rack_response
+        # We must ALWAYS save the response, even if we don't need it here for response sampling. It is used for other
+        # vulnerability detection, most notably XSS, and not capturing it may suppress valid findings.
+        @response = Contrast::Agent::Response.new(rack_response)
+        return unless @sample_res
+
+        Contrast::Agent::Assess::Rule::Response::AutoComplete.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CacheControl.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::ClickJacking.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderMissing.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderInsecure.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::HSTSHeader.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::ParametersPollution.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XContentType.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XXssProtection.new.analyze(@response)
+      rescue StandardError => e
+        logger.error('Unable to extract information after request', e)
+      end
+    end
+  end
+end

data/lib/contrast/agent/request_handler.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporter'
+require 'contrast/agent/reporting/masker/masker'
+
+module Contrast
+  module Agent
+    # This class is instantiated when we receive a request and the agent is enabled to process that request. It holds
+    # the ruleset that we perform filtering operations on (currently prefilter and postfilter).
+    class RequestHandler
+      include Contrast::Components::Logger::InstanceMethods
+
+      attr_reader :ruleset, :context
+
+      # @param context [Contrast::Agent::RequestContext] the context of the request for which this handler applies
+      def initialize context
+        @context = context
+        @ruleset = ::Contrast::AGENT.ruleset
+      end
+
+      # reports events[Contrast::Agent::Reporting::ObservedRoute] to TS
+      # Other ReportingEvents are handled through batching in the middleware
+      #
+      def report_observed_route
+        return unless (reporter = Contrast::Agent.reporter)
+
+        reporter.send_event(context.observed_route) if Contrast::ROUTES_SENT.sendable?(context.observed_route)
+      end
+
+      # If the response is streaming, we should only perform filtering on our stream safe rules
+      def stream_safe_postfilter
+        stream_safe_ruleset = ruleset.select(&:stream_safe?)
+        postfilter_ruleset = Contrast::Agent::RuleSet.new(stream_safe_ruleset)
+        postfilter_ruleset.postfilter
+      end
+    end
+  end
+end

data/lib/contrast/agent/response.rb

@@ -1,14 +1,14 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/comment_range'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/logger'
+require 'contrast/utils/response_utils'
 
 module Contrast
   module Agent
@@ -17,11 +17,13 @@ module Contrast
     # data in a format that the Agent expects, caching those transformations in
     # order to avoid repeatedly creating Strings & thrashing GC.
     class Response
-      include Contrast::Components::Interface
-      access_component :logging
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Utils::ResponseUtils
 
       extend Forwardable
 
+      # @return [Array, Rack::Response] The Rack Response passed by the application & middleware. It can be an Array
+      #   in format [response_code, header_hash, response_body] or an instance of Rack::Response
       attr_reader :rack_response
 
       def initialize rack_response
@@ -29,6 +31,9 @@ module Contrast
         @is_array = !rack_response.is_a?(Rack::Response)
       end
 
+      # The document type of the response, based on its Content-Type. Can be one of :JSON, :NORMAL, :XML, or nothing.
+      #
+      # @return [Symbol<:XML, :JSON, :NORMAL>, nil]
       def document_type
         case content_type
         when /xml/i
@@ -40,175 +45,42 @@ module Contrast
         end
       end
 
-      # B/c the response can change, we can't memoize this :(
-      def dtm
-        context_response = Contrast::Api::Dtm::HttpResponse.new
-        context_response.response_code = response_code.to_i
-        headers.each_pair do |key, value|
-          k = Contrast::Utils::StringUtils.force_utf8(key)
-          v = Contrast::Utils::StringUtils.force_utf8(value)
-          context_response.response_headers[k] = v
-        end
-        context_response.parsed_response_headers = true
-
-        context_response.response_body = Contrast::Utils::StringUtils.force_utf8(body)
-        context_response.parsed_response_body = true
-
-        doc_type = document_type
-        context_response.document_type = doc_type if doc_type
-
-        context_response
-      end
-
+      # The response code of this response
+      #
+      # @return [Integer]
       def response_code
-        return unless @rack_response
+        return unless rack_response
 
-        @is_array ? @rack_response[0].to_i : @rack_response.status
+        @is_array ? rack_response[0].to_i : rack_response.status
       end
 
+      # The headers of this response
+      #
+      # @return [Hash, nil]
       def headers
-        return unless @rack_response
+        return unless rack_response
 
-        if @is_array
-          @rack_response[1]
-        else
-          @rack_response.headers
-        end
+        @is_array ? rack_response[1] : rack_response.headers
       end
 
-      # Header keys upcased and any underscores replaced with dashes
-      # We cannot memoize this, b/c response headers can change during the
-      # request lifecycle.
-      def normalized_headers
-        hash = {}
-        headers.each_pair do |header_name, header_value|
-          hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-        end
-        hash
-      end
-
-      CONTENT_TYPE_HEADER = 'CONTENT-TYPE'.cs__freeze
+      # The Content-Type of this response, as set in the headers hash under the key Rack::CONTENT_TYPE
+      #
+      # @return [String, nil]
       def content_type
-        return unless @rack_response
+        return unless rack_response
 
-        if @is_array
-          normalized_headers[CONTENT_TYPE_HEADER]
-        else
-          @rack_response.content_type
-        end
+        @is_array ? headers[Rack::CONTENT_TYPE] : rack_response.content_type
       end
 
-      def header key
-        return unless @rack_response
-
-        if @is_array
-          normalized_headers[Contrast::Utils::StringUtils.normalized_key(key)]
-        else
-          @rack_response.get_header(key)
-        end
-      end
-
-      def set_header key, value
-        return unless @rack_response
-
-        if @is_array
-          Rack::Utils.set_cookie_header!(@rack_response[1], key, value)
-        elsif @rack_response.is_a?(Rack::Response)
-          @rack_response.set_header(key, value)
-        end
-      end
-
-      # The response body can change during the request lifecycle
-      # We should not extract it out as a variable here, or we'll miss those
-      # changes. (headdesk)
+      # The response body can change during the request lifecycle, so we have to look it up every time we need it.
+      # We should not extract it out as a variable here, or we'll miss those changes.
+      #
+      # @return [String, nil]
       def body
-        return unless @rack_response
+        return unless rack_response
 
-        if @is_array
-          extract_body(@rack_response[2])
-        elsif Contrast::Utils::DuckUtils.quacks_to?(@rack_response, :body)
-          extract_body(@rack_response.body)
-        end
-      end
-
-      def update_body body_string
-        return unless @rack_response
-
-        successfully_updated_body = true
-        if @is_array
-          if @rack_response[2].is_a?(Rack::BodyProxy)
-            successfully_updated_body = update_rack_body_proxy(body_string, true)
-          else
-            @rack_response[2] = [body_string]
-          end
-        elsif @rack_response.body.is_a?(Rack::BodyProxy)
-          successfully_updated_body = update_rack_body_proxy(body_string)
-        else
-          @rack_response.body = body_string
-        end
-        update_content_length(body_string.bytesize) if successfully_updated_body
-      end
-
-      # Set the length header for this response. This value should be set ot the
-      # bytesize, NOT THE LENGTH, of the response body. Otherwise, we may get
-      # got by the Lint thing.
-      CONTENT_LENGTH_HEADER = 'Content-Length'.cs__freeze
-      def update_content_length length
-        headers[CONTENT_LENGTH_HEADER] = length.to_s
-      end
-
-      private
-
-      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
-
-      def update_rack_body_proxy body_string, is_array = false
-        top_body_proxy = is_array ? @rack_response[2] : @rack_response
-        parent_body_proxy = top_body_proxy
-        until (next_body = parent_body_proxy.instance_variable_get(:@body)).cs__class != Rack::BodyProxy
-          parent_body_proxy = next_body
-        end
-
-        if next_body.cs__class.to_s == 'ActionDispatch::Response::RackBody'
-          modified_response = next_body.instance_variable_defined?(:@response) ? next_body.instance_variable_get(:@response) : nil
-          if modified_response
-            modified_response.body = body_string
-            next_body.instance_variable_set(:@response, modified_response)
-          end
-        elsif next_body.is_a?(Array) && next_body[0].cs__class.to_s == 'ActionView::OutputBuffer'
-          new_body = ActionView::OutputBuffer.new(body_string)
-          next_body[0] = new_body
-        else
-          logger.warn("Detected unsupported Rack::BodyProxy internal response class #{ next_body.cs__class }")
-          return false
-        end
-        true
-      end
-
-      def extract_body body
-        return nil unless body
-
-        if defined?(Rack::File) && body.is_a?(Rack::File)
-          # not sure what to do in this situation, so don't do anything.
-          nil
-        elsif Contrast::Utils::DuckUtils.quacks_to?(body, :each)
-          acc = []
-          body.each { |tmp| acc << read_or_string(tmp) }
-          acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
-        else
-          read_or_string(body)
-        end
-      end
-
-      def read_or_string obj
-        return nil unless obj
-
-        if Contrast::Utils::DuckUtils.quacks_to?(obj, :read)
-          tmp = obj.read
-          obj.rewind
-          tmp
-        else
-          obj.to_s
-        end
+        body_content = @is_array ? rack_response[2] : rack_response.body
+        extract_body(body_content)
       end
     end
   end