contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,7 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Assess
@@ -12,13 +15,18 @@ module Contrast
         # untrusted data (indicate points in the application where user
         # controlled input is modified).
         class PropagationNode < PolicyNode
+          include Contrast::Components::Logger::InstanceMethods
+
           JSON_ACTION = 'action'
           JSON_UNTAGS = 'untags'
           JSON_PATCH_CLASS = 'patch_class'
           JSON_PATCH_METHOD = 'patch_method'
 
-          attr_accessor :action, :untags, :patch_class, :patch_method
+          attr_reader :action, :untags, :patch_method
+          attr_accessor :patch_class
 
+          TAGGER = 'Tagger'
+          PROPAGATOR = 'Propagator'
           # Most things here carry over from PolicyNode.
           # A couple things are new / have new rules
           #
@@ -36,11 +44,11 @@ module Contrast
             @patch_method = propagation_hash[JSON_PATCH_METHOD]
             @patch_method = @patch_method.to_sym if @patch_method
             validate
+          rescue ArgumentError => e
+            logger.error('Propagation Node Initialization failed with: ', e)
+            nil
           end
 
-          TAGGER = 'Tagger'
-          PROPAGATOR = 'Propagator'
-
           def node_class
             @_node_class ||= tagger? ? TAGGER : PROPAGATOR
           end
@@ -54,59 +62,62 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source, target, and action
+          # @raise[ArgumentError] raises if any of the required propagation node field is not valid, or is missing
           def validate
             super
             raise(ArgumentError, "Propagator #{ id } did not have a proper action. Unable to create.") unless action
 
             if @action == 'CUSTOM'
-              raise(ArgumentError, "Propagator #{ id } did not have a proper patch_class. Unable to create.") unless patch_class
-              raise(ArgumentError, "Propagator #{ id } did not have a proper patch_method. Unable to create.") unless patch_method.is_a?(Symbol)
+              unless patch_class
+                raise(ArgumentError, "Propagator #{ id } did not have a proper patch_class. Unable to create.")
+              end
+              unless patch_method.is_a?(Symbol)
+                raise(ArgumentError, "Propagator #{ id } did not have a proper patch_method. Unable to create.")
+              end
             else
-              raise(ArgumentError, "Propagator #{ id } did not have a proper target. Unable to create.") unless targets&.any?
-              raise(ArgumentError, "Propagator #{ id } did not have a proper source. Unable to create.") unless sources&.any?
+              unless targets&.any?
+                raise(ArgumentError, "Propagator #{ id } did not have a proper target. Unable to create.")
+              end
+              unless sources&.any?
+                raise(ArgumentError, "Propagator #{ id } did not have a proper source. Unable to create.")
+              end
             end
             validate_untags
           end
 
+          # @raise[ArgumentError] raises if any of the tags is invalid
           def validate_untags
             return unless untags
 
             untags.each do |tag|
-              raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.") unless VALID_TAGS.include?(tag)
-              raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.") if tags&.include?(tag)
+              unless Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag)
+                raise(ArgumentError,
+                      "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.")
+              end
+              if tags&.include?(tag)
+                raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.")
+              end
             end
           end
 
           def needs_object?
-            @_needs_object ||= begin
-              if action == Contrast::Agent::Assess::Policy::PropagationMethod::CUSTOM_ACTION
-                true
-              elsif action == Contrast::Agent::Assess::Policy::PropagationMethod::DB_WRITE_ACTION
-                true
-              elsif sources.any? { |source| source == Contrast::Utils::ObjectShare::OBJECT_KEY }
-                true
-              elsif targets.any? { |target| target == Contrast::Utils::ObjectShare::OBJECT_KEY }
-                true
-              else
-                false
-              end
+            if @_needs_object.nil?
+              @_needs_object = action == Contrast::Utils::Assess::PropagationMethodUtils::CUSTOM_ACTION ||
+                  action == Contrast::Utils::Assess::PropagationMethodUtils::DB_WRITE_ACTION ||
+                  sources.any?(Contrast::Utils::ObjectShare::OBJECT_KEY) ||
+                  targets.any?(Contrast::Utils::ObjectShare::OBJECT_KEY)
             end
+            @_needs_object
           end
 
