contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/agent/reporting/reporting_events/finding_event.rb

@@ -0,0 +1,264 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/finding_event_source'
+require 'contrast/agent/reporting/reporting_events/finding_object'
+require 'contrast/agent/reporting/reporting_events/finding_stack'
+require 'contrast/agent/reporting/reporting_events/finding_taint_range'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Finding class which will include all the needed information for the new reporting system to
+      # relay this information in the Finding/Trace messages. These findings are used by TeamServer to construct the
+      # vulnerability information for the assess feature. They represent those parts of the application, either through
+      # configuration, method invocation, or dataflow, which are determined to be insecure.
+      #
+      # @attr_reader action [String] what the event did; CREATION, A2O, A2P, A2A, A2R, O2A, O2O, O2P, O2R, P2A, P2O,
+      #   P2P, P2R, TAG, TRIGGER.
+      # @attr_reader args [Array<Contrast::Agent::Reporting::FindingObject>] the arguments passed to the method.
+      # @attr_reader code [nil] unused.
+      # @attr_reader event_id [Integer] the id of this event.
+      # @attr_reader event_sources [Array<Contrast::Agent::Reporting::FindingEventSource>] the source of taint
+      # @attr_reader field_name [nil] unused.
+      # @attr_reader object [Contrast::Agent::Reporting::FindingEventSource] the object this method was invoked on.
+      # @attr_reader parent_object_ids [Array<Integer>]
+      # @attr_reader properties [Hash<String,String]
+      # @attr_reader ret [Contrast::Agent::Reporting::FindingObject] the return of the method.
+      # @attr_reader signature [Contrast::Agent::Reporting::FindingSignature] the signature of the method.
+      # @attr_reader source [String] the source of the taint from the method; ^(O|R|P\d+)$
+      # @attr_reader stack [Array<Contrast::Agent::Reporting::FindingStack>]
+      # @attr_reader tags [Array<String>] description of what's happened to the data
+      # @attr_reader taint_ranges [Array<Contrast::Agent::Reporting::FindingTaintRange>] the tags and spans of the
+      #   source that are tracked
+      # @attr_reader target [String] the target of the taint from the method; ^(O|R|P\d+)$
+      # @attr_reader thread [String] the id of the thread on which the method was invoked
+      # @attr_reader time [Integer] the time, in ms, when the event was generated
+      # @attr_reader type [String] the type of event; METHOD, PROPAGATION, TAG
+      class FindingEvent
+        attr_reader :action, :args, :code, :event_id, :event_sources, :field_name, :object, :parent_object_ids,
+                    :properties, :ret, :signature, :source, :stack, :tags, :taint_ranges, :target, :thread, :time,
+                    :type
+
+        class << self
+          # Find all the events leading up to the given source and return an array of FindingEvents
+          #
+          # @param source [Object] something that may have been tracked
+          # @return [Array<Contrast::Agent::Reporting::FindingEvent>]
+          def from_source source
+            return unless source && (props = Contrast::Agent::Assess::Tracker.properties(source))
+
+            build_events([], props.event) if props&.event
+          end
+
+          # @param event [Contrast::Agent::Assess::ContrastEvent]
+          # @return [Contrast::Agent::Reporting::FindingEvent]
+          def convert event
+            report = new
+            report.attach_data(event)
+            report
+          end
+
+          private
+
+          # Pull the parent events from the given event, generating an array of FindingEvents, passing back the given
+          # array of events after populating it.
