contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity.rb

@@ -0,0 +1,74 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/timer'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample'
+require 'contrast/agent/reporting/reporting_events/reportable_hash'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new AttackerSampleActivity class which will include Sample of the given attacks in the activity
+      # period.
+      class ApplicationDefendAttackSampleActivity < Contrast::Agent::Reporting::ReportableHash
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSample>]
+        attr_reader :samples
+        # @return [Hash<Integer,Integer>] map of time from start in seconds to number of attacks in that second
+        attr_reader :time_map
+
+        def initialize
+          @samples = []
+          @start_time = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0 # in ms
+          @event_type = :application_defend_attack_sample_activity
+          @time_map = Hash.new { |h, k| h[k] = 0 }
+          super()
+        end
+
+        def to_controlled_hash
+          validate
+          {
+              attackTimeMap: time_map,
+              samples: samples.map(&:to_controlled_hash),
+              startTime: @start_time, # Start time in ms.
+              total: 1 # there will only ever be 1 attack sample, until batching is done
+          }
+        end
+
+        def validate
+          raise(ArgumentError, 'Start Time is not presented') unless @start_time
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          attack_result.samples.each do |attack_sample|
+            base_time = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
+            sample_time = attack_sample.time_stamp.to_i
+            samples << Contrast::Agent::Reporting::ApplicationDefendAttackSample.convert(attack_result, attack_sample)
+            @start_time = if sample_time.zero?
+                            @start_time
+                          else
+                            sample_time
+                          end
+            attack_second = (@start_time - base_time) / 1000 # in seconds
+            time_map[attack_second] += 1
+          end
+        end
+
+        # This method will merge time_maps of attack samples with same
+        # type.
+        #
+        # @param map [Hash<Integer,Integer>] TimeMap to append to previously_violated rule
+        # samples.
+        # @return time_map [Hash<Integer,Integer>] merged time map with updated occurrences.
+        def merge_time_maps map
+          # If the second is the same (key) if we just merge there won't be a new entry,
+          # so just increase the attack count.
+          map.each_key do |key|
+            @time_map[key] = @time_map.fetch(key, 0) + map[key]
+          end
+          @time_map
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_stack.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackSample class which includes a samples of an attack for the given rule of
+      # the given result observed in the activity period.
+      class ApplicationDefendAttackSampleStack
+        # @return [String]
+        attr_accessor :file_name
+        # @return [String]
+        attr_accessor :method_name
+
+        # @return [Hash]
+        def to_controlled_hash
+          { fileName: @file_name, methodName: @method_name }.compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attacker_activity.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/reporting/reporting_events/reportable_hash'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_activity'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new AttackerActivity class which will includes the attacker information discovered during this
+      # activity period.
+      class ApplicationDefendAttackerActivity < Contrast::Agent::Reporting::ReportableHash
+        # @return [Hash<String,Contrast::Agent::Reporting::ApplicationDefendAttackActivity>] map of rule-id to violated
+        #   samples for that rule
+        attr_accessor :protection_rules
+        # @return [String, nil] the IP address of the request from which the attack originated; used to identify unique
+        #   attackers
+        attr_reader :source_ip
+        # @return [String, nil] the X-Forwarded-For Header of the request from which the attack originated; used to
+        #   identify unique attackers
+        attr_reader :source_forwarded_for
+
+        # @param ia_request [Contrast::Agent::Reporting::FindingRequest, nil] Worthwatching worker input_analysis
+        # saved request.
+        def initialize ia_request: nil
+          @protection_rules = {}
+          req = ia_request || Contrast::Agent::REQUEST_TRACKER.current&.request
+          if req
+            @source_ip = req.ip || Contrast::Utils::ObjectShare::EMPTY_STRING
+            @source_forwarded_for = req.headers['X-Forwarded-For']
+          end
+          @event_type = :application_defend_attacker_activity
+          super()
+        end
+
+        def to_controlled_hash
+          validate
+          {
+              protectionRules: process_protection_rules,
+              source: {
+                  ip: source_ip,
+                  xForwardedFor: source_forwarded_for
+              }
+          }
+        end
+
+        def validate
+          if Contrast::Utils::DuckUtils.empty_duck?(protection_rules) # rubocop:disable Style/GuardClause
+            raise(ArgumentError, 'Protection Rules are not presented')
+          elsif Contrast::Utils::DuckUtils.empty_duck?(source_ip)
+            raise(ArgumentError, 'Source  is not presented')
+          end
+
+          nil
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          @protection_rules[attack_result.rule_id] = Contrast::Agent::Reporting::ApplicationDefendAttackActivity.new.
