contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/agent/request_handler.rb

@@ -1,8 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporter'
+require 'contrast/agent/reporting/reporting_utilities/dtm_message'
 
 module Contrast
   module Agent
@@ -19,15 +21,49 @@ module Contrast
         @ruleset = ::Contrast::AGENT.ruleset
       end
 
-      # TODO: RUBY-1353
+      # Send Activities messages to TS [Contrast::Agent::Reporting::ServerActivity,
+      #                                 Contrast::Api::Dtm::ServerActivity,
+      #                                 Contrast::Api::Dtm::Activity,
+      #                                 Contrast::Api::Dtm::ObservedRoute]
+      # If bypass is enabled use the reporting service if not than the messages are
+      # send with speedracer
       # TODO: RUBY-1355
-      # TODO: RUBY-1357
       # TODO: RUBY-1358
+      # TODO: RUBY-1438 -- remove
       def send_activity_messages
+        events = [context.activity]
+        unless Contrast::Agent::Reporter.enabled?
+          Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage(context.activity)
+          events << context.server_activity
+          events << context.observed_route
+        end
+        events.each do |message|
+          Contrast::Agent.messaging_queue&.send_event_eventually(message)
+        end
+      end
+
+      # reports events[Contrast::Agent::Reporting::ReporterEvent] to TS
+      # This method is used to send our JSON messages directly to TeamServer at the end of each request. As we move
+      # more endpoints over, this method will take the messages originally sent by #send_actiivty_messages. At the end,
+      # that method should be removed.
+      # TODO: RUBY-1358
+      def report_activity
+        return unless Contrast::Agent::Reporter.enabled?
+
+        reporter = Contrast::Agent.reporter
+        return unless reporter
+
         Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage(context.activity)
-        [context.server_activity, context.activity, context.observed_route].each do |message|
-          Contrast::Agent.messaging_queue.send_event_eventually(message)
+        [
+          context.new_observed_route,
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages)
+        ].each do |event|
+          reporter.send_event(event)
+        rescue StandardError => e
+          logger.warn('Unable to send Event Activity', e)
         end
+        context.activity.library_usages.clear # TODO: RUBY-1355 remove when no longer using activity
       end
 
       # If the response is streaming, we should only perform filtering on our stream safe rules

data/lib/contrast/agent/response.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'resolv'
@@ -8,6 +8,7 @@ require 'contrast/utils/object_share'
 require 'contrast/utils/string_utils'
 require 'contrast/utils/hash_digest'
 require 'contrast/components/logger'
+require 'contrast/utils/response_utils'
 
 module Contrast
   module Agent
@@ -17,6 +18,7 @@ module Contrast
     # order to avoid repeatedly creating Strings & thrashing GC.
     class Response
       include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Utils::ResponseUtils
 
       extend Forwardable
 
@@ -27,6 +29,9 @@ module Contrast
         @is_array = !rack_response.is_a?(Rack::Response)
       end
 
+      # The document type of the response, based on its Content-Type. Can be one of :JSON, :NORMAL, :XML, or nothing.
+      #
+      # @return [Symbol<:XML, :JSON, :NORMAL>, nil]
       def document_type
         case content_type
         when /xml/i
@@ -38,7 +43,10 @@ module Contrast
         end
       end
 
-      # B/c the response can change, we can't memoize this :(
+      # A form of the Rack::Response which we can report to the Service to be sent to TeamServer for processing. B/c
+      # the response can change, we can't memoize this :(
+      #
+      # @return [Contrast::Api::Dtm::HttpResponse]
       def dtm
         context_response = Contrast::Api::Dtm::HttpResponse.new
         context_response.response_code = response_code.to_i
@@ -53,114 +61,43 @@ module Contrast
         context_response
       end
 
+      # The response code of this response
+      #
+      # @return [Integer]
       def response_code
         return unless rack_response
 
