contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/utils/assess/property/tagged_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -9,6 +9,29 @@ module Contrast
       # This module includes simple methods for the tags like
       # adding tags, getting tags, deleting tags and similar
       module TaggedUtils
+        # Is the given tag present?
+        # Used in testing, so found by `be_tagged`, if you're grepping for it
+        #
+        # @param label [Symbol] the tag to check for
+        # @return [Boolean]
+        def tagged? label
+          tracked? && tags.key?(label)
+        end
+
+        # Similar to #tracked?, but limited to a given range.
+        #
+        # @param start [Integer] the inclusive start index to check.
+        # @param finish [Integer] the exclusive end index to check.
+        # @return [Boolean]
+        def any_tags_between? start, finish
+          return false unless tracked?
+
+          tags.each_value do |tag_array|
+            return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
+          end
+          false
+        end
+
         # Given a tag name and range object, add a new tag to this
         # collection. If the given range touches an existing tag,
         # we'll combine the two, adjusting the existing one and

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'
@@ -29,13 +29,13 @@ module Contrast
         end
 
         def sample? request
-          history = request_history(request)
-          history.hit
-
           # if sampling isn't enabled, we record all requests and take a
           # default amount of responses
           return [true, true] unless @enabled
 
+          history = request_history(request)
+          history.hit
+
           # if we've exceeded this sample window, reset it
           if history.elapsed >= @window_ms
             history.reset_window

data/lib/contrast/utils/assess/source_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/split_utils.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module extends the Split class which is specifically for String#split & String#grapheme_clusters
+      # propagation it propagates tag ranges from a string to elements within an untracked array
+      module SplitUtils
+        private
+
+        # Quick hook to the String#split propagation node in our Assess policy
+        #
+        # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
+        def split_node
+          @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+            node.class_name == 'String' && node.method_name == :split && node.instance_method?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
@@ -50,14 +50,9 @@ module Contrast
 
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-              obj.each_pair do |k, v|
-                return true if _tracked?(k, idx) || _tracked?(v, idx)
-              end
-              false
+              handle_hash obj, idx
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-              obj.any? do |ele|
-                _tracked?(ele, idx) unless obj == ele
-              end
+              handle_enumerable obj, idx
             else
               Contrast::Agent::Assess::Tracker.tracked?(obj)
             end
@@ -84,15 +79,9 @@ module Contrast
 
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-              obj.each_pair do |k, v|
-                return true if _trackable?(k, idx)
-                return true if _trackable?(v, idx)
-              end
-              false
+              handle_hash obj, idx
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-              obj.any? do |ele|
-                _trackable?(ele, idx) unless obj == ele
-              end
+              handle_enumerable obj, idx
             else
               Contrast::Agent::Assess::Tracker.trackable?(obj)
             end
@@ -103,6 +92,22 @@ module Contrast
             logger.warn('Failed to determine trackable', e, module: obj.cs__class)
             false
           end
+
+          def handle_hash obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
+            obj.each_pair do |k, v|
+              return true if send(caller_method, k, idx)
+              return true if send(caller_method, v, idx)
+            end
+            false
+          end
+
+          def handle_enumerable obj, idx
+            caller_method = caller(1..1).first[/`.*'/][1..-2].to_sym
+            obj.any? do |ele|
+              send(caller_method, ele, idx) unless obj == ele
+            end
+          end
         end
       end
     end

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,12 +19,13 @@ module Contrast
 
         # Find the request for this finding. This assumes, for now, that if there is an active request, then that
         # is the request to report. Otherwise, we'll use the first request found in the events of the
-        # source_object.
+        # source_object if the non request tracking flag is set.
         #
         # @param source [Object,nil] some Object used as the source of a trigger event
         # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
         def find_request source
           return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless ::Contrast::ASSESS.non_request_tracking?
           return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
 
           find_event_request(properties.event)
@@ -103,7 +104,7 @@ module Contrast
         # @param object [Object] the Object on which the method was invoked
         # @param ret [Object] the Return of the invoked method
         # @param args [Array<Object>] the Arguments with which the method was invoked
-        def apply_dataflow_rule trigger_node, source, object, ret, *args
+        def apply_dataflow_rule trigger_node, source, object, ret, *args # rubocop:disable Metrics/PerceivedComplexity
           return unless source
 
           if Contrast::Agent::Assess::Tracker.trackable?(source)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'
@@ -54,7 +54,7 @@ module Contrast
         # Once we move to 2.7+, we can combine the caches using ID b/c the memory location stops being the id
         #
         # @param object [Object, nil] the entity to convert to a String
-        # @return [String] the human readable form of the String, as defined by
+        # @return [String, Object] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
           # Only treat object like a string if it actually is a string+ some subclasses of String override string
@@ -66,19 +66,23 @@ module Contrast
           else
             return @lru_cache[object.__id__] if @lru_cache.key? object.__id__
 
-            @lru_cache[object.__id__] = if object.nil?
-                                          Contrast::Utils::ObjectShare::NIL_STRING
-                                        elsif object.cs__is_a?(Symbol)
-                                          ":#{ object }"
-                                        elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
-                                          "#{ object.cs__name }@#{ object.__id__ }"
-                                        elsif object.cs__is_a?(Regexp)
-                                          object.source
-                                        elsif use_to_s?(object)
-                                          object.to_s
-                                        else
-                                          "#{ object.cs__class.cs__name }@#{ object.__id__ }"
-                                        end
+            @lru_cache[object.__id__] = convert_object object
+          end
+        end
+
+        def convert_object object
+          if object.nil?
+            Contrast::Utils::ObjectShare::NIL_STRING
+          elsif object.cs__is_a?(Symbol)
+            ":#{ object }"
+          elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
+            "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
+          elsif use_to_s?(object)
+            object.to_s
+          else
+            "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
         end
 

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -39,7 +39,7 @@ module Contrast
       def self.resolve_corrected_path path
         tmp_path = path.dup
         start_match = START_UNDERSCORE.match(tmp_path)
-        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+        tmp_path = tmp_path[start_match.offset(0).last..] if start_match
 
         tmp_path.gsub!(REPEATING_UNDERSCORE, '__')
 

data/lib/contrast/utils/exclude_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/findings.rb

@@ -0,0 +1,65 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Utils
+    # Utility for saving raw findings for later
+    class Findings
+      include Contrast::Components::Logger::InstanceMethods
+
+      def initialize
+        @_collection = []
+      end
+
+      def collection
+        @_collection ||= []
+      end
+
+      def push trigger_node, source, object, ret, *args
+        return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless trigger_node.collectable?
+
+        @_collection << { trigger_node: trigger_node, source: source, object: object, ret: ret, args: args }
+      end
+
+      # Some rules requires response to be available before validating them correctly,
+      # so we check if trigger_node.rule_id is collectable and then save them for
+      # later report, when we have the response.
+      #
+      # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+      # trigger event
+      # @param source [Object] the source of the Trigger Event
+      # @param object [Object] the Object on which the method was invoked
+      # @param ret [Object] the Return of the invoked method
+      # @param args [Array<Object>] the Arguments with which the method was invoked
+      def collect_finding trigger_node, source, object, ret, *args
+        push trigger_node, source, object, ret, args
+        logger.trace('Finding collected', node_id: trigger_node.id,
+                                          source_id: source.__id__,
+                                          rule: trigger_node.rule_id)
+      end
+
+      # Build and report all collected findings for the collectable rules.
+      #
+      # We make sure the content-type is present before reporting, because some
+      # findings do require it for validation.
+      #
+      # @return [true, nil]
+      def report_collected_findings
+        return if @_collection.empty?
+        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
+
+        while @_collection.any?
+          finding = @_collection.pop
+          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding finding[:trigger_node],
+                                                                       finding[:source],
+                                                                       finding[:object],
+                                                                       finding[:ret],
+                                                                       finding[:args]
+        end
+        true
+      end
+    end
+  end
+end

data/lib/contrast/utils/hash_digest.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
+require 'contrast/utils/hash_digest_extend'
 
 module Contrast
   module Utils
@@ -13,6 +14,7 @@ module Contrast
     # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
     class HashDigest < Digest::Class
       include Digest::Instance
+      extend Contrast::Utils::HashDigestExtend
 
       CONTENT_LENGTH_HEADER = 'Content-Length'
       CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
@@ -21,94 +23,48 @@ module Contrast
       CLASS_SOURCE_KEY = 'source'
       CLASS_CONSTANT_NAME_KEY = 'name'
       CLASS_LINE_NO_KEY = 'lineNo'
-      class << self
-        def generate_request_hash request
-          hash = new
-          hash.update(request.request_method)
-          hash.update(request.normalized_uri)
-          request.parameters.each_key do |name|
-            hash.update(name)
-          end
-          cl = request.headers[CONTENT_LENGTH_HEADER]
-          hash.update_on_content_length(cl) if cl
-          hash.finish
-        end
-
-        def generate_event_hash finding, source, request
-          return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
-
-          id = finding.rule_id
-          return generate_crypto_hash(finding, source, request) if CRYPTO_RULES.include?(id)
-
-          generate_trigger_hash(finding, request)
-        end
-
-        def generate_config_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          path = finding.properties[CONFIG_PATH_KEY]
-          hash.update(path)
-          method = finding.properties[CONFIG_SESSION_ID_KEY]
-          hash.update(method)
-          hash.finish
-        end
-
-        def generate_class_scanning_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          module_name = finding.properties[CLASS_SOURCE_KEY]
-          hash.update(module_name)
-          # We're not currently collecting this. 30/7/19 HM
-          line_no = finding.properties[CLASS_LINE_NO_KEY]
-          hash.update(line_no)
-          field = finding.properties[CLASS_CONSTANT_NAME_KEY]
-          hash.update(field)
-          hash.finish
-        end
-
-        private
-
-        def generate_crypto_hash finding, algorithm, request
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update(algorithm)
-          hash.update_on_request(finding, request)
-          hash.finish
-        end
-
-        def generate_dataflow_hash finding, request
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_sources(finding.events)
-          hash.update_on_request(finding, request)
-          hash.finish
-        end
-
-        def generate_trigger_hash finding, request
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request(finding, request)
-          hash.finish
-        end
-      end
 
+      # Update to CRC checksum the finding route and verb if finding route
+      # [Contrast::Api::Dtm::RouteCoverage] is available else update the passed
+      # request or Contrast::REQUEST_TRACKER.current.request uri and used request
+      # method.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] finding to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [Integer, nil] returns nil if there is no request context or tracking
+      # is disabled.
       def update_on_request finding, request
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context || ::Contrast::ASSESS.non_request_tracking?
+
         if (route = finding.routes[0])
-          update(route.route)
-          update(route.verb)
-        elsif request ||= Contrast::Agent::REQUEST_TRACKER.current&.request
-          update(request.normalized_uri)
-          update(request.request_method)
+          update(route.route) # the normalized URL used to access the method in the route.
+          update(route.verb) # the HTTP Verb used  to access the method in the route.
+        elsif request ||= context&.request
+          update(request.normalized_uri) # the normalized URL used to access the method in the route.
+          update(request.request_method) # The HTTP method used in the request
         end
       end
 
+      # Update to CRC checksum the event source name and source type.
+      # Expects Contrast::Api::Dtm::TraceEvent || Contrast::Agent::Assess::Events::SourceEvent
+      #
+      # @param events [Protobuf::Field::FieldArray<Contrast::Api::Dtm::TraceEvent>,
+      #                                            <Contrast::Agent::Assess::Events::SourceEvent>]
+      #                                            Array of TraceEvents
+      # @return checksum [Integer, nil] returns nil if there is no events
       def update_on_sources events
         return unless events&.any?
 
         events.each do |event|
-          event.event_sources.each do |source|
-            update(source.type)
-            update(source.name) # rubocop:disable Security/Module/Name -- API attribute.
+          if event.cs__is_a?(Contrast::Api::Dtm::TraceEvent)
+            event.event_sources&.each do |source|
+              update(source.type)
+              update(source.name) # rubocop:disable Security/Module/Name
+            end
+          elsif event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
+            update(event.source_type)
+            update(event.source_name)
           end
         end
       end
@@ -127,12 +83,23 @@ module Contrast
         @crc32 = 0
       end
 
+      # Converts  given string to CRC checksum. CRC32 checksum ensures that If error
+      # of a single bit occurs, the CRC checksum will fail, regardless of any other
+      # property of the transmitted data, including its length. Called several times
+      # with previous CRC to recalculate the new output.
+      #
+      # @param str [String]
+      # @return @crc32 [Integer, nil] updated value of crc 32 bit integer checksum or
+      # nil if passed string is nil or empty
       def update str
         return unless str
 
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
+      # Casts current CRC checksum to String
+      #
+      # @return @crc32 [String] String representation of CRC32 checksum
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/hash_digest_extend.rb

@@ -0,0 +1,129 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'digest'
+require 'contrast/utils/hash_digest'
+
+module Contrast
+  module Utils
+    # We use this class to provide hashes for our Request and Finding objects
+    # based upon our definitions of uniqueness.
+    # While the uniqueness of the request object is something internal to the
+    # Ruby agent, the uniqueness of the Finding hash is defined by a
+    # specification shared across all agent teams. The spec can be found here:
+    # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
+    module HashDigestExtend
+      # Generates the hash checksum for the request. Converts the request method, uri,
+      # param names and content length to CRC checksum and returns string representation
+      #
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_request_hash request
+        hash = new
+        hash.update(request.request_method)
+        hash.update(request.normalized_uri)
+        request.parameters.each_key do |name|
+          hash.update(name)
+        end
+        cl = request.headers[Contrast::Utils::HashDigest::CONTENT_LENGTH_HEADER]
+        hash.update_on_content_length(cl) if cl
+        hash.finish
+      end
+
+      # Generates the hash checksum for the event, either dataflow,
+      # crypto(crypto-bad-ciphers, crypto-bad-mac) rules or trigger event
+      # and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param source [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_event_hash finding, source, request
+        return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
+
+        id = finding.rule_id
+        return generate_crypto_hash(finding, source, request) if Contrast::Utils::HashDigest::CRYPTO_RULES.include?(id)
+
+        generate_trigger_hash(finding, request)
+      end
+
+      # Generates the hash checksum for configurations. Converts the finding rule_id, session_id and configPath and
+      # to CRC32 checksum and returns string representation to be appended to Contrast::Api::Dtm::Finding
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
+      def generate_config_hash finding
+        hash = new
+        hash.update(finding.rule_id)
+        path = finding.properties[Contrast::Utils::HashDigest::CONFIG_PATH_KEY]
+        hash.update(path)
+        method = finding.properties[Contrast::Utils::HashDigest::CONFIG_SESSION_ID_KEY]
+        hash.update(method)
+        hash.finish
+      end
+
+      # Generates the hash checksum for class scanning. Converts the rule_id, finding.properties(source, name)
+      # to CRC32 checksum and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
+      def generate_class_scanning_hash finding
+        hash = new
+        hash.update(finding.rule_id)
+        module_name = finding.properties[Contrast::Utils::HashDigest::CLASS_SOURCE_KEY]
+        hash.update(module_name)
+        # We're not currently collecting this. 30/7/19 HM
+        line_no = finding.properties[Contrast::Utils::HashDigest::CLASS_LINE_NO_KEY]
+        hash.update(line_no)
+        field = finding.properties[Contrast::Utils::HashDigest::CLASS_CONSTANT_NAME_KEY]
+        hash.update(field)
+        hash.finish
+      end
+
+      private
+
+      # Generates the hash checksum for crypto(crypto-bad-ciphers, crypto-bad-mac) rules.
+      # used in #generate_event_hash.
+      #
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param algorithm [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_crypto_hash finding, algorithm, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update(algorithm)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+
+      # Generates the hash checksum for dataflow when the finding events are more than one
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_dataflow_hash finding, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update_on_sources(finding.events)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+
+      # Generates the hash checksum for trigger
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
+      def generate_trigger_hash finding, request
+        hash = new
+        hash.update(finding.rule_id)
+        hash.update_on_request(finding, request)
+        hash.finish
+      end
+    end
+  end
+end