contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/class_util.rb

@@ -1,30 +1,23 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+require 'contrast/extension/module'
+require 'contrast/utils/object_share'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Utils
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
+      @lru_cache = LRUCache.new(300)
+      @string_cache = LRUCache.new(300)
       class << self
-        # Given a module, return all of its descendants
+        # some classes have had things prepended to them, like Marshal in Rails 5 and higher. Their
+        # ActiveSupport::MarshalWithAutoloading will break our alias patching approach, as will any other prepend on
+        # something that we touch. Prepend and Alias are inherently incompatible monkey patching approaches. As such,
+        # we need to know if something has been prepended to.
         #
-        # @param mod [Module] the module whose descendants you want to find.
-        # @return [Array<Module>] those Modules that inherit from the given.
-        def descendants mod
-          ObjectSpace.each_object(mod).to_a
-        end
-
-        # some classes have had things prepended to them, like Marshal in Rails
-        # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
-        # our alias patching approach, as will any other prepend on something
-        # that we touch. Prepend and Alias are inherently incompatible monkey
-        # patching approaches. As such, we need to know if something has been
-        # prepended to.
-        #
-        # @param mod [Module] the Module to check to see if it has had something
-        #   prepended
+        # @param mod [Module] the Module to check to see if it has had something prepended
         # @param ancestors [Array<Module>] the array of ancestors for the mod
         # @return [Boolean] if the mod has been prepended or not
         def prepended? mod, ancestors = nil
@@ -32,10 +25,15 @@ module Contrast
           ancestors[0] != mod
         end
 
-        # return true if the given method is overwritten by one of the ancestors
-        # in the ancestor change that comes before the given module
+        # return true if the given method is overwritten by one of the ancestors in the ancestor change that comes
+        # before the given module
+        #
+        # @param mod [Module] the Module to check to see if it has had something prepended
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that holds the method we
+        #   need to check
+        # @return [Boolean] if this method specifically was prepended
         def prepended_method? mod, method_policy
-          target_module = determine_target_class mod, method_policy.instance_method
+          target_module = determine_target_class(mod, method_policy.instance_method)
           ancestors = target_module.ancestors
           return false unless prepended?(target_module, ancestors)
 
@@ -48,58 +46,79 @@ module Contrast
           false
         end
 
-        # Return a String representing the object invoking this method in the
-        # form expected by our dataflow events.
+        # Return a String representing the object invoking this method in the form expected by our dataflow events.
+        # After implementing the LRU Cache, we firstly need to check if already had that object cached and if we have
+        # it - we can return it directly; otherwise we'll calculate and store the result before returning.
+        #
+        # Combining of the caches have close performance, but keeping the two with current implementation has
+        # a slight advantage in performance. For now we can keep the things the way they are.
         #
-        # @param object [Object] the entity to convert to a String
-        # @return [String] the human readable form of the String, as defined by
+        # @param object [Object, nil] the entity to convert to a String
+        # @return [String, Object] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          if object.cs__is_a?(String)
-            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+          # Only treat object like a string if it actually is a string+ some subclasses of String override string
+          # methods we depend on
+          if object.cs__class == String
+            return @string_cache[object] if @string_cache.key?(object)
+
+            @string_cache[object] = to_cached_string(object) || object.dup
+          else
+            return @lru_cache[object.__id__] if @lru_cache.key?(object.__id__)
+
+            @lru_cache[object.__id__] = convert_object(object)
+          end
+        end
 
-            object.dup
+        def convert_object object
+          if object.nil?
+            Contrast::Utils::ObjectShare::NIL_STRING
           elsif object.cs__is_a?(Symbol)
             ":#{ object }"
-          elsif object.cs__is_a?(Numeric)
-            object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
+          elsif use_to_s?(object)
+            object.to_s
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
         end
 
-        # The method const_defined? can cause autoload, which is bad for us.
-        # The method autoload? doesn't traverse namespaces. This method lets us
-        # provide a constant, as a String, and parse it to determine if it has
-        # been truly truly defined, meaning it existed before this method was
-        # invoked, not as a result of it.
+        # The method Module.const_defined? can raise an exception if the constant is poorly named. As such, we need to
+        # handle the case where that exception is raised.
         #
-        # This is required to handle a bug in Ruby prior to 2.7.0. When we drop
-        # support for 2.6.X, we should remove this code.
-        # https://bugs.ruby-lang.org/issues/10741
         # @param name [String] the name of the constant to look up
         # @return [Boolean]
         def truly_defined? name
           return false unless name
 
