contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/excluder/exclusion_matcher.rb

@@ -0,0 +1,112 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/settings/exclusion_base'
+require 'contrast/agent/reporting/settings/input_exclusion'
+require 'contrast/agent/reporting/settings/url_exclusion'
+
+module Contrast
+  module Agent
+    # Exclusions are ways for the User to tell the Agent to ignore sections of
+    # the Application. If a request or an event matches one of these, the
+    # functions of the Agent are suppressed for that request or event.
+    class ExclusionMatcher
+      include Contrast::Components::Logger::InstanceMethods
+      extend Forwardable
+
+      attr_reader :protect, :assess, :exclusion_type, :wildcard_url, :wildcard_input
+
+      def_delegators :@exclusion, :protect_rules, :assess_rules, :type, :name, :input_name, :urls, :match_strategy
+
+      MATCH_ALL = 'ALL'.cs__freeze
+
+      # Create a matcher around an exclusion sent from TeamServer.
+      #
+      # @param excl [Contrast::Agent::Reporting::Settings::ExclusionBase]
+      # @return [Contrast::Agent::ExclusionMatcher]
+      def initialize excl
+        @exclusion = excl
+        @protect = @exclusion.protect
+        @assess = @exclusion.assess
+
+        case excl
+        when Contrast::Agent::Reporting::Settings::InputExclusion
+          handle_wildcard_input
+          @exclusion_type = :INPUT
+        when Contrast::Agent::Reporting::Settings::UrlExclusion
+          handle_wildcard_url
+          @exclusion_type = :URL
+        end
+      end
+
+      # According to the docs for exclusions, user input applies to all inputs if
+      # the name supplied is an '*' or '.*'. The name matcher does NOT support
+      # regexp beyond this.
+      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
+      def handle_wildcard_input
+        return unless @exclusion.name # rubocop:disable Security/Module/Name
+
+        @wildcard_input = @exclusion.name == '.*' || @exclusion.name == Contrast::Utils::ObjectShare::ASTERISK # rubocop:disable Security/Module/Name
+      end
+
+      # According to the docs for exclusions, urls apply to all urls if the url
+      # supplied is '/.*' or if the URL mode is all. Otherwise, the URL supplied is
+      # to be treated as a regular expression that must match the entire URL
+      # against which it is tested.
+      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
+      def handle_wildcard_url
+        @wildcard_url = match_all?
+        return if @wildcard_url
+        return unless @exclusion.urls&.any?
+
+        @wildcard_url ||= @exclusion.urls.any?('/.*')
+        return if @wildcard_url
+
+        @urls = []
+        @exclusion.urls.each do |url|
+          url_pattern = build_regexp(url, start_anchor: true, end_anchor: true)
+          @urls << url_pattern if url_pattern
+        end
+      end
+
+      def build_regexp pattern, start_anchor: false, end_anchor: false
+        pattern = Contrast::Utils::ObjectShare::CARROT + pattern if start_anchor
+        pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
+        Regexp.compile(pattern)
+      rescue RegexpError => e
+        logger.error('Unable to generate a pattern for exclusion matching.', e, pattern: pattern)
+      end
+
+      def protect?
+        @protect
+      end
+
+      def assess?
+        @assess
+      end
+
+      def match_all?
+        (@exclusion.urls.nil? || @exclusion.urls.empty?) && @exclusion.match_strategy == MATCH_ALL
+      end
+
+      # Determine if the given rule is excluded by this exclusion.
+      # In this case, the `protect_rules` being empty means apply to all rules,
+      # not no rules
+      #
+      # @param rule - the id of the rule which we're checking for exclusion
+      def protection_rule? rule
+        protect? && (@exclusion.protect_rules.empty? || @exclusion.protect_rules.include?(rule))
+      end
+
+      # Determine if the given rule is excluded by this exclusion.
