contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,261 +1,267 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the continuation of traces. A Propagator is any
-# method that transforms an untrusted value. In general, these methods work on
-# the String class or a holder of Strings
-cs__scoped_require 'set'
+require 'set'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-
-cs__scoped_require 'contrast/agent/assess/policy/propagator'
-
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagator'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
+require 'contrast/utils/assess/propagation_method_utils'
+require 'contrast/utils/assess/event_limit_utils'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/utils/assess/object_store'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # This module contains the logic for determining how to propagate tags
-        # and events from a source to a target
+        # This class is responsible for the continuation of traces. A Propagator is any method that transforms an
+        # untrusted value. In general, these methods work on the String class or a holder of Strings.
+        # rubocop:disable Metrics/ModuleLength
         module PropagationMethod
-          include Contrast::Components::Interface
-          access_component :logging
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Utils::Assess::PropagationMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
-          APPEND_ACTION = 'APPEND'
-          CENTER_ACTION = 'CENTER'
-          INSERT_ACTION = 'INSERT'
-          KEEP_ACTION = 'KEEP'
-          NEXT_ACTION = 'NEXT'
-          PREPEND_ACTION = 'PREPEND'
-          REPLACE_ACTION = 'REPLACE'
-          REMOVE_ACTION = 'REMOVE'
-          REVERSE_ACTION = 'REVERSE'
-          SPLAT_ACTION = 'SPLAT'
-          SPLIT_ACTION = 'SPLIT'
-          TAG_ACTION = 'TAG'
-          DB_WRITE_ACTION = 'DB_WRITE'
-          CUSTOM_ACTION = 'CUSTOM'
+          @properties = Contrast::Utils::Assess::ObjectStore.new
 
           class << self
-            def determine_target propagation_node, ret, object, args
-              target_key = propagation_node.targets[0]
-              return ret if target_key == Contrast::Utils::ObjectShare::RETURN_KEY
-              return object if target_key == Contrast::Utils::ObjectShare::OBJECT_KEY
-
-              return args[target_key] if target_key.is_a?(Integer)
-
-              arg = nil
-              args.each do |search|
-                next unless search.is_a?(Hash)
-
-                arg = search[target_key]
-                break if arg
-              end
-              arg
-            end
-
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that governs the
+            #   patches to this method
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+            #   the invocation of the patched method.
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param block [Block] the Block passed to the original method
+            # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
+            #   original function if not nil
             def apply_propagation method_policy, preshift, object, ret, args, block
-              return unless method_policy.propagation_node
-              return unless preshift
-
-              propagation_node = method_policy.propagation_node
+              return unless (propagation_node = method_policy.propagation_node)
+              return unless propagation_node.use_original_object? || preshift
+              return if event_limit?(method_policy)
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, 0, args, block)
+              propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, propagation_data, block)
             end
 
