contrast-agent 3.9.1 → 6.15.3

data/ext/cs__assess_kernel/cs__assess_kernel.c

@@ -1,36 +1,50 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_kernel.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,
                              const VALUE self) {
-    int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
+    VALUE nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
 
-    if (!nested_scope && argc > 0) {
-        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    if (nested_scope == Qfalse && argc > 0) {
+        /* enter scope */
+        inst_methods_enter_cntr_scope(contrast_patcher(), 0);
         VALUE data = argv[0];
         rb_funcall(kernel_propagator, exec_apply_trigger, 1, data);
-        rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+        /* exit scope */
+        inst_methods_exit_cntr_scope(contrast_patcher(), 0);
     }
 
-    return rb_funcall(self, rb_intern("cs__assess_kernel_exec"), argc, *argv);
+    /* maybe this should be rb_funcall2.  this works right now because *argv ==
+     * argv[0]. exec shouldn't ever be called with != 1 argc, so not a huge
+     * problem */
+    return rb_funcall(self, rb_sym_assess_kernel_exec, argc, *argv);
+}
+
+/* Check and see if the Kernel#exec is already prepended */
+VALUE contrast_is_kernel_exec_prepended() {
+    return contrast_check_prepended(
+        rb_const_get(rb_cObject, rb_intern("Kernel")), rb_sym_kernel_exec,
+        Qfalse);
 }
 
 void Init_cs__assess_kernel(void) {
-    kernel_propagator = rb_define_module("KernelPropagator");
+    VALUE rb_sym_kernel_exec = ID2SYM(rb_intern("exec"));
+    kernel_propagator = rb_define_module_under(core_assess, "KernelPropagator");
     exec_apply_trigger = rb_intern("apply_trigger");
 
-    VALUE singleton = rb_singleton_class(rb_mKernel);
+    rb_sym_assess_kernel_exec =
+        contrast_register_patch("Kernel", "exec", contrast_patched_kernel_exec);
 
-    contrast_alias_method(rb_mKernel, "cs__assess_kernel_exec", "exec");
-    rb_define_private_method(rb_mKernel, "exec", contrast_patched_kernel_exec,
-                             -1);
-
-    contrast_alias_method(singleton, "cs__assess_kernel_exec", "exec");
-    rb_define_method(singleton, "exec", contrast_patched_kernel_exec, -1);
+    /* check if prepended and register singleton patch if true */
+    if (contrast_is_kernel_exec_prepended() == Qtrue) {
+        /* should return the same value as above */
+        rb_sym_assess_kernel_exec = contrast_register_singleton_patch(
+            "Kernel", "exec", contrast_patched_kernel_exec);
+    }
 }

data/ext/cs__assess_kernel/cs__assess_kernel.h

@@ -2,6 +2,9 @@
 
 static VALUE exec_apply_trigger;
 static VALUE kernel_propagator;
+static VALUE rb_sym_assess_kernel_exec;
+static VALUE rb_sym_kernel_exec;
+VALUE contrast_is_kernel_exec_prepended();
 
 VALUE
 contrast_patched_kernel_exec(const int argc, const VALUE *argv,

data/ext/cs__assess_kernel/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c

@@ -1,34 +1,58 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_marshal_module.h"
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_marshal_module_load(const int argc,
-                                                 const VALUE *argv) {
+/*
+ * Marshal#load source:
+ * static VALUE
+ * marshal_load(int argc, VALUE *argv)
+ *  {
+ *     VALUE port, proc;
+ *
+ *     rb_check_arity(argc, 1, 2);
+ *     port = argv[0];
+ *     proc = argc > 1 ? argv[1] : Qnil;
+ *     return rb_marshal_load_with_proc(port, proc);
+ * }
+ */
+static VALUE contrast_marshal_module_prepend(const int argc,
+                                             const VALUE *argv) {
     VALUE result;
     VALUE source_string;
 
-    result = rb_call_super(argc, argv);
-
+    /* Our patches need to apply only in the case where there was valid input.
+     */
     if (argc >= 1) {
         source_string = argv[0];
+    } else {
+        source_string = Qnil;
+    }
 
-        if (rb_respond_to(source_string, rb_sym_cs_tracked)) {
-            VALUE tracked = rb_funcall(source_string, rb_sym_cs_tracked, 0);
+    /* Run our protect code ahead of the original method */
+    if (source_string != Qnil) {
+        rb_funcall(marshal_propagator, rb_sym_protect_marshal_load, 1,
+                   source_string);
+    }
 
-            if (tracked == Qtrue) {
-                VALUE skip = rb_funcall(contrast_patcher(),
-                                        rb_sym_skip_assess_analysis, 0);
+    /* Invoke the original method */
+    result = rb_call_super(argc, argv);
+
+    /* Run our assess code after the original method */
+    if (source_string != Qnil) {
+        VALUE tracked =
+            rb_funcall(properties_hash, rb_sym_hash_tracked, 1, source_string);
 
-                if (skip == Qfalse) {
-                    VALUE scope =
-                        rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
-                    rb_funcall(marshal_module, rb_sym_assess_load_trigger_check,
-                               2, source_string, result);
-                    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 1, scope);
-                }
+        /* Assuming the source is tracked and needs assess checks */
+        if (tracked == Qtrue) {
+            VALUE skip =
+                rb_funcall(contrast_patcher(), rb_sym_skip_assess_analysis, 0);
+            /* And Assess is enabled and applies to this request */
+            if (skip == Qfalse) {
+                rb_funcall(marshal_propagator, rb_sym_assess_marshal_load, 2,
+                           source_string, result);
             }
         }
     }
@@ -36,12 +60,22 @@ static VALUE contrast_assess_marshal_module_load(const int argc,
 }
 
 void Init_cs__assess_marshal_module(void) {
-    rb_sym_assess_load_trigger_check = rb_intern("cs__load_trigger_check");
+    /* Contrast::Agent::Assess::Tracker::PROPERTIES_HASH */
+    VALUE tracker = rb_define_class_under(assess, "Tracker", rb_cObject);
+    properties_hash = rb_const_get(tracker, rb_intern("PROPERTIES_HASH"));
+    marshal_propagator =
+        rb_define_class_under(core_assess, "MarshalPropagator", rb_cObject);
+    rb_sym_assess_marshal_load = rb_intern("cs__load_assess");
+    rb_sym_protect_marshal_load = rb_intern("cs__load_protect");
 
-    marshal_module = rb_define_module("Marshal");
+    /* check if prepended called form the after_load_patcher */
+    VALUE marshal = rb_const_get(rb_cObject, rb_intern("Marshal"));
+    VALUE marshal_load = ID2SYM(rb_intern("load"));
+    VALUE is_prepended =
+        contrast_check_prepended(marshal, marshal_load, Qfalse);
 
-    VALUE contrast_marshal = rb_define_module("MarshalWithContrastAssess");
-    rb_define_method(contrast_marshal, "load",
-                     contrast_assess_marshal_module_load, -1);
-    rb_prepend_module(rb_singleton_class(marshal_module), contrast_marshal);
+    if (is_prepended == Qtrue) {
+        contrast_register_singleton_prepend_patch(
+            "Marshal", "load", &contrast_marshal_module_prepend);
+    }
 }

data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h

@@ -1,8 +1,11 @@
 #include <ruby.h>
 
-static VALUE marshal_module;
+static VALUE marshal_propagator;
 
-static VALUE rb_sym_assess_load_trigger_check;
+static VALUE rb_sym_assess_marshal_load;
+static VALUE rb_sym_protect_marshal_load;
+static VALUE properties_hash;
+static VALUE marshal, marshal_load, is_prepended;
 
 /*
  * Rails is a jerk. In Rails 5, they decided to do away with the alias chaining
@@ -12,7 +15,7 @@ static VALUE rb_sym_assess_load_trigger_check;
  * special case this for now.
  * -HM (shamelessly commenting on DP's work)
  */
-static VALUE contrast_assess_marshal_module_load(const int argc,
+static VALUE contrast_marshal_module_prepend(const int argc,
                                                  const VALUE *argv);
 
 void Init_cs__assess_marshal_module(void);

data/ext/cs__assess_marshal_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_module/cs__assess_module.c

@@ -1,32 +1,31 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_module.h"
 #include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
 #include <ruby.h>
 
 void contrast_assess_eval_trigger_check(VALUE module, VALUE source, VALUE ret) {
-    VALUE has_trigger_check = rb_respond_to(module, trigger_check_method);
-
     if (RTEST(
             rb_funcall(contrast_patcher(), rb_sym_skip_contrast_analysis, 0))) {
         return;
     }
 
-    int nested_scope =
-        RTEST(rb_funcall(contrast_patcher(), rb_sym_in_scope, 0));
-
-    rb_funcall(contrast_patcher(), rb_sym_enter_scope, 0);
+    int nested_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
+    /* enter scope */
+    inst_methods_enter_cntr_scope(contrast_patcher(), 0);
 
-    if (!nested_scope && has_trigger_check) {
+    if (nested_scope == Qfalse) {
         VALUE method = rb_funcall(rb_mKernel, rb_sym_method, 0);
         /* If this method ever throws an exception, the scope-leave
          * needs to be moved within a rescue call.
          */
-        rb_funcall(module, trigger_check_method, 3, source, ret, method);
+        rb_funcall(module_eval_trigger, trigger_check_method, 4, module, source,
+                   ret, method);
     }
-
-    rb_funcall(contrast_patcher(), rb_sym_exit_scope, 0);
+    /* exit scope */
+    inst_methods_exit_cntr_scope(contrast_patcher(), 0);
 }
 
 VALUE
@@ -58,20 +57,81 @@ contrast_assess_module_module_eval(const int argc, const VALUE *argv,
     return ret;
 }
 
-void Init_cs__assess_module(void) {
-    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+VALUE
+contrast_assess_module_prepend(const int argc, const VALUE *argv,
+                               const VALUE self) {
+
+    //    rb_prepend_module(self, argv[0]);
+
+    VALUE module_at;
+    VALUE rb_incl_in_mod_ary = rb_funcall(self, rb_intern("included_in"), 0);
+
+    if (RB_TYPE_P(rb_incl_in_mod_ary, T_ARRAY)) {
+        int i = 0;
+        int size = rb_funcall(rb_incl_in_mod_ary, rb_intern("length"), 0);
+        for (i = 0; i < size; ++i) {
+            module_at = rb_ary_entry(rb_incl_in_mod_ary, i);
+            if (RB_TYPE_P(module_at, T_MODULE)) {
+                rb_include_module(module_at, argv[0]);
+            }
+        }
+    }
+    return self;
+}
 
-    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
+VALUE
+contrast_assess_module_included(const int argc, const VALUE *argv,
+                                const VALUE self) {
+    VALUE frozen;
+    if (RB_TYPE_P(self, T_MODULE)) {
+        // check if frozen
+        frozen = rb_funcall(self, rb_intern("cs__frozen?"), 0);
+        if (frozen == Qfalse) {
+            VALUE ary = rb_funcall(self, rb_intern("included_in"), 0);
+            if (RB_TYPE_P(ary, T_ARRAY)) {
+                rb_ary_push(ary, argv[0]);
+            }
+        }
+    }
+    return self;
+}
 
+void Init_cs__assess_module(void) {
+    module_eval_trigger =
+        rb_define_class_under(core_assess, "EvalTrigger", rb_cObject);
     trigger_check_method = rb_intern("eval_trigger_check");
 
-    contrast_alias_method(rb_cModule, "cs__patched_class_eval", "class_eval");
-
-    rb_define_method(rb_cModule, "class_eval",
-                     contrast_assess_module_class_eval, -1);
-
-    contrast_alias_method(rb_cModule, "cs__patched_module_eval", "module_eval");
+    rb_sym_assess_patch_eval = rb_intern("patch_assess_on_eval");
+    assess_patcher = rb_define_module_under(assess_policy, "Patcher");
 
-    rb_define_method(rb_cModule, "module_eval",
-                     contrast_assess_module_module_eval, -1);
+    /* Returns of these 2 patches are discarded.
+     * We're calling the underlying via direct C, instead of
+     * whatever method was there before.
+     * See similar comments in basic_object C ext patch.
+     */
+
+    contrast_register_patch("Module", "class_eval",
+                            contrast_assess_module_class_eval);
+
+    contrast_register_patch("Module", "module_eval",
+                            contrast_assess_module_module_eval);
+    /*
+     * We patch these for better ancestors handling, and only for older ruby
+     * versions.
+     */
+    //  if (rb_ver_below_three()) {
+    /*
+     * `included` is a private method. We should make it public, patch it,
+     * and make our new method public
+     */
+    //     contrast_register_patch("Module", "included",
+    //                             contrast_assess_module_included);
+    /*
+     * The `prepend` patch may actually be the issue, if we're not properly
+     * passing along the call/context. It could be that my attempt to fix
+     * `included` left this section unreachable.
+     */
+    //     contrast_register_patch("Module", "prepend",
+    //                             contrast_assess_module_prepend);
+    //     }
 }

data/ext/cs__assess_module/cs__assess_module.h

@@ -4,6 +4,9 @@
 static VALUE assess_patcher;
 
 static VALUE rb_sym_assess_patch_eval;
+
+/* Contrast::Extension::Assess::EvalTrigger */
+static VALUE module_eval_trigger;
 static VALUE trigger_check_method;
 
 /* c.f. cs__assess_basic_object.c for more context on how eval is patched. */
@@ -21,5 +24,12 @@ contrast_assess_module_class_eval(const int argc, const VALUE *argv,
 VALUE
 contrast_assess_module_module_eval(const int argc, const VALUE *argv,
                                    const VALUE mod);
+VALUE
+contrast_assess_module_prepend(const int argc, const VALUE *argv,
+                               const VALUE self);
+
+VALUE
+contrast_assess_module_included(const int argc, const VALUE *argv,
+                               const VALUE mod);
 
 void Init_cs__assess_module(void);

data/ext/cs__assess_module/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_regexp/cs__assess_regexp.c

@@ -1,9 +1,22 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_regexp.h"
+#include "../cs__common/cs__common.h"
+#include "../cs__contrast_patch/cs__contrast_patch.h"
 #include <ruby.h>
 
+extern VALUE contrast_force_patch(const int argc, VALUE *argv) {
+    return contrast_check_and_register_instance_patch(
+        "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
+}
+
+/* check if method is prepended and register instance alias or prepend patch */
+VALUE contrast_check_and_register_instance_patch(const char *module_name,
+                                                 const char *method_name,
+                                                 VALUE(c_fn)(const int, VALUE *,
+                                                             const VALUE));
+
 void contrast_alias_method(const VALUE target, const char *to,
                            const char *from);
 
@@ -21,17 +34,22 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
         rb_hash_aset(infohash, rb_sym_result, result);
         rb_hash_aset(infohash, rb_sym_string, argv[0]);
         rb_hash_aset(infohash, rb_sym_back_ref, rb_backref_get());
-        rb_funcall(regexp, rb_sym_assess_track_regexp, 1, infohash);
+        rb_funcall(regexp_propagator, rb_sym_assess_track_regexp, 1, infohash);
     }
 
     return result;
 }
 
 void Init_cs__assess_regexp(void) {
-    rb_sym_assess_regexp_equal_squiggle =
-        rb_intern("cs__patched_equal_squiggle");
-    rb_sym_assess_track_regexp = rb_intern("cs__regexp_tagger");
+    regexp_propagator =
+        rb_define_class_under(core_assess, "RegexpPropagator", rb_cObject);
+    rb_sym_assess_track_regexp = rb_intern("track_equal_squiggle");
 
+    /* These are the keys we use to define our hash of
+     * Regexp info.  rb_global_variable doesn't make
+     * them global in the $global sense, but marks them
+     * so they don't get swept by the GC.
+     */
     rb_sym_result = ID2SYM(rb_intern("result"));
     rb_global_variable(&rb_sym_result);
     rb_sym_regexp = ID2SYM(rb_intern("regexp"));
@@ -40,9 +58,10 @@ void Init_cs__assess_regexp(void) {
     rb_global_variable(&rb_sym_string);
     rb_sym_back_ref = ID2SYM(rb_intern("back_ref"));
     rb_global_variable(&rb_sym_back_ref);
+    rb_define_singleton_method(assess, "contrast_force_repatch_regexp",
+                               contrast_force_patch, 0);
 
