contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/tag.rb

@@ -1,63 +1,111 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Assess
       # A Tag represents a range in a given piece of data. It is used by the
       # Agent to determine if a vulnerable dataflow has occurred.
       class Tag
-        attr_reader :length,    # length of tagged text within string
+        include Contrast::Components::Logger::InstanceMethods
+
+        attr_reader :label,     # the label of this tag
+                    :length,    # length of tagged text within string
                     :start_idx, # start of range
-                    :end_idx    # end of range (calculated from start + length)
+                    :end_idx    # end of range (calculated from start + length), exclusive
 
+        # Update range should be how start and end index of tags are changed,
+        # as it includes validation
+        #
+        # Note that we allow start_idx == end_idx b/c this is how we determine
+        # if a tag range is 'covered' in trigger detection
+        ERROR_NEGATIVE_START = 'Unable to set start idx negative'
+        BELOW = 'BELOW'
+        ERROR_END_BEFORE_START = 'Unable to set start idx after end idx'
+        LOW_SPAN = 'LOW_SPAN'
+        WITHIN = 'WITHIN'
+        WITHOUT = 'WITHOUT'
+        HIGH_SPAN = 'HIGH_SPAN'
+        ABOVE = 'ABOVE'
         # Initialize a new tag
-        # length : the length of the string described with this tag
-        # start_idx : (default: 0) the starting position in the string for this tag
-        def initialize length, start_idx = 0
+        #
+        # @param label [String] the label of the tag
+        # @param length [Integer] the length of the string described with this
+        #   tag
+        # @param start_idx [Integer] (0) the starting position in the string for
+        #   this tag
+        def initialize label, length, start_idx = 0
+          @label = label
           update_range(start_idx, start_idx + length)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Return true if the tag covers the given position in the string
+        #
+        # @param idx [Integer] the index to check
+        # @return [Boolean]
         def covers? idx
           idx >= start_idx && idx < end_idx
         end
 
         # Return true if the tag is above the given position in the string
+        # @param idx [Integer] the index to check
+        # @return [Boolean]
         def above? idx
           idx < start_idx
         end
 
-        # Return the range that this tag covers
+        # Return the range that this tag covers, from start (inclusive) to
+        # end (exclusive).
+        #
+        # @return [Range]
         def range
           start_idx...end_idx
         end
 
+        def extends_beyond_string_size? string_length
+          @end_idx > string_length
+        end
+
         # Return if a given tag overlaps this one
-        def overlaps? other
-          return true if @start_idx <  other.start_idx && @end_idx >= other.start_idx  # we start below other & end in it
-          return true if @start_idx >= other.start_idx && @end_idx <= other.end_idx    # we start and end in other
-          return true if @start_idx <= other.end_idx   && @end_idx >  other.end_idx    # we start in other & end above it
+        def overlaps? start_idx, end_idx
+          return true if @start_idx <  start_idx && @end_idx >= start_idx  # we start below range & end in it
+          return true if @start_idx >= start_idx && @end_idx <= end_idx    # we start and end in range
+
+          @start_idx <= end_idx && @end_idx > end_idx                      # we start in range & end above it
         end
 
         def shift idx
           update_range(@start_idx + idx, @end_idx + idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def shift_end idx
           update_range(@start_idx, @end_idx + idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def update_start start_idx
           update_range(start_idx, @end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def update_end end_idx
           update_range(@start_idx, end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def repurpose start_idx, end_idx
           update_range(start_idx, end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Given a tag, merge its ranges with this one
@@ -67,11 +115,13 @@ module Contrast
         # Returns true if the other tag was merged into
         # this tag
         def merge other
-          return unless overlaps?(other)
+          return unless overlaps?(other.start_idx, other.end_idx)
 
           start = other.start_idx < @start_idx ? other.start_idx : @start_idx
           finish = other.end_idx > @end_idx ? other.end_idx : @end_idx
           update_range(start, finish)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Modification to tracked String can change the position and length of the tracked tag
@@ -82,7 +132,7 @@ module Contrast
           new_start_idx = start >= 0 ? start : 0
           # If a tag were to go negative, cut off the negative portion from length
           new_length = start >= 0 ? length : (length + start)
-          Contrast::Agent::Assess::Tag.new(new_length, new_start_idx)
+          Contrast::Agent::Assess::Tag.new(label, new_length, new_start_idx)
         end
 
         def str_val
@@ -90,37 +140,36 @@ module Contrast
         end
         alias_method :to_s, :str_val
 