+          #
+          # @param events [Array<Contrast::Agent::Reporting::FindingEvent>]
+          # @param event [Contrast::Agent::Assess::ContrastEvent]
+          # @return [Array<Contrast::Agent::Reporting::FindingEvent>]
+          def build_events events, event
+            return unless event
+
+            event.parent_events&.each do |parent_event|
+              build_events(finding, parent_event)
+            end
+            events << convert(event)
+            events
+          end
+        end
+
+        # Parse the data from a Contrast::Agent::Assess::ContrastEvent to attach what is required for reporting to
+        # TeamServer to this Contrast::Agent::Reporting::FindingEvent
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def attach_data event
+          @event_id = event.event_id
+          @time = event.time.to_i
+          @thread = event.thread
+          display_params!(event)
+          dataflow!(event)
+          event_sources!(event)
+          @signature = Contrast::Agent::Reporting::FindingSignature.convert(event)
+          stack!(event)
+          parent_ids!(event)
+          properties!(event)
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              action: action,
+              args: args,
+              # code: code, # Unused by our agent
+              eventId: event_id,
+              eventSources: event_sources,
+              # fieldName: field_name, # Unused by our agent
+              object: object,
+              parentObjectIds: parent_object_ids,
+              properties: properties,
+              ret: ret,
+              signature: signature,
+              source: source,
+              stack: stack,
+              tags: tags,
+              taintRanges: taint_ranges,
+              target: target,
+              thread: thread,
+              time: time,
+              type: type
+          }
+        end
+
+        # @raise [ArgumentError]
+        def validate
+          validate_base
+          validate_dataflow
+        end
+
+        private
+
+        # Find the action and type of this event, used by TeamServer to display type of the event and the
+        # transformation if made.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def display_params! event
+          @action = event.policy_node.build_action
+          @type = event.policy_node.node_type
+        end
+
+        # Build the dataflow components of this FindingEvent.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def dataflow! event
+          taint_target = taint_target!(event)
+          truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
+          @object = Contrast::Agent::Reporting::FindingObject.convert(event.object, truncate_obj)
+          truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
+          @ret = Contrast::Agent::Reporting::FindingObject.convert(event.ret, truncate_ret)
+          event_args!(event, taint_target)
+          taint_ranges!(event)
+        end
+
+        # Convert the arguments of the given ContrastEvent to the reportable form for this FindingEvent. We'll
+        # truncate any argument that isn't the taint target of this event.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        # @param taint_target [String,nil] the target of the taint in this event.
+        def event_args! event, taint_target
+          @args = []
+          idx = 0
+          while idx < event.args.length
+            @args << Contrast::Agent::Reporting::FindingObject.convert(event.args[idx], taint_target != idx)
+            idx += 1
+          end
+        end
+
+        # Convert the sources of the event to sources here
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def event_sources! event
+          @event_sources = []
+          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
+
+          event_sources << Contrast::Agent::Reporting::FindingEventSource.convert(event)
+        end
+
+        # Convert the parent id's of the given ContrastEvent to the reportable form for this FindingEvent.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def parent_ids! event
+          @parent_object_ids = []
+          event.parent_events&.each do |parent_event|
+            parent_object_ids << parent_event.event_id.to_i
+          end
+        end
+
+        # Convert the properties of the given ContrastEvent to the reportable form for this FindingEvent.
+        # TODO: RUBY-99999 How do properties get to events? Do they? I thought Stored-XSS needed it.
+        #
+        # @param _event [Contrast::Agent::Assess::ContrastEvent]
+        def properties! _event
+          @properties = {}
+        end
+
+        # Convert the stack of the given ContrastEvent to the reportable form for this FindingEvent.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def stack! event
+          @stack = []
+          event.stack_trace.each do |stack_event|
+            if (report = Contrast::Agent::Reporting::FindingStack.convert(stack_event))
+              stack << report
+            end
+          end
+        end
+
+        # Convert the taint ranges of the given ContrastEvent to the reportable form for this FindingEvent.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def taint_ranges! event
+          @tags = []
+          @taint_ranges = []
+          event&.tags&.each_pair do |tag_key, tag_ranges|
+            tags << tag_key
+            tag_ranges.each { |range| taint_ranges << Contrast::Agent::Reporting::FindingTaintRange.convert(range) }
+          end
+        end
+
+        # Find the source and target for this FindingEvent based on the provided event.
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        # @return [String,nil] the target of the taint in this event.
+        def taint_target! event
+          return unless (node = event.policy_node)
+
+          @source = node.source_string if node.source_string
+          @target = node.target_string if node.target_string
+          return node.targets[0] if node.targets&.any?
+
+          node.sources[0] if node.sources&.any?
+        end
+
+        # @raise [ArgumentError]
+        def validate_base
+          raise(ArgumentError, "#{ self } did not have a proper action. Unable to continue.") unless action
+          raise(ArgumentError, "#{ self } did not have a proper eventId. Unable to continue.") unless event_id
+          raise(ArgumentError, "#{ self } did not have a proper thread. Unable to continue.") unless thread
+          raise(ArgumentError, "#{ self } did not have a proper time. Unable to continue.") unless time
+          raise(ArgumentError, "#{ self } did not have a proper type. Unable to continue.") unless type
+        end
+
+        # @raise [ArgumentError]
+        def validate_dataflow
+          unless parent_object_ids
+            raise(ArgumentError, "#{ self } did not have a proper parentObjectIds. Unable to continue.")