         @is_array ? rack_response[0].to_i : rack_response.status
       end
 
+      # The headers of this response
+      #
+      # @return [Hash, nil]
       def headers
         return unless rack_response
 
-        if @is_array
-          rack_response[1]
-        else
-          rack_response.headers
-        end
+        @is_array ? rack_response[1] : rack_response.headers
       end
 
+      # The Content-Type of this response, as set in the headers hash under the key Rack::CONTENT_TYPE
+      #
+      # @return [String, nil]
       def content_type
         return unless rack_response
 
-        if @is_array
-          headers[Rack::CONTENT_TYPE]
-        else
-          rack_response.content_type
-        end
+        @is_array ? headers[Rack::CONTENT_TYPE] : rack_response.content_type
       end
 
-      # The response body can change during the request lifecycle
-      # We should not extract it out as a variable here, or we'll miss those
-      # changes.
+      # The response body can change during the request lifecycle, so we have to look it up every time we need it.
+      # We should not extract it out as a variable here, or we'll miss those changes.
+      #
+      # @return [String, nil]
       def body
         return unless rack_response
 
         body_content = @is_array ? rack_response[2] : rack_response.body
         extract_body(body_content)
       end
-
-      private
-
-      # From the dtm for normalized_response_headers:
-      #   Key is UPPERCASE_UNDERSCORE
-      #
-      #   Example: Content-Type: text/html; charset=utf-8
-      #   "CONTENT_TYPE" => Content-Type,["text/html; charset=utf8"]
-      def append_pair map, key, value
-        return unless key && value
-        return if value.is_a?(Hash)
-
-        safe_key = Contrast::Utils::StringUtils.force_utf8(key)
-        hash_key = Contrast::Utils::StringUtils.normalized_key(safe_key)
-        map[hash_key] ||= Contrast::Api::Dtm::Pair.new
-        map[hash_key].key = safe_key
-        map[hash_key].values << Contrast::Utils::StringUtils.force_utf8(value)
-      end
-
-      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
-
-      # Given some holder of the content of the response's body, extract that
-      # content and return it as a String
-      #
-      # @param body [String, Rack::File, Rack::BodyProxy,
-      #   ActionDispatch::Response::RackBody, Rack::Response] Something that
-      #   holds, wraps, or is the body of the Response
-      # @return [nil, String] the content of the body
-      def extract_body body
-        return unless body
-
-        if defined?(Rack::File) && body.is_a?(Rack::File)
-          # not sure what to do in this situation, so don't do anything.
-          nil
-        elsif body.is_a?(Rack::BodyProxy)
-          handle_rack_body_proxy(body)
-        elsif (defined?(ActionDispatch::Response::RackBody) && body.is_a?(ActionDispatch::Response::RackBody)) ||
-              body.is_a?(Rack::Response)
-
-          extract_body(body.body)
-        elsif Contrast::Utils::DuckUtils.quacks_to?(body, :each)
-          acc = []
-          body.each { |tmp| acc << read_or_string(tmp) }
-          acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
-        elsif ActionView::OutputBuffer
-          # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
-          body.to_str
-        else
-          read_or_string(body)
-        end
-      end
-
-      def handle_rack_body_proxy body
-        next_body = body.instance_variable_get(:@body)
-        case next_body
-        when Array
-          extract_body(next_body[0])
-        else
-          extract_body(next_body)
-        end
-      end
-
-      def read_or_string obj
-        return unless obj
-
-        if Contrast::Utils::DuckUtils.quacks_to?(obj, :read)
-          tmp = obj.read
-          obj.rewind
-          tmp
-        else
-          obj.to_s
-        end
-      end
     end
   end
 end

data/lib/contrast/agent/rule_set.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/service_heartbeat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/startup_metrics_telemetry_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/metrics_hash'
@@ -17,14 +17,41 @@ module Contrast
       include Contrast::Utils::OS
 
       APP_AND_SERVER_DATA = ::Contrast::APP_CONTEXT.app_and_server_information.cs__freeze
-      SAAS_DEFAULT = { addr: 'app.contrastsecuirty.com', type: 'SAAS_DEFAULT' }.cs__freeze
+      # Multi-tenant Production Environments
+      SAAS_DEFAULT = { addr: 'app.contrastsecurity.com', type: 'SAAS_DEFAULT' }.cs__freeze
+      SAAS_CS = { addr: /cs[[:digit:]]+\.contrastsecurity\.com/, type: 'SAAS_DEFAULT' }.cs__freeze
+      SAAS_JP = { addr: 'app.contrastsecurity.jp', type: 'SAAS_DEFAULT' }.cs__freeze
       SAAS_CE = { addr: 'ce.contrastsecurity.com', type: 'SAAS_CE' }.cs__freeze
-      SAAS_CUSTOM = { addr: 'contrastsecurite.com', type: 'SAAS_CUSTOM' }.cs__freeze
-      SAAS_POV = { addr: 'eval.contrastsecuirty.com', type: 'SAAS_POV' }.cs__freeze
+      # Multi-tenant Demo Environments
+      SAAS_DEMO = { addr: 'apptwo.contrastsecurity.com', type: 'SAAS_DEMO' }.cs__freeze
+      SAAS_POV = { addr: 'eval.contrastsecurity.com', type: 'SAAS_POV' }.cs__freeze
+      # Multi-tenant Testing Environment
+      SAAS_RESEARCH = { addr: 'security-research.contrastsecurity.com', type: 'SAAS_RESEARCH' }.cs__freeze
+      SAAS_ALPHA = { addr: 'alpha.contrastsecurity.com', type: 'SAAS_ALPHA' }.cs__freeze
+      SAAS_STAGING = { addr: 'teamserver-staging.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
+      SAAS_STAGING_TOKYO = { addr: 'teamserver-staging.contsec.jp', type: 'SAAS_TESTING' }.cs__freeze
+      SAAS_TESTING = { addr: 'teamserver-darpa.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
+      SAAS_OPS_TESTING = { addr: 'teamserver-ops.contsec.com', type: 'SAAS_TESTING' }.cs__freeze
+      # Fallback for Single-tenant Production Environments
+      SAAS_CUSTOM = { addr: 'contrastsecurity.com', type: 'SAAS_CUSTOM' }.cs__freeze
+      SAAS_CUSTOM_JP = { addr: 'contrastsecurity.jp', type: 'SAAS_CUSTOM' }.cs__freeze
+
+      SINGLE_MAP_TENANTS = [
+        SAAS_DEFAULT, SAAS_JP, SAAS_CE, SAAS_DEMO, SAAS_POV, SAAS_RESEARCH, SAAS_ALPHA,
+        SAAS_STAGING, SAAS_STAGING_TOKYO, SAAS_TESTING, SAAS_OPS_TESTING
+      ].cs__freeze
+      REGEXP_MAP_TENANTS = [SAAS_CS].cs__freeze
+      FALLBACK_TENANTS = [SAAS_CUSTOM, SAAS_CUSTOM_JP].cs__freeze
+      # Fallback for Custom, most likely self-hosted, Environments
       EOP = 'EOP'
+      REJECTED_VALUES = [:EMPTY_VALUE, 'NEEDS_TO_BE_SET', Contrast::Utils::ObjectShare::EMPTY_STRING].cs__freeze
 
       def initialize
         super
+        @settings = []
+        add_config_keys ::Contrast::CONFIG.root, 'root'
+        @settings << ENV.keys.select { |v| v.starts_with?('CONTRAST') }
+        @settings.flatten
         add_tags
       end
 
