contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/config/ruby_configuration.rb

@@ -1,44 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # specific settings that apply to Ruby
-    class RubyConfiguration < BaseConfiguration
-      # These commands being detected will result the agent disabling instrumentation, generally any command
-      # that doesn't result in the application listening on a port can be added here, this normally includes tasks
-      # that are ran pre-startup(like migrations) or to show information about the application(such as routes)
-      DISABLED_RAKE_TASK_LIST = %w[
-        about assets:clean assets:clobber assets:environment
-        assets:precompile assets:precompile:all db:create db:drop db:fixtures:load db:migrate
-        db:migrate:status db:rollback db:schema:cache:clear db:schema:cache:dump db:schema:dump
-        db:schema:load db:seed db:setup db:structure:dump db:version doc:app graphql:install graphql:object
-        log:clear middleware notes notes:custom rails:template rails:update routes secret spec spec:features
-        spec:requests spec:controllers spec:helpers spec:models spec:views spec:routing spec:rcov stats
-        test test:all test:all:db test:recent test:single test:uncommitted time:zones:all tmp:clear
-        tmp:create webpacker:compile contrast:service:start contrast:service:status contrast:service:stop
-      ].cs__freeze
-
-      DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
-
-      KEYS = {
-          disabled_agent_rake_tasks: Contrast::Config::DefaultValue.new(DISABLED_RAKE_TASK_LIST),
-          exceptions: Contrast::Config::ExceptionConfiguration,
-          # controls whether or not we patch interpolation, either by rewrite or by funchook
-          interpolate: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          # controls whether or not we patch the rb_yield block to track split propagation
-          propagate_yield: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          # control whether or not we run file scanning rules on require
-          require_scan: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          # controls whether or not we track frozen Strings by replacing them
-          track_frozen_sources: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          uninstrument_namespace: Contrast::Config::DefaultValue.new(DEFAULT_UNINSTRUMENTED_NAMESPACES)
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
-      end
-    end
-  end
-end

data/lib/contrast/config/sampling_configuration.rb

@@ -1,22 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # sampling functionality of the Agent.
-    class SamplingConfiguration < BaseConfiguration
-      KEYS = {
-          enable: EMPTY_VALUE,
-          baseline: EMPTY_VALUE,
-          request_frequency: EMPTY_VALUE,
-          response_frequency: EMPTY_VALUE,
-          window_ms: EMPTY_VALUE
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
-      end
-    end
-  end
-end

data/lib/contrast/config/service_configuration.rb

@@ -1,22 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # communication between the Agent & the Service.
-    class ServiceConfiguration < BaseConfiguration
-      KEYS = {
-          enable: EMPTY_VALUE,
-          host: EMPTY_VALUE,
-          port: EMPTY_VALUE,
-          socket: EMPTY_VALUE,
-          logger: Contrast::Config::LoggerConfiguration
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
-      end
-    end
-  end
-end

data/lib/contrast/delegators/application_update.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Delegators
-    # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
-    # AppUpdate dtm
-    class ApplicationUpdate < SimpleDelegator
-      def append_view_technology_descriptor_data view_technology_descriptors
-        view_technology_descriptors.each do |vtd|
-          vtd.technology_names.each do |tech_name|
-            @delegate_sd_obj.technologies[tech_name] = true
-          end
-        end
-      end
-
-      # TS only allows you to report 500 routes per application
-      def append_route_coverage_data route_coverage_dtms
-        route_coverage_dtms.take(500).each do |route_coverage_dtm|
-          @delegate_sd_obj.routes << route_coverage_dtm
-        end
-      end
-
-      def append_platform_version platform_version
-        @delegate_sd_obj.platform = Contrast::Api::Dtm::Platform.new if @delegate_sd_obj.platform.nil?
-        @delegate_sd_obj.platform.major = platform_version.major
-        @delegate_sd_obj.platform.minor = platform_version.minor
-        @delegate_sd_obj.platform.build = platform_version.patch
-      end
-    end
-  end
-end

data/lib/contrast/delegators.rb

@@ -1,9 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  # Used to define decorators for objects to add behavior without polluting the namespace
-  module Delegators
-  end
-end
-cs__scoped_require 'contrast/delegators/application_update'

data/lib/contrast/extensions/framework/rack/cookie.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Rack
-  module Session
-    # Our patch into the Rack::Session::Cookie Class, allowing for the
-    # runtime detection of insecure configurations on individual cookies
-    # within the application
-    class Cookie
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      access_component :scope
-
-      alias_method :cs__patched_initialize, :initialize
-      def initialize app, options = {}
-        Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
-        cs__patched_initialize(app, options)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/request.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Request class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Request
-    unless Rack::Request.instance_methods(true).include?(:set_header)
-      def set_header name, value
-        @env[name] = value
-      end
-    end
-
-    unless Rack::Request.instance_methods(true).include?(:get_header)
-      def get_header name
-        @env[name]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/response.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Response Class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Response
-    unless Rack::Response.instance_methods(true).include?(:set_header)
-      def set_header key, value
-        headers[key] = value
-      end
-    end
-    unless Rack::Response.instance_methods(true).include?(:get_header)
-      def get_header key
-        headers[key]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/action_controller_railties_helper_inherited.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActionController
-  module Railties
-    # Used to monkey patch all the inherited calls in action_pack
-    #
-    # This is the usual entry point for Rails inheritance work, so it should
-    # catch most of the calls to inherited.
-    module Helpers
-      alias_method :cs__patched_inherited, :inherited
-      def inherited klass
-        klass&.instance_variable_set(:@cs__defining_class, true)
-        cs__patched_inherited(klass)
-      ensure
-        klass&.instance_variable_set(:@cs__defining_class, false)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/active_record.rb

@@ -1,26 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActiveRecord
-  module AttributeMethods
-    module Read
-      # Rails / ActiveRecord are sneaky a.f. They define attributes of a
-      # class in one method, then monkey patch allocate in another and
-      # finally invoke module_eval in this method... but of course they use a
-      # '_tmp_' header for the method name and then alias it in this module
-      # to name it what we expect
-      module ClassMethods
-        alias_method :cs__patched_define_method_attribute, :define_method_attribute
-
-        def define_method_attribute *args, &block
-          ret = cs__patched_define_method_attribute(*args, &block)
-          method_name = args[0]
-          Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-          ret
-        end
-
-        protected :cs__patched_define_method_attribute, :define_method_attribute
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/active_record_named.rb

@@ -1,53 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module ActiveRecord
-  module Scoping
-    module Named
-      # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
-      # allowing for the runtime rewrite of interpolation calls defined in
-      # methods defined dynamically during application execution.
-      #
-      # TODO: RUBY-534
-      module ClassMethods
-        include Contrast::Components::Interface
-        access_component :logging, :agent
-
-        def _cs__rewrite method_name, body
-          return body unless AGENT.rewrite_interpolation?
-          return body unless body.is_a?(Proc)
-
-          location = body.source_location
-          return body if location.nil?
-
-          # Good news, once we patch the body once, the source location
-          # becomes eval. We may need to fix this later though (so it may
-          # be bad news)
-          return body if location.empty? || location[0].empty? || location[0].include?('eval')
-
-          opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(self))
-          original_source_code = opener.source_code(location, method_name)
-          return body unless original_source_code
-          return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
-          return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
-
-          # the code looks like 'source :some_method_name, ->lambda_literal'
-          # we just need the lambda
-          body_start = original_source_code.index(',') + 1
-          original_source_code = original_source_code[body_start..-1]
-
-          new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
-          return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
-
-          unbound_eval(cs__name, new_method_source)
-        rescue SyntaxError, StandardError => e
-          logger.debug(e, "Can't parse method source in scoped method #{ method_name }: #{ e.message }")
-          body
-        end
-      end
-    end
-  end
-end
-cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'

data/lib/contrast/extensions/framework/rails/active_record_time_zone_inherited.rb

@@ -1,21 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActiveRecord
-  module AttributeMethods
-    # Used to monkey patch all the inherited calls in action_pack
-    module TimeZoneConversion
-      module ClassMethods #:nodoc:
-        private
-
-        alias_method :cs__patched_inherited, :inherited
-        def inherited klass
-          klass&.instance_variable_set(:@cs__defining_class, true)
-          cs__patched_inherited(klass)
-        ensure
-          klass&.instance_variable_set(:@cs__defining_class, false)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/buffer.rb

@@ -1,28 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module ActionController
-  module Live
-    # This class acts as our patch into the ActionController::Live::Buffer
-    # class, allowing us to track the close event on streamed responses.
-    class Buffer
-      include Contrast::Components::Interface
-      access_component :contrast_service
-
-      # normally pre->in->post filters are applied however, in a streamed response
-      # we can run into a case where it's pre -> in -> post -> more infilters
-      # in order to submit anything found during the infilters after the response has been written we need to explicity send them
-      alias_method :cs__close, :close
-      def close
-        if (context = Contrast::Agent::REQUEST_TRACKER.current)
-          [context.server_activity, context.activity, context.observed_route].each do |msg|
-            CONTRAST_SERVICE.send_message msg
-          end
-        end
-        cs__close
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/configuration.rb

@@ -1,27 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Rails
-  class Application
-    # Our patch into the Rails::Application::Configuration Class, allowing
-    # for the runtime detection of insecure configurations on individual
-    # ActionDispatch::Session::AbstractStore instances within the
-    # application.
-    class Configuration
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      # Note to self / PR reviewers / wizard people dear reader,
-      # including the components into Rails here may be unnecessary
-      # if we're not calling anything besides #analyze_session_store?
-      access_component :analysis, :scope
-
-      alias_method :cs__patched_session_store, :session_store
-      def session_store *args
-        ret = cs__patched_session_store(*args)
-        Contrast::Utils::RailsAssessConfiguration.analyze_session_store(*args)
-        ret
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/sinatra/base.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/framework/sinatra_support'
-
-module Sinatra
-  # Our patch into the Sinatra::Base Class, allowing for the inventory of the
-  # routes called by the application
-  class Base
-    alias_method :cs__patched_call!, :call!
-
-    # publicly available method for Sinatra::Base things -- unfortunately,
-    # getting the routes appear to require a lookup every time
-    def call! *args
-      cs__patched_map_route(*args)
-      cs__patched_call!(*args)
-    end
-
-    private
-
-    # Use logic copied from Sinatra::Base#process_route to determine which
-    # pattern matches the request being invoked by Sinatra::Base#call!
-    #
-    # @param args [Array<Object>] we rely on the @settings object in
-    #   Sinatra::Base and the env variable passed in as args[0]
-    def cs__patched_map_route *args
-      context = Contrast::Agent::REQUEST_TRACKER.current
-      return unless context
-
-      env = args[0]
-      return unless env
-
-      # There isn't a Request object in the Sinatra::Base yet - it's made
-      # during the #call! method, which we're patching - so we need to
-      # access the env
-      method = env[Rack::REQUEST_METHOD]
-      route = env[Rack::PATH_INFO]
-      route = route.to_s
-
-      # get all potential routes for this request type
-      routes = settings.routes[method]
-      return unless routes
-
-      # Do some cleanup that matches Sinatra::Base#process_route
-      route = '/' if route.empty? && !settings.empty_path_info?
-      route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
-
-      # Find the route that matches this request. Since we're using
-      # settings, we should resolve in the same precedence as Sinatra
-      routes.each do |pattern, _, _| # Mustermann::Sinatra
-        next unless pattern.params(route)
-
-        dtm = Contrast::Framework::SinatraSupport.send(:route_to_coverage, cs__class, method, pattern)
-        context.append_route_coverage(dtm)
-        break
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/assess/array.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/patching/policy/patch'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/components/interface'
-
-# This is our patch of the Array class required to handle propagation
-# Disclaimer: there may be a better way, but we're in a 'get it work' state.
-# Hopefully, we'll be in a 'get it right' state soon.
-class Array
-  include Contrast::Components::Interface
-
-  access_component :scope
-
-  ARRAY_JOIN_HASH = {
-      'class_name' => 'Array',
-      'instance_method' => true,
-      'method_visibility' => 'public',
-      'method_name' => 'join',
-      'action' => 'CUSTOM',
-      'source' => 'O',
-      'target' => 'R',
-      'patch_class' => 'NOOP',
-      'patch_method' => 'cs__track_join'
-  }.cs__freeze
-  ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
-
-  # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
-  # Multiple Strings are appended with the #join method. Because that
-  # operation happens in C, we have to do it here rather than rely on the
-  # patch of our String append or concat methods.
-  def cs__track_join separator, ret
-    return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
-
-    with_contrast_scope do
-      shift = 0
-      separator_length = separator.nil? ? 0 : separator.to_s.length
-      each do |obj|
-        if obj # skip nil here
-          ret.cs__copy_from(obj, shift)
-          shift += obj.to_s.length
-        end
-        shift += separator_length
-      end
-      return ret unless ret.cs__tracked?
-
-      ret.cs__properties.cleanup_tags
-      ret.cs__properties.build_event(
-          ARRAY_JOIN_NODE,
-          ret,
-          self,
-          ret,
-          [separator])
-      ret
-    end
-  end
-end
-cs__scoped_require 'cs__assess_array/cs__assess_array'

data/lib/contrast/extensions/ruby_core/assess/assess_extension.rb

@@ -1,143 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/properties'
-cs__scoped_require 'contrast/agent/assess/frozen_properties'
-cs__scoped_require 'contrast/agent/assess/insulator'
-
-module Contrast
-  module CoreExtensions
-    module Assess
-      # This module is responsible for maintaining the data we need to
-      # construct a trace event for the object in which it is included. Rather
-      # than have this code all over the place, any class that wants to use
-      # dataflow features should be sent
-      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
-      module AssessExtension
-        # Lazily build properties object. Only objects that have been tracked
-        # will have the @_cs__properties, but all will respond to the
-        # cs__properties method call. You should only call this method if you
-        # either intend to start tracking an object or you have already checked
-        # cs__tracked? and it is true.
-        def cs__properties
-          # If this object was tracked before being frozen, it'll have
-          # mutable properties we need inside of the insulator @_cs__properties
-          if cs__frozen?
-            if instance_variable_defined?(:@_cs__properties)
-              @_cs__properties.properties
-            else
-              Contrast::Agent::Assess::Insulator.generate_frozen.properties
-            end
-          else
-            @_cs__properties ||= Contrast::Agent::Assess::Insulator.generate
-            @_cs__properties.properties
-          end
-        end
-
-        def cs__properties?
-          instance_variable_defined?(:@_cs__properties)
-        end
-
-        # This is a way to check if we are already tracking an object without
-        # adding tracking to it. If the object already has been tracked we will
-        # return the tracking state of its properties. If the object hasn't
-        # already been tracked we will return false without starting to track
-        # it
-        def cs__tracked?
-          cs__properties? && cs__properties.tracked?
-        end
-
-        def cs__reset_properties
-          return unless cs__properties?
-
-          @_cs__properties = nil
-        end
-
-        # copy tags and info from object to self if object support methods
-        # obj: the object from which to copy tags and events
-        # shift: how far to shift the tags, negative moves left
-        # skip_tags: array of tags to skip copying
-        def cs__copy_from obj, shift = 0, skip_tags = nil
-          return if obj.equal?(self)
-          return unless Contrast::Utils::DuckUtils.quacks_to?(obj,
-                                                              :cs__tracked?)
-          return unless obj.cs__tracked?
-          return if cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
-
-          # This was fun to find...
-          # the clone and dup methods don't apply to instance variables in the
-          # cloned/ duped thing, so the arrays in the properties were the same.
-          # The most infinite of infinite loops ensued.
-          # DO NOT TAKE THIS OUT!
-          cs__reset_properties if obj.cs__properties == cs__properties
-
-          obj.cs__properties.events.each do |event|
-            cs__properties.events << event
-          end
-
-          obj.cs__properties.tag_keys.each do |key|
-            next if skip_tags&.include?(key)
-
-            new_tags = []
-            value = obj.cs__properties.fetch_tag(key)
-            value.each do |tag|
-              new_tags << tag.copy_modified(shift)
-            end
-            existing = cs__properties.fetch_tag(key)
-            if existing
-              existing.concat(new_tags)
-            else
-              cs__properties.set_tags(key, new_tags)
-            end
-          end
-        end
-
-        # Some propagation occurred, but we're not sure what the
-        # exact transformation was. To be safe, we just explode
-        # all the tags from the source to the return.
-        #
-        # If the return already had that tag, the existing tag
-        # range is recycled to save us an object.
-        def cs__splat_tags ret, source = self
-          return unless Contrast::Utils::DuckUtils.quacks_to?(
-              ret,
-              :cs__tracked?)
-
-          splat_source = Contrast::Utils::DuckUtils.quacks_to?(
-              source,
-              :cs__tracked?)
-          splat_source &&= source.cs__tracked?
-          if splat_source
-            length = Contrast::Utils::StringUtils.ret_length(ret)
-            source.cs__properties.tag_keys.each do |key|
-              existing = ret.cs__properties.fetch_tag(key)
-              # if the tag already exists, drop all but the first range
-              # then change that range to cover the entire return
-              if existing
-                existing.drop(existing.length - 1)
-                range = existing[0]
-                range.repurpose(0, length)
-              else
-                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
-                ret.cs__properties.add_tag(key, span)
-              end
-            end
-          end
-          return unless ret.cs__tracked?
-
-          length ||= Contrast::Utils::StringUtils.ret_length(ret)
-          ret.cs__properties.tag_keys.each do |key|
-            next unless key
-
-            existing = ret.cs__properties.fetch_tag(key)
-            next unless existing
-
-            existing.each do |range|
-              range.update_end(length) if range.end_idx > length
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/assess/basic_object.rb

@@ -1,15 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/extensions/ruby_core/eval_trigger'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-
-# Our patch into the BasicObject class, allowing us to track calls to the eval
-# method
-class BasicObject
-  class << self
-    include Contrast::CoreExtensions::Assess::EvalTrigger
-  end
-end
-
-cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'