contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,8 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/logger'
-require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/policy/propagator/substitution_utils'
 
 module Contrast
   module Agent
@@ -17,9 +16,7 @@ module Contrast
           class Substitution
             include Contrast::Components::Logger::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
-
-            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
-            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+            extend Contrast::Agent::Assess::Policy::Propagator::SubstitutionUtils
 
             class << self
               # gsub is hard. there are four versions of this method
@@ -38,157 +35,6 @@ module Contrast
               def sub_tagger patcher, preshift, ret, block
                 substitution_tagger(patcher, preshift, ret, !block.nil?, false)
               end
-
-              private
-
-              def substitution_tagger patcher, preshift, ret, block, global = true
-                return ret unless ret
-
-                begin
-                  source = preshift.object
-                  self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
-                  args = preshift.args[1]
-                  incoming_tracked = args && determine_tracked(args)
-                  return ret unless self_tracked || incoming_tracked
-
-                  parent_events = []
-                  if block
-                    block_sub(self_tracked, source, ret)
-                  elsif args.is_a?(String)
-                    string_sub(parent_events, self_tracked, preshift, ret, args, incoming_tracked, global)
-                  elsif args.is_a?(Hash)
-                    hash_sub(self_tracked, source, ret)
-                  else # Enumerator, only for gsub
-                    pattern_gsub(parent_events, preshift, ret)
-                  end
-
-                  if self_tracked
-                    source_properties = Contrast::Agent::Assess::Tracker.properties(source)
-                    parent_event = source_properties&.event
-                    parent_events.prepend(parent_event) if parent_event
-                  end
-                  string_build_event(parent_events, patcher, preshift, ret)
-                rescue StandardError => e
-                  logger.error('Unable to apply gsub propagator', e)
-                end
-                ret
-              end
-
-              def determine_tracked args
-                # if there's no arg, it can't be tracked
-                return false unless args
-
-                # if it's a string, just ask if it's tracked
-                case args
-                when String
-                  Contrast::Agent::Assess::Tracker.tracked?(args)
-                  # if it's a hash, ask if it has a tracked string
-                when Hash
-                  args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
-                  # this should never happen
-                else
-                  false
-                end
-              end
-
-              def string_sub parent_events, self_tracked, preshift, ret, incoming, incoming_tracked, global
-                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-                incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
-                parent_events << incoming_properties&.event if incoming_properties&.event
-
-                source = preshift.object
-
-                # We can't efficiently find the places that things were
-                # copied from regexp / captures. Trading accuracy for
-                # performance
-                if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
-                  properties.splat_from(source, ret) if self_tracked
-                  return
-                end
-
-                # if it's just a straight insert, that we can do
-                # Copy the tags from us to the return
-                ranges = find_string_sub_insert(properties, preshift, incoming, ret, global)
-
-                properties.delete_tags_at_ranges(ranges)
-                properties.shift_tags(ranges)
-                return unless incoming_tracked
-                return unless incoming_properties
-
-                tags = incoming_properties.tag_keys
-                ranges.each do |range|
-                  tags.each do |tag|
-                    properties.add_tag(tag, range)
-                  end
-                end
-              end
-
-              # Find the points at which the new String was placed into the original
-              #
-              # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
-              # @param preshift [Contrast::Agent::Assess::PreShift] the capture of the state of the code just prior to
-              #   the invocation of the patched method
-              # @param incoming [String] the new String going into the substitution
-              # @param ret [String] the result of the substitution
-              # @param global [Boolean] if this was a global or single substitution
-              # @return [Array<Range>] the Ranges where substitution occurred
-              def find_string_sub_insert properties, preshift, incoming, ret, global
-                pattern = preshift.args[0]
-                source = preshift.object
-
-                properties.copy_from(source, ret)
-                # Figure out where inserts occurred
-                last_idx = 0
-                ranges = []
-                # For each insert, move the tag ranges
-                while last_idx
-                  idx = source.index(pattern, last_idx)
-                  break unless idx
-
-                  last_idx = idx ? idx + 1 : nil
-                  start_index = idx
-                  end_index = idx + incoming.length
-                  ranges << (start_index...end_index)
-                  break unless global
-                end
-                ranges
-              end
-
-              def block_sub self_tracked, source, ret
-                return unless self_tracked
-
-                properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-                properties&.splat_from(source, ret)
-              end
-
-              def hash_sub self_tracked, source, ret
-                return unless self_tracked
-
-                properties = Contrast::Agent::Assess::Tracker.properties!(ret)
-                properties&.splat_from(source, ret)
-              end
-
-              def pattern_gsub parent_events, preshift, ret
-                source = preshift.object
-                return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
-                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
-
-                source_properties.tag_keys.each do |key|
-                  properties.add_tag(key, 0...1)
-                end
-                parent_event = source_properties.event
-                parent_events << parent_event if parent_event
-              end