           def needs_args?
-            @_needs_args ||= begin
-              if action == Contrast::Agent::Assess::Policy::PropagationMethod::CUSTOM_ACTION
-                true
-              elsif action == Contrast::Agent::Assess::Policy::PropagationMethod::DB_WRITE_ACTION
-                true
-              elsif sources.any? { |source| source.is_a?(Integer) || source.is_a?(Symbol) }
-                true
-              elsif targets.any? { |target| target.is_a?(Integer) || target.is_a?(Symbol) }
-                true
-              else
-                false
-              end
+            if @_needs_args.nil?
+              @_needs_args = action == Contrast::Utils::Assess::PropagationMethodUtils::CUSTOM_ACTION ||
+                  action == Contrast::Utils::Assess::PropagationMethodUtils::DB_WRITE_ACTION ||
+                  sources.any? { |source| source.is_a?(Integer) || source.is_a?(Symbol) } ||
+                  targets.any? { |target| target.is_a?(Integer) || target.is_a?(Symbol) }
             end
+            @_needs_args
           end
 
           # This is a tagger if it has a tag or an untag.
@@ -114,11 +125,8 @@ module Contrast
           # it is an interesting security event that has a meaningful
           # change.
           def tagger?
-            @_tagger ||= begin
-              has_tags = tags&.any?
-              has_untags = untags&.any?
-              has_tags || has_untags
-            end
+            @_tagger = tags&.any? || untags&.any? if @_tagger.nil?
+            @_tagger
           end
         end
       end

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -16,6 +16,8 @@ module Contrast
               # copy tags from the param to the target in chunks of param size or less
               # if param is appended in space less than param length
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 sources = propagation_node.sources
                 source1 = find_source(sources[0], preshift)
                 # Some appends have two args. If they don't this is probably something
@@ -25,25 +27,40 @@ module Contrast
                 # if the object and the return are the same length just copy the tags
                 # from the object(since nothing from args was added to return)
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
                 else
-                  # find original in the target, copy tags to the new position in
-                  # target
-                  original_start_index = target.index(source1)
-                  target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                  handle_append(propagation_node, source1, source2, target, properties)
+                end
+                properties.cleanup_tags
+              end
+
+              private
+
+              # Given the append operation on source 1 added source 2 to it, changing the target output, modify the
+              # tags on the target to account for the change.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node responsible for the
+              #   propagation action required by this method
+              # @param source1 [Object] the thing being appended to
+              # @param source2 [Object] the thing being appended
+              # @param target [Object] the result of the append operation
+              # @param properties [Contrast::Agent::Assess::Properties] the properties of the target
+              def handle_append propagation_node, source1, source2, target, properties
+                # find original in the target, copy tags to the new position in
+                # target
+                original_start_index = target.index(source1)
+                properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 
-                  start = original_start_index + source1.length
-                  while start < target.length
-                    target.cs__copy_from(source2, start, propagation_node.untags)
-                    start += source2.length
-                    next unless start > target.length
+                start = original_start_index + source1.length
+                while start < target.length
+                  properties.copy_from(source2, target, start, propagation_node.untags)
+                  start += source2.length
+                  next unless start > target.length
 
-                    target.cs__properties.tags_at(start - source2.length).each do |tag|
-                      tag.update_end(target.length)
-                    end
+                  properties.tags_at(start - source2.length).each do |tag|
+                    tag.update_end(target.length)
                   end
                 end
-                target.cs__properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -22,11 +22,13 @@ module Contrast
               end
 
               def tracked_value? value
-                Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?) && value.cs__tracked?
+                Contrast::Agent::Assess::Tracker.tracked?(value)
               end
 
+              # @raise [NoMethodError] This is being raised if any of the implementing subclasses does not have
+              #     that method implemented, but is being called on.
               def propagate _propagation_node, _preshift, _target
-                raise NotImplementedError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
+                raise(NoMethodError("Expected Base propagator subclass: #{ cs__class } to implement #propagate"))
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/buffer.rb

@@ -0,0 +1,119 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagator/select'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target at the point of insertion. The target's
+          # preexisting tags are shifted to account for this insertion.
+          class Buffer < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # For the source, append its tags to the target.
+              # Once the tag is applied, shift it to the location of the insert
+              # Unlike additive propagation, this currently only supports one source
+              # We assume that insert changes the preshift target
+              def propagate_insert propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source = find_source(propagation_node.sources[0], preshift)
+
+                patcher_target = propagation_node.targets[0]
+                preshift_target = case patcher_target
+                                  when Contrast::Utils::ObjectShare::OBJECT_KEY
+                                    preshift.object
+                                  else
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
+                                  end
+
+                # in case of situations, where buffer is initialized with X size and it's not fully
+                preshift_target = preshift_target.get_string
+                target = target.get_string
+                # Find the first difference between the source to which
+                # we inserted and the result. That is the insertion
+                # point on which all tags need to be adjusted
+                # If the insertion point is the end of the string, preshift length is returned
+                # https://stackoverflow.com/questions/31714522/find-the-first-differing-character-between-two-strings-in-ruby
+                insert_point = (0...preshift_target.length).find do |i|
+                  preshift_target[i] != target[i]
+                end || preshift_target.length
+                # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
+                # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
+                insert_point = target.rindex(source, insert_point)
+                overflow = insert_point...(insert_point + source.length)
+
+                # handle shifting the inserted range
+                properties.shift_tags([overflow])
+
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
+              end
+
+              # This method will implement both KEEP and SPLAT actions.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return target from method invocation.
+              def buffer_keep_splat propagation_node, preshift, ret
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is included in the preshift's UNDUPLICABLE_MODULES.
+                return unless preshift.object
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # we use this for the IO::Buffer#get_value and it requires 2 args always.
+                return unless ret || Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
+
+                if preshift.args[1] == 0 # rubocop:disable Style/NumericPredicate
+                  # KEEP
+                  Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, ret)
+                else
+                  # SPLAT
+                  Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                end
+              end
+
+              # This method will implement both SELECT and KEEP actions for
+              # IO::Buffer
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return targer from method invocation.
+              # @param _block [nil, {}] block passed.
+              def propagate_keep_select propagation_node, preshift, ret, _block
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is handled with no dup in preshift.
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret)) &&
+                    (source = preshift.object)
+
+                # KEEP means the tags just pass from the source to the target as is.
+                # There is a case with IO::Buffer use, when we don't pass any args,
+                # and the target (ret) in this case is the whole strings. We should
+                # use Keep action. Otherwise the SELECT action covers all other cases.
+                if preshift.args.empty?
+                  # KEEP
+                  properties.copy_from(source, ret, 0, propagation_node.untags)
+                  ret
+                else
+                  # SELECT
+                  Contrast::Agent::Assess::Policy::Propagator::Select.select_tagger(propagation_node, preshift, ret,
+                                                                                    nil)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -12,24 +12,27 @@ module Contrast
           class Center < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
                 sources = propagation_node.sources
                 source1 = find_source(sources[0], preshift)
 
                 if source1.length == target.length
-                  target.cs__copy_from(source1, 0, propagation_node.untags)
-                  target.cs__properties.cleanup_tags
+                  properties.copy_from(source1, target, 0, propagation_node.untags)
+                  properties.cleanup_tags
                   return
                 end
 
                 # find original in the target, copy tags to the new position in target
-                original_start_index = target[0..target.length / 2 + 1].rindex(source1)
+                original_start_index = target[0..(target.length / 2) + 1].rindex(source1)
                 original_start_index ||= 1
-                target.cs__copy_from(source1, original_start_index, propagation_node.untags)
+                properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 
                 return unless sources[1]
 
                 original_end_index = original_start_index + source1.length - 1
-                handle_incoming_tags(target, propagation_node, sources[1], preshift, original_start_index, original_end_index)
+                handle_incoming_tags(target, propagation_node, sources[1], preshift, original_start_index,
+                                     original_end_index)
               end
 
               private
@@ -54,12 +57,13 @@ module Contrast
               end
 
               def iterate_tags target, propagation_node, source, start, stop
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
                 while start < stop
-                  target.cs__copy_from(source, start, propagation_node.untags)
+                  properties.copy_from(source, target, start, propagation_node.untags)
                   start += source.length
                   next unless start > stop
 
-                  target.cs__properties.tags_at(start - source.length).each do |tag|
+                  properties.tags_at(start - source.length).each do |tag|
                     tag.update_end(stop)
                   end
                 end

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/core_extensions/module'
+require 'contrast/extension/module'
+require 'contrast/utils/assess/event_limit_utils'
 
 module Contrast
   module Agent
@@ -12,7 +13,9 @@ module Contrast
           # of tags from the source to the target. Each node with the CUSTOM
           # action knows the class and method it should call to preform this
           # action.
-          class Custom
+          module Custom
+            extend Contrast::Utils::Assess::EventLimitUtils
+
             class << self
               def propagate propagation_node, preshift, ret, block
                 clazz = propagation_node.patch_class
@@ -26,6 +29,7 @@ module Contrast
                   propagation_node.patch_class = clazz
                 end
                 clazz.send(method, propagation_node, preshift, ret, block)
+                increment_event_count(propagation_node)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/assess/event_limit_utils'
 
 module Contrast
   module Agent
@@ -13,45 +13,54 @@ module Contrast
           # results in new source nodes to track which columns in the database
           # have been tainted.
           class DatabaseWrite < Contrast::Agent::Assess::Policy::Propagator::Base
-            include Contrast::Components::Interface
-            access_component :analysis
+            extend Contrast::Utils::Assess::EventLimitUtils
 
             class << self
               def propagate propagation_node, preshift, target
+                return unless Contrast::ASSESS.require_dynamic_sources?
+
                 class_type = preshift.object.cs__class
                 class_name = class_type.cs__name
                 tainted_columns = {}
 
