contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/configuration.rb

@@ -1,12 +1,20 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'yaml'
-cs__scoped_require 'fileutils'
-
-cs__scoped_require 'contrast/config'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
+require 'yaml'
+require 'fileutils'
+
+require 'contrast/config'
+require 'contrast/utils/object_share'
+require 'contrast/components/agent'
+require 'contrast/components/api'
+require 'contrast/components/app_context'
+require 'contrast/components/scope'
+require 'contrast/components/inventory'
+require 'contrast/components/protect'
+require 'contrast/components/assess'
+require 'contrast/components/config/sources'
+require 'contrast/config/server_configuration'
 
 module Contrast
   # This is how we read in the local settings for the Agent, both ENV/ CMD line
@@ -15,64 +23,123 @@ module Contrast
   class Configuration
     extend Forwardable
 
-    include Contrast::Components::Interface
-
-    access_component :scope
-
-    def_delegator :root, :assign_value_to_path_array
-
-    attr_reader :default_name, :root
-
+    include Contrast::Components::Scope::InstanceMethods
+    extend Contrast::Components::Scope::InstanceMethods
+
+    include Contrast::Config::BaseConfiguration
+
+    attr_reader :default_name
+
+    # @return [Contrast::Components::Api::Interface]
+    attr_writer :api
+    # @return [Contrast::Components::Agent::Interface]
+    attr_writer :agent
+    # @return [Contrast::Components::AppContext::Interface]
+    attr_writer :application
+    # @return [Contrast::Config::ServerConfiguration]
+    attr_writer :server
+    # @return [Contrast::Components::Assess::Interface]
+    attr_writer :assess
+    # @return [Contrast::Components::Inventory::Interface]
+    attr_writer :inventory
+    # @return [Contrast::Components::Protect::Interface]
+    attr_writer :protect
+    # @return [Boolean, nil]
+    attr_accessor :enable
+    # @return [Hash]
+    attr_accessor :loaded_config
+    # @return [Contrast::Config::Sources]
+    attr_accessor :sources
+    # @return [String,nil]
+    attr_reader :config_file
+
+    CONTRAST_ENV_MARKER = 'CONTRAST__'
     DEFAULT_YAML_PATH  = 'contrast_security.yaml'
-    DEFAULT_HOST       = '127.0.0.1'
-    DEFAULT_PORT       = '30555'
     MILLISECOND_MARKER = '_ms'
-    CONVERSION = {
-        'agent.service.enable' => 'agent.start_bundled_service'
-    }.cs__freeze
-    CONFIG_BASE_PATHS = [
-      '',
-      'config/',
-      '/etc/contrast/ruby/',
-      '/etc/contrast/',
-      '/etc/'
-    ].cs__freeze
-    REMOVE_FIELDS = [
-      'contrast'
-    ].cs__freeze
-
-    def initialize cli_options = nil, default_name = DEFAULT_YAML_PATH
+    CONVERSION = {}.cs__freeze
+    CONFIG_BASE_PATHS = ['', 'config/', '/etc/contrast/ruby/', '/etc/contrast/', '/etc/'].cs__freeze
+    KEYS_TO_REDACT = %i[api_key url service_key user_name].cs__freeze
+    REDACTED = '**REDACTED**'
+
+    def initialize cli_options = nil, default_name = DEFAULT_YAML_PATH # rubocop:disable Metrics/AbcSize
       @default_name = default_name
 
       # Load config_kv from file
-      config_kv = deep_stringify_all_keys(load_config)
+      config_kv = deep_symbolize_all_keys(load_config)
+      config_sources = assign_source_to(config_kv, Contrast::Components::Config::Sources::YAML)
+
+      unless cli_options
+        cli_options = {}
+        ENV.each do |key, value|
+          next unless key.to_s.start_with?(CONTRAST_ENV_MARKER)
 