-
-              def string_build_event parent_events, patcher, preshift, ret
-                return unless Contrast::Agent::Assess::Tracker.tracked?(ret)
-
-                properties = Contrast::Agent::Assess::Tracker.properties(ret)
-                args = preshift.args
-                properties.build_event(patcher, ret, preshift.object, ret, args, 2)
-                properties.event.instance_variable_set(:@_parent_events, parent_events)
-              end
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # This module is specifically for String#(g)sub propagation
+          #
+          # Disclaimer: there may be a better way, but we're
+          # in a 'get it work' state. hopefully, we'll be in
+          # a 'get it right' state soon.
+          module SubstitutionUtils
+            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
+            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+
+            private
+
+            # Update our properties of the object dependent on the substitution pattern used.
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] instance of PreShift
+            # @param ret [String] the result of the substitution
+            # @param block, the given block
+            # @param global [Boolean] if this was a global or single substitution, optional
+            def substitution_tagger patcher, preshift, ret, block, global = true
+              return ret unless ret
+
+              begin
+                # define here what is used across private methods
+                @_preshift = preshift
+                args = @_preshift.args[1]
+                @_self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
+                @_incoming_tracked = args && determine_tracked(args)
+                @_ret = ret
+                return @_ret unless @_self_tracked || @_incoming_tracked
+
+                @_parent_events = []
+                if block
+                  block_sub
+                elsif args.is_a?(String)
+                  string_sub(args, global)
+                elsif args.is_a?(Hash)
+                  hash_sub
+                else # Enumerator, only for gsub
+                  pattern_gsub
+                end
+
+                self_tracked_handle(@_parent_events)
+                string_build_event(patcher)
+              rescue StandardError => e
+                logger.error('Unable to apply gsub propagator', e)
+              end
+              ret
+            end
+
+            def self_tracked_handle parent_events
+              return unless @_self_tracked
+
+              source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+              parent_event = source_properties&.event
+              parent_events.prepend(parent_event) if parent_event
+            end
+
+            def source
+              @_preshift.object
+            end
+
+            # @param args [String] the new String going into the substitution
+            def determine_tracked args
+              # if there's no arg, it can't be tracked
+              return false unless args
+
+              # if it's a string, just ask if it's tracked
+              case args
+              when String
+                Contrast::Agent::Assess::Tracker.tracked?(args)
+                # if it's a hash, ask if it has a tracked string
+              when Hash
+                args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
+                # this should never happen
+              else
+                false
+              end
+            end
+
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            def string_sub incoming, global
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+              @_parent_events << incoming_properties&.event if incoming_properties&.event
+
+              # We can't efficiently find the places that things were
+              # copied from regexp / captures. Trading accuracy for
+              # performance
+              if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
+                properties.splat_from(source, @_ret) if @_self_tracked
+                return
+              end
+
+              # if it's just a straight insert, that we can do
+              # Copy the tags from us to the return
+              ranges = find_string_sub_insert(properties, incoming, global)
+
+              properties.delete_tags_at_ranges(ranges)
+              properties.shift_tags(ranges)
+              return unless @_incoming_tracked
+              return unless incoming_properties
+
+              tags = incoming_properties.tag_keys
+              ranges.each do |range|
+                tags.each do |tag|
+                  properties.add_tag(tag, range)
+                end
+              end
+            end
+
+            # Find the points at which the new String was placed into the original
+            #
+            # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            # @return [Array<Range>] the Ranges where substitution occurred
+            def find_string_sub_insert properties, incoming, global
+              pattern = @_preshift.args[0]
+              properties.copy_from(source, @_ret)
+              # Figure out where inserts occurred
+              last_idx = 0
+              ranges = []
+              # For each insert, move the tag ranges
+              while last_idx
+                idx = source.index(pattern, last_idx)
+                break unless idx
+
+                last_idx = idx ? idx + 1 : nil
+                start_index = idx
+                end_index = idx + incoming.length
+                ranges << (start_index...end_index)
+                break unless global
+              end
+              ranges
+            end
+
+            def block_sub
+              hash_sub
+            end
+
+            def hash_sub
+              return unless @_self_tracked
+
+              properties = Contrast::Agent::Assess::Tracker.properties!(@_ret)
+              properties&.splat_from(source, @_ret)
+            end
+
+            def pattern_gsub
+              return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              source_properties.tag_keys.each do |key|
+                properties.add_tag(key, 0...1)
+              end
+              parent_event = source_properties.event
+              @_parent_events << parent_event if parent_event
+            end
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            def string_build_event patcher
+              return unless Contrast::Agent::Assess::Tracker.tracked?(@_ret)
+
+              properties = Contrast::Agent::Assess::Tracker.properties(@_ret)
+              args = @_preshift.args
+              event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, @_ret, @_preshift, @_ret, args)
+              properties.build_event(event_data, 2)
+              properties.event.instance_variable_set(:@_parent_events, @_parent_events)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,8 +24,12 @@ module Contrast
 