-          segments = name.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
-          previous_module = Module
-          segments.each do |segment|
-            return false if previous_module.cs__autoload?(segment)
-            return false unless previous_module.cs__const_defined?(segment)
-
-            previous_module = previous_module.cs__const_get(segment)
-          end
-
-          true
+          Module.cs__const_defined?(name)
         rescue NameError # account for nonsense / poorly formatted constants
           false
         end
 
         private
 
+        # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list
+        # approach.
+        #
+        # @param object [Object] something that may have a safe to_s method
+        # @return [Boolean] if we should invoke to_s to represent the object
+        def use_to_s? object
+          return true if object.cs__is_a?(Numeric)
+          return true if defined?(Arel::Nodes::SqlLiteral) && object.cs__is_a?(Arel::Nodes::SqlLiteral)
+
+          false
+        end
+
+        # Find the target class based on the instance, or module, provided. If a module, return it.
+        #
+        # @param mod [Module] the Module, or instance of a Module, that we need to check
+        # @param is_instance [Boolean] is the object provided an instance of a class, requiring lookup by class
+        # @return [Module]
         def determine_target_class mod, is_instance
           return mod if mod.singleton_class?
 
@@ -107,6 +126,19 @@ module Contrast
 
           mod
         end
+
+        # If the String matches a common String in our ObjectShare, return that rather that for use as the
+        # representation of the String rather than forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast representation.
+        # @return [String, nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
+
+          nil
+        end
       end
     end
   end

data/lib/contrast/utils/duck_utils.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
     # Utility methods for identifying instances that can be used interchangeably
-    class DuckUtils
+    module DuckUtils
       class << self
         # Determine if the given object, or the object to which it delegates,
         # responds to the given method.
@@ -13,6 +13,7 @@ module Contrast
         # @param method [Symbol]
         # @return [Boolean]
         def quacks_to? object, method
+          object.cs__respond_to?(method)
           return true if object.cs__respond_to?(method)
           return false unless object.is_a?(Delegator)
 
@@ -63,14 +64,22 @@ module Contrast
           false
         end
 
-        # This method will return true if the object being checked has been patched
-        # to have the cs__properties field. We check the cs__tracked? method since it
-        # is side effect free (ie doesn't cause the properties object to be created).
-        def trackable? object
-          return true if object.cs__respond_to?(:cs__tracked?)
-          return false unless object.is_a?(Delegator)
+        # Every duck quacks to nil, we need to check if it is empty?
+        # Utils method to check for blank ( nil or empty object ).
+        #
+        # @param [Object] object to test.
+        # @return [Boolean]
+        def empty_duck? object
+          # If not quacking to empty it is True/False class, Integer, Regexp or Time instance.
+          return false if object.instance_of?(TrueClass) || object.instance_of?(FalseClass)
 
-          object.cs__delegator_respond_to?(:cs__tracked?)
+          if object.cs__respond_to?(:empty?)
+            return true if object.empty?
+          elsif object.nil?
+            return true
+          end
+
+          false
         end
       end
     end

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,10 +10,11 @@ module Contrast
       END_UNDERSCORE   = /(_+)$/.cs__freeze
       REPEATING_UNDERSCORE = /_{3,}/.cs__freeze
 
-      attr_reader :value, :dot_path_array
+      attr_reader :value, :dot_path_array, :key
 
       def initialize key, value
         key = EnvConfigurationItem.resolve_corrected_path(key)
+        @key = key
         @dot_path_array = key.downcase.split(Contrast::Utils::ObjectShare::DOUBLE_UNDERSCORE)
         @value = value
 
@@ -38,7 +39,7 @@ module Contrast
       def self.resolve_corrected_path path
         tmp_path = path.dup
         start_match = START_UNDERSCORE.match(tmp_path)
-        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+        tmp_path = tmp_path[start_match.offset(0).last..] if start_match
 
         tmp_path.gsub!(REPEATING_UNDERSCORE, '__')
 

