contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/config/root_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/ruby_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -23,17 +23,20 @@ module Contrast
       DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
 
       KEYS = {
-          disabled_agent_rake_tasks: Contrast::Config::DefaultValue.new(DISABLED_RAKE_TASK_LIST),
+          disabled_agent_rake_tasks: DISABLED_RAKE_TASK_LIST,
           exceptions: Contrast::Config::ExceptionConfiguration,
           # controls whether or not we patch interpolation, either by rewrite or by funchook
-          interpolate: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          interpolate: Contrast::Utils::ObjectShare::TRUE,
           # controls whether or not we patch the rb_yield block to track split propagation
-          propagate_yield: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          propagate_yield: Contrast::Utils::ObjectShare::TRUE,
           # control whether or not we run file scanning rules on require
-          require_scan: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
+          require_scan: Contrast::Utils::ObjectShare::TRUE,
           # controls whether or not we track frozen Strings by replacing them
-          track_frozen_sources: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE),
-          uninstrument_namespace: Contrast::Config::DefaultValue.new(DEFAULT_UNINSTRUMENTED_NAMESPACES)
+          track_frozen_sources: Contrast::Utils::ObjectShare::TRUE,
+          # controls tracking outside of request
+          non_request_tracking: Contrast::Utils::ObjectShare::FALSE,
+          uninstrument_namespace: DEFAULT_UNINSTRUMENTED_NAMESPACES
+
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/sampling_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/server_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/service_configuration.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/config/default_value'
 require 'contrast/config/logger_configuration'
 
 module Contrast
@@ -20,7 +19,7 @@ module Contrast
           port: EMPTY_VALUE,
           socket: EMPTY_VALUE,
           logger: Contrast::Config::LoggerConfiguration,
-          bypass: Contrast::Config::DefaultValue.new(false)
+          bypass: false
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -11,7 +11,6 @@ module Contrast
 end
 
 require 'contrast/config/base_configuration'
-require 'contrast/config/default_value'
 
 require 'contrast/config/logger_configuration'
 

data/lib/contrast/configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'
@@ -87,7 +87,7 @@ module Contrast
     def yaml_to_hash path
       if path && File.readable?(path)
         begin
-          yaml = IO.read(path)
+          yaml = File.read(path)
           yaml = ERB.new(yaml).result if defined?(ERB)
           return YAML.safe_load(yaml)
         rescue Psych::Exception => e
@@ -205,7 +205,6 @@ module Contrast
     # in the thing to convert and setting them in the given hash. For now, this
     # logs every possible key, whether set or not. If we want to change that
     # behavior, we can skip adding keys to the hash if the value is nil, blank,
-    # or Contrast::Config::DefaultValue depending on desired behavior
     #
     # @param hash [Hash] the hash to populate
     # @param convert [Contrast::Config::BaseConfiguration, Object] the level of

data/lib/contrast/extension/assess/array.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch'
 require 'contrast/agent/patching/policy/patcher'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -42,19 +43,18 @@ module Contrast
               shift = 0
               separator_length = separator.nil? ? 0 : separator.to_s.length
               parent_events = []
-              ary.each do |obj|
-                if obj # skip nil here
-                  properties.copy_from(obj, ret, shift)
-                  shift += obj.to_s.length
-                  parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
-                  parent_events << parent_event if parent_event
-                end
+              ary.compact.each do |obj|
+                properties.copy_from(obj, ret, shift)
+                shift += obj.to_s.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(obj)&.event
+                parent_events << parent_event if parent_event
                 shift += separator_length
               end
               return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
               properties.cleanup_tags
-              properties.build_event(ARRAY_JOIN_NODE, ret, ary, ret, [separator])
+              event_data = Contrast::Agent::Assess::Events::EventData.new ARRAY_JOIN_NODE, ret, ary, ret, [separator]
+              properties.build_event(event_data)
               properties.event.instance_variable_set(:@_parent_events, parent_events)
               ret
             end

data/lib/contrast/extension/assess/erb.rb

@@ -1,9 +1,16 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This module is used to track propagation through ERB template rendering
 module ERBPropagator
   class << self
+    # After ERB#result method is called we need to take the tags to the target and keep the
+    # propagation.
+    #
+    # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event
+    # @param preshift [Contrast::Agent::Assess::Preshift] Saved state before the propagation
+    # @param ret [the Return of the invoked method]
+    # @param _block [&block, nil] block passed
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
       return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
@@ -13,6 +20,30 @@ module ERBPropagator
 
       erb_pre_result = preshift.object.src
       parent_events = []
+      binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
+      properties.build_event(Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args), 1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
+      ret
+    end
+
+    private
+
+    # Checks if binded variables set includes the object we track and proceed to update tags in the returned value
+    #
+    # @param binding_variable_set [Array<Symbol>] list of local variables used in the binding of params
+    # @param used_binding [Binding] the binding in of the current event, saved as preshift argument
+    # @param erb_pre_result [String] the source saved in the preshift
+    # @param properties [Contrast::Agent::Assess::Properties] properties of the target if none create new
+    # @param parent_events [Array<Contrast::Agent::Assess::ContrastEvent>] parents event extracted from the source
+    #                                                                      properties
+    # @param ret [String] the Return of the invoked method
+    # @return [Array<Symbol>]
+    def binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
         next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
@@ -25,10 +56,6 @@ module ERBPropagator
         parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
         parent_events << parent_event if parent_event
       end
-      properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
-      properties.event.instance_variable_set(:@_parent_events, parent_events)
-
-      ret
     end
   end
 end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -23,6 +23,8 @@ module Contrast
           end
 
           def apply_trigger obj, source, ret, clazz, method
+            return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
             # Since we know this is the source of the trigger, we can do some
             # optimization here and return when it is not tracked
             return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/at_exit_hook'
@@ -11,6 +11,7 @@ module Contrast
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
         def apply_trigger source
+          return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
           # Since we know this is the source of the trigger, we can do some
           # optimization here and return when it is not tracked
           return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)

data/lib/contrast/extension/assess/fiber.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -64,7 +65,8 @@ module Contrast
                 next unless (result_properties = Contrast::Agent::Assess::Tracker.properties!(result))
 
                 result_properties.splat_from(fiber, result)
-                result_properties.build_event(FIBER_YIELD_NODE, result, fiber, result, [])
+                event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_YIELD_NODE, result, fiber, result, [])
+                result_properties.build_event(event_data)
               end
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
@@ -80,7 +82,8 @@ module Contrast
               return unless properties
 
               properties.splat_from(underlying, fiber)
-              properties.build_event(FIBER_NEW_NODE, fiber, underlying, fiber, [])
+              event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_NEW_NODE, fiber, underlying, fiber, [])
+              properties.build_event(event_data)
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Fiber.new', e)

data/lib/contrast/extension/assess/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/assess/exec_trigger'
 require 'contrast/components/logger'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -45,8 +46,12 @@ module Contrast
 
             parent_events = []
             track_sprintf(ret, format_string, args, parent_events)
-
-            properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
+            event_data = Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                        ret,
+                                                                        preshift.object,
+                                                                        ret,
+                                                                        preshift.args)
+            properties.build_event(event_data, 1)
 
             properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret

data/lib/contrast/extension/assess/marshal.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -29,6 +30,8 @@ module Contrast
 
           def cs__load_assess source, ret
             with_contrast_scope do
+              return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
               args = [source]
               # source might not be all the args passed in, but it is the one we care
               # about. we could pass in all the args in the last param here if it
@@ -40,7 +43,8 @@ module Contrast
               properties.copy_from(source, ret)
 
               node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
-              properties.build_event(node, ret, self, ret, args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new node, ret, self, ret, args
+              properties.build_event(event_data)
             rescue StandardError => e
               logger.error('Unable to run Assess for Marshal.load', e)
             end

data/lib/contrast/extension/assess/regexp.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -53,7 +54,12 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.splat_from(string, target)
-              properties.build_event(REGEXP_EQUAL_SQUIGGLE_NODE, target, self, result, [string])
+              event_data = Contrast::Agent::Assess::Events::EventData.new(REGEXP_EQUAL_SQUIGGLE_NODE,
+                                                                          target,
+                                                                          self,
+                                                                          result,
+                                                                          [string])
+              properties.build_event(event_data)
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Regexp#=~', e)

data/lib/contrast/extension/assess/string.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -46,7 +47,12 @@ module Contrast
                 parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
                 parent_events << parent_event if parent_event
               end
-              properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(INTERPOLATION_NODE,
+                                                                          result,
+                                                                          inputs,
+                                                                          result,
+                                                                          inputs)
+              properties.build_event(event_data)
               properties.event.instance_variable_set(:@_parent_events, parent_events)
             end
           rescue StandardError => e

data/lib/contrast/extension/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/delegator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Some developers override various methods on Delegator, which can often

data/lib/contrast/extension/extension.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -36,10 +36,8 @@ module Contrast
           # conditions
           def assign_value path
             case path
-            when /fiber/
+            when /fiber/, /interpolation26/
               require path if Funchook.available?
-            when /interpolation26/
-              require path if ::Contrast::AGENT.patch_interpolation? && Funchook.available?
             else
               require path
             end

data/lib/contrast/extension/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'

data/lib/contrast/extension/module.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/extension/protect/psych.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 if defined?(Psych)

data/lib/contrast/extension/protect.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # ensure that we're being loaded with an agent
@@ -10,22 +10,41 @@
 # exists mostly for reference.
 #
 # Scope HAS to exist per-fiber.
+# Check to see if Thread#initialize has been prepended. If it hasn't, then we should use the alias approach, so that
+# others can continue to alias it. If it has been, then we must use prepend ourselves.
+if Thread.instance_method(:initialize).owner == Thread
+  # Alias-chaining Thread#initialize.
+  class Thread
+    alias_method :cs__initialize, :initialize
 
-# Monkey-patching Thread#initialize.
-class Thread
-  alias_method :cs__initialize, :initialize
+    def initialize *args, &block
+      # Thread.current still references the original(callee) thread that is instantiating this new fiber during
+      # initialization.
+      Contrast::Components::Scope::MONITOR.synchronize do
+        if (current_context = Thread.current[:current_context])
+          self[:current_context] = current_context.dup
+        end
 
-  def initialize *args, &block
-    # Thread.current still references the original(callee) thread that is
-    # instantiating this new fiber during initialization
-    Contrast::Components::Scope::MONITOR.synchronize do
-      if (current_context = Thread.current[:current_context])
-        self[:current_context] = current_context.dup
+        Contrast::Components::Scope.sweep_dead_ecs
       end
 
-      Contrast::Components::Scope.sweep_dead_ecs
+      cs__initialize(*args, &block)
+    end
+  end
+else
+  # Prepending Thread#initialize.
+  module ContrastThread
+    def initialize *args, &block
+      # Thread.current still references the original(callee) thread that is instantiating this new fiber during
+      # initialization.
+      Contrast::Components::Scope::MONITOR.synchronize do
+        if (current_context = Thread.current[:current_context])
+          self[:current_context] = current_context.dup
+        end
+        Contrast::Components::Scope.sweep_dead_ecs
+      end
+      super
     end
-
-    cs__initialize(*args, &block)
   end
+  Thread.prepend(ContrastThread)
 end

data/lib/contrast/framework/base_support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -30,6 +30,10 @@ module Contrast
         raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
       end
 
+      def current_route_coverage
+        raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
+      end
+
       def current_route
         raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
       end

data/lib/contrast/framework/grape/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'
@@ -91,6 +91,30 @@ module Contrast
             Contrast::Api::Dtm::RouteCoverage.from_grape_controller(final_controller, method, route_pattern, full_route)
           end
 
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Grape::API] optionally use this controller instead of global ::Grape::API.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Grape::API, full_route = nil
+            return unless grape_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find final controller - actually we gotta match the route to the scanned application
+            # Initially Grape compiles all routes on startup, so we can use the url from the request
+            # and create the observed route
+            # Class < Grape::API, Grape::Router::Route
+            final_controller, route_pattern = _route_recurse(method, _cleaned_route(request), grape_controllers)
+            return unless final_controller
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data final_controller, method, route_pattern, full_route
+          end
+
           # Search object space for grape controllers--any class that subclasses ::Grape::API.
           #
           # @return [Array<::Grape::API>] grape controllers