contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/utils/patching/policy/patch_utils.rb

@@ -1,21 +1,17 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
     module Patching
-      # This module will include all methods for different patch applies from Patch module
-      # and some other module methods from the same place, so we can ease the main module
+      # This module will include all methods for different patch applies from Patch module and some other module
+      # methods from the same place, so we can ease the main module
       module PatchUtils
-        # Method to choose which replaced return from the post_patch to
-        # actually return
+        # Method to choose which replaced return from the post_patch to actually return.
         #
-        # @param propagated_ret [Object, nil] The replaced return from the
-        #   propagation patch.
-        # @param source_ret [Object, nil] The replaced return from the
-        #   source patch.
-        # @param ret [Object, nil] The original return of the patched
-        #   method.
+        # @param propagated_ret [Object, nil] The replaced return from the propagation patch.
+        # @param source_ret [Object, nil] The replaced return from the source patch.
+        # @param ret [Object, nil] The original return of the patched method.
         # @return [Object, nil] The thing to return from the post patch.
         def handle_return propagated_ret, source_ret, ret
           safe_return = propagated_ret || source_ret || ret
@@ -23,8 +19,8 @@ module Contrast
           safe_return
         end
 
-        # Given a module and method, construct an expected name for the
-        # alias by which Contrast will reference the original.
+        # Given a module and method, construct an expected name for the alias by which Contrast will reference the
+        # original.
         #
         # @param patched_class [Module] the module being patched
         # @param patched_method [Symbol] the method being patched
@@ -48,56 +44,44 @@ module Contrast
         # ===== PATCH APPLIERS =====
         # THIS IS CALLED FROM C. Do not change the signature lightly.
         #
-        # This method functions to call the infilter methods from our
-        # patches, allowing for analysis and reporting at the point just
-        # before the patched code is invoked.
+        # This method functions to call the infilter methods from our patches, allowing for analysis and reporting at
+        # the point just before the patched code is invoked.
         #
-        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-        #   Mapping of the triggers on the given method.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
         # @param method [Symbol] The method into which we're patching
-        # @param exception [StandardError] Any exception raised during the
-        #   call of the patched method.
-        # @param object [Object] The object on which the method is invoked,
-        #   typically what would be returned by self.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
         def apply_pre_patch method_policy, method, exception, object, args
           apply_protect(method_policy, method, exception, object, args)
           apply_inventory(method_policy, method, exception, object, args)
         rescue Contrast::SecurityException => e
-          # We were told to block something, so we gotta. Don't catch this
-          # one, let it get back to our Middleware or even all the way out to
-          # the framework
+          # We were told to block something, so we gotta. Don't catch this one, let it get back to our Middleware or
+          # even all the way out to the framework
           raise e
         rescue StandardError => e
-          # Anything else was our bad and we gotta catch that to allow for
-          # normal application flow
+          # Anything else was our bad and we gotta catch that to allow for normal application flow
           logger.error('Unable to apply pre patch to method.', e)
         rescue Exception => e # rubocop:disable Lint/RescueException
-          # This is something like NoMemoryError that we can't
-          # hope to handle.  Nonetheless, shouldn't leak scope.
+          # This is something like NoMemoryError that we can't hope to handle.  Nonetheless, shouldn't leak scope.
           exit_contrast_scope!
           raise e
         end
 
         # THIS IS CALLED FROM C. Do not change the signature lightly.
         #
-        # This method functions to call the infilter methods from our
-        # patches, allowing for analysis and reporting at the point just
-        # after the patched code is invoked
+        # This method functions to call the infilter methods from our patches, allowing for analysis and reporting at
+        # the point just after the patched code is invoked
         #
-        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-        #   Mapping of the triggers on the given method.
-        # @param preshift [Contrast::Agent::Assess::PreShift] The capture
-        #   of the state of the code just prior to the invocation of the
-        #   patched method.
-        # @param object [Object] The object on which the method was
-        #   invoked, typically what would be returned by self.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to the
+        #   invocation of the patched method.
+        # @param object [Object] The object on which the method was invoked, typically what would be returned by self.
         # @param ret [Object] The return of the method that was invoked.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
-        # @param block [Proc] The block passed to the method that was
-        #   invoked.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        # @param block [Proc] The block passed to the method that was invoked.
         def apply_post_patch method_policy, preshift, object, ret, args, block
           apply_assess(method_policy, preshift, object, ret, args, block)
         rescue StandardError => e
@@ -106,15 +90,12 @@ module Contrast
 
