contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # This module is specifically for String#(g)sub propagation
+          #
+          # Disclaimer: there may be a better way, but we're
+          # in a 'get it work' state. hopefully, we'll be in
+          # a 'get it right' state soon.
+          module SubstitutionUtils
+            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
+            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+
+            private
+
+            # Update our properties of the object dependent on the substitution pattern used.
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] instance of PreShift
+            # @param ret [String] the result of the substitution
+            # @param block, the given block
+            # @param global [Boolean] if this was a global or single substitution, optional
+            def substitution_tagger patcher, preshift, ret, block, global = true
+              return ret unless ret
+
+              begin
+                # define here what is used across private methods
+                @_preshift = preshift
+                args = @_preshift.args[1]
+                @_self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
+                @_incoming_tracked = args && determine_tracked(args)
+                @_ret = ret
+                return @_ret unless @_self_tracked || @_incoming_tracked
+
+                @_parent_events = []
+                if block
+                  block_sub
+                elsif args.is_a?(String)
+                  string_sub(args, global)
+                elsif args.is_a?(Hash)
+                  hash_sub
+                else # Enumerator, only for gsub
+                  pattern_gsub
+                end
+
+                self_tracked_handle(@_parent_events)
+                string_build_event(patcher)
+              rescue StandardError => e
+                logger.error('Unable to apply gsub propagator', e)
+              end
+              ret
+            end
+
+            def self_tracked_handle parent_events
+              return unless @_self_tracked
+
+              source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+              parent_event = source_properties&.event
+              parent_events.prepend(parent_event) if parent_event
+            end
+
+            def source
+              @_preshift.object
+            end
+
+            # @param args [String] the new String going into the substitution
+            def determine_tracked args
+              # if there's no arg, it can't be tracked
+              return false unless args
+
+              # if it's a string, just ask if it's tracked
+              case args
+              when String
+                Contrast::Agent::Assess::Tracker.tracked?(args)
+                # if it's a hash, ask if it has a tracked string
+              when Hash
+                args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
+                # this should never happen
+              else
+                false
+              end
+            end
+
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            def string_sub incoming, global
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+              @_parent_events << incoming_properties&.event if incoming_properties&.event
+
+              # We can't efficiently find the places that things were
+              # copied from regexp / captures. Trading accuracy for
+              # performance
+              if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
+                properties.splat_from(source, @_ret) if @_self_tracked
+                return
+              end
+
+              # if it's just a straight insert, that we can do
+              # Copy the tags from us to the return
+              ranges = find_string_sub_insert(properties, incoming, global)
+
+              properties.delete_tags_at_ranges(ranges)
+              properties.shift_tags(ranges)
+              return unless @_incoming_tracked
+              return unless incoming_properties
+
+              tags = incoming_properties.tag_keys
+              ranges.each do |range|
+                tags.each do |tag|
+                  properties.add_tag(tag, range)
+                end
+              end
+            end
+
+            # Find the points at which the new String was placed into the original
+            #
+            # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            # @return [Array<Range>] the Ranges where substitution occurred
+            def find_string_sub_insert properties, incoming, global
+              pattern = @_preshift.args[0]
+              properties.copy_from(source, @_ret)
+              # Figure out where inserts occurred
+              last_idx = 0
+              ranges = []
+              # For each insert, move the tag ranges
+              while last_idx
+                idx = source.index(pattern, last_idx)
+                break unless idx
+
+                last_idx = idx ? idx + 1 : nil
+                start_index = idx
+                end_index = idx + incoming.length
+                ranges << (start_index...end_index)
+                break unless global
+              end
+              ranges
+            end
+
+            def block_sub
+              hash_sub
+            end
+
+            def hash_sub
+              return unless @_self_tracked
+
+              properties = Contrast::Agent::Assess::Tracker.properties!(@_ret)
+              properties&.splat_from(source, @_ret)
+            end
+
+            def pattern_gsub
+              return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              source_properties.tag_keys.each do |key|
+                properties.add_tag(key, 0...1)
+              end
+              parent_event = source_properties.event
+              @_parent_events << parent_event if parent_event
+            end
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            def string_build_event patcher
+              return unless Contrast::Agent::Assess::Tracker.tracked?(@_ret)
+
+              properties = Contrast::Agent::Assess::Tracker.properties(@_ret)
+              args = @_preshift.args
+              event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, @_ret, @_preshift, @_ret, args)
+              properties.build_event(event_data, 2)
+              properties.event.instance_variable_set(:@_parent_events, @_parent_events)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,8 +24,12 @@ module Contrast
 