-        BELOW = 'BELOW'
-        LOW_SPAN = 'LOW_SPAN'
-        WITHIN = 'WITHIN'
-        WITHOUT = 'WITHOUT'
-        HIGH_SPAN = 'HIGH_SPAN'
-        ABOVE = 'ABOVE'
-
         # The tag is ______ the range
         # rrrrrrr == self.range, the range of the tag
         def compare_range start, stop
-          # r starts and stops below
-          # rrrrrrrrrrrrr
-          #               start       stop
-          return BELOW     if @start_idx <  start && @end_idx <= start
-          # r starts below and finishes within
-          # rrrrrrrrrrrrr
-          #    start       stop
-          return LOW_SPAN  if @start_idx <  start && @end_idx > start && @end_idx <= stop
+          # the range starts below the given values
+          if @start_idx < start
+            # r starts and stops below
+            # rrrrrrrrrrrrr
+            #               start       stop
+            return BELOW if @end_idx <= start
+            # r starts below and finishes within
+            # rrrrrrrrrrrrr
+            #    start       stop
+            return LOW_SPAN if @end_idx > start && @end_idx <= stop
+            # r starts below and finishes above stop
+            #  rrrrrrrrrrrrrrrrrrrrrrrr
+            #     start       stop
+            return WITHOUT if @end_idx > stop
+          end
+
+          # the range starts at or above the given values
           # r is between start and stop
           #        rrrrrrrrrrrrrrr
           # start                   stop
-          return WITHIN    if @start_idx >= start && @start_idx < stop && @end_idx <= stop
-          # r starts below and finishes above stop
-          #  rrrrrrrrrrrrrrrrrrrrrrrr
-          #     start       stop
-          return WITHOUT   if @start_idx <  start && @end_idx > stop
+          return WITHIN if @start_idx < stop && @end_idx <= stop
           # r starts within and finishes above stop
           #           rrrrrrrrrrrrr
           #   start       stop
-          return HIGH_SPAN if @start_idx >= start && @start_idx < stop && @end_idx > stop
+          return HIGH_SPAN if @start_idx < stop && @end_idx > stop
 
+          # the range is above the given values
           # starts and stops above
           #                   rrrrrrrrrrrrr
           #  start       stop
@@ -129,13 +178,7 @@ module Contrast
 
         private
 
-        # Update range should be how start and end index of tags are changed,
-        # as it includes validation
-        #
-        # Note that we allow start_idx == end_idx b/c this is how we determine
-        # if a tag range is 'covered' in trigger detection
-        ERROR_NEGATIVE_START = 'Unable to set start idx negative'
-        ERROR_END_BEFORE_START = 'Unable to set start idx after end idx'
+        # @raise[ArgumentError] raises if start_idx is negative or the end_idx is smaller than the start_idx
         def update_range start_idx, end_idx
           raise(ArgumentError, ERROR_NEGATIVE_START) if start_idx.negative?
           raise(ArgumentError, ERROR_END_BEFORE_START) if end_idx < start_idx

data/lib/contrast/agent/assess/tracker.rb

@@ -0,0 +1,70 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/finalizers/hash'
+
+module Contrast
+  module Agent
+    module Assess
+      # How we track the Assess properties attached to objects
+      #
+      # Finalized objects should run through this class as the Finalizers
+      # have tightly coupled dependencies on each other.
+      class Tracker
+        PROPERTIES_HASH = Contrast::Agent::Assess::Finalizers::Hash.new
+
+        class << self
+          # Retrieve the properties of the given Object, iff they exist.
+          #
+          # @param source [Object, nil] the thing for which to look up properties.
+          # @return [Contrast::Agent::Assess::Properties, nil]
+          def properties source
+            PROPERTIES_HASH[source]
+          end
+
+          # Retrieve the properties of the given Object, returning a new
+          # instance if one does not already exist and the source is trackable.
+          #
+          # @param source [Object] the thing for which to look up properties.
+          # @return [Contrast::Agent::Assess::Properties, nil]
+          def properties! source
+            return unless trackable?(source)
+
+            PROPERTIES_HASH[source] ||= Contrast::Agent::Assess::Properties.new
+          end
+
+          def trackable? source
+            PROPERTIES_HASH.trackable?(source)
+          end
+
+          def tracked? source
+            PROPERTIES_HASH.tracked?(source)
+          end
+
+          def pre_freeze source
+            PROPERTIES_HASH.pre_freeze(source)
+          end
+
+          # Copy the properties from one object to the next, assuming the
+          # target does not already have its own properties. This should only
+          # ever be called when building PreShift for those objects sources
+          # which are already tracked.
+          #
+          # @param source [Object] the instance from which to copy properties
+          # @param target [Object] the instance to which to copy properties
+          def copy source, target
+            PROPERTIES_HASH[target] ||= properties(source).dup
+          end
+
+          # Clean PROPERTIES_HASH of any values older than KEEP_AGE ms or
+          # have nil properties
+          def cleanup!
+            PROPERTIES_HASH.cleanup!
+          end
+        end
+      end
+    end
+  end
+end
+
+require 'contrast/agent/assess/finalizers/freeze'

