contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,33 +1,27 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the origination of traces. A Source is any method
-# that returns an untrusted value. In general, these sources are request methods
-# as the request object is user controlled.
-#
-# Going forward, we may add in Dynamic sources (determined at runtime) based on
-# database configs or other variables (used for Stored XSS or other persisted
-# vulnerability detection rules)
-cs__scoped_require 'set'
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/adjusted_span'
-cs__scoped_require 'contrast/agent/assess/policy/source_validation/source_validation'
-
-cs__scoped_require 'contrast/components/interface'
+require 'set'
+require 'contrast/agent/assess/policy/source_validation/source_validation'
+require 'contrast/agent/excluder/excluder'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
+require 'contrast/utils/assess/source_method_utils'
+require 'contrast/utils/assess/event_limit_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # This class controls the actions we take on Sources, as determined by
-        # our Assess policy. It indicates what actions we should take in order
-        # to mark data as User Input and treat it as untrusted, starting the
-        # dataflows used in Assess vulnerability detection.
+        # This class controls the actions we take on Sources, as determined by our Assess policy. It indicates what
+        # actions we should take in order to mark data as User Input and treat it as untrusted, starting the dataflows
+        # used in Assess vulnerability detection.
         module SourceMethod
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Utils::Assess::SourceMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
           PARAMETER_TYPE     = 'PARAMETER'
           PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
@@ -37,217 +31,145 @@ module Contrast
           COOKIE_KEY_TYPE    = 'COOKIE_KEY'
 
           class << self
-            # This is called from within our woven proc. It will be called as if it
-            # were inline in the Rack application.
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack application.
             #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   the policy that applies to the method being called
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
+            #   method being called
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Object, nil] the tracked Return or nil if no changes
-            #   were made
-            def source_patchers method_policy, object, ret, args
-              return if method_policy.source_node.nil?
-
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless current_context&.analyze_request? && ASSESS.enabled?
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_source method_policy, object, ret, args
+              logger.trace_with_time('Elapsed time for Contrast::Agent::Assess::Policy::SourceMethod#apply_source') do
+                return unless analyze?(method_policy, object, ret, args)
+                return if event_limit?(method_policy)
+                return unless (source_node = method_policy.source_node)
+                return if excluded_by_url?
 
-              replaced_return = nil
-              source_node = method_policy.source_node
+                # used to hold the object and ret
+                source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
 
-              target = determine_target(source_node, object, ret, args)
+                return unless (target = determine_target(source_node, source_data, args))
+                return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
 
-              # We don't propagate to frozen things that haven't been tracked
-              # before. By definition, something that is a source has not
-              # previously been tracked; therefore, we can break out early.
-              if target.cs__frozen?
-                # That being said, we don't have enough context to know if we
-                # can make this assumption and still function, so we'll allow for
-                # source tracking of frozen things by a common config setting.
-                #
-                # Rails' StrongParameters make a case for this to be default
-                # behavior
-                return replaced_return unless ASSESS.track_frozen_sources?
-
-                # If we're tracking the frozen target, we need to unfreeze
-                # (dup) it to track and then freeze that result. For
-                # simplicities sake, we ONLY do this if the return is the
-                # target (I don't want to have to deal with unfreezing self)
-                return replaced_return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-
-                restore_frozen_state = true
-                ret = Contrast::Utils::FreezeUtil.unfreeze_dup(ret)
-                target = ret
+                process_source(source_node, target, source_data, source_node.type, nil, *args)
               end
-
-              invoked = 3 # apply_post_patch => apply_assess => source_patchers
-              apply_source(current_context, source_node, target, object, ret, source_node.type, nil, invoked, *args)
-
-              ret.cs__freeze if restore_frozen_state
-              ret
             end
 
             private
 
-            # This is our method that actually taints the object our
-            # source_node targets.
+            # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param source_type [String] the type of this source, from the
-            #   source_node, or a KEY_TYPE if invoked for a map
-            # @param source_name [String, nil] the name of this source, i.e.
-            #   the key used to accessed if from a map or nil if a type like
-            #   BODY
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, invoked = 0, *args
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def process_source source_node, target, source_data, source_type, source_name = nil, *args # rubocop:disable Metrics/PerceivedComplexity
+              context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
-              source_name ||= determine_source_name(source_node, object, ret, *args)
+              increment_event_count(source_node)
+
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
+
+              return if excluded_by_input?(source_type, source_name)
+
               # We know we only work on certain things.
               # Skip if this isn't one of them
-              if Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-                apply_tags(source_node, target, object, ret, source_type, source_name, invoked, *args)
-                # While we don't taint hashes themselves, we may taint the things
-                # they hold. Let's pass their keys and values back to ourselves and
-                # try again
+              if Contrast::Agent::Assess::Tracker.trackable?(target)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                source_key_type = invoked.zero? ? key_type(source_type) : source_type
-                invoked += 1
-                to_replace = []
-                target.each_pair do |key, value|
-                  # We only do this for Strings b/c of the way Hash lookup works.
-                  # To replace another object would break hash lookup and,
-                  # therefore, the application
-                  if ASSESS.track_frozen_sources? &&
-                        key.is_a?(String) &&
-                        Contrast::Utils::DuckUtils.quacks_to?(target, :delete)
-                    key = Contrast::Utils::FreezeUtil.unfreeze_dup(key)
-                    to_replace << key
-                  end
-                  apply_source(context, source_node, key, object, ret, source_key_type, key, invoked, *args)
-                  apply_source(context, source_node, value, object, ret, source_type, key, invoked, *args)
-                end
-
-                # Hash is designed to keep one instance of the string key in it.
-                # We need to remove the existing one and replace it with our new
-                # tracked one.
-                to_replace.each do |key|
-                  key.cs__freeze
-                  value = target[key]
-                  target.delete(key)
-                  target[key] = value
-                end
-                # While we don't taint arrays themselves, we may taint the things
-                # they hold. Let's pass their keys and values back to ourselves and
-                # try again
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
+                # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
+                # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                invoked += 1
-                target.each { |value| apply_source(context, source_node, value, object, ret, source_type, source_name, invoked, *args) }
+                target.each do |value|
+                  process_source(source_node, value, source_data, source_type, source_name, *args)
+                end
               end
             rescue StandardError => e
-              logger.warn(e, "Unable to apply source for source_node #{ source_node.id }")
+              logger.warn('Unable to apply source', e, node_id: source_node.id)
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, invoked, *args
-              # don't apply second source -- probably needs tuning later if we
-              # use more than 'UNTRUSTED' in our sources
-              return if target.cs__tracked? || target.cs__frozen?
+            # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
+            # values back to ourselves and try again
+            #
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_hash_tags source_node, target, source_data, source_type, *args
+              target.each_pair do |key, value|
+                process_source(source_node, key, source_data, key_type(source_type), key, *args)
+                process_source(source_node, value, source_data, source_type, key, *args)
+              end
+            end
 
-              invoked += 1
-              # otherwise for each tag this source_node applies, create a tag range
-              # on the target object
-              # I realize this looping is counter-intuitive from the above
-              # message, that's why we're revisiting.
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
+              # don't apply tags if we can't track the thing
+              return unless Contrast::Agent::Assess::Tracker.trackable?(target)
+              # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
+              return if Contrast::Agent::Assess::Tracker.tracked?(target)
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+              # otherwise for each tag this source_node applies, create a tag range on the target object. I realize
+              # this looping is counter-intuitive from the above message, that's why we're revisiting.
               source_node.tags.each do |tag|
                 next unless Contrast::Agent::Assess::Policy::SourceValidation.valid?(tag, source_type, source_name)
 
                 length = Contrast::Utils::StringUtils.ret_length(target)
-                target.cs__properties.add_tag(tag, Contrast::Agent::Assess::AdjustedSpan.new(0, length))
-                target.cs__properties.add_properties(source_node.properties)
-                logger.debug(nil, "Source #{ source_node.id } detected: #{ target.__id__ } tagged with #{ tag }")
+                properties.add_tag(tag, 0...length)
+                properties.add_properties(source_node.properties)
+                logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
-
               # make a representation of this method that TeamServer can render
-              target.cs__properties.build_event(source_node, target, object, ret, args, invoked, source_type, source_name)
-            end
-
-            # Find the name of the source
-            #
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [String, nil] the human readable name of the target to
-            #   which this source event applies, or nil if none provided by the
-            #   node
-            def determine_source_name source_node, object, ret, *args
-              return source_node.get_property('dynamic_source_name') if source_node.type == 'UNTRUSTED_DATABASE'
-
-              source_node_source = source_node.sources[0]
-              case source_node_source
-              when nil
-                nil
-              when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
-              when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
-              else
-                args[source_node_source]
-              end
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
             end
 