         # Apply the Protect patch which applies to the given method.
         #
-        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-        #   Mapping of the triggers on the given method.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
         # @param method [Symbol] The method into which we're patching
-        # @param exception [StandardError] Any exception raised during the
-        #   call of the patched method.
-        # @param object [Object] The object on which the method is invoked,
-        #   typically what would be returned by self.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
         def apply_protect method_policy, method, exception, object, args
           return unless ::Contrast::AGENT.enabled?
           return unless ::Contrast::PROTECT.enabled?
@@ -124,15 +105,12 @@ module Contrast
 
         # Apply the Inventory patch which applies to the given method.
         #
-        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-        #   Mapping of the triggers on the given method.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
         # @param method [Symbol] The method into which we're patching
-        # @param exception [StandardError] Any exception raised during the
-        #   call of the patched method.
-        # @param object [Object] The object on which the method is invoked,
-        #   typically what would be returned by self.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
         def apply_inventory method_policy, method, exception, object, args
           return unless ::Contrast::INVENTORY.enabled?
 
@@ -141,18 +119,14 @@ module Contrast
 
         # Apply the Assess patches which apply to the given method.
         #
-        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-        #   Mapping of the triggers on the given method.
-        # @param preshift [Contrast::Agent::Assess::PreShift] The capture
-        #   of the state of the code just prior to the invocation of the
-        #   patched method.
-        # @param object [Object] The object on which the method was
-        #   invoked, typically what would be returned by self.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to the
+        #   invocation of the patched method.
+        # @param object [Object] The object on which the method was invoked, typically what would be returned by self.
         # @param ret [Object] The return of the method that was invoked.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
-        # @param block [Proc] The block passed to the method that was
-        #   invoked.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        # @param block [Proc] The block passed to the method that was invoked.
         def apply_assess method_policy, preshift, object, ret, args, block
           source_ret = nil
           propagated_ret = nil
@@ -166,9 +140,8 @@ module Contrast
             Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args)
           end
           if method_policy.source_node
-            # If we were given a frozen return, and it was the target of a
-            # source, and we have frozen sources enabled, we'll need to
-            # replace the return. Note, this is not the default case.
+            # If we were given a frozen return, and it was the target of a source, and we have frozen sources enabled,
+            # we'll need to replace the return. Note, this is not the default case.
             source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret, args)
           end
           if method_policy.propagation_node
@@ -190,39 +163,30 @@ module Contrast
           raise e
         end
 
-        # Generic invocation of the Inventory or Protect patch which apply
-        # to the given method.
+        # Generic invocation of the Inventory or Protect patch which apply to the given method.
         #
-        # @param trigger_node [Contrast::Agent::Inventory::Policy::TriggerNode]
-        #   Mapping of the specific trigger on the given method.
+        # @param trigger_node [Contrast::Agent::Inventory::Policy::TriggerNode] Mapping of the specific trigger on the
+        #   given method.
         # @param method [Symbol] The method into which we're patching
-        # @param exception [StandardError] Any exception raised during the
-        #   call of the patched method.
-        # @param object [Object] The object on which the method is invoked,
-        #   typically what would be returned by self.
-        # @param args [Array<Object>] The arguments passed to the method
-        #   being invoked.
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
         def apply_trigger_only trigger_node, method, exception, object, args
           return unless trigger_node
 
-          # If that rule only applies in the case of an exception being
-          # thrown and there's no exception here, move along, or vice versa
+          # If that rule only applies in the case of an exception being thrown and there's no exception here, move
+          # along, or vice versa
           return if trigger_node.on_exception && !exception
           return if !trigger_node.on_exception && exception
 
-          # Each patch has an applicator that handles logic for it. Think
-          # of this as being similar to propagator actions, most closely
-          # resembling CUSTOM - they all have a common interface but their
-          # own logic based on what's in the method(s) they've been patched
-          # into.
-          # Each patch also knows the method of its applicator. Some
-          # things, like AppliesXxeRule, have different methods depending
-          # on the library patched. This lets us handle the boilerplate of
-          # patching while still allowing for custom handling of the
-          # methods.
+          # Each patch has an applicator that handles logic for it. Think of this as being similar to propagator
+          # actions, most closely resembling CUSTOM - they all have a common interface but their own logic based on
+          # what's in the method(s) they've been patched into.
+          # Each patch also knows the method of its applicator. Some things, like AppliesXxeRule, have different
+          # methods depending on the library patched. This lets us handle the boilerplate of patching while still
+          # allowing for custom handling of the methods.
           applicator_method = trigger_node.applicator_method
-          # By calling send like this, we can reuse all the patching.
-          # We `send` to the given method of the given class
+          # By calling send like this, we can reuse all the patching. We `send` to the given method of the given class
           # (applicator) since they all accept the same inputs
           trigger_node.applicator.send(applicator_method, method, exception, trigger_node.properties, object, args)
         end

data/lib/contrast/utils/patching/policy/patcher_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/preflight_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/request_utils.rb

@@ -0,0 +1,96 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # used in Contrast::Agent::Request
+    module RequestUtils
+      # Return a flattened hash of params with realized paths for keys, in
+      # addition to a separate, valueless, entry for each nest key.
+      # See RUBY-621 for more details.
+      # { key : { nested_key : ['x','y','z' ] } }
+      # becomes
+      # {
+      #   key[nested_key][0] : 'x'
+      #   key[nested_key][1] : 'y'
+      #   key[nested_key][2] : 'z'
+      #   key :                ''
+      #   nested_key :         ''
+      # }
+      # @return params_hash [Hash]
+      def normalize_params val, prefix: nil
+        # In non-recursive invocations, val should always be a Hash
+        # (rather than breaking this out into two methods)
+        case val
+        when Tempfile
+          # Skip if it's the auto-generated value from rails when it handles
+          # file uploads. The file name will still be sent to SR for analysis.
+          {}
+        when Hash
+          res = val.each_with_object({}) do |(k, v), hash|
+            k = Contrast::Utils::StringUtils.force_utf8(k)
+            nested_prefix = prefix.nil? ? k : "#{ prefix }[#{ k }]"
+            hash[k] = Contrast::Utils::ObjectShare::EMPTY_STRING
+            hash.merge! normalize_params(v, prefix: nested_prefix)
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        when Enumerable
+          idx = 0
+          res = {}
+          while idx < val.length
+            res.merge! normalize_params(val[idx], prefix: "#{ prefix }[#{ idx }]")
+            idx += 1
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        else
+          { prefix => Contrast::Utils::StringUtils.force_utf8(val) }
+        end
+      end
+
+      # Read the response body and rewind.
+      # A well behaved middleware would read the IO object and then rewind.
+      #
+      # @return body [String]
+      def read_body body
+        return body if body.is_a?(String)
+
+        begin
+          can_rewind = Contrast::Utils::DuckUtils.quacks_to?(body, :rewind)
+          # if we are after a middleware that failed to rewind
+          body.rewind if can_rewind
+          body.read
+        rescue StandardError => e
+          logger.error('Error in attempt to read body', message: e.message)
+          logger.trace('With Stack', e)
+          body.to_s
+        ensure
+          # be a good citizen and rewind
+          body.rewind if can_rewind
+        end
+      end
+
+      # @param multipart_data [Object<Hash>]
+      # @param current_names [Hash]
+      # @return current_names [Hash<Name =>file_name]
+      def traverse_parsed_multipart multipart_data, current_names
+        return current_names unless multipart_data
+
+        multipart_data.each_value do |data_value|
+          next unless data_value.is_a?(Hash)
+
+          tempfile = data_value[:tempfile]
+          if tempfile.nil?
+            traverse_parsed_multipart(data_value, current_names)
+          else
+            name = data_value[:name].to_s
+            file_name = data_value[:filename].to_s
+            current_names[name] = file_name
+          end
+        end
+        current_names
+      end
+    end
+  end
+end

data/lib/contrast/utils/resource_loader.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/response_utils.rb

@@ -0,0 +1,97 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # used in Contrast::Agent::Response
+    module ResponseUtils
+      private
+
+      # From the dtm for normalized_response_headers:
+      #   Key is UPPERCASE_UNDERSCORE
+      #
+      #   Example: Content-Type: text/html; charset=utf-8
+      #   "CONTENT_TYPE" => Content-Type,["text/html; charset=utf8"]
+      def append_pair map, key, value
+        return unless key && value
+        return if value.is_a?(Hash)
+
+        safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+        hash_key = Contrast::Utils::StringUtils.normalized_key(safe_key)
+        map[hash_key] ||= Contrast::Api::Dtm::Pair.new
+        map[hash_key].key = safe_key
+        map[hash_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+      end
+
+      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
+
+      # Given some holder of the content of the response's body, extract that
+      # content and return it as a String
+      #
+      # @param body [String, Rack::File, Rack::BodyProxy,
+      #   ActionDispatch::Response::RackBody, Rack::Response] Something that
+      #   holds, wraps, or is the body of the Response
+      # @return [nil, String] the content of the body
+      def extract_body body
+        return unless body
+        return if defined?(Rack::File) && body.is_a?(Rack::File)
+
+        case body
+        when Rack::BodyProxy
+          handle_rack_body_proxy(body)
+        when ActionDispatch::Response::RackBody
+          extract_body(body.body) if defined?(ActionDispatch::Response::RackBody)
+        when Rack::Response
+          extract_body(body.body)
+        when Contrast::Utils::DuckUtils.quacks_to?(body, :each)
+          acc = []
+          body.each { |tmp| acc << read_or_string(tmp) }
+          acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
+        when ActionView::OutputBuffer
+          # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
+          body.to_str
+        else
+          read_or_string(body)
+        end
+        # if body.is_a?(Rack::BodyProxy)
+        #   handle_rack_body_proxy(body)
+        # elsif (defined?(ActionDispatch::Response::RackBody) && body.is_a?(ActionDispatch::Response::RackBody)) ||
+        #       body.is_a?(Rack::Response)
+        #
+        #   extract_body(body.body)
+        # elsif Contrast::Utils::DuckUtils.quacks_to?(body, :each)
+        #   acc = []
+        #   body.each { |tmp| acc << read_or_string(tmp) }
+        #   acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
+        # elsif ActionView::OutputBuffer
+        #   # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
+        #   body.to_str
+        # else
+        #   read_or_string(body)
+        # end
+      end
+
+      def handle_rack_body_proxy body
+        next_body = body.instance_variable_get(:@body)
+        case next_body
+        when Array
+          extract_body(next_body[0])
+        else
+          extract_body(next_body)
+        end
+      end
+
+      def read_or_string obj
+        return unless obj
+
+        if Contrast::Utils::DuckUtils.quacks_to?(obj, :read)
+          tmp = obj.read
+          obj.rewind
+          tmp
+        else
+          obj.to_s
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/sha256_builder.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'

data/lib/contrast/utils/stack_trace_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/utils/string_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -7,84 +7,86 @@ module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
-      include Contrast::Components::Logger::InstanceMethods
+      class << self
+        include Contrast::Components::Logger::InstanceMethods
 
-      UTF8 = 'utf-8'
-      HTTP_PREFIX = 'HTTP_'
+        UTF8 = 'utf-8'
+        HTTP_PREFIX = 'HTTP_'
 
-      # Convenience method. We assume that we're working on Strings or tags
-      # String representations of things. To that end, we'll to_s anything
-      # that comes in before returning its length.
-      #
-      # But don't worry though, String.to_s just returns self. teehee
-      def self.ret_length string
-        string.nil? ? 0 : string.to_s.length
-      end
+        # Convenience method. We assume that we're working on Strings or tags
+        # String representations of things. To that end, we'll to_s anything
+        # that comes in before returning its length.
+        #
+        # But don't worry though, String.to_s just returns self. teehee
+        def ret_length string
+          string.nil? ? 0 : string.to_s.length
+        end
 
-      def self.present? str
-        !str.nil? && !str.to_s.empty?
-      end
+        def present? str
+          !str.nil? && !str.to_s.empty?
+        end
 
-      def self.protobuf_format data, truncate: true
-        data = data&.to_s
-        data = Contrast::Utils::StringUtils.force_utf8(data)
-        data = Contrast::Utils::StringUtils.truncate(data) if truncate
-        data
-      end
+        def protobuf_format data, truncate: true
+          data = data&.to_s
+          data = Contrast::Utils::StringUtils.force_utf8(data)
+          data = Contrast::Utils::StringUtils.truncate(data) if truncate
+          data
+        end
 
-      # Protobuf has a very strict typing. Nil is not a String and will throw
-      # an exception if you try to set it. Use this to be safe.
-      # Uses the object share to avoid creating several new strings per request
-      def self.protobuf_safe_string string
-        string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
-      end
+        # Protobuf has a very strict typing. Nil is not a String and will throw
+        # an exception if you try to set it. Use this to be safe.
+        # Uses the object share to avoid creating several new strings per request
+        def protobuf_safe_string string
+          string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
+        end
 
-      # Truncate a string to 255 characters max length
-      def self.truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
-        return default if str.nil?
+        # Truncate a string to 255 characters max length
+        def truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
+          return default if str.nil?
 
-        str.to_s[0..255]
-      end
+          str.to_s[0..255]
+        end
 
-      def self.force_utf8 str
-        return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
+        def force_utf8 str
+          return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
 
-        str = str.to_s
-        if str.encoding == Encoding::UTF_8
-          str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
-        else
-          str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
-        end
-        str.to_s
-      rescue StandardError => e
-        # We were unable to switch the String to a UTF-8 format.
-        # Return non-nil so as not to throw an exception later when trying
-        # to do regexp or other compares on the String
-        logger.trace('Unable to cast String to UTF-8 format', e, value: str)
+          str = str.to_s
+          if str.encoding == Encoding::UTF_8
+            str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
+          else
+            str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
+          end
+          str.to_s
+        rescue StandardError => e
+          # We were unable to switch the String to a UTF-8 format.
+          # Return non-nil so as not to throw an exception later when trying
+          # to do regexp or other compares on the String
+          logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
-        Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
+          Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
 
-      # Given a string return a normalized version of that string.
-      # Keys are memoized so that the normalization process doesn't need
-      # to happen every time.
-      #
-      # @param str [String] the String to normalize
-      # @return [String] a copy of the given String, upper cased, trimmed,
-      #   dashes replaced with underscore, and HTTP trimmed
-      def self.normalized_key str
-        return unless str
+        # Given a string return a normalized version of that string.
+        # Keys are memoized so that the normalization process doesn't need
+        # to happen every time.
+        #
+        # @param str [String] the String to normalize
+        # @return [String] a copy of the given String, upper cased, trimmed,
+        #   dashes replaced with underscore, and HTTP trimmed
+        def normalized_key str
+          return unless str
 
-        str = str.to_s
-        @_normalized_keys ||= {}
-        if @_normalized_keys.key?(str)
-          @_normalized_keys[str]
-        else
-          upped = str.upcase
-          stripped = upped.strip! || upped
-          trimmed = stripped.tr!('-', '_') || stripped
-          cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..-1] : trimmed
-          @_normalized_keys[str] = cut
+          str = str.to_s
+          @_normalized_keys ||= {}
+          if @_normalized_keys.key?(str)
+            @_normalized_keys[str]
+          else
+            upped = str.upcase
+            stripped = upped.strip! || upped
+            trimmed = stripped.tr!('-', '_') || stripped
+            cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..] : trimmed
+            @_normalized_keys[str] = cut
+          end
         end
       end
     end