+          end
+          unless taint_ranges && !taint_ranges.empty?
+            raise(ArgumentError, "#{ self } did not have a proper taintRanges. Unable to continue.")
+          end
+          raise(ArgumentError, "#{ self } did not have a proper args. Unable to continue.") unless args
+          raise(ArgumentError, "#{ self } did not have a proper object. Unable to continue.") unless object
+          raise(ArgumentError, "#{ self } did not have a proper signature. Unable to continue.") unless signature
+          raise(ArgumentError, "#{ self } did not have a proper stack. Unable to continue.") unless stack
+          raise(ArgumentError, "#{ self } did not have a proper tags. Unable to continue.") unless tags && !tags.empty?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'base64'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new FindingEventSource class which will include all the needed information for the new reporting
+      # system to relay this information in the Finding/Trace messages. These FindingEventSource are used by TeamServer
+      # to construct the vulnerability information for the assess feature. They indicate the type of data that the
+      # event represents.
+      #
+      # @attr_reader name [String] the name of the source
+      # @attr_reader type [String] the type of the source
+      class FindingEventSource
+        attr_reader :name, :type
+
+        class << self
+          # @param event [Contrast::Agent::Assess::Events::SourceEvent] the event to pull the source off of
+          # @return [Contrast::Agent::Reporting::FindingObject]
+          def convert event
+            report = new
+            report.attach_data(event)
+            report
+          end
+        end
+
+        # Parse the data from a Contrast::Agent::Assess::Events::SourceEvent to attach what is required for reporting
+        # to TeamServer to this Contrast::Agent::Reporting::FindingEventSource
+        #
+        # @param event [Contrast::Agent::Assess::Events::SourceEvent] the event to pull the source off of
+        def attach_data event
+          @name = event.source_name
+          @type = event.source_type
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              name: name, # rubocop:disable Security/Module/Name
+              type: type
+          }
+        end
+
+        def validate
+          raise(ArgumentError, "#{ self } did not have a proper type. Unable to continue.") unless type && !type.empty?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/finding_object.rb

@@ -0,0 +1,90 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'base64'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new FindingObject class which will include all the needed information for the new reporting system
+      # to relay this information in the Finding/Trace messages. These FindingObjects are used by TeamServer to
+      # construct the vulnerability information for the assess feature. They represent those parts of the objects that
+      # were acted on in a Dataflow Finding.
+      #
+      # @attr_reader hash [String] the id of the Object this represents.
+      # @attr_reader tracked [Boolean] if the Object this represents is tracked or not.
+      # @attr_reader value [String] the base64 of the human readable representation of the Object this represents.
+      class FindingObject
+        attr_reader :hash, :tracked, :value
+
+        # We'll truncate any object that isn't important to the taint ranges of this event, so that we don't murder
+        # TeamServer by, for instance, hypothetically sending the entire rendered HTML page >_>  <_<  >_>
+        ELLIPSIS = '...'
+        UNTRUNCATED_PORTION_LENGTH = 25
+        TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
+
+        class << self
+          # @param object [Contrast::Agent::Assess::ContrastObject] the object to translate
+          # @param truncate [Boolean] if the value of this FindingObject should be truncated or not
+          # @return [Contrast::Agent::Reporting::FindingObject]
+          def convert object, truncate
+            report = new
+            report.attach_data(object, truncate)
+            report
+          end
+        end
+
+        # Parse the data from a Contrast::Agent::Assess::ContrastObject to attach what is required for reporting to
+        # TeamServer to this Contrast::Agent::Reporting::FindingObject
+        #
+        # @param object [Contrast::Agent::Assess::ContrastObject]
+        def attach_data object, truncate
+          @hash = object.__id__
+          @tracked = object.tracked?
+          @value = reportable_value(object.object, truncate)
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              hash: hash,
+              tracked: tracked,
+              value: value
+          }
+        end
+
+        def validate
+          raise(ArgumentError, "#{ self } did not have a proper hash. Unable to continue.") unless hash && !hash.empty?
+          raise(ArgumentError, "#{ self } did not have a proper tracked. Unable to continue.") if tracked.nil?
+          return unless value && !value.empty?
+
+          raise(ArgumentError, "#{ self } did not have a proper value. Unable to continue.")
+        end
+
+        private
+
+        # Parse, truncate, and translate the given value to be reported to TeamServer. The field is expected to be
+        # base64 encoded.
+        #
+        # @param value [String] the contrast_string of the object this represents.
+        # @param truncate [Boolean] if the string should be truncated or not.
+        # @return [String]
+        def reportable_value value, truncate
+          if truncate && value.length > TRUNCATION_LENGTH
+            tmp = []
+            tmp << value[0, UNTRUNCATED_PORTION_LENGTH]
+            tmp << ELLIPSIS
+            tmp << value[value.length - UNTRUNCATED_PORTION_LENGTH, UNTRUNCATED_PORTION_LENGTH]
+            value = tmp.join
+          end
+          Base64.strict_encode64(value)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/finding_request.rb

@@ -0,0 +1,121 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Finding class which will include all the needed information for the new reporting system to
+      # relay this information in the Finding/Trace messages. These findings are used by TeamServer to construct the
+      # vulnerability information for the assess feature. They represent those parts of the application, either through
+      # configuration, method invocation, or dataflow, which are determined to be insecure.
+      #
+      # @attr_accessor events [Array<Contrast::Agent::Assess::ContrastEvent>] if a dataflow based finding, the
+      #   representation of those method calls which constitute a dangerous code path.
+      # @attr_accessor properties [Hash<String,String>] a set of values that TeamServer can use to provide more context
+      #   to the user when rendering the finding. For some findings, a specific set of keys and values are required.
+      # @attr_accessor request [Contrast::Agent::Request, nil] the request, if any, in which this finding occurred
+      # @attr_accessor hash_code [String] the unique identifier of this finding.
+      # @attr_reader rule_id [String] the name of the rule violated; must match those in TeamServer.
+      class FindingRequest
+        attr_reader :body, :headers, :method, :parameters, :port, :protocol, :query_string, :uri, :version
+
+        class << self
+          # @param request [Contrast::Api::Dtm::HttpRequest,Contrast::Agent::Request]
+          # @return [Contrast::Agent::Reporting::FindingRequest]
+          def convert request
+            report = new
+            if request.cs__is_a?(Contrast::Agent::Request)
+              report.attach_data(request)
+            else
+              report.attach_dtm_data(request)
+            end
+            report
+          end
+        end
+
+        # Parse the data from a Contrast::Agent::Request to attach what is required for reporting to TeamServer to this
+        # Contrast::Agent::Reporting::FindingRequest
+        #
+        # @param request [Contrast::Agent::Request]
+        def attach_data request
+          @body = request.body
+          @headers = {}
+          request.headers.each_pair do |key, value|
+            next unless key && value
+
+            # We need to change from the uppercase _ format to capitalized - format.
+            header = key.split('_')
+            header.each(&:capitalize!)
+            header = header.join('-')
+            headers[header] = value.split
+          end
+          @method = request.request_method
+          @parameters = {}
+          request.parameters.each_pair do |key, value|
+            @parameters[key] = value
+          end
+          @port = request.port || 0
+          @protocol = request.scheme
+          @query_string = request.query_string
+          @uri = request.normalized_uri
+          @version = request.version
+        end
+
+        # Parse the data from a Contrast::Api::Dtm::HttpRequest to attach what is required for reporting to TeamServer
+        # to this Contrast::Agent::Reporting::FindingRequest
+        #
+        # @param request_dtm [Contrast::Api::Dtm::HttpRequest]
+        def attach_dtm_data request_dtm
+          @body = request_dtm.request_body_binary
+          @headers = {}
+          request_dtm.request_headers.each_pair do |key, value|
+            next unless key && value
+
+            # We need to change from the uppercase _ format to capitalized - format.
+            header = key.split('_')
+            header.each(&:capitalize!)
+            header = header.join('-')
+            headers[header] = value.split
+          end
+          @method = request_dtm.method # rubocop:disable Security/Object/Method
+          @parameters = {}
+          request_dtm.normalized_request_params.each_value do |pair|
+            @parameters[pair.key] = pair.values
+          end
+          @port = nil
+          @protocol = request_dtm.protocol
+          @query_string = request_dtm.query_string
+          @uri = request_dtm.uri
+          @version = request_dtm.version
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              body: body,
+              headers: headers,
+              method: method, # rubocop:disable Security/Object/Method
+              parameters: parameters,
+              port: port || 0,
+              protocol: protocol,
+              queryString: query_string,
+              uri: uri,
+              version: version
+          }
+        end
+
+        def validate
+          unless cs__method && !cs__method.empty?
