contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -8,6 +8,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/propagation_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -15,6 +16,7 @@ module Contrast
       module Policy
         # This class is responsible for the continuation of traces. A Propagator is any method that transforms an
         # untrusted value. In general, these methods work on the String class or a holder of Strings.
+        # rubocop:disable Metrics/ModuleLength
         module PropagationMethod
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::PropagationMethodUtils
@@ -37,7 +39,8 @@ module Contrast
               propagation_node = method_policy.propagation_node
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
+              propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, propagation_data, block)
             end
 
             # I lied above. We had to figure out what the target of the propagation was. Now that we know, we'll
@@ -49,27 +52,33 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
             # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
             #   original function if not nil
-            def apply_propagator propagation_node, preshift, target, object, ret, args, block
+            def apply_propagator propagation_node, preshift, target, propagation_data, block
               return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
+                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node,
+                                                                                     preshift,
+                                                                                     propagation_data.ret)
               elsif propagation_node.action == CUSTOM_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
+                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node,
+                                                                              preshift,
+                                                                              propagation_data.ret,
+                                                                              block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, propagation_data, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_enumerable_propagation(propagation_node, preshift, target, propagation_data, block)
               else
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_cs_properties_propagation(propagation_node, preshift, target, propagation_data, block)
               end
             rescue StandardError => e
               logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
@@ -90,6 +99,10 @@ module Contrast
               end
             end
 
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
             # If this patcher has tags, remove them from the entire target
             #
             # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
@@ -113,6 +126,7 @@ module Contrast
             # @return [Boolean]
             def propagation_possible? propagation_node, target
               return false unless propagation_node && valid_target?(target, propagation_node)
+              return false unless context_available? || Contrast::ASSESS.non_request_tracking?
               return false unless valid_length?(target, propagation_node.action)
 
               true
@@ -135,14 +149,15 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_hash_propagation propagation_node, preshift, target, propagation_data, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, key, propagation_data, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -153,15 +168,16 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_enumerable_propagation propagation_node, preshift, target, propagation_data, block
               target.each do |value|
                 next if target == value
 
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -172,11 +188,12 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param _block [Block] the Block passed to the original method
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
+            def handle_cs_properties_propagation propagation_node, preshift, target, propagation_data, _block
               return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
               return unless (propagation_class = find_propagation_class(propagation_node))
@@ -184,7 +201,7 @@ module Contrast
               restore_frozen_state = false
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless can_handle_frozen?(propagation_node)
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(propagation_data.ret))
 
                 restore_frozen_state = true
                 ret = dup
@@ -195,6 +212,10 @@ module Contrast
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
               propagation_class.propagate(propagation_node, preshift, target)
+              update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
+            end
+
+            def update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
               # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
               apply_tags(propagation_node, target)
               # Even though we skipped propagating tags from the source if they were included in untags, the target may
@@ -204,7 +225,12 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.add_properties(propagation_node.properties)
-              properties.build_event(propagation_node, target, object, ret, args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                          target,
+                                                                          propagation_data.object,
+                                                                          ret,
+                                                                          propagation_data.args)
+              properties.build_event(event_data)
               logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
               restore_frozen_state ? ret : nil
             end
@@ -235,6 +261,7 @@ module Contrast
             end
           end
         end
+        # rubocop:enable Metrics/ModuleLength
       end
     end
   end

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy_node'

data/lib/contrast/agent/assess/policy/propagator/append.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/center.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,7 +24,7 @@ module Contrast
                 end
 
                 # find original in the target, copy tags to the new position in target
-                original_start_index = target[0..target.length / 2 + 1].rindex(source1)
+                original_start_index = target[0..(target.length / 2) + 1].rindex(source1)
                 original_start_index ||= 1
                 properties.copy_from(source1, target, original_start_index, propagation_node.untags)
 

data/lib/contrast/agent/assess/policy/propagator/custom.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -47,7 +47,11 @@ module Contrast
 
                   # TODO: RUBY-540 handle sanitization, handle nested objects
                   Contrast::Agent::Assess::Policy::PropagationMethod.apply_tags(propagation_node, value)
-                  properties.build_event(propagation_node, value, preshift.object, target, preshift.args)
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              value, preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  properties.build_event(event_data)
                   next unless tracked_value?(value)
 
                   tainted_columns[key] = properties

data/lib/contrast/agent/assess/policy/propagator/insert.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -25,7 +25,10 @@ module Contrast
                                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                                     preshift.object
                                   else
-                                    preshift.args[int]
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
                                   end
 
                 # Find the first difference between the source to which

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -96,8 +96,12 @@ module Contrast
                 applicable_tags.each do |tag_name, tag_ranges|
                   return_properties.set_tags(tag_name, tag_ranges)
                 end
-                return_properties.build_event(propagation_node, return_value, preshift.object, return_value,
-                                              preshift.args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                            return_value,
+                                                                            preshift.object,
+                                                                            return_value,
+                                                                            preshift.args)
+                return_properties.build_event(event_data)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/next.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/prepend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/replace.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/reverse.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/select.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -26,7 +26,8 @@ module Contrast
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, ret, source, ret, args)
+                properties.build_event(event_data)
 
                 range = determine_select_range(source, args)
                 return unless range

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
@@ -6,6 +6,8 @@ require 'contrast/components/agent'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/utils/thread_tracker'
+require 'contrast/utils/assess/split_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -17,6 +19,7 @@ module Contrast
           class Split < Contrast::Agent::Assess::Policy::Propagator::Base
             extend Contrast::Components::Scope::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
+            extend Contrast::Utils::Assess::SplitUtils
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
 
@@ -38,24 +41,7 @@ module Contrast
                 source = find_source(propagation_node.sources[0], preshift)
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
 
-                separator_length = find_separator_length(propagation_node, preshift)
-
-                current_index = 0
-                target.each do |target_elem|
-                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
-
-                  # Get tags for element from source by element range.
-                  range = current_index...(current_index + target_elem.length)
-                  tags = source_properties.tags_at_range(range)
-
-                  # Set element properties accordingly.
-                  elem_properties.clear_tags
-                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
-                  elem_properties.build_event(propagation_node, target_elem, preshift.object, target, preshift.args, 0)
-                  elem_properties.add_properties(propagation_node.properties)
-
-                  current_index = range.end + separator_length
-                end
+                update_element_properties propagation_node, target, preshift, source_properties
                 nil
               end
 
@@ -160,12 +146,28 @@ module Contrast
                 split_value[split_scope_depth] = target # rubocop:disable Lint/UselessSetterCall
               end
 
-              # Quick hook to the String#split propagation node in our Assess policy
-              #
-              # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
-              def split_node
-                @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                  node.class_name == 'String' && node.method_name == :split && node.instance_method?
+              def update_element_properties propagation_node, target, preshift, source_properties
+                separator_length = find_separator_length(propagation_node, preshift)
+                current_index = 0
+                target.each do |target_elem|
+                  next unless (elem_properties = Contrast::Agent::Assess::Tracker.properties!(target_elem))
+
+                  # Get tags for element from source by element range.
+                  range = current_index...(current_index + target_elem.length)
+                  tags = source_properties.tags_at_range(range)
+
+                  # Set element properties accordingly.
+                  elem_properties.clear_tags
+                  tags.each_pair { |key, value| elem_properties.set_tags(key, value) }
+                  event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                              target_elem,
+                                                                              preshift.object,
+                                                                              target,
+                                                                              preshift.args)
+                  elem_properties.build_event(event_data, 0)
+                  elem_properties.add_properties(propagation_node.properties)
+
+                  current_index = range.end + separator_length
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,8 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/logger'
-require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/policy/propagator/substitution_utils'
 
 module Contrast
   module Agent
@@ -17,9 +16,7 @@ module Contrast
           class Substitution
             include Contrast::Components::Logger::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
-
-            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
-            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+            extend Contrast::Agent::Assess::Policy::Propagator::SubstitutionUtils
 
             class << self
               # gsub is hard. there are four versions of this method
@@ -38,157 +35,6 @@ module Contrast
               def sub_tagger patcher, preshift, ret, block
                 substitution_tagger(patcher, preshift, ret, !block.nil?, false)
               end
-
-              private
-
-              def substitution_tagger patcher, preshift, ret, block, global = true
-                return ret unless ret
-
-                begin
-                  source = preshift.object
-                  self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
-                  args = preshift.args[1]
-                  incoming_tracked = args && determine_tracked(args)
-                  return ret unless self_tracked || incoming_tracked
-
-                  parent_events = []
-                  if block
-                    block_sub(self_tracked, source, ret)
-                  elsif args.is_a?(String)
-                    string_sub(parent_events, self_tracked, preshift, ret, args, incoming_tracked, global)
-                  elsif args.is_a?(Hash)
-                    hash_sub(self_tracked, source, ret)
-                  else # Enumerator, only for gsub
-                    pattern_gsub(parent_events, preshift, ret)
-                  end
-
-                  if self_tracked
-                    source_properties = Contrast::Agent::Assess::Tracker.properties(source)
-                    parent_event = source_properties&.event
-                    parent_events.prepend(parent_event) if parent_event
-                  end
-                  string_build_event(parent_events, patcher, preshift, ret)
-                rescue StandardError => e
-                  logger.error('Unable to apply gsub propagator', e)
-                end
-                ret
-              end
-
-              def determine_tracked args
-                # if there's no arg, it can't be tracked
-                return false unless args
-
-                # if it's a string, just ask if it's tracked
-                case args
-                when String
-                  Contrast::Agent::Assess::Tracker.tracked?(args)
-                  # if it's a hash, ask if it has a tracked string
-                when Hash
-                  args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
-                  # this should never happen
-                else
-                  false
-                end
-              end
-
-              def string_sub parent_events, self_tracked, preshift, ret, incoming, incoming_tracked, global
-                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-                incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
-                parent_events << incoming_properties&.event if incoming_properties&.event
-
-                source = preshift.object
-
-                # We can't efficiently find the places that things were
-                # copied from regexp / captures. Trading accuracy for
-                # performance
-                if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
-                  properties.splat_from(source, ret) if self_tracked
-                  return
-                end
-
-                # if it's just a straight insert, that we can do
-                # Copy the tags from us to the return
-                ranges = find_string_sub_insert(properties, preshift, incoming, ret, global)
-
-                properties.delete_tags_at_ranges(ranges)
-                properties.shift_tags(ranges)
-                return unless incoming_tracked
-                return unless incoming_properties
-
-                tags = incoming_properties.tag_keys
-                ranges.each do |range|
-                  tags.each do |tag|
-                    properties.add_tag(tag, range)
-                  end
-                end
-              end
-
-              # Find the points at which the new String was placed into the original
-              #
-              # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
-              # @param preshift [Contrast::Agent::Assess::PreShift] the capture of the state of the code just prior to
-              #   the invocation of the patched method
-              # @param incoming [String] the new String going into the substitution
-              # @param ret [String] the result of the substitution
-              # @param global [Boolean] if this was a global or single substitution
-              # @return [Array<Range>] the Ranges where substitution occurred
-              def find_string_sub_insert properties, preshift, incoming, ret, global
-                pattern = preshift.args[0]
-                source = preshift.object
-
-                properties.copy_from(source, ret)
-                # Figure out where inserts occurred
-                last_idx = 0
-                ranges = []
-                # For each insert, move the tag ranges
-                while last_idx
-                  idx = source.index(pattern, last_idx)
-                  break unless idx
-
-                  last_idx = idx ? idx + 1 : nil
-                  start_index = idx
-                  end_index = idx + incoming.length
-                  ranges << (start_index...end_index)
-                  break unless global
-                end
-                ranges
-              end
-
-              def block_sub self_tracked, source, ret
-                return unless self_tracked
-
-                properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-                properties&.splat_from(source, ret)
-              end
-
-              def hash_sub self_tracked, source, ret
-                return unless self_tracked
-
-                properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-                properties&.splat_from(source, ret)
-              end
-
-              def pattern_gsub parent_events, preshift, ret
-                source = preshift.object
-                return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
-                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-                source_properties.tag_keys.each do |key|
-                  properties.add_tag(key, 0...1)
-                end
-                parent_event = source_properties.event
-                parent_events << parent_event if parent_event
-              end
-
-              def string_build_event parent_events, patcher, preshift, ret
-                return unless Contrast::Agent::Assess::Tracker.tracked?(ret)
-
-                properties = Contrast::Agent::Assess::Tracker.properties(ret)
-                args = preshift.args
-                properties.build_event(patcher, ret, preshift.object, ret, args, 2)
-                properties.event.instance_variable_set(:@_parent_events, parent_events)
-              end
             end
           end
         end