+      # In this case, the `assessment_rules` being empty means apply to all rules,
+      # not no rules
+      #
+      # @param rule - the id of the rule which we're checking for exclusion
+      def assess_rule? rule
+        assess? && (@exclusion.assess_rules.empty? || @exclusion.assess_rules.include?(rule))
+      end
+    end
+  end
+end

data/lib/contrast/agent/hooks/at_exit_hook.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    # This module adds an at_exit hook for us to send messages that may be lost at process exit
+    module AtExitHook
+      extend Contrast::Components::Logger::InstanceMethods
+
+      def self.exit_hook
+        @_exit_hook ||= begin
+          at_exit do
+            on_exit
+          end
+          true
+        end
+      end
+
+      # Actions to take when a process exits. Typically called from our
+      # exit_hook, but exposed here for other process terminations, like those
+      # in Kernel#exec
+      def self.on_exit
+        logger.debug('at_exit invoked, host application terminating',
+                     p_id: @pid,
+                     pp_id: @ppid,
+                     process_pid: Process.pid,
+                     process_pp_id: Process.ppid)
+
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context
+
+        [
+          Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage,
+          context.observed_route
+        ].compact.each do |event|
+          Contrast::Agent.reporter&.send_event_immediately(event)
+        end
+        Contrast::Agent.reporter&.send_event_immediately(context.activity)
+      end
+    end
+  end
+end

data/lib/contrast/agent/hooks/tracepoint_hook.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+
+module Contrast
+  module Agent
+    # This module is used to apply instrumentation to classes as they are required
+    module TracePointHook
+      extend Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::Scope::InstanceMethods
+
+      class << self
+        def enable!
+          @require_hook ||= TracePoint.new(:end) do |tracepoint_event|
+            process(tracepoint_event)
+          end
+
+          @require_hook.enable
+          logger.debug('Enabled :end event tracing')
+        end
+
+        def disable
+          instance_variable_defined?(:@require_hook) && @require_hook.disable
+        end
+
+        private
+
+        # Use the TracePoint from the :end event, meaning the completion of a definition of a Class or Module (or
+        # really the completion of that piece of a definition, as determined by an `end` statement since there could be
+        # definitions across multiple files) to carry out actions required on definition. This typically involves
+        # patching and usage analysis
+        #
+        # @param tracepoint_event [TracePoint] the TracePoint from the :end
+        def process tracepoint_event
+          with_contrast_scope do
+            # the Module or Class that was loaded during this event
+            loaded_module = tracepoint_event.self
+            # the file being loaded that contained this definition
+            path = tracepoint_event.path
+            return if path&.include?('contrast')
+
+            logger.trace('Received TracePoint end event', module: loaded_module, path: path)
+
+            Contrast::Agent.framework_manager.register_late_framework(loaded_module)
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
+            Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
+            Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)
+          rescue StandardError => e
+            logger.error('Unable to complete TracePoint analysis', e, module: loaded_module, path: path)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/database_config.rb

@@ -0,0 +1,175 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Methods used for parsing database connection configurations
+      # for getting inventory information from the application
+      module DatabaseConfig
+        extend Contrast::Components::Logger::InstanceMethods
+
+        # TeamServer only accepts certain values for FlowMap Services.
+        # DO NOT CHANGE THIS
+        ADAPTER = 'adapter'
+        HOST = 'host'
+        PORT = 'port'
+        DATABASE = 'database'
+        DEFAULT = 'default'
+        LOCALHOST = 'localhost'
+
+        class << self
+          # Append the available database connection information to the message being sent to TeamServer.
+          #
+          # @param activity_or_update [Contrast::Agent::Reporting::ApplicationUpdate]
+          # @param hash_or_str [Hash, String] the database connection information
+          def append_db_config activity_or_update, hash_or_str = active_record_config
+            arr = build_from_db_config(hash_or_str)
+            return unless arr&.any?
+
+            arr.each do |component|
+              next unless component
+
+              if activity_or_update.cs__is_a?(Contrast::Agent::Reporting::ApplicationUpdate)
+                activity_or_update.components << component
+              else
+                activity_or_update.attach_inventory(component)
+              end
+            end
+          rescue StandardError => e
+            logger.warn('Unable to append db config', e)
+            nil
+          end
+
+          private
+
+          # We capture the active record configuration used by this application, as reported by
+          # ActiveRecord::Base.connection_db_config, so that we can record it once and report it as needed.
+          #
+          # @return [Hash]
+          def active_record_config
+            return @_active_record_config if instance_variable_defined?(:@_active_record_config)
+            return unless defined?(ActiveRecord) && defined?(ActiveRecord::Base)
+
+            @_active_record_config = if ActiveRecord::Base.cs__respond_to?(:connection_db_config)
+                                       ActiveRecord::Base.connection_db_config
+                                     else
+                                       # TODO: RUBY-99999 - Remove when Rails 6.0 is not supported
+                                       ActiveRecord::Base.connection_config
+                                     end
+          rescue StandardError => e
+            logger.error('Unable to detect db config connection', e)
+            nil
+          end
+
+          # The classes we instrument in order to determine which, if any, database(s) an application connects to take
+          # either a Hash or a String as a parameter. We install this one patch into all of those methods, letting our
+          # code here, rather than at the patch level, make the determination of which path to call. We'll make that
+          # decision and then parse the given configuration to create a
+          # Contrast::Agent::Reporting::ArchitectureComponent for reporting.