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -1,16 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent
     module Deadzone
       module Policy
-        # This class functions to translate our policy.json into an actionable
-        # Ruby object, allowing for dynamic patching over hardcoded patching,
-        # specifically for those methods in which other Contrast operations
-        # should not apply
+        # This class functions to translate our policy.json into an actionable Ruby object, allowing for dynamic
+        # patching over hardcoded patching, specifically for those methods in which other Contrast operations should
+        # not apply.
         class DeadzoneNode < Contrast::Agent::Patching::Policy::PolicyNode
           def node_class
             'Deadzone'
@@ -19,6 +18,12 @@ module Contrast
           def feature
             'Deadzone'
           end
+
+          # Deadzone means place the code inside of the contrast scope so that none of our code executes. As such, all
+          # DeadZone nodes have that as their method scope.
+          def method_scope
+            :contrast
+          end
         end
       end
     end

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -1,15 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/deadzone/policy/deadzone_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/deadzone/policy/deadzone_node'
+require 'contrast/agent/patching/policy/policy'
 
 module Contrast
   module Agent
     module Deadzone
       module Policy
-        # This is just a holder for our policy. Takes the policy JSON and
-        # converts it into hashes that we can access nicely
+        # This is just a holder for our policy. Takes the policy JSON and converts it into hashes that we can access
+        # nicely.
         class Policy < Contrast::Agent::Patching::Policy::Policy
           def self.policy_folder
             'deadzone'
@@ -35,16 +35,20 @@ module Contrast
             end
           end
 
+          def module_names
+            @_module_names ||= Set.new(deadzones.map(&:class_name))
+          end
+
           def add_node node, _node_type = :deadzones
             unless node
-              logger.error(nil, 'Node was nil when adding node to policy')
+              logger.error('Node was nil when adding node to policy')
               return
             end
 
             begin
               node.validate
             rescue ArgumentError => e
-              logger.error(e, e.message)
+              logger.error('Node failed validation', e)
               return
             end
 

data/lib/contrast/agent/excluder/excluder.rb

@@ -0,0 +1,306 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/url_exclusion'
+require 'contrast/agent/reporting/input_analysis/input_type'
+
+module Contrast
+  module Agent
+    # Given an array of exclusion matcher instances provides methods to
+    # determine if the exclusions apply to particular urls.
+    class Excluder # rubocop:disable Metrics/ClassLength
+      include Contrast::Agent::Reporting::InputType
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      attr_reader :exclusions
+
+      # @param exclusions [Array<Contrast::Agent::ExclusionMatcher>]
+      def initialize exclusions = []
+        @exclusions = exclusions
+      end
+
+      # Determine if an input is excluded for protect rule.
+      #
+      # @param results [Array<Contrast::Agent::Reporting::InputAnalysisResult>]
+      # @param request_path [String] Current request path
+      def protect_excluded_by_input? results, request_path
+        return false unless results.any?
+
+        exclusion_matched = 0
+        protect_input_exclusions.any? do |exclusion_match|
+          # each exclusion against each input result
+          results.each do |rule_result|
+            # check and see the rule_id match first or if this applicable for all protect rules.
+            next unless exclusion_match.protection_rule?(rule_result.rule_id)
+
+            # Based on strategy:
+            match = input_match_strategy(exclusion_match,
+                                         input_match?(exclusion_match, rule_result.input_type, rule_result.key),
+                                         request_path)
+            exclusion_matched += 1 if match
+          end
+        end
+        return false if exclusion_matched.zero?
+
+        true
+      end
+
+      # If an assess URL exclusion rule applies to the current url, *and* is defined as "All Rules"
+      # then we can avoid any tracking for the request.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @return [Boolean]
+      def assess_excluded_by_url? request
+        assess_url_exclusions_for_all_rules.any? do |exclusion_matcher|
+          path_match?(exclusion_matcher, request.path)
+        end
+      end
+
+      # If an assess URL exclusion rule applies to the current url, *and* also covers the
+      # provided rule_id, then we can avoid tracking this entry.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param rule_id [String]
+      # return [Boolean]
+      def assess_excluded_by_url_and_rule? request, rule_id
+        request_path = request.path
+
+        assess_url_exclusions.any? do |exclusion_matcher|
+          path_match?(exclusion_matcher, request_path) &&
+              (exclusion_matcher.assess_rules.empty? || exclusion_matcher.assess_rules.include?(rule_id))
+        end
+      end
+
+      # If an assess INPUT exclusion rule applies to the current url, *and* also covers all
+      # rules, then we can avoid tracking this entry.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param source_type [String]
+      # @param source_name [String]
+      # return [Boolean]
+      def assess_excluded_by_input? request, source_type, source_name
+        request_path = request.path
+
+        assess_input_exclusions_for_all_rules.any? do |exclusion_matcher|
+          input_match?(exclusion_matcher, source_type, source_name) && path_match?(exclusion_matcher, request_path)
+        end
+      end
+
+      # If an assess INPUT exclusion rule covers the provided rule_id *for all finding event sources*, then we
+      # can avoid tracking this entry. If any event source *isn't excluded* then we don't exclude the finding.
+      #
+      # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+      # @param finding [Contrast::Agent::Reporting::Finding]
+      # @param rule [String]
+      # return [Boolean]
+      def assess_excluded_by_input_and_rule? request, finding, rule
+        return false if finding.events.empty?
+
+        # We need to check for url exclusions here for the input rules as the url exclusions
+        # that have already been checked didn't include the INPUT exclusions. So we look for
+        # any INPUT exclusions that apply to the current url and the supplied rule.
+        path = request.path
+        rule_input_exclusions = assess_input_exclusions.select do |exclusion_matcher|
+          (exclusion_matcher.protect_rules.empty? || exclusion_matcher.protect_rules.include?(rule)) &&
+              path_match?(exclusion_matcher, path)
+        end
+        return false if rule_input_exclusions.empty?
+
+        event_sources = finding.events.flat_map(&:event_sources)
+        event_sources.each do |event_source|
+          return false unless rule_input_exclusions.any? do |exclusion|
+            input_match?(exclusion, event_source.source_type, event_source.source_name)
+          end
+        end
+
+        # If we reach here, and we have event sources then all of them matched so we should exclude
+        # this finding. On the other hand, if there were no event sources we have nothing to exclude.
+        event_sources.any?
+      end
+
+      # If a protect URL exclusion rule applies to the current url, *and* is defined as "All Rules"
+      # then we can avoid using the rule for the request.
+      #
+      # @param rule_id [String]
+      # @param path [String]
+      # return [Boolean]
+      def protect_excluded_by_url? rule_id, path
+        protect_url_exclusions.any? do |exclusion_matcher|
+          next unless exclusion_matcher.protection_rule?(rule_id)
+
+          return true if path_match?(exclusion_matcher, path)
+        end
+      end
+
+      private
+
+      # Here we check to see the matching strategy. If ALL is set we need to exclude any input matching
+      # the exclusion. If ONLY is set, that means that we have a set if urls to match and apply the
+      # input exclusion only to those matching urls.
+      #
+      # @param exclusion_match [Contrast::Agent::ExclusionMatcher]
+      # @param input_match [Boolean] does the input match the exclusion
+      # @param request_path [String] Current request path
+      # @return [Boolean]
+      def input_match_strategy exclusion_match, input_match, request_path
+        # for ALL urls
+        return input_match if exclusion_match.match_all?
+
+        # for ONLY match we need to check if there is an input and url match.
+        input_match && path_match?(exclusion_match, request_path)
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_url_exclusions_for_all_rules
+        @_assess_url_exclusions_for_all_rules ||= assess_url_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.assess_rules.empty?
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_url_exclusions
+        @_assess_url_exclusions ||= assess_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.exclusion_type == :URL
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_input_exclusions_for_all_rules
+        @_assess_input_exclusions_for_all_rules ||= assess_input_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.assess_rules.empty?
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_input_exclusions
+        @_assess_input_exclusions ||= assess_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.exclusion_type == :INPUT
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def assess_exclusions
+        @_assess_exclusions ||= @exclusions.select(&:assess)
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_url_exclusions
+        @_protect_url_exclusions ||= protect_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.exclusion_type == :URL
+        end
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_exclusions
+        @_protect_exclusions ||= @exclusions.select(&:protect)
+      end
+
+      # @return [Array<Contrast::Agent::ExclusionMatcher>]
+      def protect_input_exclusions
+        @_protect_input_exclusions ||= protect_exclusions.select do |exclusion_matcher|
+          exclusion_matcher.exclusion_type == :INPUT
+        end
+      end
+
+      # @return [Boolean]
+      def path_match? exclusion_matcher, path
+        return false unless path
+
+        exclusion_matcher.wildcard_url ||
+            exclusion_matcher.urls.any? { |url| url.match?(path) || regexp_match?(url, path) }
+      end
+
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_type [String]
+      # @param source_name [String]
+      # @return [Boolean]
+      def input_match? exclusion, source_type, source_name
+        case exclusion.type
+        when 'PARAMETER'
+          input_match_parameter?(exclusion, source_type, source_name)
+        when 'COOKIE'
+          input_match_cookie?(exclusion, source_type, source_name)
+        when 'HEADER'
+          input_match_header?(exclusion, source_type, source_name)
+        when 'BODY'
+          BODY == source_type
+        when 'QUERYSTRING'
+          QUERYSTRING == source_type
+        else
+          false
+        end
+      end
+
+      # Returns true if parameter exclusion is found.
+      #
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_type [Contrast::Agent::Reporting::InputType<Symbol>]
+      # @param source_name [String] value to match
+      # @return [Boolean]
+      def input_match_parameter? exclusion, source_type, source_name
+        return false unless params_types.include?(source_type)
+
+        input_value_match?(exclusion, source_name)
+      end
+
+      # Returns true if cookie exclusion is found.
+      #
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_type [Contrast::Agent::Reporting::InputType<Symbol>]
+      # @param source_name [String] value to match
+      # @return [Boolean]
+      def input_match_cookie? exclusion, source_type, source_name
+        return false unless cookie_types.include?(source_type)
+
+        input_value_match?(exclusion, source_name)
+      end
+
+      # Returns true if header exclusion is found.
+      #
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_type [Contrast::Agent::Reporting::InputType<Symbol>]
+      # @param source_name [String] value to match
+      # @return [Boolean]
+      def input_match_header? exclusion, source_type, source_name
+        return false unless source_type == HEADER
+
+        input_value_match?(exclusion, source_name, header: true)
+      end
+
+      # regexp check for input name match
+      #
+      # @return [Boolean]
+      def regexp_match? possible_pattern, source_name
+        Regexp.new("^#{ possible_pattern }$").match?(source_name) || Regexp.new(possible_pattern).match?(source_name)
+      rescue RegexpError
+        false
+      end
+
+      # Returns true if ia input matches exclusion input name, or it's a all input type - wildcard [*, .*]
+      #
+      # @param exclusion [Contrast::Agent::ExclusionMatcher]
+      # @param source_name [String] value to match
+      # @param header [Boolean]
+      # @return [Boolean]
+      def input_value_match? exclusion, source_name, header: nil
+        exclusion.wildcard_input ||
+            (header.nil? ? (exclusion.name == source_name) : exclusion.name.casecmp(source_name).zero?) || # rubocop:disable Security/Module/Name
+            regexp_match?(exclusion.name, source_name) || exclusion.input_name == source_name # rubocop:disable Security/Module/Name
+      end
+
+      # Input types to match against exclusions parameter type.
+      #
+      # @return [Array<Symbol>]
+      def params_types
+        @_params_types ||= [PARAMETER_VALUE, PARAMETER_NAME].cs__freeze
+      end
+
+      # Input types to match against exclusions cookie type.
+      #
+      # @return [Array<Symbol>]
+      def cookie_types
+        @_cookie_types ||= [COOKIE_NAME, COOKIE_VALUE].cs__freeze
+      end
+    end
+  end
+end