+          cli_options[key] = value
+        end
+      end
       # Overlay CLI options - they take precedence over config file
-      cli_options = deep_stringify_all_keys(cli_options)
-      config_kv = deep_merge(cli_options, config_kv) if cli_options
+      cli_options = deep_symbolize_all_keys(cli_options)
+      if cli_options
+        config_kv = deep_merge(cli_options, config_kv)
+        config_sources = deep_merge(assign_source_to(cli_options, Contrast::Components::Config::Sources::CLI),
+                                    config_sources)
+      end
 
       # Some in-flight rewrites to maintain backwards compatibility
       config_kv = update_prop_keys(config_kv)
-      config_kv = deprecate_fields(config_kv)
+      @loaded_config = config_kv
+
+      @sources = Contrast::Components::Config::Sources.new(config_sources)
+
+      @api = Contrast::Components::Api::Interface.new(config_kv[:api])
+      @enable = config_kv[:enable]
+      @agent = Contrast::Components::Agent::Interface.new(config_kv[:agent])
+      @application = Contrast::Components::AppContext::Interface.new(config_kv[:application])
+      @server = Contrast::Config::ServerConfiguration.new(config_kv[:server])
+      @assess = Contrast::Components::Assess::Interface.new(config_kv[:assess])
+      @inventory = Contrast::Components::Inventory::Interface.new(config_kv[:inventory])
+      @protect = Contrast::Components::Protect::Interface.new(config_kv[:protect])
+    end
 
-      @root = Contrast::Config::RootConfiguration.new(config_kv)
+    # Get a loggable YAML format of this configuration
+    # @return [String] the current active configuration of the Agent,
+    #   represented as a YAML string
+    def loggable
+      convert_to_hash.to_yaml
     end
 
-    # Because we call this method to determine the need for scoping, it itself
-    # must be executed inside a Contrast scope. Failure to do so could result
-    # in an infinite loop on the to_sym method used later.
-    def method_missing symbol, *args
-      with_contrast_scope do
-        begin
-          root.public_send(symbol, *args)
-        rescue NoMethodError => _e
-          super
-        end
-      end
+    # @return [Contrast::Components::Api::Interface]
+    def api
+      @api ||= Contrast::Components::Api::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Agent::Interface]
+    def agent
+      @agent ||= Contrast::Components::Agent::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
     end
 
-    def respond_to_missing? method_name, *args
-      root&.cs__respond_to?(method_name) || super
+    # @return [Contrast::Components::AppContext::Interface]
+    def application
+      @application ||= Contrast::Components::AppContext::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Config::ServerConfiguration]
+    def server
+      @server ||= Contrast::Config::ServerConfiguration.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Assess::Interface]
+    def assess
+      @assess ||= Contrast::Components::Assess::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Inventory::Interface]
+    def inventory
+      @inventory ||= Contrast::Components::Inventory::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Protect::Interface]
+    def protect
+      @protect ||= Contrast::Components::Protect::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
     end
 
     protected
@@ -82,102 +149,60 @@ module Contrast
     def load_config
       config = {}
       configuration_paths.find do |path|
-        found = File.exist?(path)
-        next unless found
+        next unless File.exist?(path)
 
-        readable = File.readable?(path)
-        unless readable
-          puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
+        unless File.readable?(path)
+          log_file_read_error(path)
           next
         end
-        config = yaml_to_hash(path)
+        config = yaml_to_hash(path) || {}
+        @config_file = path
         break
       end
 
-      if config.empty?
-        puts "!!! Contrast - working directory: #{ Dir.pwd }"
-        puts '!!! Contrast - configuration file could not be found at any of the search paths'
-        puts 'Valid configuration paths are: '
-        configuration_paths.each do |path|
-          puts(path)
-        end
-      end
       config
     end
 
     def yaml_to_hash path
       if path && File.readable?(path)
         begin
-          yaml = IO.read(path)
+          yaml = File.read(path)
           yaml = ERB.new(yaml).result if defined?(ERB)
           return YAML.safe_load(yaml)
+        rescue Psych::Exception => e
+          log_yaml_parse_error(path, e)
         rescue RuntimeError => e
-          puts "ERROR: unable to load configuration from path due to #{ e }"
-          puts "ERROR: path=#{ path } pwd=#{ Dir.pwd }"
+          puts("WARN: Unable to load configuration. #{ e }; path: #{ path }, pwd: #{ Dir.pwd }")
         end
       end
 