+              tap do |activity|
+            activity.attach_data(attack_result)
+          end
+        end
+
+        def process_protection_rules
+          hsh = {}
+          @protection_rules.each_pair do |rule_id, attack_activity|
+            hsh[rule_id] = attack_activity.to_controlled_hash
+          end
+          hsh
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb

@@ -0,0 +1,43 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/agent/reporting/reporting_events/discovered_route'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationInventory class which will include all the needed information
+      # for the new reporting system to report. Reporting those components or details discovered at
+      # startup, or as soon as possible, but not necessarily seen used by the application. Each of
+      # these messages should only be sent once per application.
+      class ApplicationInventory < Contrast::Agent::Reporting::ApplicationReportingEvent
+        # @param [Array<Contrast::Agent::Reporting::DiscoveredRoute>] the routes registered to this application, as
+        #   discovered during first request processing.
+        attr_reader :routes
+
+        def initialize
+          @event_type = :application_inventory
+          @event_method = :POST
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_inventory
+          # The API spec limits us to 500 routes, so we'll enforce that here to not hold on to superfulous data.
+          @routes = Contrast::Agent.framework_manager.find_route_discovery_data&.take(500)
+          super()
+        end
+
+        def file_name
+          'applications-inventory'
+        end
+
+        def to_controlled_hash
+          {
+              session_id: ::Contrast::ASSESS.session_id,
+              # documentation lists routes as deprecated from the agent_ng_endpoints.yml
+              routes: routes.map(&:to_controlled_hash)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationInventoryActivity class which will include all the information
+      # about the inventory of the application which was discovered during exercise of the application
+      # during this activity period.
+      class ApplicationInventoryActivity < Contrast::Agent::Reporting::ApplicationReportingEvent
+        # return [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+        attr_reader :components
+        # @ return [Array<String>, nil] - User-Agent Header value
+        attr_reader :browsers
+
+        def initialize
+          @event_type = :application_inventory_activity
+          @browsers = []
+          @components = []
+          super()
+        end
+
+        def to_controlled_hash
+          {
+              activityDuration: duration,
+              browsers: browsers,
+              components: components.map(&:to_controlled_hash)
+          }
+        end
+
+        # @param architectures [Array<Contrast::Agent::Reporting::ArchitectureComponent>,
+        # Contrast::Agent::Reporting::ArchitectureComponent]
+        def attach_data architectures
+          Array(architectures).each do |architecture|
+            @components << architecture
+          end
+          request_headers = Contrast::Agent::REQUEST_TRACKER.current&.request&.headers
+          @browsers << request_headers['USER_AGENT'] if request_headers
+        end
+
+        def duration
+          Contrast::Utils::Timer.now_ms - (Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0)
+        end
+
+        # Helper method to determine if InventoryActivity has no data
+        def empty?
+          @browsers.empty? && @components.empty?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_reporting_event.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationReportingEvent class which will include all the needed and mutual information for
+      # those events which correspond to Applications, such as Application Activity or Application Update
+      #
+      # @abstract
+      class ApplicationReportingEvent < Contrast::Agent::Reporting::ReportingEvent
+        protected
+
+        # The timestamp field is a bit of a misnomer. It's really the time, in ms, since the settings for this
+        # application have been updated. If I've never updated, then it's been 0ms since then.
+        #
+        #
+        # @return [Integer]
+        def since_last_update
+          (update_time = Contrast::SETTINGS.last_app_update_ms) ? Contrast::Utils::Timer.now_ms - update_time : 0
+        end
+
+        # Human readable last time update for header set. Set to 0 if the agent is just starting and have not received
+        # the latest header from TS.
+        #
+        #
+        # @return [String]
+        def since_last_update_httpdate
+          Contrast::SETTINGS.app_settings_last_httpdate || Contrast::Utils::Timer.ms_to_httpdate(0)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_settings.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_utilities/endpoints'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will initialize a GET request to be send to TS. The application settings endpoint is the way
+      # the Agent receives application sittings
+      class ApplicationSettings < Contrast::Agent::Reporting::ApplicationReportingEvent
+        def initialize
+          @event_method = :GET
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_settings
+          super()
+        end
+
+        def file_name
+          'application-settings'
+        end
+
+        # Attach the last server settings received timestamp to the request as it is required.