-    VALUE regexp_class = rb_define_class("Regexp", rb_cObject);
-    contrast_alias_method(regexp_class, "cs__patched_equal_squiggle", "=~");
-    rb_define_method(regexp_class, "=~", contrast_assess_regexp_equal_squiggle,
-                     -1);
+    rb_sym_assess_regexp_equal_squiggle =
+        contrast_check_and_register_instance_patch(
+            "Regexp", "=~", contrast_assess_regexp_equal_squiggle);
 }

data/ext/cs__assess_regexp/cs__assess_regexp.h

@@ -6,6 +6,7 @@ static VALUE rb_sym_string;
 static VALUE rb_sym_back_ref;
 static VALUE rb_sym_assess_regexp_equal_squiggle;
 static VALUE rb_sym_assess_track_regexp;
+static VALUE regexp_propagator;
 
 /*
  * argc - number of arguments
@@ -19,4 +20,6 @@ static VALUE contrast_assess_regexp_equal_squiggle(const int argc,
                                                    const VALUE *argv,
                                                    const VALUE regexp);
 
+extern VALUE contrast_force_patch(const int argc, VALUE *argv);
+
 void Init_cs__assess_regexp(void);

data/ext/cs__assess_regexp/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string/cs__assess_string.c

@@ -1,38 +1,70 @@
-/* Copyright (c) 2020 Contrast Security, Inc.  See
+/* Copyright (c) 2023 Contrast Security, Inc.  See
  * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
 
 #include "cs__assess_string.h"
 #include "../cs__common/cs__common.h"
 #include <ruby.h>
 
-static VALUE contrast_assess_string_uminus(const VALUE obj) {
-    VALUE dup, tracked;
+/*
+ * The -@ method source:
+ *
+ *                static VALUE
+ * str_uminus(VALUE str)
+ * {
+ *     if (!BARE_STRING_P(str) && !rb_obj_frozen_p(str)) {
+ *         str = rb_str_dup(str);
+ *     }
+ *     return rb_fstring(str);
+ * }
+ */
+
+/*
+ * This patch won't do the Prepend. We would call to the String instance'
+ * uminus directly and skip other propagation from prepended modules.
+ * We could come back to this one and rethink it's prepend patching.
+ */
+
+static VALUE contrast_assess_string_freeze(const int argc, VALUE *argv,
+                                           const VALUE obj) {
     if (!OBJ_FROZEN(obj)) {
-        tracked = rb_funcall(obj, rb_sym_cs_tracked, 0);
-        if (RTEST(tracked)) {
-            /*
-             * If the object is not frozen and the object is tracked, we cheat.
-             * We dup and then freeze to replicate the behavior of str_uminus in
-             * string.c, but we ignore any other monkey patches on String#-@
-             */
-            dup = rb_funcall(obj, rb_sym_dup, 0);
-            rb_funcall(dup, rb_sym_freeze, 0);
-            return dup;
-        }
+        rb_funcall(properties_hash, rb_sym_pre_freeze, 1, obj);
+    }
+    return rb_funcall(obj, rb_sym_assess_string_freeze, 0);
+}
+
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                           const VALUE obj) {
+    if (!OBJ_FROZEN(obj)) {
+        /* We're doing something intentionally different here. Ruby, for -@,
+         * attempts to de-duplicate the String and use an "interned" copy of
+         * the String. We cannot allow that to happen for a couple reasons:
+         * - prior to Ruby 2.7, this would cause us to track ALL instances of
+         *   that interned copy.
+         * - 2.7 and later, this action is actually missed because of a change
+         *   to the str_uminus method in Ruby, which dups the String in a way
+         *   that we cannot see.
+         * B/c we cannot track this in 2.7, rather than having a version check
+         * and two approaches, we'll instead directly call the #freeze method,
+         * so the end result is that this String itself is frozen and never
+         * deduplicated.
+         */
+        return contrast_assess_string_freeze(argc, argv, obj);
     }
     /* in all other cases, preserve monkey patching and c call */
     return rb_funcall(obj, rb_sym_assess_string_uminus, 0);
 }
 
 void Init_cs__assess_string(void) {
-    VALUE string_class;
-
     rb_sym_dup = rb_intern("dup");
     rb_sym_freeze = rb_intern("freeze");
-    rb_sym_assess_string_uminus = rb_intern("cs__patched_minus_at");
+    rb_sym_pre_freeze = rb_intern("pre_freeze");
+    /* Contrast::Agent::Assess::Tracker::PROPERTIES_HASH */
+    VALUE tracker = rb_define_class_under(assess, "Tracker", rb_cObject);
+    properties_hash = rb_const_get(tracker, rb_intern("PROPERTIES_HASH"));
 