       {}
     end
 
-    # We're updating properties loaded from the configuration
-    # files to match the new agreed upon standard configuration
+    # We're updating properties loaded from the configuration files to match the new agreed upon standard configuration
     # names, so that one file works for all agents
     def update_prop_keys config
-      converted = false
       CONVERSION.each_pair do |old_method, new_method|
         # See if the old value was set and needs to be translated
-        deprecated_keys = old_method.split('.')
-
+        deprecated_keys = old_method.split('.').map(&:to_sym)
         old_value = config
         deprecated_keys.each do |key|
           old_value = old_value[key]
           break if old_value.nil?
         end
+        next if old_value.nil? # have to account for literal false
 
-        next if old_value.nil?
-
-        converted = true
-
-        puts "The deprecated property #{ old_method } is being set."
-        puts "Please update your config to use the property #{ new_method } instead."
-
-        new_keys = new_method.split('.')
-
+        log_deprecated_property(old_method, new_method)
+        new_keys = new_method.split('.').map(&:to_sym)
         # We changed the seconds values into ms values. Multiply them accordingly
         old_value = old_value.to_i * 1000 if new_method.end_with?(MILLISECOND_MARKER)
-
         new_value = config
-        end_idx = new_keys.length - 1
-        new_keys.each_with_index do |new_key, index|
-          if index == end_idx
-            new_value[new_key] = old_value if new_value[new_key].nil?
-          else
-            new_value = {} if new_value.nil?
-            new_value[new_key] = {} if new_value[new_key].nil?
-            new_value = new_value[new_key]
-          end
-        end
+        replace_props(new_keys, new_value, old_value)
       end
 
       config
     end
 
-    def deprecate_fields hash
-      REMOVE_FIELDS.each do |field|
-        path = field.split('.')
-        active_path = hash
-        path.each_with_index do |delete_path, index|
-          if index == path.length - 1 && active_path
-            active_path.delete(delete_path)
-          elsif active_path
-            active_path = active_path[delete_path]
-          end
-        end
-      end
-      hash
-    end
-
     # Base paths to check for the contrast configuration file, sorted by
     # reverse order of precedence (first is most important).
     def configuration_paths
@@ -201,14 +226,121 @@ module Contrast
       end
     end
 
-    def deep_stringify_all_keys hash
+    def deep_symbolize_all_keys hash
       return if hash.nil?
 
       new_hash = {}
       hash.each do |key, value|
-        new_hash[key.to_s] = value.is_a?(Hash) ? deep_stringify_all_keys(value) : value
+        new_hash[key.to_sym] = value.is_a?(Hash) ? deep_symbolize_all_keys(value) : value
       end
       new_hash
     end
+
+    private
+
+    # We cannot use all access components at this point, unfortunately, as they
+    # may not have been initialized. Instead, we need to access the logger
+    # directly.
+    def logger
+      @_logger ||= (Contrast::Logger::Log.instance.logger if defined?(Contrast::Logger::Log))
+    end
+
+    # When we fail to parse a configuration because it is misformatted, log an
+    # appropriate message based on the Agent Onboarding specification
+    def log_yaml_parse_error path, exception
+      hash = { path: path, pwd: Dir.pwd }
+      if exception.is_a?(Psych::SyntaxError)
+        hash[:context] = exception.context
+        hash[:column] = exception.column
+        hash[:line] = exception.line
+        hash[:offset] = exception.offset
+        hash[:problem] = exception.problem
+      end
+
+      if logger
+        logger.warn('YAML validator found an error', hash)
+      else
+        puts("CONTRAST - WARN: YAML validator found an error. #{ hash.inspect }")
+      end
+    end
+
+    def log_file_read_error path
+      if logger
+        logger.warn('Configuration file is not readable by current user', path: path)
+      else
+        puts("CONTRAST - WARN: Configuration file is not readable by current user; path: #{ path }")
+      end
+    end
+
+    def log_deprecated_property old_method, new_method
+      if logger
+        logger.warn('Deprecated property in use', old_method: old_method, new_method: new_method)
+      else
+        puts("CONTRAST - WARN: Deprecated property in use; old_method: #{ old_method }, new_method: #{ new_method }")
+      end
+    end
+
+    # Convert this entire configuration into a hash, walking down the entries
+    # in the thing to convert and setting them in the given hash. For now, this
+    # logs every possible key, whether set or not. If we want to change that
+    # behavior, we can skip adding keys to the hash if the value is nil, blank,
+    #
+    # @param hash [Hash] the hash to populate
+    # @param convert [Contrast::Config::BaseConfiguration, Object] the level of
+    #   configuration from which to convert. Note that at least one top level
+    #   Contrast::Config::BaseConfiguration is required for anything to be set
+    #   in the hash
+    # @return [Hash, Object] the leaf of each
+    #   Contrast::Config::BaseConfiguration will be returned in the N > 0 steps
+    #   the Hash will be returned at the end of the 0 level
+    def convert_to_hash convert = self, hash = {}
+      case convert
+      when Contrast::Config::BaseConfiguration
+        # to_hash returns @configuration_map
+        convert.to_contrast_hash.each_key do |key|
+          # change '-' to '_' for ProtectRulesConfiguration
+          hash[key] = convert_to_hash(convert.send(key.tr('-', '_').to_sym), {})
+          hash[key] = REDACTED if redactable?(key)
+        end
+        hash
+      else
+        convert
+      end
+    end
+
+    def replace_props new_keys, new_value, old_value
+      idx = 0
+      end_idx = new_keys.length - 1
+      while idx < new_keys.length
+        new_key = new_keys[idx].to_sym
+        if idx == end_idx
+          new_value[new_key] = old_value if new_value[new_key].nil?
+        else
+          new_value = {} if new_value.nil?
+          new_value[new_key] = {} if new_value[new_key].nil?
+          new_value = new_value[new_key]
+        end
+        idx += 1
+      end
+    end
+
+    # Check if keys with sensitive data needs to be
+    # redacted.
+    #
+    # @param key [Symbol] key to check
+    # @return[Boolean] true | false
+    def redactable? key
+      KEYS_TO_REDACT.include?(key.to_sym)
+    end
+
+    def assign_source_to hash, source = Contrast::Components::Config::Sources::YAML
+      hash.transform_values do |value|
+        if value.is_a?(Hash)
+          assign_source_to(value, source)
+        else
+          source
+        end
+      end
+    end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -0,0 +1,75 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/patching/policy/patch'
+require 'contrast/agent/patching/policy/patcher'
+require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
+require 'cs__assess_array/cs__assess_array'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      class ArrayPropagator
+        extend Contrast::Components::Scope::InstanceMethods
+
+        ARRAY_JOIN_HASH ||= { # rubocop:disable Lint/OrAssignmentToConstant
+            'class_name' => 'Array',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'join',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'cs__track_join'
+        }.cs__freeze
+        ARRAY_JOIN_NODE ||= Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH) # rubocop:disable Lint/OrAssignmentToConstant
+
+        class << self
+          # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+          # Multiple Strings are appended with the #join method. Because that
+          # operation happens in C, we have to do it here rather than rely on the
+          # patch of our String append or concat methods.
+          def cs__track_join ary, separator, ret
+            return ret unless ary&.any? { |element| Contrast::Agent::Assess::Tracker.tracked?(element) }
+            return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
+
+            with_contrast_scope do
+              return ret unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+              shift = 0
+              separator_length = separator.nil? ? 0 : separator.to_s.length
+              parent_events = []
+              ary.compact.each do |obj|
+                properties.copy_from(obj, ret, shift)
+                shift += obj.to_s.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
+                parent_events << parent_event if parent_event
+                shift += separator_length
+              end
+              return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
+
+              properties.cleanup_tags
+              event_data = Contrast::Agent::Assess::Events::EventData.new(ARRAY_JOIN_NODE, ret, ary, ret, [separator])
+              properties.build_event(event_data)
+              properties.event.instance_variable_set(:@_parent_events, parent_events)
+              ret
+            end
+          end
+        end
+      end
+
+      # Helper module to call cs__join
+      module ContrastArray
+        def join *args
+          cs__join(*args)
+          super(*args)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/erb.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# This module is used to track propagation through ERB template rendering
+module ERBPropagator
+  class << self
+    # After ERB#result method is called we need to take the tags to the target and keep the
+    # propagation.
+    #
+    # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event
+    # @param preshift [Contrast::Agent::Assess::Preshift] Saved state before the propagation
+    # @param ret [the Return of the invoked method]
+    # @param _block [&block, nil] block passed
+    def result_tagger patcher, preshift, ret, _block
+      return unless preshift.args.length >= 1
+      return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
+
+      used_binding = preshift.args[0]
+      binding_variable_set = used_binding.local_variables
+
+      erb_pre_result = preshift.object.src
+      parent_events = []
+      binding_variable_set(binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret)
+      properties.build_event(Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args), 1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
+      ret
+    end
+
+    private
+
+    # Checks if binded variables set includes the object we track and proceed to update tags in the returned value
+    #
+    # @param binding_variable_set [Array<Symbol>] list of local variables used in the binding of params
+    # @param used_binding [Binding] the binding in of the current event, saved as preshift argument
+    # @param erb_pre_result [String] the source saved in the preshift
+    # @param properties [Contrast::Agent::Assess::Properties] properties of the target if none create new
+    # @param parent_events [Array<Contrast::Agent::Reporting::FindingEvent>] parents event extracted from the source
+    #                                                                      properties
+    # @param ret [String] the Return of the invoked method
+    # @return [Array<Symbol>]
+    def binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
+      binding_variable_set.each do |bound_var_symbol|
+        bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
+        next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
+        next unless erb_pre_result.include?(bound_var_symbol.to_s)
+
+        start_index = ret.index(bound_variable_value)
+        next if start_index.nil?
+
+        properties.copy_from(bound_variable_value, ret, start_index)
+        parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
+        parent_events << parent_event if parent_event
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -0,0 +1,47 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      class EvalTrigger
+        include Contrast::Components::Logger::InstanceMethods
+
+        class << self
+          def instance_eval_trigger_check obj, source, ret
+            apply_trigger(obj, source, ret, 'BasicObject', :instance_eval)
+          end
+
+          def eval_trigger_check obj, source, ret, method
+            apply_trigger(obj, source, ret, 'Module', method)
+          end
+
+          def apply_trigger obj, source, ret, clazz, method
+            return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(trigger_node(clazz, method), source, obj,
+                                                                              ret, source)
+          end
+
+          private
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb

@@ -1,21 +1,17 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/hooks/at_exit_hook'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Module allows us to track calls to the Kernel#exec method, which
       # violates the design of most methods we track in that we have to apply
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
-        include Contrast::Components::Interface
-        access_component :contrast_service
         def apply_trigger source
-          current_context = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_context
-
+          return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
           # Since we know this is the source of the trigger, we can do some
           # optimization here and return when it is not tracked
           return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
@@ -23,24 +19,16 @@ module Contrast
           # source might not be all the args passed in, but it is the one we care
           # about. we could pass in all the args in the last param here if it
           # becomes an issue in rendering on TS
-          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-              current_context,
-              trigger_node,
-              source,
-              self,
-              '',
-              1,
-              source)
-          # Exec replaces the current process, if we occur in a forked process our appendage of this finding will not make it to TS
-          CONTRAST_SERVICE.send_message(current_context.activity)
+          finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                 source, Kernel, nil, source)
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
         end
 
         private
 
         def trigger_node
-          @_trigger_node ||= begin
-            Contrast::Agent::Assess::Policy::Policy.instance.find_node('cmd-injection', 'Kernel', :exec, false)
-          end
+          @_trigger_node ||= Contrast::Agent::Assess::Policy::Policy.instance.find_node('cmd-injection', 'Kernel',
+                                                                                        :exec, false)
         end
       end
     end