-                known_tainted = ASSESS.tainted_columns[class_name]
+                known_tainted = ::Contrast::ASSESS.tainted_columns[class_name]
                 propagation_node.sources.each do |source|
-                  arg = preshift.args[source]
-                  next unless arg.cs__respond_to?(:each_pair)
-
-                  arg.each_pair do |key, value|
-                    next unless value
-                    next if known_tainted&.include?(key)
-
-                    # TODO: RUBY-540 handle sanitization, handle nested objects
-                    Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                    value.cs__properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
-                    next unless tracked_value?(value)
-
-                    tainted_columns[key] = value.cs__properties.events
-                  end
+                  handle_write(propagation_node, source, preshift, target, known_tainted, tainted_columns)
+                  increment_event_count(propagation_node)
                 end
-
                 return if tainted_columns.empty?
 
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  unless class_type < Contrast::CoreExtensions::Assess::AssessExtension
-                    class_type.send(:include, Contrast::CoreExtensions::Assess::AssessExtension)
-                  end
-                  ASSESS.tainted_columns[class_name] = tainted_columns.keys
+                  ::Contrast::ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 
-                Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns
+                Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources(class_type, tainted_columns)
+              end
+
+              private
+
+              def handle_write propagation_node, source, preshift, target, known_tainted, tainted_columns
+                arg = preshift.args[source]
+                return unless arg.cs__respond_to?(:each_pair)
+
+                arg.each_pair do |key, value|
+                  next unless value
+                  next if known_tainted&.include?(key)
+                  next unless (properties = Contrast::Agent::Assess::Tracker.properties!(value))
+
+                  # TODO: RUBY-540 handle sanitization, handle nested objects
+                  Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              value, preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  properties.build_event(event_data)
+                  next unless tracked_value?(value)
+
+                  tainted_columns[key] = properties
+                end
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -16,14 +16,19 @@ module Contrast
               # Unlike additive propagation, this currently only supports one source
               # We assume that insert changes the preshift target
               def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source = find_source(propagation_node.sources[1], preshift)
 
                 patcher_target = propagation_node.targets[0]
                 preshift_target = case patcher_target
                                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                                     preshift.object
                                   else
-                                    preshift.args[int]
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
                                   end
 
                 # Find the first difference between the source to which
@@ -31,20 +36,19 @@ module Contrast
                 # point on which all tags need to be adjusted
                 # If the insertion point is the end of the string, preshift length is returned
                 # https://stackoverflow.com/questions/31714522/find-the-first-differing-character-between-two-strings-in-ruby
-                insert_point = (0...preshift_target.length).find { |i| preshift_target[i] != target[i] } || preshift_target.length
+                insert_point = (0...preshift_target.length).find do |i|
+                  preshift_target[i] != target[i]
+                end || preshift_target.length
                 # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
                 # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
                 insert_point = target.rindex(source, insert_point)
-
-                overflow = Contrast::Agent::Assess::AdjustedSpan.new(
-                    insert_point,
-                    insert_point + source.length)
+                overflow = insert_point...(insert_point + source.length)
 
                 # handle shifting the inserted range
-                target.cs__properties.shift_tags([overflow])
+                properties.shift_tags([overflow])
 
-                target.cs__copy_from(source, insert_point, propagation_node.untags)
-                target.cs__properties.cleanup_tags
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -11,11 +11,28 @@ module Contrast
           # are unaffected beyond any merging of overlapping tags.
           class Keep < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # Keep means the tags just pass from the source to the target
-              # as is.
-              def propagate propagation_node, preshift, target
-                source = find_source(propagation_node.sources[0], preshift)
-                target.cs__copy_from(source, 0, propagation_node.untags)
+              # Keep means the tags just pass from the source to the target as is.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object, so we will always return 'O' key which is the object itself.
+                           # Because preshift is disabled for this methods we use it's parameter to pass
+                           # in the original object, preshift = object. To see list of methods in which
+                           # this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
+                properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end
           end