+        #
+        # If-Modified-Since: <day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
+        # @param request [Net::HTTPRequest]
+        def attach_headers request
+          request['If-Modified-Since'] = since_last_update_httpdate
+        end
+
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          {}
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_startup.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/application_startup_instrumentation'
+require 'contrast/config'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationStartup class which will include all the needed information for the new reporting
+      # system to report an Application has started; creating a new one or marking an existing one as online in the
+      # Contrast UI
+      class ApplicationStartup < Contrast::Agent::Reporting::ApplicationReportingEvent
+        def initialize
+          @event_method = :PUT
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints::NG_ENDPOINTS[:application_create]
+          super()
+        end
+
+        def file_name
+          'applications-create'
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        def to_controlled_hash
+          app_config = ::Contrast::CONFIG.application
+          {
+              code: app_config.code,
+              group: app_config.group,
+              instrumentation: Contrast::Agent::Reporting::ApplicationStartupInstrumentation.new.to_controlled_hash,
+              metadata: app_config.metadata,
+              session_id: ::Contrast::CONFIG.session_id,
+              session_metadata: ::Contrast::CONFIG.session_metadata,
+              tags: app_config.tags
+          }.compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_startup_instrumentation.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/protect'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationStartupInstrumentation class which will include all the needed information for the
+      # system to report the instrumentation mode to which the agent was set by local configuration.
+      class ApplicationStartupInstrumentation
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          {
+              protect: {
+                  enable: ::Contrast::PROTECT.enabled?
+              }
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_update.rb

@@ -0,0 +1,55 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/library_discovery'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/agent/reporting/reporting_events/route_discovery'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Application Update class which will include all the needed information for the new reporting
+      # system. Contains data used by TeamServer to render the Flow Map and SCA features.
+      #
+      # @attr_reader components [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+      # @attr_accessor libraries [Array<Contrast::Agent::Reporting::LibraryDiscovery>]
+      class ApplicationUpdate < Contrast::Agent::Reporting::ApplicationReportingEvent
+        attr_reader :components
+        attr_accessor :libraries
+
+        def initialize
+          @event_method = :PUT
+          @event_endpoint = "#{ Contrast::API.api_url }/api/ng/update/application"
+          @components = []
+          @libraries = []
+          super()
+        end
+
+        def file_name
+          'update-application'
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              components: components.map(&:to_controlled_hash),
+              libraries: libraries.map(&:to_controlled_hash),
+              timestamp: since_last_update
+          }
+        end
+
+        # Ensure the required fields are present.
+        #
+        # @raise [ArgumentError]
+        def validate; end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/reportable_hash'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Architecture Component class which will include all the needed information for the new
+      # reporting system to relay this information in the Application Update and Application Activity messages. These
+      # components are used by TeamServer to construct the backend/ outbound connection section of the Flow Map
+      # feature.
+      #
+      # @attr_reader remote_host [String] the host section of the connection to the component.
+      # @attr_reader remote_port [Integer] the port section of the connection to the component.
+      # @attr_reader type [String] the type of the component. Only ::VALID_TYPES can be used. Required for reporting.
+      # @attr_reader url [String] the url used to connect to the component. Required for reporting.
+      # @attr_reader vendor [String] the publisher of the component, like MySQL.
+      class ArchitectureComponent < Contrast::Agent::Reporting::ReportableHash
+        # required attributes
+        attr_accessor :type, :url
+        # optional attributes
+        attr_accessor :remote_host, :remote_port, :vendor
+
+        # TeamServer only treats these specific values as valid for Architecture Components. It does not know how to
+        # process a message with a different type.
+        AC_TYPE_DB = 'db'
+        VALID_TYPES = %w[db ldap ws].cs__freeze
+
+        class << self
+          def build_database
+            msg = new
+            msg.type = AC_TYPE_DB
+            msg
+          end
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              remoteHost: remote_host,
+              remotePort: remote_port,
+              type: type,
+              url: url,
+              vendor: vendor
+          }
+        end
+
+        # Ensure the required fields are present.