-    string_class = rb_define_class("String", rb_cObject);
-    /* -@ */
-    contrast_alias_method(string_class, "cs__patched_minus_at", "-@");
-    rb_define_method(string_class, "-@", contrast_assess_string_uminus, 0);
+    /* We only do alias for this one */
+    rb_sym_assess_string_uminus =
+        contrast_register_patch("String", "-@", &contrast_assess_string_uminus);
+    rb_sym_assess_string_freeze = contrast_register_patch(
+        "String", "freeze", &contrast_assess_string_freeze);
 }

data/ext/cs__assess_string/cs__assess_string.h

@@ -1,8 +1,13 @@
 #include <ruby.h>
 
 static VALUE rb_sym_assess_string_uminus;
+static VALUE rb_sym_assess_string_freeze;
+// Contrast::Agent::Assess::Tracker::PROPERTIES_HASH
+static VALUE properties_hash;
 static VALUE rb_sym_dup;
 static VALUE rb_sym_freeze;
+static VALUE rb_sym_pre_freeze;
+static VALUE properties_hash;
 
 /*
  * The String#-@ method calls to the str_uminus method in String.C. This method
@@ -14,6 +19,7 @@ static VALUE rb_sym_freeze;
  * String#freeze, which will leave our properties alone.
  * -HM
  */
-static VALUE contrast_assess_string_uminus(const VALUE obj);
+static VALUE contrast_assess_string_uminus(const int argc, VALUE *argv,
+                                           const VALUE obj);
 
 void Init_cs__assess_string(void);

data/ext/cs__assess_string/extconf.rb

@@ -1,2 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
 $TO_MAKE = File.basename(__dir__)
 require_relative '../extconf_common'

data/ext/cs__assess_string_interpolation/cs__assess_string_interpolation.c

@@ -0,0 +1,39 @@
+/* Copyright (c) 2023 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__assess_string_interpolation.h"
+#include "../cs__common/cs__common.h"
+#include "../cs__scope/cs__scope.h"
+#include <ruby.h>
+
+static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary) {
+    VALUE result = rb_str_concat_literals_original(num, strary);
+    VALUE rb_params = rb_ary_new_from_values((int)num, strary);
+    VALUE in_contrast_scope = inst_methods_in_cntr_scope(contrast_patcher(), 0);
+
+    if (in_contrast_scope == Qfalse) {
+        /* enter scope */
+        inst_methods_enter_cntr_scope(contrast_patcher(), 0);
+        rb_funcall(string_propagator, track_interpolation, 2, rb_params,
+                   result);
+        /* exit scope */
+        inst_methods_exit_cntr_scope(contrast_patcher(), 0);
+    }
+
+    return result;
+}
+
+static int install_hooks() {
+    rb_str_concat_literals_original = rb_str_concat_literals;
+    patch_via_funchook(&rb_str_concat_literals_original,
+                       &rb_str_concat_literals_hook);
+
+    return 0;
+}
+
+void Init_cs__assess_string_interpolation(void) {
+    string_propagator =
+        rb_define_class_under(core_assess, "StringPropagator", rb_cObject);
+    track_interpolation = rb_intern("track_interpolation");
+    install_hooks();
+}

data/ext/cs__assess_string_interpolation/cs__assess_string_interpolation.h

@@ -0,0 +1,13 @@
+#include <ruby.h>
+
+static VALUE string_propagator;
+static VALUE track_interpolation;
+
+VALUE *rb_str_concat_literals(size_t num, const VALUE *strary);
+VALUE (*rb_str_concat_literals_original)(size_t, const VALUE *);
+
+static VALUE rb_str_concat_literals_hook(size_t num, VALUE *strary);
+
+static int install_hooks();
+
+void Init_cs__assess_string_interpolation(void);

data/ext/cs__assess_string_interpolation/extconf.rb

@@ -0,0 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'