contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/framework/rails/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'
@@ -10,7 +10,7 @@ module Contrast
   module Framework
     module Rails
       # Used when Rails is present to define framework specific behavior
-      class Support
+      class Support # rubocop:disable Metrics/ClassLength
         extend Contrast::Framework::BaseSupport
         extend Contrast::Framework::Rails::Patch::Support
         include Contrast::Components::Logger::InstanceMethods
@@ -78,6 +78,38 @@ module Contrast
             nil
           end
 
+          # Find the current route, based on the provided Request wrapper
+          #
+          # @param request[Contrast::Agent::Request]
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request
+            return unless ::Rails.cs__respond_to?(:application)
+
+            # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
+            match, _params, route, path = get_full_route(request.rack_request)
+            unless route
+              logger.warn('Unable to determine the current route of this request')
+              return
+            end
+
+            original_url = request.rack_request.path_info
+            mounted_app = route&.app&.app
+            # Route is either the final rails route, or a router that points to a Sinatra controller.
+            if mounted_app && Contrast::Framework::Sinatra::Support.sinatra_controller?(mounted_app)
+              return mounted_new_sinatra_route(request, match, path, route, original_url)
+            end
+            if mounted_app && Contrast::Framework::Grape::Support.grape_controller?(mounted_app)
+              return mounted_new_grape_route(request, match, path, route, original_url)
+            end
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rails_data route, original_url
+          rescue StandardError => e
+            logger.warn('Unable to determine the current route of this request', e)
+            nil
+          end
+
           # Copy a request for modification.
           #
           # @param env [::ActionDispatch::Request] original env.
@@ -155,6 +187,12 @@ module Contrast
             Contrast::Framework::Sinatra::Support.current_route(new_req, route.app.app, original_url)
           end
 
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_sinatra_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Sinatra::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
           # @param request[Contrast::Agent::Request]
           # @param match [ActionDispatch::Journey::Path::Pattern::MatchData]
           # @param path [Array<String>] the path of this request, built out from each nested
@@ -167,6 +205,12 @@ module Contrast
             Contrast::Framework::Grape::Support.current_route(new_req, route.app.app, original_url)
           end
 
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_grape_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Grape::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
           # Create a request copied from current request, but with the base path removed from path_info, as that's
           # the mount.
           #

data/lib/contrast/framework/sinatra/support.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'
+require 'contrast/agent/reporting/report'
 
 module Contrast
   module Framework
@@ -82,6 +83,27 @@ module Contrast
             Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(final_controller, method, route_pattern, full_route)
           end
 
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Sinatra::Base] optionally use this controller instead of global ::Sinatra::Base.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Sinatra::Base, full_route = nil
+            return unless sinatra_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find route match--checking superclasses if necessary.
+            final_controller, route_pattern = _route_recurse(controller, method, _cleaned_route(request))
+            return unless final_controller
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data final_controller, method, route_pattern, full_route
+          end
+
           # Search object space for sinatra controllers--any class that subclasses ::Sinatra::Base.
           #
           # @return [Array<::Sinatra::Base>] sinatra controlelrs
@@ -100,13 +122,14 @@ module Contrast
           #
           # @param controller [Sinatra::Base, #routes] a Sinatra application.
           # @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
-          # @param method [String] the relative route passed from Rack.
+          # @param route [String] the relative route passed from Rack.
           # @return [Array[Sinatra::Base, Mustermann::Sinatra], nil] Either the controller that
           # will handle the route along with the route pattern or nil if no match.
           def _route_recurse controller, method, route
             return if controller.nil? || controller.cs__class == NilClass
 
-            route_patterns = controller.routes.fetch(method) { [] }.map(&:first)
+            route_patterns = controller.routes.fetch(method) { [] }.
+                map(&:first)
             route_pattern = route_patterns&.find do |matcher|
               matcher.params(route) # ::Mustermann::Sinatra match.
             end

data/lib/contrast/funchook/funchook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -17,26 +17,29 @@ module Funchook
 
   AGENT_ROOT = File.join(__dir__, '..', '..', '..')
 
-  def self.resolve_path!
-    actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
-      load_path = absolute_path(potential_funchook_path)
-      File.exist?(load_path)
+  class << self
+    def resolve_path!
+      actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+        load_path = absolute_path(potential_funchook_path)
+        File.exist?(load_path)
+      end
+
+      if actual_path_segments.nil?
+        logger.warn('Unable to find funchook')
+      else
+        @path = absolute_path(actual_path_segments)
+        logger.info('Funchook found', path: @path)
+      end
+      @path
     end
 
-    if actual_path_segments.nil?
-      logger.warn('Unable to find funchook')
-    else
-      @path = absolute_path(actual_path_segments)
-      logger.info('Funchook found', path: @path)
+    def absolute_path path_array
+      File.absolute_path(File.join(AGENT_ROOT, *path_array))
     end
-    @path
-  end
-
-  def self.absolute_path path_array
-    File.absolute_path(File.join(AGENT_ROOT, *path_array))
-  end
 
-  def self.available?
-    @_available ||= !!resolve_path!
+    def available?
+      @_available = !!resolve_path! if @_available.nil?
+      @_available
+    end
   end
 end

data/lib/contrast/logger/application.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/exclude_key'

data/lib/contrast/logger/format.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ougai'

data/lib/contrast/logger/log.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'logger'
@@ -11,6 +11,7 @@ require 'contrast/logger/format'
 require 'contrast/logger/request'
 require 'contrast/logger/time'
 require 'contrast/components/config'
+require 'contrast/utils/log_utils'
 
 module Contrast
   # This module allows us to dynamically weave timing into our code, so that only when the time is actually needed do
@@ -26,9 +27,9 @@ module Contrast
     # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
     # logger set to TRACE.
     #
-    # @params: clazz [Class] the class of the method to time.
-    # @params: method [Symbol] the method to time.
-    # @params: method [String] optional custom logging message.
+    # @param: clazz [Class] the class of the method to time.
+    # @param: method [Symbol] the method to time.
+    # @param: method [String] optional custom logging message.
     def add_method_to_trace_timing clazz, method, msg = nil
       methods_to_time.append(METHOD_INFO.new(clazz, method, msg, false))
       enable_trace_timing if logger.level == ::Ougai::Logging::TRACE
@@ -37,9 +38,9 @@ module Contrast
     # Add a method to the list of methods to be trace timed if logger set to TRACE. Enables trace timing after if
     # logger set to TRACE.
     #
-    # @params: method_spec [METHOD_INFO] specs about the method to be timed.
-    # @params: class_method [Boolean] whether this is or isn't a class/module method.
-    def trace_time_class_method meth_spec, class_method
+    # @param: meth_spec [METHOD_INFO] specs about the method to be timed.
+    # @param: class_method [Boolean] whether this is or isn't a class/module method.
+    def trace_time_class_method meth_spec, class_method # rubocop:disable Metrics/AbcSize
       untimed_func_symbol = "untimed_#{ meth_spec.method_name }".to_sym
       send_to = class_method ? meth_spec.clazz.cs__singleton_class : meth_spec.clazz
       meth_spec.clazz.class_eval do
@@ -105,12 +106,7 @@ module Contrast
     class Log
       include Singleton
       include ::Contrast::TraceTiming
-
-      DEFAULT_NAME     = 'contrast.log'
-      DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
-      VALID_LEVELS     = ::Ougai::Logging::Severity::SEV_LABEL
-      STDOUT_STR       = 'STDOUT'
-      STDERR_STR       = 'STDERR'
+      include Contrast::Utils::LogUtils
 