             # Find the literal target of the propagation
             #
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
-            def determine_target source_node, object, ret, args
+            def determine_target source_node, source_data, args
               source_target = source_node.targets[0]
               case source_target
               when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
+                source_data.ret
               when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
+                source_data.object
               else
-                if source_target.is_a?(Integer)
-                  args[source_target]
-                  # If this isn't an index param, it's a named one. R.I.P.
-                else
-                  arg = nil
-                  args.each do |search|
-                    next unless search.is_a?(Hash)
-
-                    arg = search[source_target]
-                    break if arg
-                  end
-                  arg
-                end
+                args[source_target]
               end
             end
 
-            # Simple helper method to flip the type from value to key when the
-            # source is the key of a Hash
+            # Simple helper method to flip the type from value to key when the source is the key of a Hash
             #
             # @param source_type [String] the original value source type
-            # @return [String] the key form of the source type, if one exists,
-            #   else the original source type
+            # @return [String] the key form of the source type, if one exists, else the original source type
             def key_type source_type
               case source_type
               when PARAMETER_TYPE
@@ -260,6 +182,22 @@ module Contrast
                 source_type
               end
             end
+
+            # Should a source be excluded because it matches one of the input exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_input? source_type, source_name
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_input?(context.request, source_type, source_name)
+            end
+
+            # Should a source be excluded because it matches one of the url exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_url?
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_url?(context.request)
+            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -13,30 +13,15 @@ module Contrast
         class SourceNode < PolicyNode
           attr_accessor :type
 
-          DB_SOURCE_TYPE = 'TAINTED_DATABASE'
-          def self.build_dynamic_source _id, dynamic_source
-            dynamic_source_hash = {
-                JSON_CLASS_NAME => dynamic_source.class_name,
-                JSON_METHOD_NAME => dynamic_source.method_name,
-                JSON_INSTANCE_METHOD => dynamic_source.instance_method,
-                JSON_TYPE => DB_SOURCE_TYPE,
-                JSON_METHOD_VISIBILITY => 'public',
-                JSON_TARGET => dynamic_source.target,
-                JSON_PROPERTIES => dynamic_source.properties
-            }
-            Contrast::Agent::Assess::Policy::SourceNode.new(dynamic_source_hash)
-          end
-
           JSON_TYPE = 'type'
-          JSON_SOURCE_NAME = 'source_name'
           SOURCE_TAG = 'UNTRUSTED'
+          SOURCE = 'Source'
           def initialize source_hash = {}
             super(source_hash)
             @type = source_hash[JSON_TYPE]
             @tags << SOURCE_TAG
           end
 
-          SOURCE = 'Source'
           def node_class
             SOURCE
           end
@@ -50,6 +35,7 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source and type
+          # @raise[ArgumentError] raises if any of the required fields is missing or invalid
           def validate
             super
             raise(ArgumentError, "Source #{ id } did not have a proper target. Unable to create.") unless targets&.any?

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,18 +1,20 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/source_method'
 
 module Contrast
   module Agent
     module Assess
       module Policy
         module SourceValidation
-          # Validator used to assert a CROSS_SITE tag is actually applicable to
-          # the given method before applying the tag to its target
+          # Validator used to assert a CROSS_SITE tag is actually applicable to the given method before applying the
+          # tag to its target
           module CrossSiteValidator
-            # prevent the application of a tag if it is from a source known to
-            # not apply a tag in a provided context.
+            # Prevent the application of a tag if it is from a source known to not apply a tag in a provided context.
+            # Note that for Rack, the Header will be HTTP_REFERER. Rails does some help in
+            # ActionDispatch::Http::Headers to convert keys like `referer` to `HTTP_REFERER` before they get to the
+            # Rack::Request#get_header method
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
             def self.valid? tag, source_type, source_name
               return true unless tag == 'CROSS_SITE'
@@ -20,7 +22,7 @@ module Contrast
               return true unless source_type == Contrast::Agent::Assess::Policy::SourceMethod::HEADER_TYPE
               return false unless source_name
 
-              source_name.casecmp?('referer')
+              source_name == 'HTTP_REFERER'
             end
           end
         end

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/source_validation/cross_site_validator'
+require 'contrast/agent/assess/policy/source_validation/cross_site_validator'
 
 module Contrast
   module Agent
@@ -11,9 +11,7 @@ module Contrast
         # certain tags in a given context. This provides a single place from
         # which those validations can be called.
         module SourceValidation
-          VALIDATORS = [
-            Contrast::Agent::Assess::Policy::SourceValidation::CrossSiteValidator
-          ].cs__freeze
+          VALIDATORS = [Contrast::Agent::Assess::Policy::SourceValidation::CrossSiteValidator].cs__freeze
 
           # Determines if the conditions in which this source was called are
           # valid and should result in the application of a tag

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -0,0 +1,103 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Trigger
+          # This acts a trigger to handle the special cases of the Tilt
+          # library gem. Reflected XSS data may come into the trigger methods
+          # from these classes.
+          class ReflectedXss
+            class << self
+              NODE_HASH = {
+                  'class_name' => 'Tilt::Template',
+                  'instance_method' => true,
+                  'method_name' => 'render',
+                  'method_visibility' => 'public',
+                  'action' => 'CUSTOM',
+                  'source' => 'O,P0',
+                  'target' => 'R',
+                  'patch_class' => 'Contrast::Agent::Assess::Policy::Trigger::ReflectedXss',
+                  'patch_method' => 'xss_tilt_trigger'
+              }.cs__freeze
+              TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
+
+              def xss_tilt_trigger trigger_node, _source, object, ret, *args
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+                scope = args[0]
+                erb_template_prerender = object.instance_variable_get(:@data)
+                interpolated_inputs = []
+                handle_binding_variables(scope, erb_template_prerender, ret, properties, interpolated_inputs)
+                handle_local_variables(args, erb_template_prerender, ret, properties, interpolated_inputs)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(TEMPLATE_PROPAGATION_NODE,
+                                                                            ret,
+                                                                            erb_template_prerender,
+                                                                            ret,
+                                                                            interpolated_inputs)
+                properties.build_event(event_data)
+                properties.copy_from(erb_template_prerender, ret, 0)
+                unless interpolated_inputs.empty?
+                  current_event = properties.event
+                  interpolated_inputs.each do |input|
+                    input_properties = Contrast::Agent::Assess::Tracker.properties(input)
+                    next unless input_properties&.event
+
+                    current_event.parent_events << input_properties.event
+                  end
+                end
+
+                if Contrast::Agent::Assess::Tracker.tracked?(ret)
+                  finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                         ret,
+                                                                                         erb_template_prerender,
+                                                                                         ret,
+                                                                                         interpolated_inputs)
+                  Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
+                end
+
+                ret
+              end
+
+              private
+
+              def handle_binding_variables scope, erb_template_prerender, ret, properties, interpolated_inputs
+                binding_variables = scope.instance_variables
+
+                binding_variables.each do |bound_variable_sym|
+                  bound_variable_value = scope.instance_variable_get(bound_variable_sym)
+
+                  next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
+                  next unless erb_template_prerender.include?(bound_variable_sym.to_s)
+                  next unless ret.cs__respond_to?(:index)
+
+                  start_index = ret.index(bound_variable_value)
+                  next if start_index.nil?
+
+                  properties.copy_from(bound_variable_value, ret, start_index)
+                  interpolated_inputs << bound_variable_sym
+                end
+              end
+
+              def handle_local_variables args, erb_template_prerender, ret, properties, interpolated_inputs
+                locals = args[1]
+                locals.each do |local_name, local_value|
+                  next unless Contrast::Agent::Assess::Tracker.tracked?(local_value)
+                  next unless erb_template_prerender.include?(local_name.to_s)
+
+                  start_index = ret.index(local_value)
+                  next if start_index.nil?
+
+                  properties.copy_from(local_value, ret, start_index)
+                  interpolated_inputs << local_name
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Trigger
+          # This acts a trigger to handle the special cases of the XPath
+          # library gem and the Oga gem. Untrusted data may come into the
+          # trigger methods from these classes as an array or hash,
+          # respectively. Since untrusted user input comes into these triggers
+          # as a splat argument or an options hash, we need to iterate through
+          # these objects to see if we were tracking on any of them and report
+          # a finding if so.
+          class Xpath
+            class << self
+              def xpath_expression_trigger trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                process(trigger_node, object, ret, *args)
+              end
+
+              def xpath_oga_trigger trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                # convert the options arg in Oga::XML::CharacterNode#initialize into an
+                # array of its values so we can check if any are unsafe
+                args = args.first.values if args.first.cs__is_a?(Hash)
+                process(trigger_node, object, ret, *args)
+              end
+
+              private
+
+              def process trigger_node, object, ret, *args
+                args.each do |arg|
+                  next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
+                  next unless Contrast::Agent::Assess::Tracker.tracked?(arg)
+                  next unless trigger_node.violated?(arg)
+
+                  finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                         arg,
+                                                                                         object,
+                                                                                         ret,
+                                                                                         *args)
+                  Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
+                end
+
+                ret
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end