data/lib/contrast/utils/findings.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Utils
+    # Utility for saving raw findings for later
+    class Findings
+      include Contrast::Components::Logger::InstanceMethods
+
+      def initialize
+        @_collection = []
+      end
+
+      def collection
+        @_collection ||= []
+      end
+
+      def push trigger_node, source, object, ret, *args
+        return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless trigger_node.collectable?
+
+        @_collection << { trigger_node: trigger_node, source: source, object: object, ret: ret, args: args }
+      end
+
+      # Some rules requires response to be available before validating them correctly,
+      # so we check if trigger_node.rule_id is collectable and then save them for
+      # later report, when we have the response.
+      #
+      # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+      # trigger event
+      # @param source [Object] the source of the Trigger Event
+      # @param object [Object] the Object on which the method was invoked
+      # @param ret [Object] the Return of the invoked method
+      # @param args [Array<Object>] the Arguments with which the method was invoked
+      def collect_finding trigger_node, source, object, ret, *args
+        push(trigger_node, source, object, ret, args)
+        logger.trace('Finding collected', node_id: trigger_node.id,
+                                          source_id: source.__id__,
+                                          rule: trigger_node.rule_id)
+      end
+
+      # Build and report all collected findings for the collectable rules.
+      #
+      # We make sure the content-type is present before reporting, because some
+      # findings do require it for validation.
+      #
+      # @return [true, nil]
+      def report_collected_findings
+        return if @_collection.empty?
+        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
+
+        while @_collection.any?
+          finding = @_collection.pop
+          collected = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(finding[:trigger_node],
+                                                                                   finding[:source],
+                                                                                   finding[:object],
+                                                                                   finding[:ret],
+                                                                                   finding[:args])
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(collected) if collected
+        end
+        true
+      end
+    end
+  end
+end

data/lib/contrast/utils/hash_digest.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'digest'
+require 'digest'
+require 'contrast/utils/hash_digest_extend'
 
 module Contrast
   module Utils
@@ -13,133 +14,85 @@ module Contrast
     # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
     class HashDigest < Digest::Class
       include Digest::Instance
-
+      extend Contrast::Utils::HashDigestExtend
       CONTENT_LENGTH_HEADER = 'Content-Length'
-      CRYPTO_RULES = %w[
-        crypto-bad-ciphers
-        crypto-bad-mac
-      ].cs__freeze
+      CHARS = %w[a b c d e f g].cs__freeze
+      CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
       CONFIG_PATH_KEY = 'path'
       CONFIG_SESSION_ID_KEY = 'sessionId'
       CLASS_SOURCE_KEY = 'source'
       CLASS_CONSTANT_NAME_KEY = 'name'
       CLASS_LINE_NO_KEY = 'lineNo'
-      class << self
-        def generate_request_hash request
-          hash = new
-          hash.update(request.request_method)
-          hash.update(request.normalized_uri)
-          request.parameters.each_key do |name|
-            hash.update(name)
-          end
-          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
-          hash.update(request.normalized_length_header(cl)) if cl
-          hash.finish
-        end
-
-        def generate_event_hash finding, source
-          return generate_dataflow_hash(finding) if finding.events.length.to_i > 1
-
-          id = finding.rule_id
-          return generate_crypto_hash(finding, source) if CRYPTO_RULES.include?(id)
-
-          generate_trigger_hash(finding)
-        end
 
-        def generate_config_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          path = finding.properties[CONFIG_PATH_KEY]
-          hash.update(path)
-          method = finding.properties[CONFIG_SESSION_ID_KEY]
-          hash.update(method)
-          hash.finish
-        end
-
-        def generate_class_scanning_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          module_name = finding.properties[CLASS_SOURCE_KEY]
-          hash.update(module_name)
-          # We're not currently collecting this. 30/7/19 HM
-          line_no = finding.properties[CLASS_LINE_NO_KEY]
-          hash.update(line_no)
-          field = finding.properties[CLASS_CONSTANT_NAME_KEY]
-          hash.update(field)
-          hash.finish
-        end
-
-        def generate_crypto_hash finding, algorithm
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update(algorithm)
-          hash.update_on_request
-          hash.finish
-        end
-
-        def generate_dataflow_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_sources(finding.events)
-          hash.update_on_request
-          hash.finish
-        end
-
-        def generate_response_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
-
-        def generate_trigger_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
+      def initialize
+        super
+        @crc32 = 0
       end
 
-      def update_on_request
+      # Update to CRC checksum the finding route and verb if finding route is available, else update the passed
+      # request or Contrast::REQUEST_TRACKER.current.request uri and used request method.
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] finding to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [Integer, nil] returns nil if there is no request context or tracking
+      # is disabled.
+      def update_on_request finding, request
         context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context
+        return unless context || ::Contrast::ASSESS.non_request_tracking?
+
+        if (route = finding.routes[0])
+          update(route.signature)
+          if (observation = route.observations[0])
+            update(observation.verb)
+          else
+            update(request.request_method)
+          end
+        else
+          return unless request ||= context&.request
 
-        route = context.route
-        request = context.request
-        if route
-          update(route.route)
-          update(route.verb)
-        elsif request
-          update(request.normalized_uri)
+          update(request.normalized_uri) # the normalized URL used to access the method in the route.
           update(request.request_method)
         end
       end
 
+      # Update to CRC checksum the event source name and source type.
+      #
+      # @param events [Array<Contrast::Agent::Reporting::FindingEvent>]
+      # @return checksum [Integer, nil] returns nil if there is no events
       def update_on_sources events
-        return unless events&.any?
-
         events.each do |event|
           event.event_sources.each do |source|
-            update(source.type)
-            update(source.name)
+            update(source.source_type)
+            update(source.source_name)
           end
         end
       end
 
-      def initialize
-        @crc32 = 0
+      # This method converts and integer value for length into a string value
+      # that we can hash on, based on the logarithmic value of the length, and
+      # updates the current hash with that value.
+      # @param chr [Numeric] the length to translate
+      def update_on_content_length chr
+        update(CHARS[Math.log10(chr.to_s.length).to_i] || CHARS[-1])
       end
 
+      # Converts  given string to CRC checksum. CRC32 checksum ensures that If error
+      # of a single bit occurs, the CRC checksum will fail, regardless of any other
+      # property of the transmitted data, including its length. Called several times
+      # with previous CRC to recalculate the new output.
+      #
+      # @param str [String]
+      # @return @crc32 [Integer, nil] updated value of crc 32 bit integer checksum or
+      # nil if passed string is nil or empty
       def update str
         return unless str
 
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
-      def reset
-        @crc32 = 0
-      end
-
+      # Casts current CRC checksum to String
+      #
+      # @return @crc32 [String] String representation of CRC32 checksum
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/hash_digest_extend.rb

@@ -0,0 +1,129 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'digest'
+require 'contrast/utils/hash_digest'
+
+module Contrast
+  module Utils
+    # We use this class to provide hashes for our Request and Finding objects
+    # based upon our definitions of uniqueness.
+    # While the uniqueness of the request object is something internal to the
+    # Ruby agent, the uniqueness of the Finding hash is defined by a
+    # specification shared across all agent teams. The spec can be found here:
+    # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
+    module HashDigestExtend
+      # Generates the hash checksum for the request. Converts the request method, uri,
+      # param names and content length to CRC checksum and returns string representation
+      #
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_request_hash request
+        hash = new
+        hash.update(request.request_method)
+        hash.update(request.normalized_uri)
+        request.parameters.each_key do |name|
+          hash.update(name)
+        end
+        cl = request.headers[Contrast::Utils::HashDigest::CONTENT_LENGTH_HEADER]
+        hash.update_on_content_length(cl) if cl
+        hash.finish
+      end
+
+      # Generates the hash checksum for the event, either dataflow,
+      # crypto(crypto-bad-ciphers, crypto-bad-mac) rules or trigger event
+      # and returns string representation.
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @param source [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_event_hash finding, source, request
+        return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
+
+        id = finding.rule_id
+        return generate_crypto_hash(finding, source, request) if Contrast::Utils::HashDigest::CRYPTO_RULES.include?(id)
+
+        generate_trigger_hash(finding, request)
+      end
+
+      # Generates the hash checksum for configurations. Converts the finding rule_id, session_id and configPath and
+      # to CRC32 checksum and returns string representation to be appended to Contrast::Api::Dtm::Finding
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
+      def generate_config_hash finding
+        hash = new
+        hash.update(finding.rule_id)
+        path = finding.properties[Contrast::Utils::HashDigest::CONFIG_PATH_KEY]
+        hash.update(path)
+        method = finding.properties[Contrast::Utils::HashDigest::CONFIG_SESSION_ID_KEY]
+        hash.update(method)
+        hash.finish
+      end
+
+      # Generates the hash checksum for class scanning. Converts the rule_id, finding.properties(source, name)
+      # to CRC32 checksum and returns string representation.
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
+      def generate_class_scanning_hash finding
+        hash = new
+        hash.update(finding.rule_id)
+        module_name = finding.properties[Contrast::Utils::HashDigest::CLASS_SOURCE_KEY]
+        hash.update(module_name)
+        # We're not currently collecting this. 30/7/19 HM
+        line_no = finding.properties[Contrast::Utils::HashDigest::CLASS_LINE_NO_KEY]
+        hash.update(line_no)
+        field = finding.properties[Contrast::Utils::HashDigest::CLASS_CONSTANT_NAME_KEY]
+        hash.update(field)
+        hash.finish
+      end
+
+      private
+
+      # Generates the hash checksum for crypto(crypto-bad-ciphers, crypto-bad-mac) rules.
+      # used in #generate_event_hash.
+      #
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @param algorithm [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_crypto_hash finding, algorithm, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update(algorithm)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+
+      # Generates the hash checksum for dataflow when the finding events are more than one
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_dataflow_hash finding, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update_on_sources(finding.events)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+
+      # Generates the hash checksum for trigger
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Agent::Reporting::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_trigger_hash finding, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+    end
+  end
+end