-            PROPAGATION_ACTIONS = {
-                APPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Append,
-                CENTER_ACTION => Contrast::Agent::Assess::Policy::Propagator::Center,
-                INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
-                KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
-                NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
-                PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
-                REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
-                REMOVE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Remove,
-                REVERSE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Reverse,
-                SPLAT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Splat,
-                SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
-            }.cs__freeze
-
-            # I lied above. We had to figure out what the target of the propagation was.
-            # Now that we know, we'll actually do things to it.
-            def apply_propagator propagation_node, preshift, target, object, ret, invoked, args, block
-              context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless context && propagation_node && valid_target?(target, propagation_node)
-              return unless valid_length?(target, propagation_node.action)
+            # I lied above. We had to figure out what the target of the propagation was. Now that we know, we'll
+            # actually do things to it. Note that the return of this method will replace the original return of the
+            # patched function unless it is nil, so be sure you're returning what you intend.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+            #   the invocation of the patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
+            # @param block [Block] the Block passed to the original method
+            def apply_propagator propagation_node, preshift, target, propagation_data, block
+              return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
+                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node,
+                                                                                     preshift,
+                                                                                     propagation_data.ret)
               elsif propagation_node.action == CUSTOM_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
+                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node,
+                                                                              preshift,
+                                                                              propagation_data.ret,
+                                                                              block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
-                logger.debug(
-                    nil,
-                    "Propagator #{ propagation_node.id } detected: propagated to #{ target.__id__ }")
-              elsif Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, propagation_data, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, invoked, args, block)
-              end
-            rescue StandardError => e
-              logger.warn(e, "Unable to apply propagator #{ propagation_node.id }")
-            end
-
-            # Custom actions tend to be the more complex of our propagations.
-            # Often, the method has to make decisions about the target based on
-            # the context with which the method was called. As such, defer
-            # determining if the target is valid to that method.
-            #
-            # In all other cases, a target is valid for propagation if it is not
-            # nil
-            def valid_target? target, propagation_node
-              return true if propagation_node.action == CUSTOM_ACTION
-
-              !!target
-            end
-
-            ZERO_LENGTH_ACTIONS = [
-              DB_WRITE_ACTION,
-              CUSTOM_ACTION,
-              KEEP_ACTION,
-              REPLACE_ACTION,
-              SPLAT_ACTION
-            ].cs__freeze
-            # If the action required needs a length and the target does not have
-            # one, the length is not valid
-            def valid_length? target, action
-              return true if ZERO_LENGTH_ACTIONS.include?(action)
-
-              if Contrast::Utils::DuckUtils.quacks_to?(target, :length)
-                target.length != 0 # rubocop:disable Style/ZeroLengthPredicate
+                handle_enumerable_propagation(propagation_node, preshift, target, propagation_data, block)
               else
-                !target.to_s.empty?
-              end
-            end
-
-            # Before we do any work, we should check if we even need to.
-            # If the source of this patcher is not tracked, there's no need to do
-            # anything. A copy of nothing is still nothing.
-            def can_propagate? propagation_node, preshift, target
-              # We cannot propagate to things that do not have cs__properties.
-              return false unless Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
-
-              # We cannot propagate to frozen things that have not been
-              # previously tracked. We probably shouldn't propagate to frozen
-              # things at all, as they're supposed to be immutable, but third
-              # parties do jenky things, so allow it as long as it is safe to do.
-              return false if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties &&
-                  propagation_node.targets[0] != Contrast::Utils::ObjectShare::RETURN_KEY
-              return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
-              return false unless preshift
-
-              propagation_node.sources.each do |source|
-                case source
-                when Contrast::Utils::ObjectShare::OBJECT_KEY
-                  return true if Contrast::Utils::Assess::TrackingUtil.tracked?(preshift.object)
-                else # has to be P, there's no ret source type (yet? ever?)
-                  return true if preshift.args && Contrast::Utils::Assess::TrackingUtil.tracked?(preshift.args[source])
-                end
+                handle_cs_properties_propagation(propagation_node, preshift, target, propagation_data, block)
               end
-              false
+            rescue StandardError => e
+              logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
+              nil
             end
 
             # If this patcher has tags, apply them to the entire target
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param target [Object] the Target to which to propagate.
             def apply_tags propagation_node, target
-              return unless propagation_node.tags
+              return unless (propagation_tags = propagation_node.tags)
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties(target))
 
               length = Contrast::Utils::StringUtils.ret_length(target)
-              propagation_node.tags.each do |tag|
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                target.cs__properties.add_tag(tag, span)
+              propagation_tags.each do |tag|
+                properties.add_tag(tag, 0...length)
               end
             end
 