+        #
+        # @raise [ArgumentError]
+        def validate
+          unless VALID_TYPES.include?(type)
+            raise(ArgumentError, "#{ self } did not have a proper type - '#{ type }'. Unable to continue.")
+          end
+          raise(ArgumentError, "#{ self } did not have a proper URL. Unable to continue.") unless url
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb

@@ -0,0 +1,122 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'json'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/utils/object_share'
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Discovered Route class which will include all the needed information for the new reporting
+      # system to relay this information in the Route Observation messages. These observations are used by TeamServer
+      # to construct the route coverage information for the assess feature. They represent those methods which map to
+      # externally accessible endpoints within the application, as registered to the application framework. This also
+      # includes the literal URL and HTTP Verb used to invoke them, as they must have been called at this point to be
+      # recorded.
+      class DiscoveredRoute < Contrast::Agent::Reporting::ObservedRoute
+        class << self
+          # @param obj [Regexp, Object]
+          # @return [String]
+          def source_or_string obj
+            if obj.cs__is_a?(Regexp)
+              obj.source
+            elsif obj.cs__respond_to?(:safe_string)
+              obj.safe_string
+            else
+              obj.to_s
+            end
+          end
+
+          # Convert ActionDispatch::Journey::Route to Contrast::Agent::Reporting::DiscoveredRoute
+          #
+          # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @param url [String, nil] use url from string instead of journey object.
+          # @return [Contrast::Agent::Reporting::DiscoveredRoute]
+          def from_action_dispatch_journey journey_obj, url = nil
+            msg = new
+            msg.signature = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
+
+            verb = source_or_string(journey_obj.verb)
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+            url ||= source_or_string(journey_obj.path.spec)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(url)
+            msg
+          end
+
+          # Convert Grape route data to discovered route.
+          #
+          # @param controller [::Grape::API] the route's final controller.
+          # @param method [String] GET, PUT, POST, etc...
+          # @param url [String, nil] use url from string instead matched pattern.
+          # @param pattern [String, Grape::Router::Route] the pattern that was matched in routing.
+          # @return [Contrast::Agent::Reporting::DiscoveredRoute]
+          def from_grape_controller controller, method, pattern, url = nil
+            if pattern.cs__is_a?(Grape::Router::Route)
+              safe_pattern = pattern.pattern&.path&.to_s
+              safe_url = source_or_string(url || safe_pattern)
+            else
+              safe_pattern = source_or_string(pattern)
+              safe_url = source_or_string(url || pattern)
+            end
+
+            msg = new
+            msg.signature = "#{ controller }##{ method } #{ safe_pattern }"
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
+            msg
+          end
+
+          # Convert Sinatra route data to discovered route.
+          #
+          # @param controller [::Sinatra::Base] the route's final controller.
+          # @param method [String] GET, PUT, POST, etc...
+          # @param pattern [::Mustermann::Sinatra]  the pattern that was matched in routing.
+          # @param url [String, nil] use url from string instead matched pattern.
+          # @return [Contrast::Agent::Reporting::DiscoveredRoute]
+          def from_sinatra_route controller, method, pattern, url = nil
+            safe_pattern = source_or_string(pattern)
+            safe_url = source_or_string(url || pattern)
+
+            msg = new
+            msg.signature = "#{ controller }##{ method } #{ safe_pattern }"
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
+            msg
+          end
+        end
+
+        # @return [String] the controller, method, and pattern of this route
+        attr_accessor :signature
+        # @return [String] the url (or url pattern) used to access this route
+        attr_accessor :url
+        # @return [String, nil] the HTTP verb used to access this route or nil for any verb
+        attr_accessor :verb
+
+        def initialize
+          @event_type = :discovered_route
+          @verb = Contrast::Utils::ObjectShare::EMPTY_STRING
+          super()
+        end
+
+        def to_controlled_hash
+          validate
+          { session_id: ::Contrast::ASSESS.session_id, signature: @signature, verb: @verb, url: @url }.compact
+        end
+
+        def validate
+          if Contrast::Utils::DuckUtils.empty_duck?(signature)
+            raise(ArgumentError, "#{ self } did not have a proper signature. Unable to continue.")
+          end
+          if Contrast::Utils::DuckUtils.empty_duck?(url)
+            raise(ArgumentError, "#{ self } did not have a proper url. Unable to continue.")
+          end
+
+          nil
+        end
+      end
+    end
+  end
+end