                 properties.copy_from(preshift.object, ret)
                 handle_tr(policy_node, preshift, ret, properties)
-
-                properties.build_event(policy_node, ret, preshift.object, ret, preshift.args, 1)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
@@ -36,7 +40,8 @@ module Contrast
                 source = preshift.object
                 args = preshift.args
                 properties.splat_from(source, ret)
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new patcher, ret, source, ret, args
+                properties.build_event(event_data)
                 ret
               end
 

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/source_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -38,13 +39,16 @@ module Contrast
             def source_patchers method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
               return unless (source_node = method_policy.source_node)
-              return unless (target = determine_target(source_node, object, ret, args))
+
+              # used to hold the object and ret
+              source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
+              return unless (target = determine_target(source_node, source_data, args))
 
               return_val = nil
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless ::Contrast::ASSESS.track_frozen_sources?
                 return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(source_data.ret))
                 return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
                 Contrast::Agent::Assess::Tracker.pre_freeze(dup)
@@ -52,8 +56,7 @@ module Contrast
                 target = dup
               end
 
-              apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret,
-                           source_node.type, nil, *args)
+              apply_source(source_node, target, source_data, source_node.type, nil, *args)
 
               return_val
             end
@@ -63,32 +66,31 @@ module Contrast
 
             # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
+            def apply_source source_node, target, source_data, source_type, source_name = nil, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
-              source_name ||= determine_source_name(source_node, object, ret, *args)
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Agent::Assess::Tracker.trackable?(target)
-                apply_tags(source_node, target, object, ret, source_type, source_name, *args)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
                 # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
                 # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each do |value|
-                  apply_source(context, source_node, value, object, ret, source_type, source_name, *args)
+                  apply_source(source_node, value, source_data, source_type, source_name, *args)
                 end
               end
             rescue StandardError => e
@@ -98,16 +100,14 @@ module Contrast
             # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
             # values back to ourselves and try again
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_hash_tags context, source_node, target, object, ret, source_type, *args
+            def apply_hash_tags source_node, target, source_data, source_type, *args
               to_replace = []
               target.each_pair do |key, value|
                 # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
@@ -116,8 +116,8 @@ module Contrast
                   key = key.dup
                   to_replace << key
                 end
-                apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
-                apply_source(context, source_node, value, object, ret, source_type, key, *args)
+                apply_source(source_node, key, source_data, key_type(source_type), key, *args)
+                apply_source(source_node, value, source_data, source_type, key, *args)
               end
               handle_hash_key(target, to_replace)
             end
@@ -146,7 +146,16 @@ module Contrast
               end
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, *args
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
               # don't apply tags if we can't track the thing
               return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
@@ -164,24 +173,28 @@ module Contrast
                 logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
               # make a representation of this method that TeamServer can render
-              properties.build_event(source_node, target, object, ret, args, source_type, source_name)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
             end
 
             # Find the literal target of the propagation
             #
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
-            def determine_target source_node, object, ret, args
+            def determine_target source_node, source_data, args
               source_target = source_node.targets[0]
               case source_target
               when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
+                source_data.ret
               when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
+                source_data.object
               else
                 args[source_target]
               end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_method'

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_validation/cross_site_validator'

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -32,7 +32,12 @@ module Contrast
                 interpolated_inputs = []
                 handle_binding_variables(scope, erb_template_prerender, ret, properties, interpolated_inputs)
                 handle_local_variables(args, erb_template_prerender, ret, properties, interpolated_inputs)
-                properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(TEMPLATE_PROPAGATION_NODE,
+                                                                            ret,
+                                                                            erb_template_prerender,
+                                                                            ret,
+                                                                            interpolated_inputs)
+                properties.build_event(event_data)
                 unless interpolated_inputs.empty?
                   current_event = properties.event
                   interpolated_inputs.each do |input|

