contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,15 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'json'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
-cs__scoped_require 'contrast/agent/assess/policy/source_node'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'json'
+require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+require 'contrast/agent/assess/rule/provider/hardcoded_key'
+require 'contrast/agent/assess/rule/provider/hardcoded_password'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/assess/policy/source_node'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/agent/assess/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 module Contrast
   module Agent
@@ -18,26 +18,30 @@ module Contrast
         # This is just a holder for our policy. Takes the policy JSON and
         # converts it into hashes that we can access nicely
         class Policy < Contrast::Agent::Patching::Policy::Policy
+          PROVIDER_CLASSES = [
+            Contrast::Agent::Assess::Rule::Provider::HardcodedKey,
+            Contrast::Agent::Assess::Rule::Provider::HardcodedPassword
+          ].cs__freeze
           # Indicates the folder in `resources` where this policy lives.
           def self.policy_folder
             'assess'
           end
 
+          def initialize
+            super
+            load_providers
+          end
+
           # Indicates is this feature has been disabled by the configuration,
           # read at startup, and therefore can never be enabled.
           def disabled_globally?
-            ASSESS.forcibly_disabled?
+            ::Contrast::ASSESS.forcibly_disabled?
           end
 
           def node_type
             Contrast::Agent::Assess::Policy::TriggerNode
           end
 
-          def initialize
-            super
-            load_providers
-          end
-
           # Our policy for dataflow rules is a 'dope ass' JSON file. Rather than
           # hard code in a bunch of things to monkey patch, we let the JSON file
           # define the conditions in which sources, propagators, and triggers are
@@ -72,8 +76,6 @@ module Contrast
                 add_node(trigger_node)
               end
             end
-
-            tracked_classes.concat(policy_data[TRACKED_CLASSES_KEY])
           end
 
           # Providers is a term that we're taking from Java until we come up with
@@ -90,11 +92,6 @@ module Contrast
               providers[instance.rule_id] = instance
             end
           end
-
-          PROVIDER_CLASSES = [
-            Contrast::Agent::Assess::Rule::Provider::HardcodedKey,
-            Contrast::Agent::Assess::Rule::Provider::HardcodedPassword
-          ].cs__freeze
         end
       end
     end

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,7 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
+require 'contrast/utils/object_share'
+require 'contrast/agent/assess/policy/policy_node_utils'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -10,16 +14,61 @@ module Contrast
         # This class functions to translate our policy.json into an actionable
         # Ruby object, allowing for dynamic patching over hardcoded patching.
         class PolicyNode < Contrast::Agent::Patching::Policy::PolicyNode
+          include Contrast::Components::Logger::InstanceMethods
+          include PolicyNodeUtils
+          JSON_TAGS = 'tags'
+          JSON_DATAFLOW = 'dataflow'
+          # The keys used to read from policy.json to create the individual
+          # policy nodes. These are common across node types
+          JSON_SOURCE = 'source'
+          ALL_TYPE = 'A'
+          JSON_TARGET = 'target'
+          TO_MARKER = '2'
+
           attr_accessor :tags, :type
           attr_reader   :sources, :targets, :source_string, :target_string
 
+          # Here are all methods that can use original objects without mutation the source.
+          # For methods with REMOVE action, their (!) bang alternative is not listed, since
+          # this methods tends to mutate the original (shortens it's length, remove special
+          # symbols..) and causes mismatch in tags range representation of the target. In
+          # short preshift is needed.
+          ORIGINAL_OBJECT_METHODS = %i[
+            capitalize
+            capitalize!
+            chomp
+            to_s
+            to_str
+            downcase
+            downcase!
+            lstrip
+            strip
+            upcase!
+            upcase
+          ].cs__freeze
+          TO_S = %w[to_s to_str].cs__freeze
+
           def initialize policy_hash = {}
             super(policy_hash)
             @source_string = policy_hash[JSON_SOURCE]
             @target_string = policy_hash[JSON_TARGET]
             @tags = Set.new(policy_hash[JSON_TAGS])
-            generate_sources
-            generate_targets
+            @sources = convert_policy_markers(source_string)
+            @targets = convert_policy_markers(target_string)
+            @_use_original_object = ORIGINAL_OBJECT_METHODS.include?(@method_name)
+            @_use_original_on_bang_method = assign_on_bang_check(policy_hash)
+          end
+
+          def assign_on_bang_check policy_hash
+            # If we have KEEP action on String, and the method is to_s, that method would return self:
+            # String#to_s => self or string. This method is included here to cover the situations such as
+            # String.to_s.html_safe, where normally the dynamic sources properties get lost. To solve this
+            # we will simply return the original object here.
+            return true if @_use_original_object && TO_S.include?(policy_hash[JSON_METHOD_NAME])
+
+            @_use_original_object &&
+                # Check if method name ends with a (!) bang unless is the to_s method:
+                policy_hash[JSON_METHOD_NAME].end_with?(Contrast::Utils::ObjectShare::BANG)
           end
 
           def feature
@@ -34,24 +83,9 @@ module Contrast
             :TYPE_METHOD
           end
 