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
             # If this patcher has tags, remove them from the entire target
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param target [Object] the Target to which to propagate.
             def apply_untags propagation_node, target
               return unless propagation_node.untags
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties(target))
 
               propagation_node.untags.each do |tag|
-                target.cs__properties.delete_tags(tag)
+                properties.delete_tags(tag)
               end
             end
 
             private
 
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            # This is checked right before actual propagation
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param target [Object] the Target to which to propagate.
+            # @return [Boolean]
+            def propagation_possible? propagation_node, target
+              return false unless propagation_node && valid_target?(target, propagation_node)
+              return false unless context_available? || Contrast::ASSESS.non_request_tracking?
+              return false unless valid_length?(target, propagation_node.action)
+
+              true
+            end
+
+            # Iterate over each key and value in a hash to allow for propagation to each.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+            #   the invocation of the patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
+            # @param block [Block] the Block passed to the original method
+            def handle_hash_propagation propagation_node, preshift, target, propagation_data, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, invoked, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, key, propagation_data, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, invoked, args, block
-              invoked += 2
+            # Iterate over each value in an enumerable to allow for propagation to each.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+            #   the invocation of the patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
+            # @param block [Block] the Block passed to the original method
+            def handle_enumerable_propagation propagation_node, preshift, target, propagation_data, block
               target.each do |value|
-                next if target == value # Some Enumerable#each are overriden to return self the first time which leads to infinite propagation
+                next if target == value
 
-                apply_propagator(propagation_node, preshift, value, object, ret, invoked, args, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, invoked, args, _block
-              invoked += 1
-              return unless can_propagate?(propagation_node, preshift, target)
+            # Move the properties from the source(s) to the target of the propagation.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+            #   propagation event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+            #   the invocation of the patched method.
+            # @param target [Object] the Target to which to propagate.
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
+            # @param _block [Block] the Block passed to the original method
+            def handle_cs_properties_propagation propagation_node, preshift, target, propagation_data, _block
+              return if propagation_node.action == NOOP_ACTION
+              return unless can_propagate?(propagation_node, preshift, target, propagation_data)
+              return unless (propagation_class = find_propagation_class(propagation_node))
+
+              # If we are using the original object tracking, the preshift object is not created.
+              # Instead identify the source as the original object itself and propagate with it.
+              source = propagation_node.use_original_object? ? propagation_data.object : preshift
+              handle_propagation(propagation_class, propagation_node, source, target)
+              update_properties(propagation_node, target, propagation_data)
+              increment_event_count(propagation_node)
+            end
 
-              # propagate all the tags from the sources to the target
-              propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil)
-              unless propagation_class
-                logger.warn(
-                    nil,
-                    "Unknown action type #{ propagation_node.action }. Unable to "\
-                    "propagate for #{ propagation_node.id }.")
-                return ret
+            def handle_propagation propagation_class, propagation_node, source, target
+              if propagation_node.patch_method
+                propagation_class.send(propagation_node.patch_method, propagation_node, source, target)
+              else
+                propagation_class.propagate(propagation_node, source, target)
               end
+            end
 
-              restore_frozen_state = false
-              if target.cs__frozen?
-                return ret unless propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+            def update_properties propagation_node, target, propagation_data
+              if propagation_node.use_original_on_bang_method?
+                properties = use_original_object_properties(propagation_data)
 
-                restore_frozen_state = true
-                ret = Contrast::Utils::FreezeUtil.unfreeze_dup(target)
-                target = ret
+                return unless properties
+              else
+                # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
+                apply_tags(propagation_node, target)
+                # Even though we skipped propagating tags from the source if they were included in untags, the target
+                # may have already had some on it. Let's go ahead and remove them. In this order, untags takes
+                # precedent over tags; but we control both and there should never be a propagator that has a
+                # tag in its untag.
+                apply_untags(propagation_node, target)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                properties.add_properties(propagation_node.properties)
               end
-              return if target.cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
-
-              propagation_class.propagate(propagation_node, preshift, target)
-
-              # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
-              apply_tags(propagation_node, target)
-
-              # Even though we skipped propagating tags from the source if they
-              # were included in untags, the target may have already had some on
-              # it. Let's go ahead and remove them.
-              # In this order, untags takes precedent over tags; but we control
-              # both and there should never be a propagator that has a tag in
-              # its untag.
-              apply_untags(propagation_node, target)
-
-              target.cs__properties.add_properties(propagation_node.properties)
-
-              target.cs__properties.build_event(propagation_node, target, object, ret, args, invoked)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                          target,
+                                                                          propagation_data.object,
+                                                                          propagation_data.ret,
+                                                                          propagation_data.args)
+              properties.build_event(event_data)
+              logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
+            end
 
-              logger.debug(
-                  nil,
-                  "Propagator #{ propagation_node.id } detected: propagated to "\
-                  "#{ target.__id__ }")
+            # Find the propagation class from the given node, if one exists.
+            #
+            # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs a
+            #   propagation event.
+            # @return [Contrast::Agent::Assess::Policy::Propagator, nil]
+            def find_propagation_class propagation_node
+              unless (propagation_class = PROPAGATION_ACTIONS.fetch(propagation_node.action, nil))
+                logger.warn('Unknown propagation action received. Unable to propagate.',
+                            node_id: propagation_node.id,
+                            action: propagation_node.action)
+              end
+              propagation_class
+            end
 
-              ret.cs__freeze if restore_frozen_state
-              ret
+            # For certain bang methods we return the same object, no need to create expensive new properties.
+            #
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] used to hold object, args
+            # and ret.
+            # @return properties [Contrast::Agent::Assess::Properties] the original properties transfered to
+            # target.
+            def use_original_object_properties propagation_data
+              unless @properties[propagation_data.object.__id__]
+                @properties[propagation_data.object.__id__] = Contrast::Agent::Assess::Tracker.properties!(
+                    propagation_data.object)
+              end
+              @properties[propagation_data.object.__id__]
             end
           end
         end
+        # rubocop:enable Metrics/ModuleLength
       end
     end
   end

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,7 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/assess/policy/policy_node'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Assess
@@ -12,13 +15,18 @@ module Contrast
         # untrusted data (indicate points in the application where user
         # controlled input is modified).
         class PropagationNode < PolicyNode
+          include Contrast::Components::Logger::InstanceMethods
+
           JSON_ACTION = 'action'
           JSON_UNTAGS = 'untags'
           JSON_PATCH_CLASS = 'patch_class'
           JSON_PATCH_METHOD = 'patch_method'
 
-          attr_accessor :action, :untags, :patch_class, :patch_method
+          attr_reader :action, :untags, :patch_method
+          attr_accessor :patch_class
 
+          TAGGER = 'Tagger'
+          PROPAGATOR = 'Propagator'
           # Most things here carry over from PolicyNode.
           # A couple things are new / have new rules
           #
@@ -36,11 +44,11 @@ module Contrast
             @patch_method = propagation_hash[JSON_PATCH_METHOD]
             @patch_method = @patch_method.to_sym if @patch_method
             validate
+          rescue ArgumentError => e
+            logger.error('Propagation Node Initialization failed with: ', e)
+            nil
           end
 
-          TAGGER = 'Tagger'
-          PROPAGATOR = 'Propagator'
-
           def node_class
             @_node_class ||= tagger? ? TAGGER : PROPAGATOR
           end
@@ -54,59 +62,62 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source, target, and action
+          # @raise[ArgumentError] raises if any of the required propagation node field is not valid, or is missing
           def validate
             super
             raise(ArgumentError, "Propagator #{ id } did not have a proper action. Unable to create.") unless action
 