       attr_reader :previous_path, :previous_level
 
@@ -167,97 +163,6 @@ module Contrast
         dir_name = File.dirname(File.absolute_path(path))
         File.writable?(dir_name)
       end
-
-      private
-
-      def build path: STDOUT_STR, level_const: DEFAULT_LEVEL
-        logger = case path
-                 when STDOUT_STR, STDERR_STR
-                   ::Ougai::Logger.new(Object.cs__const_get(path))
-                 else
-                   ::Ougai::Logger.new(path)
-                 end
-        add_contrast_loggers(logger)
-        logger.progname = 'Contrast Agent'
-        logger.level = level_const
-        logger.formatter = Contrast::Logger::Format.new
-        logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
-        logger
-      end
-
-      def add_contrast_loggers logger
-        logger.extend(Contrast::Logger::Application)
-        logger.extend(Contrast::Logger::Request)
-        logger.extend(Contrast::Logger::Time)
-      end
-
-      # Determine the valid path to which to log, given the precedence of config > settings > default.
-      #
-      # @param log_file [String, nil] the file to which to log as provided by the settings retrieved from the
-      #   TeamServer.
-      # @return [String] the path to which to log or STDOUT / STDERR if one of those values provided.
-      def find_valid_path log_file
-        config = ::Contrast::CONFIG.root.agent.logger
-        config_path = config&.path&.length.to_i.positive? ? config.path : nil
-        valid_path(config_path || log_file)
-      end
-
-      def valid_path path
-        path = path.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : path
-        return path if path == STDOUT_STR
-        return path if path == STDERR_STR
-
-        path = DEFAULT_NAME if path.empty?
-        if write_permission?(path)
-          path
-        elsif write_permission?(DEFAULT_NAME)
-          # Log once when the path is invalid. We'll change to this path, so no
-          # need to log again.
-          if previous_path != DEFAULT_NAME
-            puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
-          end
-          DEFAULT_NAME
-        else
-          # Log once when the path is invalid. We'll change to this path, so no
-          # need to log again.
-          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead." if previous_path != STDOUT_STR
-          STDOUT_STR
-        end
-      end
-
-      # Determine the valid level to which to log, given the precedence of config > settings > default.
-      #
-      # @param log_level [String, nil] the level at which to log as provided by the settings retrieved from the
-      #   TeamServer.
-      # @return [::Ougai::Logging::Severity] the level at which to log
-      def find_valid_level log_level
-        config = ::Contrast::CONFIG.root.agent.logger
-        config_level = config&.level&.length&.positive? ? config.level : nil
-
-        valid_level(config_level || log_level)
-      end
-
-      def valid_level level
-        level ||= DEFAULT_LEVEL
-        level = level.upcase
-        if VALID_LEVELS.include?(level)
-          Object.cs__const_get("::Ougai::Logging::Severity::#{ level }")
-        else
-          DEFAULT_LEVEL
-        end
-      rescue StandardError
-        DEFAULT_LEVEL
-      end
-
-      # Log that the Agent log has changed and include some default information at the start of the log.
-      def log_update
-        logger.debug('Initialized new contrast agent logger')
-        logger.debug_with_time('middleware: log environment') do
-          logger.application_environment
-          logger.application_configuration
-          logger.application_libraries
-        end
-      end
     end
   end
 end

data/lib/contrast/logger/request.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/timer'

data/lib/contrast/logger/time.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/security_exception.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/tasks/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/tasks/service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/os'

data/lib/contrast/utils/assess/propagation_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/property/tagged_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -9,6 +9,29 @@ module Contrast
       # This module includes simple methods for the tags like
       # adding tags, getting tags, deleting tags and similar
       module TaggedUtils
+        # Is the given tag present?
+        # Used in testing, so found by `be_tagged`, if you're grepping for it
+        #
+        # @param label [Symbol] the tag to check for
+        # @return [Boolean]
+        def tagged? label
+          tracked? && tags.key?(label)
+        end
+
+        # Similar to #tracked?, but limited to a given range.
+        #
+        # @param start [Integer] the inclusive start index to check.
+        # @param finish [Integer] the exclusive end index to check.
+        # @return [Boolean]
+        def any_tags_between? start, finish
+          return false unless tracked?
+
+          tags.each_value do |tag_array|
+            return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
+          end
+          false
+        end
+
         # Given a tag name and range object, add a new tag to this
         # collection. If the given range touches an existing tag,
         # we'll combine the two, adjusting the existing one and

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'
@@ -29,13 +29,13 @@ module Contrast
         end
 
         def sample? request
-          history = request_history(request)
-          history.hit
-
           # if sampling isn't enabled, we record all requests and take a
           # default amount of responses
           return [true, true] unless @enabled
 
+          history = request_history(request)
+          history.hit
+
           # if we've exceeded this sample window, reset it
           if history.elapsed >= @window_ms
             history.reset_window

data/lib/contrast/utils/assess/source_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/split_utils.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module extends the Split class which is specifically for String#split & String#grapheme_clusters
+      # propagation it propagates tag ranges from a string to elements within an untracked array
+      module SplitUtils
+        private
+
+        # Quick hook to the String#split propagation node in our Assess policy
+        #
+        # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
+        def split_node
+          @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+            node.class_name == 'String' && node.method_name == :split && node.instance_method?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
@@ -50,14 +50,9 @@ module Contrast
 
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-              obj.each_pair do |k, v|
-                return true if _tracked?(k, idx) || _tracked?(v, idx)
-              end
-              false
+              handle_hash obj, idx
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-              obj.any? do |ele|
-                _tracked?(ele, idx) unless obj == ele
-              end
+              handle_enumerable obj, idx
             else
               Contrast::Agent::Assess::Tracker.tracked?(obj)
             end
@@ -84,15 +79,9 @@ module Contrast
 
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-              obj.each_pair do |k, v|
-                return true if _trackable?(k, idx)
-                return true if _trackable?(v, idx)
-              end
-              false
+              handle_hash obj, idx
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-              obj.any? do |ele|
-                _trackable?(ele, idx) unless obj == ele
-              end
+              handle_enumerable obj, idx
             else
               Contrast::Agent::Assess::Tracker.trackable?(obj)
             end
@@ -103,6 +92,22 @@ module Contrast
             logger.warn('Failed to determine trackable', e, module: obj.cs__class)
             false
           end
+
+          def handle_hash obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
+            obj.each_pair do |k, v|
+              return true if send(caller_method, k, idx)
+              return true if send(caller_method, v, idx)
+            end
+            false
+          end
+
+          def handle_enumerable obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
+            obj.any? do |ele|
+              send(caller_method, ele, idx) unless obj == ele
+            end
+          end
         end
       end
     end

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,12 +19,13 @@ module Contrast
 
         # Find the request for this finding. This assumes, for now, that if there is an active request, then that
         # is the request to report. Otherwise, we'll use the first request found in the events of the
-        # source_object.
+        # source_object if the non request tracking flag is set.
         #
         # @param source [Object,nil] some Object used as the source of a trigger event
         # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
         def find_request source
           return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless ::Contrast::ASSESS.non_request_tracking?
           return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
 
           find_event_request(properties.event)
@@ -103,7 +104,7 @@ module Contrast
         # @param object [Object] the Object on which the method was invoked
         # @param ret [Object] the Return of the invoked method
         # @param args [Array<Object>] the Arguments with which the method was invoked
-        def apply_dataflow_rule trigger_node, source, object, ret, *args
+        def apply_dataflow_rule trigger_node, source, object, ret, *args # rubocop:disable Metrics/PerceivedComplexity
           return unless source
 
           if Contrast::Agent::Assess::Tracker.trackable?(source)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'
@@ -54,7 +54,7 @@ module Contrast
         # Once we move to 2.7+, we can combine the caches using ID b/c the memory location stops being the id
         #
         # @param object [Object, nil] the entity to convert to a String
-        # @return [String] the human readable form of the String, as defined by
+        # @return [String, Object] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
           # Only treat object like a string if it actually is a string+ some subclasses of String override string
@@ -66,19 +66,23 @@ module Contrast
           else
             return @lru_cache[object.__id__] if @lru_cache.key? object.__id__
 
-            @lru_cache[object.__id__] = if object.nil?
-                                          Contrast::Utils::ObjectShare::NIL_STRING
-                                        elsif object.cs__is_a?(Symbol)
-                                          ":#{ object }"
-                                        elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
-                                          "#{ object.cs__name }@#{ object.__id__ }"
-                                        elsif object.cs__is_a?(Regexp)
-                                          object.source
-                                        elsif use_to_s?(object)
-                                          object.to_s
-                                        else
-                                          "#{ object.cs__class.cs__name }@#{ object.__id__ }"
-                                        end
+            @lru_cache[object.__id__] = convert_object object
+          end
+        end
+
+        def convert_object object
+          if object.nil?
+            Contrast::Utils::ObjectShare::NIL_STRING
+          elsif object.cs__is_a?(Symbol)
+            ":#{ object }"
+          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+            "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
+          elsif use_to_s?(object)
+            object.to_s
+          else
+            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
         end
 

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -39,7 +39,7 @@ module Contrast
       def self.resolve_corrected_path path
         tmp_path = path.dup
         start_match = START_UNDERSCORE.match(tmp_path)
-        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+        tmp_path = tmp_path[start_match.offset(0).last..] if start_match
 
         tmp_path.gsub!(REPEATING_UNDERSCORE, '__')