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -7,6 +7,8 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/trigger_method_utils'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/agent/reporting/reporting_utilities/reporting_storage'
 
 module Contrast
   module Agent
@@ -16,7 +18,7 @@ module Contrast
         # Contrast::Agent::Assess::Policy::TriggerNode class. Each such method will call to this module just after
         # invocation in order to determine if the call was done safely. In those cases where it was not, a Finding
         # report is issued to the Service.
-        module TriggerMethod
+        module TriggerMethod # rubocop:disable Metrics/ModuleLength
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::TriggerMethodUtils
 
@@ -25,6 +27,11 @@ module Contrast
           MINIMUM_FINDING_VERSION = 3
           # The level of TeamServer compliance our traces meet.
           CURRENT_FINDING_VERSION = 4
+          # Rules that always exists outside of Request Context
+          NON_REQUEST_RULES = [
+            'hardcoded-password', # Contrast::Agent::Assess::Rule::Provider::HardcodedPassword.NAME,
+            'hardcoded-key' # Contrast::Agent::Assess::Rule::Provider::HardcodedKey.NAME
+          ].cs__freeze
 
           class << self
             # This is called from within our woven proc. It will be called as if it were inline in the Rack
@@ -38,6 +45,14 @@ module Contrast
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
 
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              # return if there is no context and the flag is set to default => false
+              # we need to have request if the flag is default
+              # else proceed, if the flag is true we don't need to check for context we
+              # go as currently.
+              # When outside of a request, only track when the feature is enabled
+              return unless Contrast::ASSESS.non_request_tracking? || context
+
               if trigger_node.sources&.any?
                 trigger_node.sources.each do |marker|
                   source = determine_source(marker, object, ret, args)
@@ -52,6 +67,14 @@ module Contrast
               apply_trigger(trigger_node, source, object, ret, *args)
             end
 
+            def append_to_finding finding, event_data, request
+              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(event_data.policy_node.rule_id)
+              finding.version = determine_compliance_version(finding)
+              append_events(finding, event_data)
+              append_route(finding, request)
+              append_hash(finding, event_data.tagged, request)
+            end
+
             # This converts the source of the finding, and the events leading up to it into a Finding
             #
             # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
@@ -63,21 +86,28 @@ module Contrast
             # @return [Contrast::Api::Dtm::Finding, nil] the Contrast::Api::Dtm::Finding to send to TeamServer or
             #   nil if conditions were not met
             def build_finding trigger_node, source, object, ret, *args
+              content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
+
+              if content_type.nil? && trigger_node.collectable?
+                Contrast::Agent::FINDINGS.collect_finding trigger_node, source, object, ret, *args
+                return
+              end
+
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
               request = find_request(source)
               return unless reportable?(request&.env)
 
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
-
-              append_events(finding, trigger_node, source, object, ret, args)
-              append_route(finding, request)
-              append_hash(finding, source, request)
-              finding.version = determine_compliance_version(finding)
-              logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
-                                              rule: trigger_node.rule_id)
-              report_finding(finding, request)
+              if Contrast::Agent::Reporter.enabled?
+                handle_new_finding(trigger_node, source, object, ret, request, *args)
+              else # TODO: RUBY-1438 -- remove
+                finding = Contrast::Api::Dtm::Finding.new
+                event_data = Contrast::Agent::Assess::Events::EventData.new trigger_node, source, object, ret, args
+                append_to_finding finding, event_data, request
+                logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
+                                                rule: trigger_node.rule_id)
+                report_finding(finding, request)
+              end
             rescue StandardError => e
               logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
@@ -97,6 +127,8 @@ module Contrast
                 return
               end
 