+            raise(ArgumentError, "#{ self } did not have a proper method. Unable to continue.")
+          end
+          raise(ArgumentError, "#{ self } did not have a proper uri. Unable to continue.") unless uri && !uri.empty?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/finding_signature.rb

@@ -0,0 +1,105 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new FindingSignature class which will include all the needed information for the new reporting
+      # system to relay this information in the Finding/Trace messages. These FindingObjects are used by TeamServer to
+      # construct the vulnerability information for the assess feature. They represent the signature of the method that
+      # was invoked in this event.
+      #
+      # @attr_reader arg_types [String] the types of the arguments in this event; may be different for each invocation
+      #   of the method.
+      # @attr_reader class_name [String] the name of the class of this object or the name itself if of Module type.
+      # @attr_reader constructor [Boolean] if the method is a constructor or not.
+      # @attr_reader expression_type [String] unused.
+      # @attr_reader flags [Integer] the Java flags.
+      # @attr_reader method_name [String] the name of the method.
+      # @attr_reader operator [String] unused.
+      # @attr_reader return_type [String] the type of the return in this event; may be different for each invocation of
+      #   the method.
+      # @attr_reader signature [String] the id of the Object this represents.
+      # @attr_reader void_method [Boolean] if the method is void or not; may be different for each invocation of the
+      #   method.
+      class FindingSignature
+        attr_reader :arg_types, :class_name, :constructor, :expression_type, :flags, :method_name, :operator,
+                    :return_type, :signature, :void_method
+
+        class << self
+          # @param event [Contrast::Agent::Assess::ContrastEvent] the event to build a signature for
+          # @return [Contrast::Agent::Reporting::FindingSignature]
+          def convert event
+            report = new
+            report.attach_data(event)
+            report
+          end
+        end
+
+        # Parse the data from a Contrast::Agent::Assess::ContrastEvent to attach what is required for reporting to
+        # TeamServer to this Contrast::Agent::Reporting::FindingSignature
+        #
+        # @param event [Contrast::Agent::Assess::ContrastEvent]
+        def attach_data event
+          node = event.policy_node
+          @arg_types = []
+          event.args&.each do |arg|
+            arg_types << type_name(arg)
+          end
+          @class_name = node.class_name
+          @constructor = node.method_name == :new || node.method_name == :initialize
+          # 8 is STATIC in Java... we have to placate them for now it has been requested that flags be removed since it
+          # isn't used
+          @flags = 8 unless policy_node.instance_method?
+          @method_name = node.method_name
+          @return_type = type_name(event.ret)
+          # if there's a ret, then this method isn't nil. not 100% full proof since you can return nil, but this is the
+          # best we've got currently.
+          @void_method = event.ret.nil? ||
+              event.ret.object.nil? ||
+              event.ret.object == Contrast::Utils::ObjectShare::NIL_STRING
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              argTypes: arg_types,
+              className: class_name,
+              constructor: constructor,
+              # expressionType: expression_type, # This is unused by the Ruby agent
+              flags: flags.to_i,
+              methodName: method_name,
+              # operator: operator, # This is unused by the Ruby agent
+              returnType: return_type,
+              # signature: signature, # This is unused by the Ruby agent
+              voidMethod: void_method
+          }
+        end
+
+        def validate
+          raise(ArgumentError, "#{ self } did not have a proper argTypes. Unable to continue.") unless arg_types
+          raise(ArgumentError, "#{ self } did not have a proper constructor. Unable to continue.") if constructor.nil?
+        end
+
+        private
+
+        # While Ruby signatures do not require neither a return type and can return anything depending on inputs, code
+        # paths, etc, nor constant parameter types, TeamServer was designed with strongly typed languages (Java) in
+        # mind, so we need types in our signatures.
+        #
+        # @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil] the object to find the type of
+        # @return [String] the name of the module of the ret_obj, or `nil`
+        def type_name contrast_object
+          contrast_object ? contrast_object.object_type : Contrast::Utils::ObjectShare::NIL_STRING
+        end
+      end
+    end
+  end
+end