+          #
+          # @param hash_or_str [Hash, String]
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>, nil]
+          def build_from_db_config hash_or_str
+            return unless hash_or_str
+
+            # we need to handle types of HashConfig, which != Hash
+            # for example ActiveRecord::DatabaseConfigurations::HashConfig is type of active_record config
+            # but the method is not handling it properly
+            # so we need to handle it here and extract the hash
+            hash_or_str = hash_or_str.configuration_hash if hash_or_str.cs__respond_to?(:configuration_hash)
+            if hash_or_str.is_a?(Hash)
+              build_from_db_hash(hash_or_str)
+            else
+              build_from_db_string(hash_or_str.to_s)
+            end
+          end
+
+          # Convert the Hash used to create a database connection into a
+          # Contrast::Agent::Reporting::ArchitectureComponent understandable by TeamServer.
+          #
+          # @param hash [Hash] the information used to open a database connection
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+          def build_from_db_hash hash
+            ac = Contrast::Agent::Reporting::ArchitectureComponent.build_database
+            ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
+            ac.remote_host = host_from_hash(hash)
+            ac.remote_port = port_from_hash(hash)
+            ac.url = hash[:database] || hash[DATABASE] || DEFAULT
+            [ac]
+          end
+
+          # Retrieve the host from the given connection Hash
+          #
+          # @param hash [Hash]
+          # @return [String]
+          def host_from_hash hash
+            hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Retrieve the port from the given connection Hash
+          #
+          # @param hash [Hash]
+          # @return [integer]
+          def port_from_hash hash
+            p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
+            p.to_i
+          end
+
+          # Examples:
+          # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
+          # postgresql://scott:tiger@localhost/mydatabase # pragma: allowlist secret
+          # mysql+mysqlconnector://scott:tiger@localhost/foo # pragma: allowlist secret
+          #
+          # @param str [String] the DB connection string
+          # @return [Array<Contrast::Agent::Reporting::ArchitectureComponent>, nil]
+          def build_from_db_string str
+            adapter, hosts, database = split_connection_str(str)
+            return unless adapter && hosts && database
+
+            acs = []
+            hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
+              host, port = s.split(Contrast::Utils::ObjectShare::COLON)
+
+              ac = Contrast::Agent::Reporting::ArchitectureComponent.build_database
+              ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
+              ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
+              ac.remote_port = port.to_i
+              ac.url = Contrast::Utils::StringUtils.force_utf8(database)
+              acs << ac
+            end
+            acs
+          end
+
+          # Parse the given string used to connect to a database into its composite components, allowing for the
+          # generation of a Contrast::Agent::Reporting::ArchitectureComponent
+          #
+          # @param str [String] the DB connection string
+          # @return [Array<String>, nil] the adapter, hosts, and database
+          def split_connection_str str
+            adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
+            return unless str
+
+            _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
+            return unless str
+
+            # Not currently used
+            # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
+            hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
+            return unless db_and_options
+
+            hosts << LOCALHOST if hosts.empty?
+            database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
+
+            [adapter, hosts, database]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependencies.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # this module is included in classes that need access to the applications dependencies
+      module Dependencies
+        CONTRAST_AGENT = 'contrast-agent'
+
+        # the #clone is necessary here, as a require in another thread could
+        # potentially result in adding a key to the loaded_specs hash during
+        # iteration.  (as in RUBY-330)
+        # this takes care of filtering out contrast-only dependencies
+        def loaded_specs
+          specs = Gem.loaded_specs.clone
+          specs.delete_if { |name, _v| contrast?(name) }
+        end
+
+        private
+
+        def contrast_gems
+          @_contrast_gems ||= find_contrast_gems
+        end
+
+        def contrast? name
+          contrast_gems.include?(name)
+        end
+
+        # Go through all dependents, given as a pair from the DependencyList: `dependency`
+        # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
+        # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
+        # then contrast depends on it. If its array of dependents is 1, then contrast is the
+        # only dependency in that list. Since only contrast depends on it, we should ignore it.