+              return unless ::Contrast::ASSESS.non_request_tracking? || NON_REQUEST_RULES.include?(finding.rule_id)
+
               activity = Contrast::Api::Dtm::Activity.new
               activity.findings << finding
               if request
@@ -105,11 +137,30 @@ module Contrast
                 logger.debug('Attempted to report finding without request', finding: finding)
               end
 
-              # If we're out of request context, then we need to report this finding ourselves, so we'll send it in the
-              # one-off activity we created.
+              # If we're out of request context, then we need to report this finding ourselves,
+              # so we'll send it in the one-off activity we created.
               Contrast::Agent.messaging_queue.send_event_eventually(activity)
             end
 
+            def handle_new_finding trigger_node, source, object, ret, request, *args
+              # sent to reporter
+              # here we will generate new type of finding
+              ruby_finding = Contrast::Agent::Reporting::Finding.new trigger_node.rule_id
+              ruby_finding.attach_data trigger_node, source, object, ret, request, *args
+              hash_code = Contrast::Utils::HashDigest.generate_event_hash(ruby_finding, source, request)
+              ruby_finding.hash_code = hash_code
+              # save the current finding
+              Contrast::Agent::Reporting::ReportingStorage[hash_code] = ruby_finding
+
+              new_preflight = Contrast::Agent::Reporting::Preflight.new
+              new_preflight_message = Contrast::Agent::Reporting::PreflightMessage.new
+              new_preflight_message.routes << request
+              new_preflight_message.hash_code = hash_code
+              new_preflight_message.data = "#{ trigger_node.rule_id },#{ hash_code }"
+              new_preflight.messages << new_preflight_message
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
+            end
+
             private
 
             def settings
@@ -149,10 +200,9 @@ module Contrast
               end
             end
 
-            def append_events finding, trigger_node, source, object, ret, args
-              append_from_source(finding, source)
-              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret,
-                                                                                    args).to_dtm_event
+            def append_events finding, event_data
+              append_from_source(finding, event_data.tagged)
+              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(event_data).to_dtm_event
             end
 
             def append_from_source finding, source

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger/reflected_xss'
@@ -22,6 +22,10 @@ module Contrast
           JSON_RULE_NAME = 'name'
           JSON_CUSTOM_PATCH = 'custom_patch'
 
+          # Our list with rules to be collected and reported back when we have response
+          # from the application. Some rules rely on Content-Type validation.
+          COLLECTABLE_RULES = %w[reflected-xss].cs__freeze
+
           attr_reader :rule_id, :required_tags, :disallowed_tags, :good_value, :bad_value
 
           def initialize trigger_hash = {}, rule_hash = {}
@@ -67,6 +71,10 @@ module Contrast
             :TYPE_METHOD
           end
 
+          def collectable?
+            COLLECTABLE_RULES.include?(rule_id)
+          end
+
           def rule_disabled?
             ::Contrast::ASSESS.rule_disabled?(rule_id)
           end
@@ -160,8 +168,8 @@ module Contrast
             @disallowed_tags << LIMITED_CHARS
             @disallowed_tags << CUSTOM_ENCODED
             @disallowed_tags << CUSTOM_VALIDATED
-            @disallowed_tags << ENCODER_START + loud_name
-            @disallowed_tags << VALIDATOR_START + loud_name
+            @disallowed_tags << (ENCODER_START + loud_name)
+            @disallowed_tags << (VALIDATOR_START + loud_name)
           end
 
           def validate_rule_tags tags
@@ -200,14 +208,14 @@ module Contrast
               satisfied = tags_at.any? && required_tags.all? { |tag| tags_at.any? { |found| found.label == tag } }
               # if this range matches all the required tags and we're already
               # chunking, meaning the previous range matched, do nothing
-              if satisfied && chunking
-                start_range += 1
-                next
-              end
 
               # if we are satisfied and we were not chunking, this represents
               # the start of the next range, so create a new entry.
               if satisfied
+                if chunking
+                  start_range += 1
+                  next
+                end
                 ranges << Contrast::Agent::Assess::Tag.new('required', 0, start_range)
                 chunking = true
                 # if we are chunking and not satisfied, this represents the end