@@ -33,14 +60,25 @@ module Contrast
       end
 
       def add_tags
-        @tags['teamserver'] = teamserver_type
-        @tags['agent_version'] = VERSION
-        @tags['ruby_version'] = RUBY_VERSION
-        @tags['os_type'] = sys_info['os_type'] == 'Darwin' ? 'MacOS' : 'Linux'
-        @tags['os_arch'] = sys_info['os_arch']
-        @tags['os_version'] = sys_info['os_version']
+        add_system_tags
         @tags['app_framework_and_version'] = APP_AND_SERVER_DATA[:application_info].to_s
         @tags['server_framework_and_version'] = APP_AND_SERVER_DATA[:server_info].to_s
+        @tags['ASSESS'] = Contrast::ASSESS.enabled?.to_s
+        @tags['PROTECT'] = Contrast::PROTECT.enabled?.to_s
+        @tags['settings'] = @settings.join(',')
+      end
+
+      def add_config_keys config, nested_key
+        config.configuration_map.reject! { |_k, v| REJECTED_VALUES.include?(v) }
+
+        config.configuration_map.each do |k, v|
+          unless v.cs__class <= Contrast::Config::BaseConfiguration
+            @settings << "#{ nested_key }.#{ k }"
+            next
+          end
+
+          add_config_keys v, "#{ nested_key }.#{ k }"
+        end
       end
 
       def sys_info
@@ -50,21 +88,33 @@ module Contrast
 
       private
 
-      # Here we extract the Teamserver url type
+      # Here we extract the TeamServer url type
       #
-      # @return[String] type, it could be SAAS_DEFAULT, SAAS_POV, SAAS_CE, SAAS_CUSTOM, or EOP
+      # @return [String] the type of TeamServer environment to which we're connecting
       def teamserver_type
-        @_teamserver_type ||= if Contrast::API.api_url.include?(SAAS_DEFAULT[:addr])
-                                SAAS_DEFAULT[:type]
-                              elsif Contrast::API.api_url.include?(SAAS_POV[:addr])
-                                SAAS_POV[:type]
-                              elsif Contrast::API.api_url.include?(SAAS_CE[:addr])
-                                SAAS_CE[:type]
-                              elsif Contrast::API.api_url.end_with? SAAS_CUSTOM[:addr]
-                                SAAS_CUSTOM[:type]
-                              else
-                                EOP
-                              end
+        @_teamserver_type ||= begin
+          url = Contrast::API.api_url
+          if (single = SINGLE_MAP_TENANTS.find { |tenant| url.include?(tenant[:addr]) })
+            single[:type]
+          elsif (regexp = REGEXP_MAP_TENANTS.find { |tenant| tenant[:addr].match?(url) })
+            regexp[:type]
+          elsif (fallback = FALLBACK_TENANTS.find { |tenant| url.include?(tenant[:addr]) })
+            fallback[:type]
+          else
+            EOP
+          end
+        end
+      end
+
+      # Here we attach the key-value pairs of the system
+      #
+      def add_system_tags
+        @tags['teamserver'] = teamserver_type
+        @tags['agent_version'] = VERSION
+        @tags['ruby_version'] = RUBY_VERSION
+        @tags['os_type'] = sys_info['os_type'] == 'Darwin' ? 'MacOS' : 'Linux'
+        @tags['os_arch'] = sys_info['os_arch']
+        @tags['os_version'] = sys_info['os_version']
       end
     end
   end

data/lib/contrast/agent/static_analysis.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporting_events/application_update'
 require 'contrast/api/decorators/application_update'
 
 module Contrast
@@ -10,8 +11,8 @@ module Contrast
     # this module handles one time static analysis tasks
     class StaticAnalysis
       include Singleton
-      include Contrast::Components::Logger::InstanceMethods
       include Contrast::Components::Scope::InstanceMethods
+      extend Contrast::Components::Logger::InstanceMethods
 
       class << self
         # After the first request is complete, we do a one-time manual catchup to review and report the already-loaded
@@ -23,7 +24,6 @@ module Contrast
           end
         end
 
-        # TODO: RUBY-1354
         # TODO: RUBY-1356
         def send_inventory_message
           return unless ::Contrast::INVENTORY.enabled?
@@ -31,7 +31,17 @@ module Contrast
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
 
           Contrast::Agent::Inventory::DatabaseConfig.append_db_config(app_update_msg)
-          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+          # TODO: RUBY-1438 -- remove and build ReportingEvent directly
+          if Contrast::Agent.reporter
+            report = Contrast::Agent::Reporting::DtmMessage.dtm_to_event(app_update_msg)
+            Contrast::Agent.reporter.send_event(report)
+
+            # This is being reported separately because we extract the data from the same message
+            inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
+            Contrast::Agent.reporter.send_event(inventory_report)
+          else
+            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+          end
         end
 
         private

data/lib/contrast/agent/telemetry.rb

@@ -1,9 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/env_variables'
 require 'contrast/components/logger'
-require 'contrast/utils/requests_client'
+require 'contrast/utils/telemetry_client'
 require 'contrast/agent/worker_thread'
 require 'contrast/utils/telemetry'
 
@@ -11,7 +11,6 @@ module Contrast
   module Agent
     # This class will initialize and hold everything needed for the telemetry
     class Telemetry < WorkerThread
-      include Contrast::Utils::RequestsClient
       include Contrast::Components::Logger::InstanceMethods
       # this is where we will send the data from the agents
       URL = 'https://telemetry.ruby.contrastsecurity.com/'
@@ -28,13 +27,13 @@ module Contrast
             mac = Contrast::Utils::Telemetry::Identifier.mac
             app_name = Contrast::Utils::Telemetry::Identifier.app_name
             id = mac + app_name if mac && app_name
-            Digest::SHA2.new(256).hexdigest(id || '_' + SecureRandom.uuid)
+            Digest::SHA2.new(256).hexdigest(id || ('_' + SecureRandom.uuid))
           end
         end
 
         def instance_id
           @_instance_id ||= Digest::SHA2.new(256).hexdigest(Contrast::Utils::Telemetry::Identifier.mac ||
-                                                                  '_' + SecureRandom.uuid)
+                                                                  ('_' + SecureRandom.uuid))
         end
 
         def enabled?
@@ -51,7 +50,8 @@ module Contrast
 
           # In case of connection error, do not create the background thread or queue,
           # as if the opt-out env var was set
-          ip_opt_out_telemetry = Contrast::Utils::RequestsClient.initialize_connection(URL)
+          @_client = Contrast::Utils::TelemetryClient.new
+          ip_opt_out_telemetry = @_client.initialize_connection(URL)
           if ip_opt_out_telemetry.nil?
             logger.warn('Connection was not established properly!!!')
             logger.warn('THE SERVICE IS GOING TO BE TERMINATED!!')
@@ -62,6 +62,14 @@ module Contrast
         end
       end
 
+      def client
+        @_client ||= Contrast::Utils::TelemetryClient.new
+      end
+
+      def connection
+        @_connection ||= client.initialize_connection(URL)
+      end
+
       def attempt_to_start?
         unless cs__class.enabled?
           logger.warn('Telemetry service is disabled!')
@@ -83,8 +91,8 @@ module Contrast
 
           begin
             logger.debug('This is the current processed event', event)
-            res = Contrast::Utils::RequestsClient.send_request event, connection
-            sleep_time = Contrast::Utils::RequestsClient.handle_response res
+            res = client.send_request event, connection
+            sleep_time = client.handle_response res
             sleep(sleep_time) unless sleep_time.nil?
           rescue StandardError => e
             logger.error('Could not send message to service from telemetry queue.', e)

data/lib/contrast/agent/telemetry_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/metrics_hash'
@@ -11,23 +11,22 @@ module Contrast
 
       attr_reader :timestamp, :tags
 
-      # The instance_id comes from the Telemetry Instance
       def initialize
         @tags = MetricsHash.new(String)
-        @timestamp = format_date
-        @instance_id = Contrast::Agent.telemetry_queue.__id__
+        @timestamp = Time.now.iso8601
       end
 
