contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/framework/rack/support.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
+
+module Contrast
+  module Framework
+    module Rack
+      # Used when Rack is present to define framework specific behavior. For
+      # now, the only part of this implemented is the Patch Support.
+      module Support
+        extend Contrast::Framework::BaseSupport
+        extend Contrast::Framework::Rack::Patch::Support
+        class << self
+          def detection_class
+            'rack -- don\'t let me be detected'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/dependency_usage_analysis'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This class acts as our patch into the ActionController::Live::Buffer class, allowing us to track the close
+        # event on streamed responses.
+        module ActionControllerLiveBuffer
+          class << self
+            def send_messages
+              return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+              [
+                context.observed_route
+              ].each do |event|
+                Contrast::Agent.reporter&.send_event_immediately(event)
+              end
+
+              Contrast::Agent.reporter&.send_event_immediately(context.activity)
+            end
+
+            def instrument
+              @_instrument ||= begin
+                ::ActionController::Live::Buffer.class_eval do
+                  # normally pre->in->post filters are applied however, in a streamed response we can run into a case
+                  # where it's pre -> in -> post -> more infilters in order to submit anything found during the
+                  # infilters after the response has been written we need to explicitly send them
+                  alias_method(:cs__close, :close)
+                  def close
+                    Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                    cs__close
+                  end
+                end
+                true
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -0,0 +1,98 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/invalid_configuration_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This module is used to analyze rails session storage configuration for assess vulnerabilities
+        module AssessConfiguration
+          include Contrast::Components::Logger::InstanceMethods
+
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
+
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def analyze_session_store *args
+              return if ::Contrast::ASSESS.forcibly_disabled?
+
+              apply_httponly_disabled(*args)
+              apply_secure_cookie_disabled(*args)
+              apply_session_timeout(*args)
+            end
+
+            private
+
+            def vulnerable_setting?(setting_key,
+                                    safe_settings_value,
+                                    original_args,
+                                    safe_default: true,
+                                    comparison_type: nil)
+              # In most cases, Rails is pretty nice and the default value is safe
+              return !safe_default unless original_args && original_args.length > 1
+
+              # If the user overrode some args, but not ours, fall back on the default
+              rails_session_settings = original_args[1]
+              return !safe_default unless rails_session_settings&.key?(setting_key)
+
+              value = rails_session_settings[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_session_timeout *args
+              return if ::Contrast::ASSESS.rule_disabled?(CS__SESSION_TIMEOUT_NAME)
+              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args,
+                                                comparison_type: :greater_than, safe_default: false)
+
+              rails_session_settings = args[1]
+              cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(3, 2)[0])
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_secure_cookie_disabled *args
+              return if ::Contrast::ASSESS.rule_disabled?(CS__SECURE_RULE_NAME)
+              return unless vulnerable_setting?(:secure, true, args)
+
+              rails_session_settings = args[1]
+              cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable secure cookies', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly_disabled *args
+              return if ::Contrast::ASSESS.rule_disabled?(CS__HTTPONLY_RULE_NAME)
+              return unless vulnerable_setting?(:httponly, true, args)
+
+              rails_session_settings = args[1]
+              cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(3, 2)[0])
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable httponly in session cookie', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/rails/patch/assess_configuration'
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Our patch into the Rails::Application::Configuration Class, allowing
+        # for the runtime detection of insecure configurations on individual
+        # ActionDispatch::Session::AbstractStore instances within the
+        # application.
+        module RailsApplicationConfiguration
+          def self.instrument
+            @_instrument ||= begin
+              ::Rails::Application::Configuration.class_eval do
+                alias_method(:cs__patched_session_store, :session_store)
+                def session_store *args, **kwargs
+                  ret = cs__patched_session_store(*args, **kwargs)
+                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args, **kwargs)
+                  ret
+                end
+              end
+              true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/support.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rails framework.
+        module Support
+          # (See BaseSupport#before_load_patches!)
+          def before_load_patches!
+            return unless defined?(::Rails)
+
+            # In Rails, session configuration occurs extremely early & only once.
+            # If we defer our patching of the rails session configuration too long
+            # (i.e., where we normally patch) we will miss the configuration
+            # and will never be able to report session misconfiguration rules.