-          def target
-            @_target ||= begin
-              if targets&.any?
-                targets[0]
-              elsif sources&.any?
-                sources[0]
-              end
-            end
-          end
-
-          def source_string= value
-            @source_string = value
-            generate_sources
-          end
-
           def target_string= value
             @target_string = value
-            generate_targets
+            @targets = convert_policy_markers(value)
           end
 
           # Sometimes we need to tie information to an event. We'll add a
@@ -70,89 +104,33 @@ module Contrast
             @properties[name]
           end
 
-          # Given a source in the format A,B,C, populate the sources of this node
-          # 1) Split on ','
-          # 2) If 'O', add the source, else it's P (we don't have R sources) and
-          #    needs to be converted. P type will either be P:name or P# where #
-          #    is the index of the paramter. Drop the P and store the int as int
-          #    or name as symbol
-          def generate_sources
-            if source_string
-              @sources = []
-              source_string.split(Contrast::Utils::ObjectShare::COMMA).each do |s|
-                is_object = (s == Contrast::Utils::ObjectShare::OBJECT_KEY)
-                if is_object
-                  @sources << s
-                else
-                  parameter_source = s[1..-1]
-                  @sources << if parameter_source.start_with?(Contrast::Utils::ObjectShare::COLON)
-                                parameter_source[1..-1].to_sym
-                              else
-                                parameter_source.to_i
-                              end
-                end
-              end
-            else
-              @sources = Contrast::Utils::ObjectShare::EMPTY_ARRAY
-            end
-          end
-
-          # Given a target in the format A,B,C, populate the targets of this node
-          # 1) Split on ','
-          # 2) If 'O' or 'R', add the target, else it's P and needs to be
-          #    converted. P type will either be P:name or P# where # is the index
-          #    of the paramter. Drop the P and store the int as int or name as
-          #    symbol
-          def generate_targets
-            if target_string
-              @targets = []
-              target_string.split(Contrast::Utils::ObjectShare::COMMA).each do |t|
-                case t
-                when Contrast::Utils::ObjectShare::OBJECT_KEY
-                  @targets << t
-                when Contrast::Utils::ObjectShare::RETURN_KEY
-                  @targets << t
-                else
-                  parameter_target = t[1..-1]
-                  @targets << if parameter_target.start_with?(Contrast::Utils::ObjectShare::COLON)
-                                parameter_target[1..-1].to_sym
-                              else
-                                parameter_target.to_i
-                              end
-                end
-              end
-            else
-              @targets = Contrast::Utils::ObjectShare::EMPTY_ARRAY
-            end
-          end
-
           # Don't let nodes be created that will be missing things we need
           # later on. Really, if they don't have these things, they couldn't have
           # done their jobs anyway.
           def validate
             super
             validate_tags
+          rescue ArgumentError => e
+            logger.debug('Validation of policy node failed with: ', e)
+            nil
           end
 
           # TeamServer is picky. The tags here match to ENUMs there. If there
           # isn't a matching ENUM in TS land, the database gets got. We really
           # don't want to get them, so we're going to prevent the node from being
           # made.
+          # @raise[ArgumentError] raises if any of the tags is invalid
           def validate_tags
             return unless tags
 
             tags.each do |tag|
-              next if VALID_TAGS.include?(tag) || VALID_SOURCE_TAGS.include?(tag)
+              next if Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag) ||
+                  Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
-              raise(ArgumentError,
-                    "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
+              raise(ArgumentError, "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
             end
           end
 
-          ALL_TYPE = 'A'
-          CREATION_TYPE = 'CREATION'
-          TRIGGER_TYPE = 'TRIGGER'
-          TO_MARKER = '2'
           # Convert our action, built from our source and target, into
           # the TS appropriate action. That's a single source to single
           # target marker (A,O,P,R)
@@ -161,127 +139,46 @@ module Contrast
           # Trigger (trigger nodes) don't have targets (they are the target)
           # Everything else (propagation nodes) are Source2Target
           def build_action
-            @event_action ||= begin
-              source = source_string
-              target = target_string
-              if source.nil?
-                :CREATION
-              elsif target.nil?
-                :TRIGGER
-              else
-                # TeamServer can't handle the multi-source or multi-target
-                # values. Give it some help by changing them to 'A'
-                source = ALL_TYPE if source.include?(Contrast::Utils::ObjectShare::COMMA)
-                target = ALL_TYPE if target.include?(Contrast::Utils::ObjectShare::COMMA)
-                str = source[0] + TO_MARKER + target[0] # TODO: RUBY-139 PERF -- save in the patcher
-                str.to_sym
-              end
-            end
+            @event_action ||= case node_class
+                              when Contrast::Agent::Assess::Policy::SourceNode::SOURCE
+                                :CREATION
+                              when Contrast::Agent::Assess::Policy::TriggerNode::TRIGGER
+                                :TRIGGER
+                              else
+                                if source_string.nil?
+                                  :CREATION
+                                elsif target_string.nil?
+                                  :TRIGGER
+                                else
+                                  # TeamServer can't handle the multi-source or multi-target values. Give it some help
+                                  # by changing them to 'A'
+                                  source = all_type?(source_string) ? ALL_TYPE : source_string
+                                  target = all_type?(target_string) ? ALL_TYPE : target_string
+                                  str = source[0] + TO_MARKER + target[0]
+                                  str.to_sym
+                                end
+                              end
+
             @event_action
           end
 
-          # EventTagTypeDTM
-          VALID_TAGS = %w[
-            XML_ENCODED
-            XML_DECODED
-            HTML_ENCODED
-            HTML_DECODED
-            URL_ENCODED
-            URL_DECODED
-            CSS_ENCODED
-            CSS_DECODED
-            BASE64_ENCODED
-            BASE64_DECODED
-            JAVASCRIPT_ENCODED
-            JAVASCRIPT_DECODED
-            JAVA_ENCODED
-            JAVA_DECODED
-            CSV_ENCODED
-            CSV_DECODED
-            SQL_ENCODED
-            SQL_DECODED
-            LDAP_ENCODED
-            LDAP_DECODED
-            XPATH_ENCODED
-            XPATH_DECODED
-            OS_ENCODED
-            OS_DECODED
-            VBSCRIPT_ENCODED
-            VBSCRIPT_DECODED
-            POTENTIAL_SANITIZED
-            POTENTIAL_VALIDATED
-            NO_CONTROL_CHARS
-            CUSTOM
-
-            CUSTOM_ENCODED
-            CUSTOM_ENCODED_CMD_INJECTION
-            CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_ENCODED_HEADER_INJECTION
-            CUSTOM_ENCODED_HQL_INJECTION
-            CUSTOM_ENCODED_LDAP_INJECTION
-            CUSTOM_ENCODED_LOG_INJECTION
-            CUSTOM_ENCODED_NOSQL_INJECTION
-            CUSTOM_ENCODED_PATH_TRAVERSAL
-            CUSTOM_ENCODED_REDOS
-            CUSTOM_ENCODED_REFLECTED_XSS
-            CUSTOM_ENCODED_REFLECTION_INJECTION
-            CUSTOM_ENCODED_SMTP_INJECTION
-            CUSTOM_ENCODED_SQL_INJECTION
-            CUSTOM_ENCODED_SSRF
-            CUSTOM_ENCODED_STORED_XSS
-            CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
-            CUSTOM_ENCODED_UNSAFE_READLINE
-            CUSTOM_ENCODED_UNSAFE_XML_DECODE
-            CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_ENCODED_UNVALIDATED_FORWARD
-            CUSTOM_ENCODED_UNVALIDATED_REDIRECT
-            CUSTOM_ENCODED_XPATH_INJECTION
-            CUSTOM_ENCODED_XXE
-            CUSTOM_SECURITY_CONTROL_APPLIED
-
-            CUSTOM_VALIDATED
-            CUSTOM_VALIDATED_CMD_INJECTION
-            CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
-            CUSTOM_VALIDATED_HEADER_INJECTION
-            CUSTOM_VALIDATED_HQL_INJECTION
-            CUSTOM_VALIDATED_LDAP_INJECTION
-            CUSTOM_VALIDATED_LOG_INJECTION
-            CUSTOM_VALIDATED_NOSQL_INJECTION
-            CUSTOM_VALIDATED_PATH_TRAVERSAL
-            CUSTOM_VALIDATED_REDOS
-            CUSTOM_VALIDATED_REFLECTED_XSS
-            CUSTOM_VALIDATED_REFLECTION_INJECTION
-            CUSTOM_VALIDATED_SMTP_INJECTION
-            CUSTOM_VALIDATED_SQL_INJECTION
-            CUSTOM_VALIDATED_SSRF
-            CUSTOM_VALIDATED_STORED_XSS
-            CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
-            CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
-            CUSTOM_VALIDATED_UNSAFE_READLINE
-            CUSTOM_VALIDATED_UNSAFE_XML_DECODE
-            CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
-            CUSTOM_VALIDATED_UNVALIDATED_FORWARD
-            CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
-            CUSTOM_VALIDATED_XPATH_INJECTION
-            CUSTOM_VALIDATED_XXE
-
-            DATABASE_WRITE
-          ].cs__freeze
-
-          VALID_SOURCE_TAGS = %w[
-            NO_NEWLINES
-            UNTRUSTED
-            CROSS_SITE
-            LIMITED_CHARS
-          ].cs__freeze
+          # This method will check if a method is fit to use it's original object and
+          # that the method is without bang - it does not change the source, but rather
+          # creates a copy of it.
+          #
+          # @return true | false
+          def use_original_object?
+            @_use_original_object && Contrast::ASSESS.track_original_object?
+          end
 
-          # The keys used to read from policy.json to create the individual
-          # policy nodes. These are common across node types
-          JSON_SOURCE = 'source'
-          JSON_TARGET = 'target'
-          JSON_TAGS = 'tags'
-          JSON_DATAFLOW = 'dataflow'
+          # This method will check if a method is fit to use it's original object and
+          # that the target return is the same as object - a bang method modifying the
+          # source.
+          #
+          # @return true | false
+          def use_original_on_bang_method?
+            @_use_original_on_bang_method && Contrast::ASSESS.track_original_object?
+          end
         end
       end
     end

data/lib/contrast/agent/assess/policy/policy_node_utils.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        # This module will extend the PolicyNode, which functions is to translate
+        # our policy.json into an actionable Ruby object, allowing for dynamic
+        # patching over hardcoded patching.
+        module PolicyNodeUtils
+          private
+
+          # Given a policy string in the format A,B,C, populate the given array
+          # 1) Split on ','
+          # 2) If 'O' or 'R', add the array, else it's P and needs to be
+          #    converted. P type will either be P# where # is the index
+          #    of the parameter. Drop the P and store the # as an int.
+          #
+          # @param markers [String] the String from the policy to parse
+          # @return [Array] the array generated by converting the marker string
+          def convert_policy_markers markers
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless markers
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY if markers.empty?
+
+            converted = []
+            markers.split(Contrast::Utils::ObjectShare::COMMA).each do |maker|
+              converted << case maker
+                           when Contrast::Utils::ObjectShare::OBJECT_KEY,
+                             Contrast::Utils::ObjectShare::RETURN_KEY
+
+                             maker
+                           else
+                             Integer(maker[1..])
+                           end
+            end
+            converted
+          end
+
+          def all_type? marker
+            marker.include?(Contrast::Utils::ObjectShare::COMMA)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,9 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent
@@ -14,13 +12,19 @@ module Contrast
         # of a file vs data flow, such as the detection of Hardcoded Passwords
         # or Keys.
         module PolicyScanner
-          include Contrast::Components::Interface
-          access_component :analysis, :logging
-
           class << self
+            # Use the given trace_point, built from an :end event, to determine
+            # where the loaded code lives and scan that code for policy
+            # violations.
+            #
+            # @param trace_point [TracePoint] the TracePoint generated by an
+            #   :end event at the end of a Module definition.
             def scan trace_point
-              return unless ASSESS.enabled?
-              return unless ASSESS.require_scan?
+              return unless ::Contrast::ASSESS.enabled?
+              return unless ::Contrast::ASSESS.require_scan?
+
+              provider_values = policy.providers.values
+              return if provider_values.all?(&:disabled?)
 
               return unless trace_point.path
               return if trace_point.path.start_with?(Gem.dir)
@@ -28,9 +32,8 @@ module Contrast
               mod = trace_point.self
               return if mod.cs__frozen? || mod.singleton_class?
 
-              policy.providers.each_value do |provider|
-                provider.analyze mod
-              end
+              ast = RubyVM::AbstractSyntaxTree.parse_file(trace_point.path)
+              provider_values.each { |provider| provider.parse(trace_point, ast) }
             end
 
             def policy

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Agent
@@ -9,12 +10,16 @@ module Contrast
       # In order to properly shift tags to account for the changes this method
       # caused, we'll need to store the state before the change occurred.
       class PreShift
-        include Contrast::Components::Interface
-        access_component :analysis, :logging
+        include Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Logger::InstanceMethods
 
-        UNDUPLICABLE_MODULES = [
+        @lru_cache = Contrast::Utils::LRUCache.new
+        UNDUPLICABLE_MODULES = [ # rubocop: disable Style/MutableConstant
           Enumerator # dup'ing results in 'can't copy execution context'
-        ].cs__freeze
+        ]
+        # dup'ing IO::Buffer results in null buffer.
+        UNDUPLICABLE_MODULES << IO::Buffer if RUBY_VERSION >= '3.1.0'
+        UNDUPLICABLE_MODULES.cs__freeze
 
         attr_accessor :object, :object_length, :args, :arg_lengths
 
@@ -36,11 +41,14 @@ module Contrast
           #   the state of the object and arguments just prior to the method
           #   being called or nil if one is not required.
           def build_preshift propagation_node, object, args
-            return nil unless propagation_node
-            return nil unless ASSESS.enabled?
+            return unless propagation_node
+            return unless ::Contrast::ASSESS.enabled?
+
+            # don't do preshift just use the original object
+            return if propagation_node.use_original_object?
 
             initializing = propagation_node.method_name == :initialize
-            return nil if unsafe_io_object?(object, initializing)
+            return if unsafe_io_object?(object, initializing)
 
             needs_object = propagation_node.needs_object?
             needs_args = propagation_node.needs_args?
@@ -51,7 +59,7 @@ module Contrast
 
             preshift
           rescue StandardError => e
-            logger.error(e, 'Unable to build preshift for method.')
+            logger.error('Unable to build preshift for method.', e)
             nil
           end
 
@@ -69,23 +77,46 @@ module Contrast
           end
 
           def append_object_details preshift, initializing, object
-            preshift.object = can_dup?(initializing, object) ? object.dup : object
-            preshift.object.cs__copy_from(object) if object.cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :cs__copy_from)
+            can = can_dup?(initializing, object)
+            preshift.object = if @lru_cache.key?(object.__id__) && !Contrast::Agent::Assess::Tracker.tracked?(object)
+                                @lru_cache[object.__id__]
+                              else
+                                can ? object.dup : object
+                              end
             preshift.object_length = if Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :length)
                                        object.length
                                      else
                                        0
                                      end
+
+            return unless can
+
+            return unless Contrast::Agent::Assess::Tracker.tracked?(object)
+
+            Contrast::Agent::Assess::Tracker.copy(object, preshift.object)
+            @lru_cache[object.__id__] = object
           end
 
           def append_arg_details preshift, args
-            preshift.args = args.dup
-            preshift.args.each_with_index do |arg, index|
-              next unless args[index].cs__frozen? && Contrast::Utils::DuckUtils.quacks_to?(arg, :cs__copy_from)
-
-              arg.cs__copy_from(args[index])
+            args_length = args.length
+            preshift.args = Array.new(args_length)
+            preshift.arg_lengths = Array.new(args_length)
+            idx = 0
+            while idx < args_length
+              or_arg = args[idx]
+              p_arg = if @lru_cache.key?(or_arg.__id__)
+                        @lru_cache[or_arg.__id__]
+                      else
+                        can_dup?(false, or_arg) ? or_arg.dup : or_arg
+                      end
+              preshift.args[idx] = p_arg
+              preshift.arg_lengths[idx] = Contrast::Utils::DuckUtils.quacks_to?(p_arg, :length) ? p_arg.length : 0
+              idx += 1
+              next if p_arg.__id__ == or_arg.__id__
+
+              Contrast::Agent::Assess::Tracker.copy(or_arg, p_arg)
+              @lru_cache[p_arg.__id__] = p_arg
             end
-            preshift.arg_lengths = preshift.args.map { |arg| Contrast::Utils::DuckUtils.quacks_to?(arg, :length) ? arg.length : 0 }
           end
         end
       end