       def path
         ''
       end
 
-      def to_json **_args
-        { tags: @tags, timestamp: @timestamp, instance_id: @instance_id }
-      end
-
-      def format_date
-        Time.now.strftime('%Y-%m-%d %H:%M:%S.%L')
+      def to_hash **_args
+        {
+            tags: @tags,
+            timestamp: @timestamp,
+            instance: Contrast::Agent::Telemetry.instance_id,
+            application: Contrast::Agent::Telemetry.application_id
+        }
       end
     end
   end

data/lib/contrast/agent/thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'

data/lib/contrast/agent/thread_watcher.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
 require 'contrast/agent/service_heartbeat'
 require 'contrast/api/communication/messaging_queue'
+require 'contrast/agent/reporting/report'
 require 'contrast/agent/telemetry'
 
 module Contrast
@@ -24,21 +25,26 @@ module Contrast
         @heartbeat = Contrast::Agent::ServiceHeartbeat.new
         @messaging_queue = Contrast::Api::Communication::MessagingQueue.new
         @telemetry = Contrast::Agent::Telemetry.new if Contrast::Agent::Telemetry.enabled?
+        @reporter = Contrast::Agent::Reporter.new if Contrast::Agent::Reporter.enabled?
       end
 
       def startup!
         return unless ::Contrast::AGENT.enabled?
 
-        telemetry_thread_status = telemetry_thread_init
-        heartbeat_thread_status = heartbeat_thread_init
-        messaging_thread_status = messaging_thread_init
+        telemetry_status = telemetry_thread_init
+        heartbeat_status = heartbeat_thread_init
+        messaging_status = messaging_thread_init
+        reporter_status = reporter_thread_init
 
         logger.debug('ThreadWatcher started threads')
 
-        @pids[Process.pid] = messaging_thread_status && heartbeat_thread_status
+        @pids[Process.pid] = messaging_status && heartbeat_status
         return @pids unless Contrast::Agent::Telemetry.enabled?
 
-        @pids[Process.pid] = messaging_thread_status && heartbeat_thread_status && telemetry_thread_status
+        @pids[Process.pid] = @pids[Process.pid] && telemetry_status
+        return @pids unless Contrast::Agent::Reporter.enabled?
+
+        @pids[Process.pid] = @pids[Process.pid] && reporter_status
       end
 
       def ensure_running?
@@ -53,6 +59,7 @@ module Contrast
         messaging_queue.stop!
         heapdump_util.stop!
         telemetry_queue&.stop!
+        reporter&.stop!
       end
 
       def heartbeat_thread_init
@@ -82,11 +89,30 @@ module Contrast
         messaging_result
       end
 
+      def reporter_thread_init
+        @reporter.start_thread! if @reporter&.attempt_to_start?
+        unless @reporter&.running?
+          logger.debug('Attempting to start reporter thread')
+          @reporter&.start_thread!
+        end
+        reporter_result = @reporter&.running?
+        logger.debug('Reporter thread status', alive: reporter_result)
+        reporter_result
+      end
+
+      # @return [Contrast::Agent::Telemetry]
       def telemetry_queue
         return if @telemetry.nil?
 
         @telemetry
       end
+
+      # @return [Contrast::Agent::Reporter]
+      def reporter
+        return if @reporter.nil?
+
+        @reporter
+      end
     end
   end
 end

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -46,9 +46,6 @@ module Contrast
             Contrast::Agent.framework_manager.register_late_framework(loaded_module)
             Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
             Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
-            if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
-              Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module)
-            end
             Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)
           rescue StandardError => e
             logger.error('Unable to complete TracePoint analysis', e, module: loaded_module, path: path)

data/lib/contrast/agent/version.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Agent
-    VERSION = '4.13.1'
+    VERSION = '5.1.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast