contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/components/sampling.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/base'
@@ -14,7 +14,7 @@ module Contrast
         DEFAULT_SAMPLING_WINDOW_MS          = 180_000
       end
 
-      module ClassMethods #:nodoc:
+      module ClassMethods # :nodoc:
         include Contrast::Components::ComponentBase
         include Constants
 
@@ -90,7 +90,7 @@ module Contrast
         end
       end
 
-      module InstanceMethods #:nodoc:
+      module InstanceMethods # :nodoc:
         include Contrast::Components::ComponentBase
         include Constants
         include ClassMethods

data/lib/contrast/components/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fiber'

data/lib/contrast/components/settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/settings.pb'
@@ -36,19 +36,32 @@ module Contrast
           @application_state.exclusion_matchers.select(&:code?)
         end
 
-        # @param server_features [Contrast::Api::Settings::ServerFeatures]
-        def update_from_server_features server_features
-          @protect_state.enabled = server_features.protect_enabled?
-          @assess_state.enabled = server_features.assess_enabled?
-          @assess_state.sampling_settings = server_features.assess.sampling
+        # @param features [Contrast::Api::Settings::ServerFeatures, Contrast::Agent::Reporting::Response]
+        def update_from_server_features features
+          if features&.class == Contrast::Agent::Reporting::Response
+            @protect_state.enabled = features.server_features.protect.enabled?
+            @assess_state.enabled = features.server_features.assess.enabled?
+            @assess_state.sampling_settings = features.server_features.assess.sampling
+          else
+            @protect_state.enabled = features.protect_enabled?
+            @assess_state.enabled = features.assess_enabled?
+            @assess_state.sampling_settings = features.assess.sampling
+          end
         end
 
-        # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
-        def update_from_application_settings application_settings
-          new_vals = application_settings.application_state_translation
-          @application_state.modes_by_id = new_vals[:modes_by_id]
-          @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
-          @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
+        # @param features [Contrast::Api::Settings::ApplicationSettings, Contrast::Agent::Reporting::Response]
+        def update_from_application_settings features
+          if features&.class == Contrast::Agent::Reporting::Response
+            @application_state.modes_by_id = features.application_settings.protect.protection_rules_to_settings_hash
+            # TODO: RUBY-1438 this needs to be translated
+            # @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+            @assess_state.disabled_assess_rules = features.application_settings.assess.disabled_rules
+          else
+            new_vals = features.application_state_translation
+            @application_state.modes_by_id = new_vals[:modes_by_id]
+            @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+            @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
+          end
         end
 
         # Wipe state to zero.

data/lib/contrast/config/agent_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,7 +8,7 @@ module Contrast
     class AgentConfiguration < BaseConfiguration
       KEYS = {
           enable: EMPTY_VALUE,
-          start_bundled_service: Contrast::Config::DefaultValue.new(true),
+          start_bundled_service: true,
           omit_body: EMPTY_VALUE,
           service: Contrast::Config::ServiceConfiguration,
           logger: Contrast::Config::LoggerConfiguration,

data/lib/contrast/config/api_configuration.rb

@@ -1,7 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/config/default_value'
+require 'contrast/config/api_proxy_configuration'
+require 'contrast/config/certification_configuration'
+require 'contrast/config/request_audit_configuration'
 
 module Contrast
   module Config
@@ -10,9 +12,12 @@ module Contrast
       URL = 'https://app.contrastsecurity.com/Contrast'
       KEYS = {
           api_key: EMPTY_VALUE,
-          url: Contrast::Config::DefaultValue.new(URL),
+          url: URL,
           user_name: EMPTY_VALUE,
-          service_key: EMPTY_VALUE
+          service_key: EMPTY_VALUE,
+          proxy: Contrast::Config::ApiProxyConfiguration,
+          request_audit: Contrast::Config::RequestAuditConfiguration,
+          certificate: Contrast::Config::CertificationConfiguration
       }.cs__freeze
       def initialize hsh
         super(hsh, KEYS)

data/lib/contrast/config/api_proxy_configuration.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Api Proxy keys configuration
+    class ApiProxyConfiguration < BaseConfiguration
+      KEYS = { enable: false, url: EMPTY_VALUE }.cs__freeze
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/application_configuration.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/config/default_value'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -18,8 +17,8 @@ module Contrast
           tags: EMPTY_VALUE,
           code: EMPTY_VALUE,
           metadata: EMPTY_VALUE,
-          session_id: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::EMPTY_STRING),
-          session_metadata: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::EMPTY_STRING)
+          session_id: Contrast::Utils::ObjectShare::EMPTY_STRING,
+          session_metadata: Contrast::Utils::ObjectShare::EMPTY_STRING
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/assess_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -9,11 +9,11 @@ module Contrast
       KEYS = {
           tags: EMPTY_VALUE,
           enable: EMPTY_VALUE,
-          enable_scan_response: Contrast::Config::DefaultValue.new('true'),
-          enable_dynamic_sources: Contrast::Config::DefaultValue.new('true'),
+          enable_scan_response: true,
+          enable_dynamic_sources: true,
           sampling: Contrast::Config::SamplingConfiguration,
           rules: Contrast::Config::AssessRulesConfiguration,
-          stacktraces: Contrast::Config::DefaultValue.new('ALL')
+          stacktraces: 'ALL'
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/assess_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/base_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'forwardable'
@@ -12,17 +12,18 @@ module Contrast
     class BaseConfiguration
       extend Forwardable
 
-      STRING_BOOLEANS = %w[false true].cs__freeze
+      attr_reader :configuration_map
 
-      attr_reader :map
-
-      alias_method :to_hash, :map
-      def_delegators :@map, :empty?, :key?, :delete, :fetch, :[], :[]=, :each, :each_pair, :each_key, :each_value
+      alias_method :to_hash, :configuration_map
+      def_delegators :@configuration_map, :empty?, :key?, :delete, :fetch,
+                     :[], :[]=, :each, :each_pair, :each_key, :each_value
 
       EMPTY_VALUE = :EMPTY_VALUE
 
       def initialize hsh = {}, keys = {}
-        @map = {}
+        # holds configuration key value pairs
+        # each configuration class can contain nested BaseConfigurations
+        @configuration_map = {}
         traverse_config(hsh, keys)
       end
 
@@ -39,7 +40,7 @@ module Contrast
       end
 
       def nil?
-        @map.empty?
+        @configuration_map.empty?
       end
 
       private
@@ -69,25 +70,13 @@ module Contrast
       end
 
       def assign_config_value str_key, spec_value, user_provided_value
-        @map[str_key] = if spec_value.is_a?(Class) && spec_value <= Contrast::Config::BaseConfiguration
-                          spec_value.new(user_provided_value)
-                        elsif spec_value.is_a?(Contrast::Config::DefaultValue) && user_provided_value == EMPTY_VALUE
-                          spec_value.value
-                        elsif user_provided_value.cs__is_a?(String)
-                          value = user_provided_value.downcase
-                          # converts string values to 'true' => true or 'false' => false
-                          case value
-                          when STRING_BOOLEANS[1]
-                            true
-                          when STRING_BOOLEANS[0]
-                            false
-                          else
-                            # returns non boolean string values
-                            user_provided_value
-                          end
-                        else
-                          user_provided_value
-                        end
+        @configuration_map[str_key] = if spec_value.is_a?(Class) && spec_value <= Contrast::Config::BaseConfiguration
+                                        spec_value.new(user_provided_value)
+                                      elsif user_provided_value == EMPTY_VALUE
+                                        spec_value
+                                      else
+                                        user_provided_value
+                                      end
       end
 
       def value_from_key_config key, config_hash
@@ -99,13 +88,13 @@ module Contrast
 
       def define_getter str_key
         define_singleton_method str_key.to_sym do
-          @map[str_key] == EMPTY_VALUE ? nil : @map[str_key]
+          @configuration_map[str_key] == EMPTY_VALUE ? nil : @configuration_map[str_key]
         end
       end
 
       def define_setter str_key
         define_singleton_method "#{ str_key }=".to_sym do |new_value|
-          @map[str_key] = new_value
+          @configuration_map[str_key] = new_value
         end
       end
     end

data/lib/contrast/config/certification_configuration.rb

@@ -0,0 +1,15 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Certificate Configuration
+    class CertificationConfiguration < BaseConfiguration
+      KEYS = { enable: false, ca_file: EMPTY_VALUE, cert_file: EMPTY_VALUE, key_file: EMPTY_VALUE }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/env_variables.rb

@@ -1,24 +1,17 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Config
     # This module is holding all the Env Variables that we could use through the agent lifecycle
     module EnvVariables
-      ENV_VARIABLES = {
-          telemetry_opt_outs: ENV['CONTRAST_AGENT_TELEMETRY_OPTOUT'].to_s || Contrast::Config::DefaultValue.new('false')
-      }.cs__freeze
+      ENV_VARIABLES = { telemetry_opt_outs: ENV['CONTRAST_AGENT_TELEMETRY_OPTOUT'].to_s || false }.cs__freeze
 
       def return_value key
         return unless ENV_VARIABLES.key?(key.to_sym)
 
         sym_key = key.downcase.to_sym
-        return_val = ENV_VARIABLES[sym_key]
-        if return_val.is_a?(Contrast::Config::DefaultValue)
-          return_val.value
-        else
-          return_val
-        end
+        ENV_VARIABLES[sym_key]
       end
     end
   end

data/lib/contrast/config/exception_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/heap_dump_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,17 +8,17 @@ module Contrast
     class HeapDumpConfiguration < BaseConfiguration
       KEYS = {
           enable:                                                                   # should dumps be taken
-            Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE),
+            Contrast::Utils::ObjectShare::FALSE,
           path:                                                                     # dir to which dumps should be
-            Contrast::Config::DefaultValue.new('contrast_heap_dumps'), #   saved
+            'contrast_heap_dumps', # saved
           delay_ms:                                                                 # time, in ms, after initialization
-            Contrast::Config::DefaultValue.new(10_000), #   to delay before taking dump
+            10_000, # to delay before taking dump
           window_ms:                                                                # ms between each dump
-            Contrast::Config::DefaultValue.new(10_000), #
+            10_000, #
           count:                                                                    # number of dumps to take
-            Contrast::Config::DefaultValue.new(5), #
+            5, #
           clean:                                                                    # remove temporary objects or not
-            Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE)  #
+            Contrast::Utils::ObjectShare::FALSE #
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/inventory_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -6,11 +6,7 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # inventory functionality of the Agent.
     class InventoryConfiguration < BaseConfiguration
-      KEYS = {
-          enable: Contrast::Config::DefaultValue.new(true),
-          analyze_libraries: Contrast::Config::DefaultValue.new(true),
-          tags: EMPTY_VALUE
-      }.cs__freeze
+      KEYS = { enable: true, analyze_libraries: true, tags: EMPTY_VALUE }.cs__freeze
 
       def initialize hsh
         super(hsh, KEYS)

data/lib/contrast/config/logger_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -12,7 +12,7 @@ module Contrast
           enable: EMPTY_VALUE,
           mode: EMPTY_VALUE,
           disable_system_commands: EMPTY_VALUE,
-          detect_custom_code_accessing_system_files: Contrast::Config::DefaultValue.new('true')
+          detect_custom_code_accessing_system_files: true
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/request_audit_configuration.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # This class holds the Common Settings for the
+    # hidden functionality of the TS
+    class RequestAuditConfiguration < BaseConfiguration
+      DEFAULT_PATH = './messages'
+
+      KEYS = { enable: false, requests: false, responses: false, path: DEFAULT_PATH }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/root_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/ruby_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -23,17 +23,20 @@ module Contrast
       DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
 
       KEYS = {
-          disabled_agent_rake_tasks: Contrast::Config::DefaultValue.new(DISABLED_RAKE_TASK_LIST),
+          disabled_agent_rake_tasks: DISABLED_RAKE_TASK_LIST,
           exceptions: Contrast::Config::ExceptionConfiguration,
           # controls whether or not we patch interpolation, either by rewrite or by funchook
-          interpolate: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          interpolate: Contrast::Utils::ObjectShare::TRUE,
           # controls whether or not we patch the rb_yield block to track split propagation
-          propagate_yield: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          propagate_yield: Contrast::Utils::ObjectShare::TRUE,
           # control whether or not we run file scanning rules on require
-          require_scan: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          require_scan: Contrast::Utils::ObjectShare::TRUE,
           # controls whether or not we track frozen Strings by replacing them
-          track_frozen_sources: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          uninstrument_namespace: Contrast::Config::DefaultValue.new(DEFAULT_UNINSTRUMENTED_NAMESPACES)
+          track_frozen_sources: Contrast::Utils::ObjectShare::TRUE,
+          # controls tracking outside of request
+          non_request_tracking: Contrast::Utils::ObjectShare::FALSE,
+          uninstrument_namespace: DEFAULT_UNINSTRUMENTED_NAMESPACES
+
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/sampling_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/server_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/service_configuration.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/config/default_value'
 require 'contrast/config/logger_configuration'
 
 module Contrast
@@ -20,7 +19,7 @@ module Contrast
           port: EMPTY_VALUE,
           socket: EMPTY_VALUE,
           logger: Contrast::Config::LoggerConfiguration,
-          bypass: Contrast::Config::DefaultValue.new(false)
+          bypass: false
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -11,7 +11,6 @@ module Contrast
 end
 
 require 'contrast/config/base_configuration'
-require 'contrast/config/default_value'
 
 require 'contrast/config/logger_configuration'
 

data/lib/contrast/configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'
@@ -87,7 +87,7 @@ module Contrast
     def yaml_to_hash path
       if path && File.readable?(path)
         begin
-          yaml = IO.read(path)
+          yaml = File.read(path)
           yaml = ERB.new(yaml).result if defined?(ERB)
           return YAML.safe_load(yaml)
         rescue Psych::Exception => e
@@ -205,7 +205,6 @@ module Contrast
     # in the thing to convert and setting them in the given hash. For now, this
     # logs every possible key, whether set or not. If we want to change that
     # behavior, we can skip adding keys to the hash if the value is nil, blank,
-    # or Contrast::Config::DefaultValue depending on desired behavior
     #
     # @param hash [Hash] the hash to populate
     # @param convert [Contrast::Config::BaseConfiguration, Object] the level of

data/lib/contrast/extension/assess/array.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch'
 require 'contrast/agent/patching/policy/patcher'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -42,19 +43,18 @@ module Contrast
               shift = 0
               separator_length = separator.nil? ? 0 : separator.to_s.length
               parent_events = []
-              ary.each do |obj|
-                if obj # skip nil here
-                  properties.copy_from(obj, ret, shift)
-                  shift += obj.to_s.length
-                  parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
-                  parent_events << parent_event if parent_event
-                end
+              ary.compact.each do |obj|
+                properties.copy_from(obj, ret, shift)
+                shift += obj.to_s.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
+                parent_events << parent_event if parent_event
                 shift += separator_length
               end
               return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
               properties.cleanup_tags
-              properties.build_event(ARRAY_JOIN_NODE, ret, ary, ret, [separator])
+              event_data = Contrast::Agent::Assess::Events::EventData.new ARRAY_JOIN_NODE, ret, ary, ret, [separator]
+              properties.build_event(event_data)
               properties.event.instance_variable_set(:@_parent_events, parent_events)
               ret
             end

data/lib/contrast/extension/assess/erb.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This module is used to track propagation through ERB template rendering
@@ -13,6 +13,20 @@ module ERBPropagator
 
       erb_pre_result = preshift.object.src
       parent_events = []
+      binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
+      properties.build_event(Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args), 1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
+      ret
+    end
+
+    private
+
+    def binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
         next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
@@ -25,10 +39,6 @@ module ERBPropagator
         parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
         parent_events << parent_event if parent_event
       end
-      properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
-      properties.event.instance_variable_set(:@_parent_events, parent_events)
-
-      ret
     end
   end
 end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -23,6 +23,8 @@ module Contrast
           end
 
           def apply_trigger obj, source, ret, clazz, method
+            return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
             # Since we know this is the source of the trigger, we can do some
             # optimization here and return when it is not tracked
             return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)