contrast-agent 3.9.1 → 6.15.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0a8762b07c0f0d3d160bbb27e17889197263e3a791ea904df5e8fd6718ea380
-  data.tar.gz: e4e19fa0f8f300f4c7450d9d2cc83d907c03f5b2d0ab66662ba91fb200e0df1e
+  metadata.gz: bb55239bd37c7b0d2c3adc47d2e47ff25e331694b9be68522a29f8e4ce8c1220
+  data.tar.gz: 41a5a677403dd10c0dcd67673b32e32aa8f8ad04a82d963891f95ceaa25b46a1
 SHA512:
-  metadata.gz: be95e36b2c836a20cc8fab92c3dc5840b087f6ab762ddce901bc109ec2ef71cd25bb75a46dbb5f092f44621eaedc4655cff04956bd72075d7d432394fbd0e3e3
-  data.tar.gz: fcdbda9a333c872c43f4ab7079bd067573891c23b42b56afd42f09bf73613ba4c22c214d9bb21570e888463312985141a568d8a7e1cd826bb3f13db988e0e9cd
+  metadata.gz: 94aaa0a8ed0b9fb08fb5c206bee3695cd1cc1f3a8b7752fa8c52abfb563a4e58fac60162ab13c4f06ceb785532ae1a76b93dcc8f348e99d29b112b265a88051b
+  data.tar.gz: 658421a2a8558bac001eb707340f0bc763012d06b9fdcfe1137fb3ceff6f53966d7cc9af9bced07f08411b5e44af1ad5c4f5805b54abaae0ad71dcc81011fbb9

data/.dockerignore

@@ -4,7 +4,6 @@ docker/
 code-deploy/
 
 Jenkinsfile
-bitbucket-pipelines.yml
 docker-compose.yml
 .rubocop.yml
 .travis.yml

data/.flayignore

@@ -0,0 +1 @@
+./lib/contrast/api/*_pb.rb

data/.gitignore

@@ -1,8 +1,8 @@
 /.bundle/
 /.yardoc
 /_yardoc/
-/Gemfile.lock
 /coverage/
+/Gemfile.lock
 /data/*
 /doc/
 /log/
@@ -18,6 +18,13 @@
 /ext/**/*.so
 /ext/**/*.bundle
 
+bin
+ruby-spec
+mspec
+
+# rspec generated files
+/spec/dummy_files/
+
 # Funchook artifacts
 /ext/**/funchook.h
 /ext/**/libfunchook.dylib
@@ -49,10 +56,6 @@ contrast-agent-*.gem
 
 .ruby-version
 .ruby-gemset
-service_executables/*-*
-
-# Generated Protobuf files
-/lib/contrast/api/*_pb.rb
 
 # IDE stuff
 tags

data/.gitmodules

@@ -1,6 +1,3 @@
-[submodule "agent-service-api"]
-	path = agent-service-api
-	url = git@bitbucket.org:contrastsecurity/agent-service-api
 [submodule "funchook"]
 	path = funchook
 	url = https://github.com/kubo/funchook.git

data/.rspec

@@ -3,4 +3,3 @@
 --format documentation
 --format RspecJunitFormatter
 --out ./test-results/results.xml
---color

data/.rspec_parallel

@@ -0,0 +1,6 @@
+--require spec_helper
+--order rand
+--format progress
+--format RspecJunitFormatter
+--out ./test-results/results.xml
+--format ParallelTests::RSpec::FailuresLogger --out tmp/failing_specs.log

data/.simplecov

@@ -1,4 +1,8 @@
-SimpleCov.minimum_coverage 92.30
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+SimpleCov.minimum_coverage(line: 94)
 SimpleCov.start do
   add_filter '/spec/'
-end
+  enable_coverage :branch
+end

data/Gemfile

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 source 'https://rubygems.org'

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright: 2020 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
 Contact: support@contrastsecurity.com
 License: Commercial
 

data/Rakefile

@@ -1,15 +1,18 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+$stdout.sync = true
+
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rake/extensiontask'
+require 'fileutils'
 
 CLOBBER << 'shared_libraries/*'
 
 Dir['ext/cs__*'].each do |extension|
   name = extension.split('/')[1]
-  Rake::ExtensionTask.new name do |ext|
+  Rake::ExtensionTask.new(name) do |ext|
     ext.lib_dir = "lib/#{ name }"
   end
 end

data/ext/build_funchook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fileutils'
@@ -10,13 +10,14 @@ unless find_header('funchook.h', ext_path)
   COMMANDS = ['./autogen.sh', './configure', 'make clean', 'make'].freeze
   bundler_install_target_paths = []
 
-  possible_gem_paths = Gem.path # .path and .paths diverge in their return type - .path returns strings, .paths returns PathSupports
+  # .path and .paths diverge in their return type - .path returns strings, .paths returns PathSupports
+  possible_gem_paths = Gem.path
   possible_gem_paths.each do |base_path|
     contrast_gem_dir_search = File.join(base_path, 'extensions', '**', '*', 'contrast-agent-*')
     extension_paths = Dir[contrast_gem_dir_search]
     extension_paths.map! do |extension_path|
       target_path = File.join(extension_path, 'shared_libraries')
-      FileUtils.mkdir_p(target_path) unless File.exist?(target_path)
+      FileUtils.mkdir_p(target_path)
       target_path
     end
     bundler_install_target_paths += extension_paths
@@ -31,15 +32,14 @@ unless find_header('funchook.h', ext_path)
   end
 
   SOURCE_PATHS = [
-      File.join('include', 'funchook.h'),
-      File.join('src', 'libfunchook.dylib'),
-      File.join('src', 'libfunchook.so')
+    File.join('include', 'funchook.h'), File.join('src', 'libfunchook.dylib'),
+    File.join('src', 'libfunchook.so')
   ].freeze
 
   TARGET_PATHS = ([
-      File.expand_path(File.join(File.expand_path(__dir__), '..', 'shared_libraries')),
-      File.expand_path(__dir__)
-  ] + (bundler_install_target_paths)).freeze
+    File.expand_path(File.join(File.expand_path(__dir__), '..', 'shared_libraries')),
+    File.expand_path(__dir__)
+  ] + bundler_install_target_paths).freeze
 
   puts 'Copying required files'
 
@@ -51,11 +51,14 @@ unless find_header('funchook.h', ext_path)
     end
 
     TARGET_PATHS.each do |target_path|
-      puts "Copying #{ source_file_path } into #{ target_path }"
+      unless File.writable?(target_path)
+        puts("Unable to copy into #{ target_path } - directory not writable")
+        next
+      end
+      puts("Copying #{ source_file_path } into #{ target_path }")
       FileUtils.cp(source_file_path, target_path)
+    rescue StandardError
+      puts("Error while copying #{ source_file } to #{ target_path }")
     end
   end
 end
-
-
-have_header('funchook.h', ext_path)

data/ext/cs__assess_array/cs__assess_array.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_array.h"
@@ -22,17 +22,61 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     }
     /* Finally, default to empty String. Implicit since nil.to_s is ''*/
 
+    /* call the Array.join but patched one */
     result = rb_funcall2(ary, rb_sym_assess_array_join, argc, argv);
-    result = rb_funcall(ary, rb_sym_assess_track_array_join, 2, sep, result);
+    /* call the Contrast::Extensions::Assess::ArrayPropagator#cs__track_join */
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
+                        ary, sep, result);
 
     return result;
 }
 
+static VALUE contrast_assess_prepend_array_join(const int argc,
+                                                const VALUE *argv,
+                                                const VALUE ary) {
+    VALUE sep, result;
+    /* We need to figure out the separator the join method actually used. */
+    /* First, check if one was provided. */
+    rb_scan_args(argc, argv, "01", &sep);
+    /* Second, check to see if `$;` is set*/
+    if (NIL_P(sep)) {
+        sep = rb_output_fs;
+    }
+
+    /* call the Array.join but patched one */
+    result = rb_ary_join(ary, sep);
+    /* call the Contrast::Extensions::Assess::ArrayPropagator#cs__track_join */
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
+                        ary, sep, result);
+
+    /*call original occurs in ruby*/
+    return Qtrue;
+}
+
 void Init_cs__assess_array(void) {
-    rb_sym_assess_array_join = rb_intern("cs__patched_join");
+
+    VALUE rb_mod_ary = rb_const_get(rb_cObject, rb_intern("Array"));
+    VALUE rb_sym_ary_join = ID2SYM(rb_intern("join"));
+    // check if prepended
+    VALUE is_prepended =
+        contrast_check_prepended(rb_mod_ary, rb_sym_ary_join, Qtrue);
+    // register the cs__track_join method of the Array propagator, and call it
+    // here from Ruby.
+    array_propagator =
+        rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
 
-    VALUE array_class = rb_define_class("Array", rb_cObject);
-    contrast_alias_method(array_class, "cs__patched_join", "join");
-    rb_define_method(array_class, "join", contrast_assess_array_join, -1);
+    // register the cs__join method of the ContrastArray for prepending, and
+    // call it here from Ruby.
+    VALUE contrast_array = rb_define_module_under(core_assess, "ContrastArray");
+    rb_define_module_function(contrast_array, "cs__join",
+                              contrast_assess_prepend_array_join, -1);
+
+    if (is_prepended == Qtrue) {
+        // do nothing prepend is done in Ruby
+    } else {
+        // register alias patch
+        rb_sym_assess_array_join = contrast_register_patch(
+            "Array", "join", contrast_assess_array_join);
+    }
 }

data/ext/cs__assess_array/cs__assess_array.h

@@ -1,9 +1,13 @@
 #include <ruby.h>
 
+static VALUE array_propagator;
 static VALUE rb_sym_assess_array_join;
 static VALUE rb_sym_assess_track_array_join;
-
+static VALUE rb_mod_ary, rb_sym_ary_join, is_prepended, contrast_array;
 static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
                                         const VALUE ary);
 
+static VALUE contrast_assess_prepend_array_join(const int argc, const VALUE *argv,
+                                        const VALUE ary);
+
 void Init_cs__assess_array(void);

data/ext/cs__assess_array/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_basic_object/cs__assess_basic_object.c

@@ -1,18 +1,31 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_basic_object.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
-void contrast_assess_instance_eval_trigger_check(VALUE module, VALUE source,
+/*
+ * Source code of instance_eval:
+ *
+ *                static VALUE
+ *  rb_obj_instance_eval_internal(int argc, const VALUE *argv, VALUE self)
+ *  {
+ *      VALUE klass = singleton_class_for_eval(self);
+ *      return specific_eval(argc, argv, klass, self, RB_PASS_CALLED_KEYWORDS);
+ *  }
+ */
+
+VALUE contrast_check_and_register_instance_patch(const char *module_name,
+                                                 const char *method_name,
+                                                 VALUE(c_fn)(const int, VALUE *,
+                                                             const VALUE));
+
+void contrast_assess_instance_eval_trigger_check(VALUE self, VALUE source,
                                                  VALUE ret) {
-    VALUE has_trigger_check =
-        rb_respond_to(rb_cBasicObject, instance_trigger_check_method);
-    if (has_trigger_check) {
-        rb_funcall(rb_cBasicObject, instance_trigger_check_method, 2, source,
-                   ret);
-    }
+    rb_funcall(basic_eval_trigger, instance_trigger_check_method, 3, self,
+               source, ret);
 }
 
 VALUE
@@ -23,28 +36,37 @@ contrast_assess_basic_object_instance_eval(const int argc, const VALUE *argv,
         return rb_obj_instance_eval(argc, argv, self);
     }
 
-    int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+    VALUE nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
-    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    /* Enter scope */
+    inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
+    /* Call the source: */
     VALUE ret = rb_obj_instance_eval(argc, argv, self);
 
-    if (!nested_scope && argc > 0) {
+    if (nested_scope == Qfalse && argc > 0) {
         VALUE data = argv[0];
         contrast_assess_instance_eval_trigger_check(self, data, ret);
     }
 
-    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    /* Exit scope */
+    inst_methods_exit_cntr_scope(contrast_patcher(), 0);
 
     return ret;
 }
 
 void Init_cs__assess_basic_object(void) {
+    basic_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     instance_trigger_check_method = rb_intern("instance_eval_trigger_check");
 
-    contrast_alias_method(rb_cBasicObject, "cs__patched_instance_eval",
-                          "instance_eval");
-    rb_define_method(rb_cBasicObject, "instance_eval",
-                     contrast_assess_basic_object_instance_eval, -1);
+    /* We don't keep a reference to the underlying method.
+     * Instead, we call rb_obj_instance_eval directly.
+     * This should work an overwhelming majority of the time,
+     * but if someone else patched BasicObject#instance_eval,
+     * IDK if this is intentional... noting it.  -ajm
+     */
+    contrast_check_and_register_instance_patch(
+        "BasicObject", "instance_eval",
+        contrast_assess_basic_object_instance_eval);
 }

data/ext/cs__assess_basic_object/cs__assess_basic_object.h

@@ -1,6 +1,7 @@
 #include <ruby.h>
 
-/* Contrast::Agent::Patching::Policy::Patcher */
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE basic_eval_trigger;
 static VALUE instance_trigger_check_method;
 
 void contrast_alias_method(const VALUE target, const char *to,

data/ext/cs__assess_basic_object/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c

@@ -1,8 +1,8 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_fiber_track.h"
-#include <funchook.h>
+#include "../cs__common/cs__common.h"
 #include <ruby.h>
 
 VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
@@ -30,7 +30,7 @@ VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
             ID meth;
         };
 
-        /* underlying object is first entry in Enumerator struct def.
+        /*  underlying object is first entry in Enumerator struct def.
          *  that's all statically defined w/in enumerator.c, so we can't
          *  reference the data types and be safe about it.  (yippee.)
          *  we cut out the TypedData_Get_Struct middleman & just go for it.
@@ -44,7 +44,7 @@ VALUE rb_fiber_new_hook(VALUE (*func)(ANYARGS), VALUE obj) {
         VALUE enumerator_method = ID2SYM(enum_ptr->meth);
         /* e.g.: 1..100, #each_value.  Should reflect #inspect on the enum. */
 
-        rb_funcall(fiber_class, track_rb_fiber_new, 5, fiber, obj,
+        rb_funcall(fiber_propagator, track_rb_fiber_new, 5, fiber, obj,
                    enumerator_method, underlying, calling_method);
     }
 
@@ -56,29 +56,25 @@ VALUE rb_fiber_yield_hook(int argc, const VALUE *argv) {
     VALUE yielding_fiber = rb_fiber_current();
 
     /* propagate from yielding_fiber -> result */
-    rb_funcall(fiber_class, track_rb_fiber_yield, 3, yielding_fiber,
+    rb_funcall(fiber_propagator, track_rb_fiber_yield, 3, yielding_fiber,
                calling_method, *argv);
 
     return rb_fiber_yield_original(argc, argv);
 }
 
 int install_fiber_hooks() {
-    funchook_t *funchook = funchook_create();
-
     rb_fiber_new_original = rb_fiber_new;
-    funchook_prepare(funchook, (void **)&rb_fiber_new_original,
-                     rb_fiber_new_hook);
+    patch_via_funchook(&rb_fiber_new_original, &rb_fiber_new_hook);
 
     rb_fiber_yield_original = rb_fiber_yield;
-    funchook_prepare(funchook, (void **)&rb_fiber_yield_original,
-                     rb_fiber_yield_hook);
+    patch_via_funchook(&rb_fiber_yield_original, &rb_fiber_yield_hook);
 
-    funchook_install(funchook, 0);
     return 0;
 }
 
 void Init_cs__assess_fiber_track(void) {
-    fiber_class = rb_define_class("Fiber", rb_cObject);
+    fiber_propagator =
+        rb_define_class_under(core_assess, "FiberPropagator", rb_cObject);
     track_rb_fiber_new = rb_intern("track_rb_fiber_new");
     track_rb_fiber_yield = rb_intern("track_rb_fiber_yield");
     rb_sym_next = rb_intern("next");

data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h

@@ -1,16 +1,15 @@
-#include <funchook.h>
 #include <ruby.h>
 
 static VALUE rb_sym_next;
-static VALUE fiber_class;
+static VALUE fiber_propagator;
 static VALUE track_rb_fiber_new;
 static VALUE track_rb_fiber_yield;
 
 VALUE rb_fiber_new(VALUE (*func)(ANYARGS), VALUE obj);
-VALUE *(*rb_fiber_new_original)(VALUE (*func)(ANYARGS), VALUE obj);
+VALUE (*rb_fiber_new_original)(VALUE (*func)(ANYARGS), VALUE obj);
 
 VALUE rb_fiber_yield(int argc, const VALUE *argv);
-VALUE *(*rb_fiber_yield_original)(int argc, const VALUE *argv);
+VALUE (*rb_fiber_yield_original)(int argc, const VALUE *argv);
 
 /* If you call `#next` on an enumerator object, that enumerator object
  * instantiates a fiber and runs its given proc inside of that fiber.

data/ext/cs__assess_fiber_track/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_hash/cs__assess_hash.c

@@ -1,64 +1,89 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_hash.h"
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
-                                              const VALUE hash) {
+/* Hashes can be constructed thusly):
+ *   irb(main):001:0> Hash[:a, :b]
+ *   => {:a=>:b}
+ *
+ * This method instruments that unique bracket-construction style
+ * of initializing a hash.
+ */
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
+                                                      const VALUE hash) {
     VALUE result;
 
     /* Array of Arrays: Hash[ [ [key, value], ... ] ]   -> new_hash */
     if (RB_TYPE_P(argv[0], T_ARRAY)) {
         int i;
         for (i = 0; i < argc; i++) {
-            argv[i] =
-                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
         /* Hash[ key, value, ... ]         -> new_hash */
     } else if (argc > 1) {
         int i;
         for (i = 0; i < argc; i += 2) {
-            argv[i] =
-                rb_funcall(hash, rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
+            argv[i] = rb_funcall(hash_propagator,
+                                 rb_sym_assess_hash_dup_and_freeze, 1, argv[i]);
         }
     }
 