+        def find_contrast_gems
+          # rubocop:disable Security/Module/Name -- here name is part of Ruby Gems.
+          ignore = Set.new([CONTRAST_AGENT])
+          contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
+            dependency.name == CONTRAST_AGENT
+          end
+          contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
+
+          Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
+            ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
+          end
+          ignore
+          # rubocop:enable Security/Module/Name
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/library_discovery'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to collect dependencies of the application for reporting
+      class DependencyAnalysis
+        include Singleton
+        include Contrast::Agent::Inventory::Dependencies
+
+        # Report the dependencies of this application
+        #
+        # @return [Array<Contrast::Agent::Reporting::LibraryDiscovery>] direct report form of
+        #   Gem::Specification that have been loaded for this application.
+        def library_pb_list
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enable
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries
+
+          loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
+            next unless spec
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            reported_lib_list << Contrast::Agent::Reporting::LibraryDiscovery.new(digest, spec)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,120 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/library_usage_observation'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'set'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Agent::Inventory::Dependencies
+
+        def initialize
+          return unless enabled?
+
+          @lock = Mutex.new
+          @lock.synchronize { @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new } }
+        end
+
+        # This method is invoked once, along with the rest of our catchup code to report libraries and their associated
+        # files that have already been loaded pre-contrast.
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself.
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+
+            new_files = loaded_files_from_gem.each_with_object(Set.new) do |file_path, set|
+              set << adjust_path_for_reporting(file_path, spec)
+              logger.trace('Recording loaded file for inventory analysis', line: file_path)
+            end
+
+            # Even if new_files is empty, still need to add digest key for library discovery.
+            @lock.synchronize { @gemdigest_cache[digest].merge(new_files) }
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific file being required to the gem to which
+        # it belongs.
+        #
+        # @param path [String] the result of TracePoint#path from the :end event in which the Module was defined.
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s) if logger.debug?
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @lock.synchronize { @gemdigest_cache[digest] << report_path }
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache. If
+        # no libraries had files loaded, or inventory analysis is disabled, return nil instead.
+        #
+        # @return [Contrast::Agent::Reporting::ObservedLibraryUsage, nil]
+        def generate_library_usage
+          return unless enabled?
+          return unless @gemdigest_cache.any?
+
+          # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
+          # assignment and the replace
+          gem_spec_digest_to_files = @lock.synchronize do
+            hold = @gemdigest_cache
+            @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
+            hold
+          end
+
+          observed_library_usage = Contrast::Agent::Reporting::ObservedLibraryUsage.new
+          gem_spec_digest_to_files.each_pair do |digest, files|
+            next unless files.any?
+
+            usage = Contrast::Agent::Reporting::LibraryUsageObservation.new(digest, files)
+            observed_library_usage.observations << usage
+          end
+          observed_library_usage.observations.any? ? observed_library_usage : nil
+        rescue StandardError => e
+          logger.error('Unable to generate library usage.', e)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = ::Contrast::INVENTORY.enable && ::Contrast::INVENTORY.analyze_libraries if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/inventory.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Namespace used for inventory behavior
+    module Inventory
+    end
+  end
+end
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/agent/inventory/dependency_usage_analysis'
+require 'contrast/agent/inventory/dependency_analysis'

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/inventory/database_config'
+
+module Contrast
+  module Agent
+    module Inventory
+      module Policy
+        # This Module is how we apply the Data Store detection required for the
+        # FlowMap feature. It is called from our patches of the targeted methods
+        # in which database operations occur. It is responsible for deciding if
+        # the given invocation is worth reporting or not.
+        module DataStores
+          extend Contrast::Components::Logger::InstanceMethods
+          class << self
+            # The key used in policy.json to indicate the database type to
+            # report.
+            DATA_STORE_MARKER = 'data_store'
+
+            def report_data_store _method, _exception, properties, object, _args
+              return unless ::Contrast::INVENTORY.enable
+
+              marker = properties[DATA_STORE_MARKER]
+              return unless marker
+
+              file_report(marker)
+            rescue StandardError => e
+              logger.error('Error reporting database call', e, object: object)
+            end
+
+            private
+
+            def file_report data_store
+              return unless data_store
+
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context&.activity
+
+              context.activity.query_count += 1
+              return unless context.activity.query_count == 1
+
+              Contrast::Agent::Inventory::DatabaseConfig.append_db_config(context.activity)
+            end
+          end
+        end
+      end
+    end
+  end
+end