contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/config/diagnostics.rb

@@ -0,0 +1,123 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'contrast/utils/timer'
+require 'contrast/utils/log_utils'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/config/config'
+require 'contrast/config/effective_config'
+require 'contrast/config/effective_config_value'
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Agent
+    module DiagnosticsConfig
+      # This class is responsible for logging to file the effective Agent configurations after startup.
+      class Diagnostics
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Utils::LogUtils
+
+        # @return [String] path to write the file.
+        attr_reader :path
+
+        DEFAULT_PATH = File.join(Dir.pwd).cs__freeze
+        ERROR_MESSAGE = '[Configuration Diagnostics] Could not write effective Agent configuration to file'
+        FILE_NAME = 'contrast_connection.json'
+        WRITE = 'w+'
+
+        # @param path [String] path to write to file.
+        def initialize path
+          @path = path if path && !path.empty?
+        end
+
+        # Write current settings to file.
+        #
+        # @param reset [Boolean] should we reset the config we have
+        # @return [Boolean]
+        def write_to_file reset: true
+          logger&.info('[Configuration Diagnostics] Writing Effective Configurations to file', path: dir_name)
+          status = false
+          write_to_file_logic(status, reset: reset)
+        rescue IOError => e
+          logger&.warn(ERROR_MESSAGE, e)
+          false
+        end
+
+        def extract_settings
+          Contrast::AGENT.to_effective_config(config.effective_config)
+          Contrast::API.to_effective_config(config.effective_config)
+          Contrast::APP_CONTEXT.to_effective_config(config.effective_config)
+          Contrast::ASSESS.to_effective_config(config.effective_config)
+          Contrast::INVENTORY.to_effective_config(config.effective_config)
+          Contrast::PROTECT.to_effective_config(config.effective_config)
+        end
+
+        # Determine the path of the current logger and permissions required for
+        # writing to path.
+        #
+        # @return [String] Path
+        def dir_name
+          @_dir_name ||= if write_permission?(@path)
+                           File.dirname(File.absolute_path(@path))
+                         else
+                           DEFAULT_PATH
+                         end
+        rescue Errno::EROFS => e
+          logger.warn(ERROR_MESSAGE, e)
+        end
+
+        # Returns effective configurations of the agent.
+        #
+        # @return [Contrast::Agent::DiagnosticsConfig::Config]
+        def config
+          @_config ||= Contrast::Agent::DiagnosticsConfig::Config.new
+        end
+
+        # Reset the state of the current effective config.
+        def reset_config
+          # salvage status if status:
+          status = if Contrast::Utils::DuckUtils.empty_duck?(@_config.config_status)
+                     nil
+                   else
+                     @_config.config_status
+                   end
+          @_config = Contrast::Agent::DiagnosticsConfig::Config.new
+          @_config.config_status = status if status
+          @_config
+        end
+
+        def to_controlled_hash
+          {
+              report_create: report_create_time,
+              config: config.to_controlled_hash
+          }
+        end
+
+        def write_to_file_logic status, reset: true
+          # We need to reset the config before updating it's values
+          reset_config if reset
+          extract_settings
+          File.open(File.join(dir_name, FILE_NAME), WRITE) do |file|
+            file.truncate(0)
+            file.write(JSON.pretty_generate(to_controlled_hash, { space: Contrast::Utils::ObjectShare::EMPTY_STRING }))
+            status = true if file
+            file.close
+          end
+          status
+        end
+
+        private
+
+        # Return current time in iso8601 format.
+        #
+        # @return [String] Time of creation
+        def report_create_time
+          Contrast::Utils::Timer.time_now
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/diagnostics_tools.rb

@@ -0,0 +1,99 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/config/effective_config_value'
+
+module Contrast
+  module Agent
+    module DiagnosticsConfig
+      # Diagnostics tools to be included in config components.
+      module DiagnosticsTools
+        CHECK = 'd'
+
+        # Converts current configuration for array of values to effective config values class and appends them to
+        # EffectiveConfig class. Must be used inside Config Components only.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        # @param config_values [Array<String>] array of the names of values.
+        # @param canonical_prefix [String] starting of the path to config => api.proxy...
+        # @param name_prefix [String] the name of the config prefix => contrast.api_key, contrast.url
+        def add_effective_config_values effective_config, config_values, canonical_prefix, name_prefix
+          return if config_values.to_s.empty?
+
+          config_values.each do |config|
+            Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |value|
+              next if (config_val = send(config.to_sym)).to_s.empty?
+
+              config_name = assign_name(config)
+              value.canonical_name = "#{ canonical_prefix }.#{ config_name }"
+              value.name = "#{ name_prefix }.#{ config_name }"
+              value.value = config_val
+              value.source = Contrast::CONFIG.sources.get(value.canonical_name)
+              if value.source == Contrast::Components::Config::Sources::YAML
+                value.filename = Contrast::CONFIG.config_file_path
+              end
+              effective_config.values << value
+            rescue StandardError => e
+              log_error(e)
+              next
+            end
+          end
+        end
+
+        # Converts current configuration for single value to effective config values class and appends them to
+        # EffectiveConfig class. Must be used inside Config Components only.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        # @param config_name [String] name of the config.
+        # @param config_value [String, Boolean] value of the config.
+        # @param canonical_prefix [String] starting of the path to config => api.proxy...
+        # @param name_prefix [String] the name of the config prefix => contrast.api_key, contrast.url
+        def add_single_effective_value effective_config, config_name, config_value, canonical_prefix, name_prefix
+          Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |value|
+            break if config_value.to_s.empty?
+
+            value.value = config_value
+            value.canonical_name = "#{ canonical_prefix }.#{ config_name }"
+            value.name = "#{ name_prefix }.#{ config_name }"
+            value.source = Contrast::CONFIG.sources.get(value.canonical_name)
+            if value.source == Contrast::Components::Config::Sources::YAML
+              value.filename = Contrast::CONFIG.config_file_path
+            end
+            effective_config.values << value
+          rescue StandardError => e
+            log_error(e)
+            next
+          end
+        end
+
+        private
+
+        # Assigns a proper name for the config removing '?' out of method names.
+        #
+        # @param config [String] name of the configuration
+        # @return [String]
+        def assign_name config
+          return Contrast::Utils::ObjectShare::EMPTY_STRING unless config
+
+          name = config.dup
+          if name.end_with?(Contrast::Utils::ObjectShare::QUESTION_MARK)
+            # check and remove '?' : start_bundled_service? => start_bundled_service
+            name.delete!(Contrast::Utils::ObjectShare::QUESTION_MARK)
+            name.chop! if name.end_with?(CHECK)
+            name
+          end
+          name
+        end
+
+        # Logs any caught error.
+        #
+        # @param error [StandardError]
+        def log_error error
+          Contrast::CONFIG.proto_logger.warn('Could not write effective config to file: ',
+                                             error: error, backtrace: error.backtrace)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/effective_config.rb

@@ -0,0 +1,131 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/effective_config_value'
+require 'contrast/config/diagnostics_tools'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module DiagnosticsConfig
+      # The current effective config received from all authorized configuration channels.
+      class EffectiveConfig
+        NON_COMMON_ENV = %w[CONTRAST_CONFIG_PATH CONTRAST_AGENT_TELEMETRY_OPTOUT].cs__freeze
+
+        # Value of effective agent configurations
+        #
+        # @return [Array]
+        attr_reader :values
+
+        def initialize
+          @values = []
+        end
+
+        def to_controlled_hash
+          {
+              effective_config: { values: @values&.map(&:to_controlled_hash) },
+              user_configuration_file: yaml_config_settings,
+              environment_variable: environment_settings(ENV).map(&:to_controlled_hash),
+              command_line: command_line_settings.map(&:to_controlled_hash),
+              contrast_ui: contrast_ui_settings.map(&:to_controlled_hash)
+          }
+        end
+
+        private
+
+        def yaml_config_settings
+          {
+              path: Contrast::CONFIG.config_file_path,
+              values: value_to_s(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::YAML))
+          }
+        end
+
+        def command_line_settings
+          cli = flatten_settings(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::CLI))
+          flat_settings(cli)
+        end
+
+        def contrast_ui_settings
+          ui = flatten_settings(Contrast::CONFIG.sources.for(Contrast::Components::Config::Sources::CONTRASTUI))
+          flat_settings(ui)
+        end
+
+        # @param flats [Array] of flatten configs produced by #flatten_settings
+        # @return [Array]
+        def flat_settings flats
+          ui_settings = []
+          flats.each do |entry|
+            entry.each do |key, value|
+              efc_value = Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |effective_value|
+                effective_value.canonical_name = Contrast::Utils::ObjectShare::CONTRAST_DOT + key
+                effective_value.name = key
+                effective_value.value = value_to_s(value)
+              end
+              ui_settings << efc_value if efc_value
+            end
+          end
+          ui_settings
+        end
+
+        def flatten_settings data, path = []
+          data.each_with_object([]) do |(k, v), entries|
+            if v.cs__is_a?(Hash)
+              entries.concat(flatten_settings(v, path.dup.append(k.to_sym)))
+            else
+              entries << { "#{ path.join('.') }.#{ k }" => Contrast::CONFIG.config.loaded_config.dig(*path, k).to_s }
+            end
+          end.flatten # rubocop:disable Style/MethodCalledOnDoEndBlock
+        end
+
+        # This method will fill the canonical name for each env var and will check for any uncommon ones.
+        #
+        # @param env [Hash]
+        # @return [Array] array of all the values needed to be written.
+        def environment_settings env
+          env_hash = env.select do |e|
+            e.to_s.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) || NON_COMMON_ENV.include?(e.to_s)
+          end
+          environment_settings = []
+          env_hash.each do |key, value|
+            efc_value = Contrast::Agent::DiagnosticsConfig::EffectiveConfigValue.new.tap do |effective_value|
+              next unless value
+
+              effective_value.canonical_name = if NON_COMMON_ENV.include?(key)
+                                                 key.gsub(Contrast::Utils::ObjectShare::UNDERSCORE,
+                                                          Contrast::Utils::ObjectShare::PERIOD).downcase
+                                               else
+                                                 key.gsub(Contrast::Utils::ObjectShare::DOUBLE_UNDERSCORE,
+                                                          Contrast::Utils::ObjectShare::PERIOD).downcase
+                                               end
+              if effective_value.canonical_name
+                effective_value.name =
+                  effective_value.canonical_name.gsub(Contrast::Utils::ObjectShare::CONTRAST_DOT,
+                                                      Contrast::Utils::ObjectShare::EMPTY_STRING)
+              end
+              effective_value.value = value_to_s(value)
+            end
+            environment_settings << efc_value if efc_value
+          end
+          environment_settings
+        end
+
+        # Recursively converts each value to string.
+        #
+        # @param value [Hash]
+        def value_to_s value
+          return value if value.cs__is_a?(String)
+
+          value.each_with_object({}) do |(k, v), m| # rubocop:disable Style/HashTransformValues
+            m[k] = if v.cs__is_a?(Hash)
+                     value_to_s(v)
+                   elsif v.cs__is_a?(Array)
+                     v.map(&:to_s)
+                   else
+                     v.to_s
+                   end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/effective_config_value.rb

@@ -0,0 +1,32 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module DiagnosticsConfig
+      # All In effect config values stored in a easy to write representation.
+      class EffectiveConfigValue
+        # @return [String] Name of the config starting form root of yaml config.
+        attr_accessor :canonical_name
+        # @return [String] Name of the config.
+        attr_accessor :name
+        # @return [String] Value set for the config.
+        attr_accessor :value
+        # @return [String] The source for the entry in the config.
+        attr_accessor :source
+        # @return [String,nil] The filename for the source of the config, if the source was "yaml".
+        attr_accessor :filename
+
+        def to_controlled_hash
+          {
+              canonical_name: canonical_name,
+              name: name, # rubocop:disable Security/Module/Name
+              value: value&.cs__is_a?(Array) ? value.map(&:to_s) : value.to_s,
+              source: source,
+              filename: filename
+          }.compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/env_variables.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # This module is holding all the Env Variables that we could use through the agent lifecycle
+    module EnvVariables
+      ENV_VARIABLES = { telemetry_opt_outs: ENV['CONTRAST_AGENT_TELEMETRY_OPTOUT'].to_s || false }.cs__freeze
+
+      def return_value key
+        return unless ENV_VARIABLES.key?(key.to_sym)
+
+        sym_key = key.downcase.to_sym
+        ENV_VARIABLES[sym_key]
+      end
+    end
+  end
+end

data/lib/contrast/config/exception_configuration.rb

@@ -1,20 +1,42 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # exception handling in Ruby, allowing for the override of Response Code
-    # and Message when Security Exceptions are raised.
-    class ExceptionConfiguration < BaseConfiguration
-      KEYS = {
-          capture: EMPTY_VALUE,
-          override_status: EMPTY_VALUE,
-          override_message: EMPTY_VALUE
-      }.cs__freeze
+    # Common Configuration settings. Those in this section pertain to the exception handling in Ruby, allowing for the
+    # override of Response Code and Message when Security Exceptions are raised.
+    class ExceptionConfiguration
+      include Contrast::Config::BaseConfiguration
+      include Contrast::Components::ComponentBase
+
+      CANON_NAME = 'agent.ruby.exception'
+      CONFIG_VALUES = %w[capture override_status override_message].cs__freeze
+
+      # @return [Integer] the HTTP status code override
+      attr_accessor :override_status
+      # @return [String] the message text override
+      attr_accessor :override_message
+      attr_writer :capture
+      # @return [String]
+      attr_reader :canon_name
+      # @return [Array]
+      attr_reader :config_values
+
+      def initialize hsh = {}
+        @config_values = CONFIG_VALUES
+        @canon_name = CANON_NAME
+        return unless hsh
+
+        @capture = hsh[:capture]
+        @override_status = hsh[:override_status]
+        @override_message = hsh[:override_message]
+      end
 
-      def initialize hsh
-        super(hsh, KEYS)
+      # @return [Boolean, false]
+      def capture
+        !!@capture
       end
     end
   end

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,36 +1,57 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
+require 'set'
 
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # rule mode of a single protect rule in the Agent.
-    class ProtectRuleConfiguration < BaseConfiguration
-      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
-      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-
-      KEYS = {
-          enable: EMPTY_VALUE,
-          mode: EMPTY_VALUE,
-          disable_system_commands: EMPTY_VALUE,
-          detect_custom_code_accessing_system_files: Contrast::Config::DefaultValue.new('true')
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
+    # Common Configuration settings. Those in this section pertain to the rule mode of a single protect rule in the
+    # Agent.
+    class ProtectRuleConfiguration
+      include Contrast::Config::BaseConfiguration
+
+      # @return [Boolean, nil]
+      attr_accessor :enable
+      # @return [String, nil]
+      attr_accessor :mode
+      # @return [Boolean, nil]
+      attr_accessor :disable_system_commands
+      attr_writer :detect_custom_code_accessing_system_files
+
+      def initialize hsh = {}
+        return unless hsh
+
+        @enable = hsh[:enable]
+        @mode = hsh[:mode]
+        @disable_system_commands = hsh[:disable_system_commands]
+        @detect_custom_code_accessing_system_files = hsh[:detect_custom_code_accessing_system_files]
       end
 
-      def off?
-        mode == 'off'
+      # @return [Boolean, true]
+      def detect_custom_code_accessing_system_files
+        @detect_custom_code_accessing_system_files.nil? ? true : @detect_custom_code_accessing_system_files
       end
 
-      def on?
-        !off?
+      # To convert the user input mode from config to a standard format used by TS & SR, we need to convert the given
+      # String to its recognized symbol equivalent. If a nonsense value is provided, it'll
+      # be treated the same as disabling the rule.
+      #
+      # @return [Symbol, nil]
+      def applicable_mode
+        return unless mode
+
+        case mode.downcase
+        when 'permit'
+          :PERMIT
+        when 'block_at_perimeter'
+          :BLOCK_AT_PERIMETER
+        when 'block'
+          :BLOCK
+        when 'monitor'
+          :MONITOR
+        else
+          :NO_ACTION
+        end
       end
     end
   end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,29 +1,104 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/config/protect_rule_configuration'
+
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # protect rule modes of the Agent.
-    class ProtectRulesConfiguration < BaseConfiguration
-      KEYS = {
-          disabled_rules: EMPTY_VALUE,
-          'bot-blocker' => Contrast::Config::ProtectRuleConfiguration,
-          'cmd-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'sql-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
-          'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
-          xxe: Contrast::Config::ProtectRuleConfiguration,
-          'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
-          'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,
-          'unsafe-file-upload' => Contrast::Config::ProtectRuleConfiguration,
-          'Contrast::Agent::Protect::Rule::Base' => Contrast::Config::ProtectRuleConfiguration
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
+    # Common Configuration settings. Those in this section pertain to the protect rule modes of the Agent.
+    class ProtectRulesConfiguration
+      include Contrast::Config::BaseConfiguration
+
+      attr_accessor :disabled_rules
+      attr_reader :bot_blocker,
+                  :cmd_injection, :cmd_injection_command_backdoors,
+                  :cmd_injection_semantic_chained_commands, :cmd_injection_semantic_dangerous_paths,
+                  :method_tampering,
+                  :nosql_injection,
+                  :path_traversal, :path_traversal_semantic_file_security_bypass,
+                  :reflected_xss,
+                  :sql_injection, :sql_injection_semantic_dangerous_functions,
+                  :unsafe_file_upload,
+                  :untrusted_deserialization,
+                  :xxe,
+                  :rule_base
+
+      BASE_RULE = 'Contrast::Agent::Protect::Rule::Base'.cs__freeze
+
+      def initialize hsh = {} # rubocop:disable Metrics/AbcSize
+        return unless hsh
+
+        # IVs must be with the same name as rule_id
+        @disabled_rules = hsh[:disabled_rules]
+        @rule_base = Contrast::Config::ProtectRuleConfiguration.new(hsh[BASE_RULE.to_sym])
+        @bot_blocker = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'bot-blocker'])
+        @cmd_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection'])
+        @cmd_injection_command_backdoors =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-command-backdoors'])
+        @cmd_injection_semantic_chained_commands =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-semantic-chained-commands'])
+        @cmd_injection_semantic_dangerous_paths =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-semantic-dangerous-paths'])
+        @method_tampering = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'method-tampering'])
+        @nosql_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'nosql-injection'])
+        @path_traversal = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'path-traversal'])
+        @path_traversal_semantic_file_security_bypass =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'path-traversal-semantic-file-security-bypass'])
+        @reflected_xss = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'reflected-xss'])
+        @sql_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection'])
+        @sql_injection_semantic_dangerous_functions =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection-semantic-dangerous-functions'])
+        @unsafe_file_upload = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'unsafe-file-upload'])
+        @untrusted_deserialization = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'untrusted-deserialization'])
+        @xxe = Contrast::Config::ProtectRuleConfiguration.new(hsh[:xxe])
+      end
+
+      def []= key, value
+        instance_variable_set("@#{ convert_key(key) }".to_sym, value)
+      end
+
+      def [] key
+        send(convert_key(key).to_sym)
+      end
+
+      def convert_key key
+        return_proper_class(key).to_s.tr('-', '_')
+      end
+
+      # Convert instance variable names to format expected by TS
+      # for adding to the hash
+      def to_contrast_hash
+        hsh = {}
+        instance_variables.each do |iv|
+          # strip the '@' to get the key
+          key = return_proper_class(iv.to_s.delete('@'))
+          hsh[key.tr('_', '-')] = send(key.to_sym)
+        end
+        hsh
+      end
+
+      # This method is to handle the specific case of
+      # Contrast::Agent::Protect::Rule::Base from protect/base.rb#initialize
+      #
+      # @param str_key [String] the key we want to check form the config
+      # @return String
+      def return_proper_class str_key
+        return BASE_RULE if str_key == 'rule_base'
+        return 'rule_base' if str_key == BASE_RULE
+
+        str_key
+      end
+
+      # if method 'Contrast::Agent::Protect::Rule::Base' is being called from convert_to_hash
+      # handle missing method and call original getter
+      def method_missing name, *_args
+        return unless name.to_s.include?('Base') || name.to_s.start_with?('Contrast')
+
+        @rule_base
+      end
+
+      def respond_to_missing? method_name, include_private = false
+        (method_name.to_s.include?('Base') || method_name.to_s.start_with?('Contrast')) || super
       end
     end
   end