contrast-agent 3.9.1 → 6.15.3

data/ext/cs__scope/cs__scope.h

@@ -0,0 +1,90 @@
+#include <ruby.h>
+
+/* Calls to Contrast modules and classes */
+VALUE scope_interface;
+VALUE scope_inst_methods, scope_mod, scope_klass;
+
+/* IVs */
+static VALUE rb_iv_cntr_scope;
+static VALUE rb_iv_dslr_scope;
+static VALUE rb_iv_split_scope;
+
+/* Constants */
+static VALUE rb_const_ec;
+static VALUE rb_const_mon;
+static VALUE rb_const_ec_keys;
+static VALUE c_const_ctr_agent_app_scope;
+
+/* Symbols */
+static VALUE rb_sym_scope_mod;
+static VALUE rb_sym_contrast;
+static VALUE rb_sym_deserialization;
+static VALUE rb_sym_split;
+
+/* methods names - only reusable ones */
+VALUE rb_method_name_init;
+VALUE rb_method_name_in_scope;
+VALUE rb_method_name_enter_scope;
+VALUE rb_method_name_exit_scope;
+VALUE rb_method_name_scope_for_current_ec;
+VALUE rb_method_name_in_cntr_scope;
+VALUE rb_method_name_enter_cntr_scope;
+VALUE rb_method_name_exit_cntr_scope;
+VALUE rb_method_name_in_dslr_scope;
+VALUE rb_method_name_enter_dslr_scope;
+VALUE rb_method_name_exit_dslr_scope;
+VALUE rb_method_name_in_split_scope;
+VALUE rb_method_name_enter_split_scope;
+VALUE rb_method_name_exit_split_scope;
+VALUE rb_method_name_split_scope_depth;
+
+/* Scope class */
+VALUE contrast_scope_klass_init(VALUE self, VALUE args);
+VALUE in_cntr_scope(VALUE self, VALUE args);
+VALUE enter_cntr_scope(VALUE self, VALUE args);
+VALUE exit_cntr_scope(VALUE self, VALUE args);
+VALUE in_split_scope(VALUE self, VALUE args);
+VALUE enter_split_scope(VALUE self, VALUE args);
+VALUE exit_split_scope(VALUE self, VALUE args);
+VALUE split_scope_depth(VALUE self, VALUE args);
+VALUE in_dsrl_scope_scope(VALUE self, VALUE args);
+VALUE enter_dsrl_scope(VALUE self, VALUE args);
+VALUE exit_dsrl_scope(VALUE self, VALUE args);
+VALUE scope_klass_in_scope(VALUE self, VALUE method_scope_sym);
+VALUE scope_klass_enter_scope(VALUE self, VALUE method_scope_sym);
+VALUE scope_klass_exit_scope(VALUE self, VALUE method_scope_sym);
+
+/* Scope interface */
+VALUE contrast_scope_interface_init(VALUE self, VALUE args);
+VALUE contrast_scope_for_current_ec(VALUE self, VALUE args);
+VALUE contrast_scope_application_update();
+
+/* Scope instance methods */
+VALUE inst_methods_in_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_in_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_split_scope_depth(VALUE self, VALUE args);
+VALUE inst_methods_in_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_in_scope(VALUE self, VALUE method_scope_sym);
+VALUE inst_methods_enter_scope(VALUE self, VALUE method_scope_sym);
+VALUE inst_methods_exit_scope(VALUE self, VALUE method_scope_sym);
+
+/* Scope components module */
+VALUE scope_mod_sweep_dead_ecs(VALUE self, VALUE args);
+VALUE inst_methods_enter_method_scope(VALUE self, VALUE scopes_to_enter);
+VALUE inst_methods_exit_method_scope(VALUE self, VALUE scopes_to_exit);
+
+/* Helpers */
+VALUE is_in_scope(int scope);
+VALUE get_ec();
+VALUE rb_new_c_scope();
+int scope_increase(int scope);
+int scope_decrease(int scope);
+void rb_raise_scope_no_method_err(const VALUE method_scope_sym);
+
+void Init_cs__scope(void);

data/ext/cs__scope/extconf.rb

@@ -0,0 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/cs__tests/cs__tests.c

@@ -0,0 +1,12 @@
+/* Copyright (c) 2023 Contrast Security, Inc.  See
+ * https://www.contrastsecurity.com/enduser-terms-0317a for more details. */
+
+#include "cs__tests.h"
+#include "../cs__common/cs__common.h"
+#include <ruby.h>
+
+/* Define any tests functions here, you could call a patch function and define
+ * it in Ruby */
+
+void Init_cs__tests(void) {
+}

data/ext/cs__tests/cs__tests.h

@@ -0,0 +1,3 @@
+#include <ruby.h>
+
+void Init_cs__tests(void);

data/ext/cs__tests/extconf.rb

@@ -0,0 +1,5 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+$TO_MAKE = File.basename(__dir__)
+require_relative '../extconf_common'

data/ext/extconf_common.rb

@@ -1,14 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-require 'mkmf'
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
 
+require 'mkmf'
 require_relative '../lib/contrast/agent/version'
 
-def name
-  $TO_MAKE
-end
-
 def make!
-  create_makefile "#{name}/#{name}"
+  create_makefile("#{ $TO_MAKE }/#{ $TO_MAKE }")
 end
 
 def ext_path
@@ -17,33 +14,6 @@ def ext_path
   __dir__
 end
 
-def rpath_root
-  if (darwin = !(/darwin/ =~ RUBY_PLATFORM).nil?)
-    "@loader_path"
-  else
-    "\\$${ORIGIN}"
-  end
-end
-
-def funchook_rpath!
-  options = " -Wl,-rpath,#{rpath_root}/../../shared_libraries"
-  raise unless try_link('int main() {return 0;}', options)
-  $LDFLAGS << options
-  $LDFLAGS << " -L#{__dir__}/../shared_libraries"
-
-  find_header('funchook.h', ext_path)
-  have_header('funchook.h')
-
-  find_library('funchook', 'funchook_create', "../shared_libraries")
-  find_library('funchook', 'funchook_install')
-  find_library('funchook', 'funchook_prepare')
-  have_library('funchook', 'funchook_create')
-  have_library('funchook', 'funchook_install')
-  have_library('funchook', 'funchook_prepare')
-end
-
 require_relative './build_funchook'
 
-# default make pathway, here for convenience
-funchook_rpath!
 make!

data/lib/contrast/agent/assess/assess.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # This is the base module for our assess classes. It is intended to
+    # facilitate the patching of the application for Assess functionality. Any
+    # class under this namespace should be required here, providing a single
+    # point of require for this functionality.
+    module Assess
+      require 'contrast/agent/assess/tracker'
+      require 'contrast/agent/assess/module_data'
+      require 'contrast/agent/assess/policy/preshift'
+
+      # Dynamic Sources
+      require 'contrast/agent/assess/policy/dynamic_source_factory'
+
+      # reporting / tracking
+      require 'contrast/agent/assess/properties'
+      require 'contrast/agent/assess/tag'
+    end
+  end
+end

data/lib/contrast/agent/assess/contrast_object.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/class_util'
+require 'contrast/utils/object_share'
+require 'contrast/agent/assess/tracker'
+
+module Contrast
+  module Agent
+    module Assess
+      # This class is a convenient holder of our version of an Object. It creates a String version of the Object from
+      # the original provided and keeps reference to the original's Tags, letting us determine if it was tracked when
+      # we try to report to TeamServer.
+      #
+      # TODO: RUBY-1083 determine if this is expensive and/or worth not storing these values directly on ContrastEvent
+      #   and passing them around. Args probably make the argument for wrapping them b/c otherwise we'll have to keep
+      #   two arrays in synch or make an array of arrays, at which point, we may as well make this.
+      class ContrastObject
+        # @return [String] the Contrast String representation of the Object.
+        attr_reader :object
+        # @return [Integer] the __id__ of the original Object.
+        attr_reader :tracked_object_id
+        # @return [String] the name of the Class/Module of the Object.
+        attr_reader :object_type
+        # @return [Hash<Contrast::Agent::Assess::Tag>] the tags on the original Object.
+        attr_reader :tags
+
+        # Capture the details about the object which we need to render it in
+        # TeamServer.
+        #
+        # @param object [Object, nil] the thing to keep a Contrast String of
+        def initialize object
+          if object
+            @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
+            @tracked_object_id = object.__id__
+            @object_type = object.cs__class.cs__name
+            @tags = Contrast::Agent::Assess::Tracker.properties(object)&.get_tags
+          else
+            @object = Contrast::Utils::ObjectShare::NIL_STRING
+            @tracked_object_id = nil.__id__
+            @object_type = nil.cs__class.cs__name
+          end
+        end
+
+        # Is the object this represents tracked or not?
+        #
+        # @return [Boolean]
+        def tracked?
+          !!tags&.any?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/events/event_data.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # this class will gather and build event
+        class EventData
+          attr_reader :policy_node, :tagged, :object, :ret, :args
+
+          # Group event data together
+          #
+          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode, nil] the node that governs this event
+          # @param tagged      [Object, nil] the Target to which this event pertains
+          # @param object      [Object, nil] the Object on which the method was invoked
+          # @param ret         [Object, nil] the Return of the invoked method
+          # @param args        [Array<Object>, nil] the Arguments with which the method was invoked
+          def initialize policy_node, tagged, object, ret, args
+            @policy_node = policy_node
+            @tagged = tagged
+            @object = object
+            @ret = ret
+            @args = args
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/finalizers/freeze.rb

@@ -0,0 +1,15 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/tracker'
+
+# Our patch of the Object#freeze method, allowing any Object we track to
+# function with our Contrast::Agent::Assess::Finalizers::Hash
+class Object
+  alias_method :cs__patched_object_freeze, :freeze
+
+  def freeze
+    Contrast::Agent::Assess::Tracker.pre_freeze(self)
+    cs__patched_object_freeze
+  end
+end

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -0,0 +1,107 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/policy/propagation_method'
+
+module Contrast
+  module Agent
+    module Assess
+      module Finalizers
+        # An extension of Hash that doesn't impact GC of the object being stored by storing its ID as a Key to lookup
+        # and registering a finalizer on the object to remove its entry from the Hash immediately after it's GC'd.
+        #
+        # NOTE: PROPERTIES_HASH is called from C
+        class Hash < Hash
+          FROZEN_FINALIZED_IDS = Set.new
+          KEEP_AGE = 600_000.cs__freeze # 10 minutes
+
+          def []= key, obj
+            return unless obj
+            return unless ::Contrast::AGENT.enabled? && ::Contrast::ASSESS.enabled?
+
+            # We can't finalize frozen things, so only act on those that went through .pre_freeze
+            if key.cs__frozen?
+              return unless FROZEN_FINALIZED_IDS.include?(key.__id__)
+            else
+              ObjectSpace.define_finalizer(key, finalizing_proc)
+            end
+            super(key.__id__, obj)
+          end
+
+          def [] key
+            super(key.__id__)
+          end
+
+          # Something is trackable if it is not a collection and either not frozen or it was frozen after we put a
+          # finalizer on it.
+          #
+          # @param key [Object] the thing to determine if trackable
+          # @return [Boolean]
+          def trackable? key
+            return false unless key
+            # Track things in these, not them themselves.
+            return false if Contrast::Utils::DuckUtils.iterable_hash?(key)
+            return false if Contrast::Utils::DuckUtils.iterable_enumerable?(key)
+            # If it's not frozen, we can finalize/ track it.
+            return true unless key.cs__frozen?
+
+            # Otherwise, we can only track it if we've finalized it in our freeze patch.
+            FROZEN_FINALIZED_IDS.include?(key.__id__)
+          end
+
+          # Determine if the given Object is tracked, meaning it has a known set of properties and those properties are
+          # tracked.
+          #
+          # @param key [Object] the Object whose properties, by id, we want to check for tracked status
+          # @return [Boolean]
+          def tracked? key
+            key?(key.__id__) && fetch(key.__id__, nil)&.tracked?
+          end
+
+          # Create a Proc to remove the given key from our frozen and properties tracking during finalization of the
+          # Object to which the given key_id pertains. The ObjectSpace's finalizer mechanism will handle passing this
+          # ID in, so we only need to define the Proc once.
+          #
+          # NOTE: by necessity, this is the only method which takes the __id__, not the Object itself. You CANNOT pass
+          # the Object to this as a finalizer cannot hold reference to the Object being finalized; that prevents GC,
+          # which introduces a memory leak and defeats the entire purpose of this.
+          #
+          # @return [Proc] the Proc to remove references to the ID of the GC'd object from our Hash
+          def finalizing_proc
+            @_finalizing_proc ||= proc do |key_id|
+              FROZEN_FINALIZED_IDS.delete(key_id)
+              Contrast::Agent::Assess::Policy::PropagationMethod.instance_variable_get(:@properties).delete(key_id)
+              delete(key_id)
+            end
+          end
+
+          # Frozen things cannot be finalized. To avoid any issue here, we intercept the #freeze call and set
+          # finalizers on the Object. To ensure later we know it's been pre-finalized, we add it's __id__ to our
+          # tracking.
+          #
+          # @param key [Object] the Object on which we need to pre-define finalizers
+          def pre_freeze key
+            return unless ::Contrast::AGENT.enabled? && ::Contrast::ASSESS.enabled?
+            return if key.cs__frozen?
+            return if FROZEN_FINALIZED_IDS.include?(key.__id__)
+
+            ObjectSpace.define_finalizer(key, finalizing_proc)
+
+            FROZEN_FINALIZED_IDS << key.__id__
+          rescue StandardError => _e
+            nil
+          end
+
+          def cleanup!
+            ids = keys.dup
+            ids.each do |key|
+              properties = fetch(key.__id__, nil)
+              delete(key) unless properties&.event && (Contrast::Utils::Timer.now_ms - properties.event.time) < KEEP_AGE
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/{module_data.rb → assess/module_data.rb}

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,10 +6,11 @@ module Contrast
     # A simple wrapper around a Module and a call to its name, used to avoid
     # calling the Module#name method and generating extra Strings
     class ModuleData
-      attr_accessor :mod, :name
-      def initialize mod, name = nil
+      attr_reader :mod, :mod_name
+
+      def initialize mod, mod_name = nil
         @mod = mod
-        @name = name || mod.cs__name
+        @mod_name = mod_name || mod.cs__name
       end
     end
   end

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -15,18 +16,25 @@ module Contrast
           READ_TABLE = 'readTable'
           READ_COLUMN = 'readColumn'
           class << self
+            include Contrast::Components::Logger::InstanceMethods
+
             # Given a Class representing a table in a Database and a map of
             # methods representing columns, generate sources for each method
             # such that calls to that method will result in a Source Event.
             #
             # @param klass [Class] the Class to taint
-            # @param tainted_columns [Hash<String, Contrast::Agent::Assess::Properties>]
+            # @param tainted_columns [Hash{String => Contrast::Agent::Assess::Properties}]
             #   the name of the method to taint, mapped to the properties it
             #   should apply
             def create_sources klass, tainted_columns
+              return unless Contrast::ASSESS.require_dynamic_sources?
+
               class_name = klass.cs__name
               instance_methods = klass.instance_methods
               instance_methods.concat(klass.private_instance_methods)
+              current_context = Contrast::Agent::REQUEST_TRACKER.current
+              current_request = current_context&.request
+
               tainted_columns.each_pair do |field, properties|
                 next unless properties
 
@@ -34,16 +42,11 @@ module Contrast
                 # Move on if we already know about this Dynamic Source
                 next if Contrast::Agent::Assess::Policy::Policy.instance.find_source_node(class_name, method_name, true)
 
-                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys))
+                dynamic_source_node = create_source_node(class_name, method_name, Set.new(properties.tag_keys),
+                                                         current_request)
                 Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
                 method_policy = build_source_policy(method_name, dynamic_source_node)
                 Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
-                current_context = Contrast::Agent::REQUEST_TRACKER.current
-                next unless current_context
-
-                dynamic_source = create_dynamic_source(current_context, dynamic_source_node, field, properties)
-                node_id = Contrast::Utils::StringUtils.force_utf8(dynamic_source_node.id)
-                current_context.activity.dynamic_sources[node_id] = dynamic_source
               end
             end
 
@@ -56,8 +59,10 @@ module Contrast
             # @param class_name [String] the name of the Class to patch
             # @param method_name [Symbol] the name of the Method to patch
             # @param tags [Set<String>] the tags this event should apply
+            # @param request [Contrast::Agent::Request] the request during
+            #  which this source is to be created.
             # @return [Contrast::Agent::Assess::Policy::SourceNode]
-            def create_source_node class_name, method_name, tags
+            def create_source_node class_name, method_name, tags, request
               node = Contrast::Agent::Assess::Policy::SourceNode.new
               node.class_name = class_name
               node.instance_method = true
@@ -72,8 +77,7 @@ module Contrast
               node.add_property(READ_TABLE, class_name)
               node.add_property(READ_COLUMN, method_name)
               node.add_property(WRITE_QUERY_TIME, Contrast::Utils::Timer.now_ms)
-              url = Contrast::Agent::REQUEST_TRACKER.current&.request&.normalized_uri
-              node.add_property(WRITE_QUERY_URL, url)
+              node.add_property(WRITE_QUERY_URL, request&.normalized_uri)
               node
             end
 
@@ -84,41 +88,12 @@ module Contrast
             # @return [Contrast::Agent::Patching::Policy::MethodPolicy] the
             #   policy to apply to the given method
             def build_source_policy method_name, dynamic_source_node
-              method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.new
-              method_policy.method_visibility = :public
-              method_policy.instance_method = true
-              method_policy.method_name = method_name
-              method_policy.source_node = dynamic_source_node
-              method_policy
-            end
-
-            # @param current_context [Contrast::Agent::RequestContext] the
-            #   context of the request in which this source is to be created.
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the SourceNode that applies to this method
-            # @param field [String] the name of the method to which this source
-            #   applies
-            # @param properties [Contrast::Agent::Assess::Properties] the
-            #   properties which this source should relate to the data tracked
-            #   as a result of this Source Method
-            # @return [Contrast::Api::Dtm::DynamicSource] the message to send
-            #   to the Service to allow it to report the events leading up to
-            #   the creation of the Dynamic Source
-            def create_dynamic_source current_context, source_node, field, properties
-              dynamic_source = Contrast::Api::Dtm::DynamicSource.new
-              dynamic_source.class_name = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
-              dynamic_source.method_name = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.instance_method = source_node.instance_method?
-              dynamic_source.target = Contrast::Utils::StringUtils.force_utf8(source_node.target_string)
-              properties.events.each do |event|
-                dynamic_source.events << event.to_dtm_event
-              end
-              dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
-              dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.properties[WRITE_QUERY_TIME] = Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
-              url = current_context.request.normalized_uri
-              dynamic_source.properties[WRITE_QUERY_URL] = Contrast::Utils::StringUtils.force_utf8(url)
-              dynamic_source
+              Contrast::Agent::Patching::Policy::MethodPolicy.new({
+                                                                      method_visibility: :public,
+                                                                      instance_method: true,
+                                                                      method_name: method_name,
+                                                                      source_node: dynamic_source_node
+                                                                  })
             end
           end
         end

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,10 +1,12 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/module_policy'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Agent
@@ -15,8 +17,8 @@ module Contrast
         # provides a map for which methods our renamed functions need to call
         # and how.
         module Patcher
-          include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :scope
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
 
           class << self
             def policy
@@ -33,49 +35,12 @@ module Contrast
             # called. This hook is provided so that patches to those methods can
             # pass us execution flow once a new method has been made available.
             def patch_assess_on_eval mod
-              return unless ASSESS.enabled?
+              return unless ::Contrast::ASSESS.enabled?
+              return if in_contrast_scope?
 
-              with_contrast_scope { patcher.patch_specific_module(mod) }
+              patcher.patch_specific_module(mod)
             rescue StandardError => e
-              logger.warn(
-                  e,
-                  "Unable to patch assess into #{ mod.cs__name } on eval")
-            end
-
-            # Exposed so that methods can be dynamically patched on creation at
-            # runtime, like those generated by
-            # ActiveRecord::AttributeMethods::Read::ClassMethods#define_method_attribute
-            CLASS_TYPES = [
-              Contrast::Utils::ObjectShare::CLASS,
-              Contrast::Utils::ObjectShare::MODULE
-            ].cs__freeze
-            def patch_assess_method clazz, method_name
-              # Module.define_method is called a lot in Class and Module. We
-              # currently do not expect these define_methods to result in methods
-              # that require patching, so for the sake of performance, we're going
-              # to skip evaluating them
-              class_name = clazz.cs__name
-              return if CLASS_TYPES.include?(class_name)
-              return unless ASSESS.enabled?
-
-              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources, class_name)
-              return if source_nodes.empty?
-
-              method_array = []
-              method_array << method_name
-              source_nodes.each do |source_node|
-                next unless source_node.method_name.to_s == method_name
-
-                method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
-                                                                                    method_name: source_node.method_name,
-                                                                                    method_visibility: source_node.method_visibility,
-                                                                                    instance_method: true)
-                patcher.patch_method(clazz, method_array, method_policy)
-              end
-            rescue StandardError => e
-              logger.warn(
-                  e,
-                  "Unable to patch assess into #{ class_name }##{ method_name } on define_method_attribute")
+              logger.warn('Unable to patch assess during eval', e, module: mod.cs__name)
             end
           end
         end