             if @action == 'CUSTOM'
-              raise(ArgumentError, "Propagator #{ id } did not have a proper patch_class. Unable to create.") unless patch_class
-              raise(ArgumentError, "Propagator #{ id } did not have a proper patch_method. Unable to create.") unless patch_method.is_a?(Symbol)
+              unless patch_class
+                raise(ArgumentError, "Propagator #{ id } did not have a proper patch_class. Unable to create.")
+              end
+              unless patch_method.is_a?(Symbol)
+                raise(ArgumentError, "Propagator #{ id } did not have a proper patch_method. Unable to create.")
+              end
             else
-              raise(ArgumentError, "Propagator #{ id } did not have a proper target. Unable to create.") unless targets&.any?
-              raise(ArgumentError, "Propagator #{ id } did not have a proper source. Unable to create.") unless sources&.any?
+              unless targets&.any?
+                raise(ArgumentError, "Propagator #{ id } did not have a proper target. Unable to create.")
+              end
+              unless sources&.any?
+                raise(ArgumentError, "Propagator #{ id } did not have a proper source. Unable to create.")
+              end
             end
             validate_untags
           end
 
+          # @raise[ArgumentError] raises if any of the tags is invalid
           def validate_untags
             return unless untags
 
             untags.each do |tag|
-              raise(ArgumentError, "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.") unless VALID_TAGS.include?(tag)
-              raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.") if tags&.include?(tag)
+              unless Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag)
+                raise(ArgumentError,
+                      "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.")
+              end
+              if tags&.include?(tag)
+                raise(ArgumentError, "#{ node_type } #{ id } had the same tag and untag, #{ tag }.")
+              end
             end
           end
 
           def needs_object?
-            @_needs_object ||= begin
-              if action == Contrast::Agent::Assess::Policy::PropagationMethod::CUSTOM_ACTION
-                true
-              elsif action == Contrast::Agent::Assess::Policy::PropagationMethod::DB_WRITE_ACTION
-                true
-              elsif sources.any? { |source| source == Contrast::Utils::ObjectShare::OBJECT_KEY }
-                true
-              elsif targets.any? { |target| target == Contrast::Utils::ObjectShare::OBJECT_KEY }
-                true
-              else
-                false
-              end
+            if @_needs_object.nil?
+              @_needs_object = action == Contrast::Utils::Assess::PropagationMethodUtils::CUSTOM_ACTION ||
+                  action == Contrast::Utils::Assess::PropagationMethodUtils::DB_WRITE_ACTION ||
+                  sources.any?(Contrast::Utils::ObjectShare::OBJECT_KEY) ||
+                  targets.any?(Contrast::Utils::ObjectShare::OBJECT_KEY)
             end
+            @_needs_object
           end
 
           def needs_args?
-            @_needs_args ||= begin
-              if action == Contrast::Agent::Assess::Policy::PropagationMethod::CUSTOM_ACTION
-                true
-              elsif action == Contrast::Agent::Assess::Policy::PropagationMethod::DB_WRITE_ACTION
-                true
-              elsif sources.any? { |source| source.is_a?(Integer) || source.is_a?(Symbol) }
-                true
-              elsif targets.any? { |target| target.is_a?(Integer) || target.is_a?(Symbol) }
-                true
-              else
-                false
-              end
+            if @_needs_args.nil?
+              @_needs_args = action == Contrast::Utils::Assess::PropagationMethodUtils::CUSTOM_ACTION ||
+                  action == Contrast::Utils::Assess::PropagationMethodUtils::DB_WRITE_ACTION ||
+                  sources.any? { |source| source.is_a?(Integer) || source.is_a?(Symbol) } ||
+                  targets.any? { |target| target.is_a?(Integer) || target.is_a?(Symbol) }
             end
+            @_needs_args
           end
 
           # This is a tagger if it has a tag or an untag.
@@ -114,11 +125,8 @@ module Contrast
           # it is an interesting security event that has a meaningful
           # change.
           def tagger?
-            @_tagger ||= begin
-              has_tags = tags&.any?
-              has_untags = untags&.any?
-              has_tags || has_untags
-            end
+            @_tagger = tags&.any? || untags&.any? if @_tagger.nil?
+            @_tagger
           end
         end
       end