+            Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
+            require('contrast/framework/rails/railtie') if ::Rails::VERSION::MAJOR.to_i >= 3
+          end
+
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActionController::Live::Buffer',
+                          'contrast/framework/rails/patch/action_controller_live_buffer',
+                          instrumenting_module:
+                            'Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Rails::Application::Configuration',
+                          'contrast/framework/rails/patch/rails_application_configuration',
+                          method_to_instrument: :session_store,
+                          instrumenting_module:
+                            'Contrast::Framework::Rails::Patch::RailsApplicationConfiguration')
+                    ])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/railtie.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/job_servers_running'
+require 'contrast/components/logger'
+
+module Contrast
+  module Framework
+    module Rails
+      # A Railtie to allow for the automatic hooking of the Agent into a Rails application.
+      class Railtie < ::Rails::Railtie
+        include Contrast::Components::Logger::InstanceMethods
+
+        initializer 'Contrast Ruby Agent Initializer' do |app|
+          log_rails = defined?(Rails) && defined?(Rails.logger)
+
+          Rails.logger.debug { "In railtie ::#{ app.middleware.inspect }" } if log_rails
+
+          if ::Contrast::APP_CONTEXT.instrument_middleware_stack?
+            ::Contrast::AGENT.insert_middleware(app)
+          else
+            Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.') if log_rails
+            logger.debug('Disabling Contrast for process', p_id: Process.pid)
+          end
+        end
+
+        rake_tasks do
+          load 'contrast/tasks/config.rb'
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/support.rb

@@ -0,0 +1,187 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/base_support'
+require 'contrast/framework/rails/patch/support'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Framework
+    module Rails
+      # Used when Rails is present to define framework specific behavior
+      class Support # rubocop:disable Metrics/ClassLength
+        extend Contrast::Framework::BaseSupport
+        extend Contrast::Framework::Rails::Patch::Support
+        include Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Logger::InstanceMethods
+
+        class << self
+          RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
+
+          def detection_class
+            'Rails'
+          end
+
+          def version
+            ::Rails.version
+          end
+
+          def application_name
+            app_class = ::Rails.application.cs__class
+            # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed
+            # entirely and instead we need to use parent_module_name
+            return app_class.parent_module_name if Gem::Version.new(::Rails.version) >= RAILS_MODULE_NAME_VERSION
+
+            app_class.parent_name
+          end
+
+          def application_root
+            ::Rails.root
+          end
+
+          def server_type
+            'rails'
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+          def collect_routes
+            find_all_routes(::Rails.application, [])
+          end
+
+          # Find the current route, based on the provided Request wrapper
+          #
+          # @param request[Contrast::Agent::Request]
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request
+            return unless ::Rails.cs__respond_to?(:application)
+
+            # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
+            match, _params, route, path = get_full_route(request.rack_request)
+            unless route
+              logger.warn("Unable to determine the current route of this request: #{ request.rack_request }")
+              return
+            end
+
+            original_url = request.rack_request.path_info
+            mounted_app = route&.app&.app
+            # Route is either the final rails route, or a router that points to a Sinatra controller.
+            if mounted_app && Contrast::Framework::Sinatra::Support.sinatra_controller?(mounted_app)
+              return mounted_new_sinatra_route(request, match, path, route, original_url)
+            end
+            if mounted_app && Contrast::Framework::Grape::Support.grape_controller?(mounted_app)
+              return mounted_new_grape_route(request, match, path, route, original_url)
+            end
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage&.attach_rails_data(route, original_url)
+            new_route_coverage
+          rescue StandardError => e
+            logger.warn('Unable to determine the current route of this request due to exception: ', e)
+            nil
+          end
+
+          # Copy a request for modification.
+          #
+          # @param env [::ActionDispatch::Request] original env.
+          # @return [::ActionDispatch::Request] a copy of original env with rails env merged.
+          def retrieve_request env
+            rails_env = ::Rails.application.env_config.merge(env)
+            ::ActionDispatch::Request.new(rails_env || env)
+          end
+
+          AC_INSTANCE = 'action_controller.instance'
+          def streaming? env
+            return false unless defined?(::ActionController::Live)
+
+            env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
+          end
+
+          private
+
+          # Determine if route is a Rails engine route.
+          #
+          # @param route [Object] app or route that points to a ::Rails::Engine
+          # @return [Boolean, nil] whether the router is an engine or not.
+          def engine_route? route
+            return false unless route&.app&.app
+            return false unless route.app.is_a?(::ActionDispatch::Routing::Mapper::Constraints) ||
+                route.app.is_a?(::ActionDispatch::Routing::RouteSet::Dispatcher)
+
+            clazz = route.app.app.is_a?(Class) ? route.app.app : route.app.app.cs__class
+            clazz < ::Rails::Engine
+          end
+
+          # Recursively get final route traversing engines as required. Because this can only be called once, we store
+          # this match for the duration of our request context.
+          #
+          # @param request [::Rack::Request] the rack request as will be handed to rails controller.
+          # @param top_router [::ActionDispatch::Journey::Router] the current router relative to the previous.
+          # @param path [Array<String>] the chunks of path that have been seen.
+          # @return [Array<Object>] the final set of rails route classes.
+          #   ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
+          def get_full_route request, top_router = ::Rails.application.routes.router, path = []
+            return if (route_matches = top_router.send(:find_routes, request)).empty?
+
+            match, params, route = route_matches.first
+
+            # If the current routing node points to a sub-app (::Rails::Engine), dive deeper.
+            # Have sub-app route the remainder of the url.
+            if engine_route?(route)
+              new_req = retrieve_request(request.env)
+              new_req.path_info = new_req.path_info.gsub(match.to_s, '')
+              get_full_route(new_req, route.app.app.routes.router, path << match.to_s)
+            else
+              [match, params, route, path]
+            end
+          end
+
+          # Rails engine routes need to be detected by inspecting Engine class route set
+          #
+          # @param app [Rails::Application]
+          # @param route_list [Array<Contrast::Agent::Reporting::DiscoveredRoute>] the list of discovered routes to
+          #   which to append and return
+          # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+          def find_all_routes app, route_list
+            return route_list unless app.cs__respond_to?(:routes) && app.routes.cs__respond_to?(:routes)
+
+            app.routes.routes.each do |route|
+              if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
+                route_list << Contrast::Agent::Reporting::DiscoveredRoute.from_action_dispatch_journey(route)
+              elsif route.app.app.cs__respond_to?(:routes)
+                route_list += find_all_routes(route.app.app, [])
+              end
+            end
+            logger.debug("Routes Found: #{ route_list }")
+            route_list
+          end
+
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_sinatra_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Sinatra::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_grape_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Grape::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
+          # Create a request copied from current request, but with the base path removed from path_info, as that's
+          # the mount.
+          #
+          # @param request[Contrast::Agent::Request]
+          # @param match []
+          # @param path [String] the path of this request
+          # @return [::ActionDispatch::Request]
+          def unmounted_route request, match, path
+            new_req = ::ActionDispatch::Request.new(request.env)
+            new_req.path_info = new_req.path_info.gsub((path << match).join, '')
+            new_req
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/support.rb

@@ -0,0 +1,165 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/base_support'
+require 'contrast/agent/reporting/report'
+
+module Contrast
+  module Framework
+    module Sinatra
+      # Used when Sinatra is present to define framework specific behavior
+      class Support
+        extend Contrast::Framework::BaseSupport
+        class << self
+          def detection_class
+            'Sinatra'
+          end
+
+          def version
+            ::Sinatra::VERSION
+          end
+
+          def application_name
+            app_class&.cs__name
+          end
+
+          def application_root
+            app_instance&.root
+          end
+
+          def server_type
+            'sinatra'
+          end
+
+          # Given an object, determine if it is a Sinatra controller with routes.
+          #
+          # @param app [Object] suspected Sinatra app.
+          # @return [Boolean]
+          def sinatra_controller? app
+            # Sinatra is loaded?
+            return false unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+            # App is a subclass of or actually is ::Sinatra::Base.
+            return false unless (app.cs__respond_to?(:<) && app < ::Sinatra::Base) || app == ::Sinatra::Base
+
+            # App has routes.
+            !app.routes.empty?
+          end
+
+          # Find all classes that subclass ::Sinatra::Base. Gather their routes.
+          #
+          # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+          def collect_routes
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            routes = []
+            sinatra_controllers.each do |controller|
+              controller.routes.each_pair do |method, route_triplets|
+                # Sinatra stores its routes as a triplet: [Mustermann::Sinatra, [], Proc]
+                route_triplets.map(&:first).each do |route_pattern|
+                  routes << Contrast::Agent::Reporting::DiscoveredRoute.from_sinatra_route(controller, method,
+                                                                                           route_pattern)
+                end
+              end
+            end
+            routes
+          end
+
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Sinatra::Base] optionally use this controller instead of global ::Sinatra::Base.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Sinatra::Base, full_route = nil
+            return unless sinatra_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find route match--checking superclasses if necessary.
+            final_controller, route_pattern = _route_recurse(controller, method, _cleaned_route(request))
+            return unless final_controller && route_pattern
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data(final_controller, method, route_pattern, full_route)
+            new_route_coverage
+          end
+
+          # Search object space for sinatra controllers--any class that subclasses ::Sinatra::Base.
+          #
+          # @return [Array<::Sinatra::Base>] sinatra controlelrs
+          def sinatra_controllers
+            [::Sinatra::Base] + ObjectSpace.each_object(Class).select { |clazz| sinatra_controller?(clazz) }
+          end
+
+          def retrieve_request env
+            ::Sinatra::Request.new(env)
+          end
+
+          private
+
+          # Given a controller and a route to match against, find the route_pattern and class that will serve the
+          # route. This is recursive as Sinatra's routing is recursive from subclass to super.
+          #
+          # @param controller [Sinatra::Base, #routes] a Sinatra application.
+          # @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
+          # @param route [String] the relative route passed from Rack.
+          # @return [Array[Sinatra::Base, Mustermann::Sinatra], nil] Either the controller that
+          # will handle the route along with the route pattern or nil if no match.
+          def _route_recurse controller, method, route
+            return if controller.nil? || controller.cs__class == NilClass
+
+            route_patterns = controller.routes.fetch(method) { [] }.
+                map(&:first)
+            route_pattern = route_patterns&.find do |matcher|
+              matcher.params(route) # ::Mustermann::Sinatra match.
+            end
+
+            return controller, route_pattern if route_pattern
+
+            # Check routes defined in superclass if present.
+            return unless controller.superclass&.instance_variable_get(:@routes)
+
+            _route_recurse(controller.superclass, method, route)
+          end
+
+          # Get route and do some cleanup matching that of Sinatra::Base#process_route.
+          #
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @return [String] the extracted and cleaned relative route.
+          def _cleaned_route request
+            settings = ::Sinatra::Base.settings
+            route = request.env[::Rack::PATH_INFO]
+            return '/' if route.empty? && !settings.empty_path_info?
+
+            !settings.strict_paths? && route.end_with?('/') ? route[0..-2] : route
+          end
+
+          # Almost an alias to app_instance.
+          #
+          # @return [::Sinatra::Base] the current controller class as routed by Rack.
+          def app_class
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            app_instance.cs__class
+          end
+
+          # Search the object space for the controller handling this request which will be
+          # the class inheriting from ::Sinatra::Base with @app=nil since it is the final servicer
+          # in the request/middleware chain.
+          #
+          # @return [::Sinatra::Base] the current controller as routed by Rack.
+          def app_instance
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            @_app_instance ||= begin
+              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+              sinatra_layers.find { |layer| layer.app.nil? }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/funchook/funchook.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+# This module is used to find funchook library and determine availability
+module Funchook
+  extend Contrast::Components::Logger::InstanceMethods
+
+  attr_accessor :path
+
+  # Possible platform library files
+  ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
+
+  # Top level agent directories that should have the funchook libraries
+  SEARCH_DIRS = [File.join('ext'), File.join('shared_libraries'), File.join('funchook', 'src')].cs__freeze
+
+  AGENT_ROOT = File.join(__dir__, '..', '..', '..')
+
+  class << self
+    def resolve_path!
+      actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+        load_path = absolute_path(potential_funchook_path)
+        File.exist?(load_path)
+      end
+
+      if actual_path_segments.nil?
+        logger.warn('Unable to find funchook')
+      else
+        @path = absolute_path(actual_path_segments)
+        logger.info('Funchook found', path: @path)
+      end
+      @path
+    end
+
+    def absolute_path path_array
+      File.absolute_path(File.join(AGENT_ROOT, *path_array))
+    end
+
+    def available?
+      @_available = !!resolve_path! if @_available.nil?
+      @_available
+    end
+  end
+end