+    const VALUE *argv_final = argv;
     /* unhandled case - shouldn't need it since issue is only unfrozen
      * String keys
      * # Hash[ object ]                  -> new_hash
      */
-    result = rb_funcall2(hash, rb_sym_assess_hash_brackets, argc, argv);
+    result = rb_funcall2(hash, rb_sym_assess_hash_bracket_constructor, argc,
+                         argv_final);
 
     return result;
 }
 
+/* Hashes, when keyed with a string, will dup & freeze that string.
+ * This is resource-efficient, but inconvenient for instrumentation.
+ */
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
                                               const VALUE hash) {
     VALUE result;
-    VALUE key;
-
-    key = rb_funcall2(hash, rb_sym_assess_hash_bracket_set, argc, argv);
-    argv[0] = key;
+    /* Current name (assess_hash_bracket_set).
+     * It doesn't set anything on the hash.
+     * It takes the arg that /would/ have been the key, and preemptively
+     * calls #dup and then #freeze, and then gives you that key.
+     *
+     * We intentionally don't enter Contrast scope for this patch.
+     * #dup instruments the string, and #freeze gets the hash to accept
+     * the key directly, without calling its own #dup/#freeze.
+     * (That naturally happens in C-land, our instrumentation is in Ruby,
+     * so our patches to #dup don't take effect within Hash#[]= unless we
+     * specifically do this instrumentation.
+     * We haven't revisited this approach since we started more extensively
+     * hooking public C functions.)
+     */
+    if (argc > 0) {
+        argv[0] = rb_funcall(hash_propagator, rb_sym_assess_hash_dup_and_freeze,
+                             1, argv[0]);
+    }
+    /* This is the underlying assignment, w/ our instrumented key. */
     result = rb_funcall2(hash, rb_sym_assess_hash_bracket_equals, argc, argv);
 
     return result;
 }
 
 void Init_cs__assess_hash(void) {
+    hash_propagator =
+        rb_define_class_under(core_assess, "HashPropagator", rb_cObject);
     rb_sym_assess_hash_dup_and_freeze = rb_intern("cs__duplicate_and_freeze");
-    rb_sym_assess_hash_brackets = rb_intern("cs__patched_[]");
-    rb_sym_assess_hash_bracket_set = rb_intern("cs__bracket_set");
-    rb_sym_assess_hash_bracket_equals = rb_intern("cs__patched_[]=");
 
     VALUE hash_class = rb_define_class("Hash", rb_cObject);
-    array_class = rb_define_class("Array", rb_cObject);
 
-    VALUE singleton = rb_singleton_class(hash_class);
-    contrast_alias_method(singleton, "cs__patched_[]", "[]");
-    rb_define_method(singleton, "[]", contrast_assess_hash_bracket_get, -1);
+    rb_sym_assess_hash_bracket_constructor = contrast_register_singleton_patch(
+        "Hash", "[]", contrast_assess_hash_bracket_constructor);
 
-    contrast_alias_method(hash_class, "cs__patched_[]=", "[]=");
-    rb_define_method(hash_class, "[]=", contrast_assess_hash_bracket_set, -1);
+    rb_sym_assess_hash_bracket_equals = contrast_register_patch(
+        "Hash", "[]=", contrast_assess_hash_bracket_set);
 }

data/ext/cs__assess_hash/cs__assess_hash.h

@@ -1,11 +1,9 @@
 #include <ruby.h>
 
-static VALUE array_class;
-
 static VALUE rb_sym_assess_hash_dup_and_freeze;
-static VALUE rb_sym_assess_hash_brackets;
-static VALUE rb_sym_assess_hash_bracket_set;
+static VALUE rb_sym_assess_hash_bracket_constructor;
 static VALUE rb_sym_assess_hash_bracket_equals;
+static VALUE hash_propagator;
 
 /*
  * Monkeypatch Ruby Hash with Contrast Security Hash in order ot avoid losing
@@ -15,8 +13,9 @@ static VALUE rb_sym_assess_hash_bracket_equals;
  * ahead of time should avoid this, similar to the behavior of the -@ Strings
  * -HM
  */
-static VALUE contrast_assess_hash_bracket_get(const int argc, VALUE *argv,
-                                              const VALUE hash);
+static VALUE contrast_assess_hash_bracket_constructor(const int argc,
+                                                      VALUE *argv,
+                                                      const VALUE hash);
 
 static VALUE contrast_assess_hash_bracket_set(const int argc, VALUE *argv,
                                               const VALUE hash);

data/ext/cs__assess_hash/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'