                 properties.copy_from(preshift.object, ret)
                 handle_tr(policy_node, preshift, ret, properties)
-
-                properties.build_event(policy_node, ret, preshift.object, ret, preshift.args, 1)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
@@ -36,7 +40,8 @@ module Contrast
                 source = preshift.object
                 args = preshift.args
                 properties.splat_from(source, ret)
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new patcher, ret, source, ret, args
+                properties.build_event(event_data)
                 ret
               end
 

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/source_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -38,13 +39,16 @@ module Contrast
             def source_patchers method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
               return unless (source_node = method_policy.source_node)
-              return unless (target = determine_target(source_node, object, ret, args))
+
+              # used to hold the object and ret
+              source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
+              return unless (target = determine_target(source_node, source_data, args))
 
               return_val = nil
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless ::Contrast::ASSESS.track_frozen_sources?
                 return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(source_data.ret))
                 return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
                 Contrast::Agent::Assess::Tracker.pre_freeze(dup)
@@ -52,8 +56,7 @@ module Contrast
                 target = dup
               end
 
-              apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret,
-                           source_node.type, nil, *args)
+              apply_source(source_node, target, source_data, source_node.type, nil, *args)
 
               return_val
             end
@@ -63,32 +66,31 @@ module Contrast
 
             # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
+            def apply_source source_node, target, source_data, source_type, source_name = nil, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
-              source_name ||= determine_source_name(source_node, object, ret, *args)
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Agent::Assess::Tracker.trackable?(target)
-                apply_tags(source_node, target, object, ret, source_type, source_name, *args)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
                 # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
                 # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each do |value|
-                  apply_source(context, source_node, value, object, ret, source_type, source_name, *args)
+                  apply_source(source_node, value, source_data, source_type, source_name, *args)
                 end
               end
             rescue StandardError => e
@@ -98,16 +100,14 @@ module Contrast
             # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
             # values back to ourselves and try again
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_hash_tags context, source_node, target, object, ret, source_type, *args
+            def apply_hash_tags source_node, target, source_data, source_type, *args
               to_replace = []
               target.each_pair do |key, value|
                 # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
@@ -116,8 +116,8 @@ module Contrast
                   key = key.dup
                   to_replace << key
                 end
-                apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
-                apply_source(context, source_node, value, object, ret, source_type, key, *args)
+                apply_source(source_node, key, source_data, key_type(source_type), key, *args)
+                apply_source(source_node, value, source_data, source_type, key, *args)
               end
               handle_hash_key(target, to_replace)
             end
@@ -146,7 +146,16 @@ module Contrast
               end
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, *args
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
               # don't apply tags if we can't track the thing
               return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
@@ -164,24 +173,28 @@ module Contrast
                 logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
               # make a representation of this method that TeamServer can render
-              properties.build_event(source_node, target, object, ret, args, source_type, source_name)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
             end
 
             # Find the literal target of the propagation
             #
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
-            def determine_target source_node, object, ret, args
+            def determine_target source_node, source_data, args
               source_target = source_node.targets[0]
               case source_target
               when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
+                source_data.ret
               when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
+                source_data.object
               else
                 args[source_target]
               end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_method'

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_validation/cross_site_validator'

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -32,7 +32,12 @@ module Contrast
                 interpolated_inputs = []
                 handle_binding_variables(scope, erb_template_prerender, ret, properties, interpolated_inputs)
                 handle_local_variables(args, erb_template_prerender, ret, properties, interpolated_inputs)
-                properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(TEMPLATE_PROPAGATION_NODE,
+                                                                            ret,
+                                                                            erb_template_prerender,
+                                                                            ret,
+                                                                            interpolated_inputs)
+                properties.build_event(event_data)
                 unless interpolated_inputs.empty?
                   current_event = properties.event
                   interpolated_inputs.each do |input|

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast