contrast-agent 4.14.0 → 5.2.0

data/lib/contrast/tasks/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/tasks/service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/os'

data/lib/contrast/utils/assess/propagation_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/property/tagged_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'
@@ -29,13 +29,13 @@ module Contrast
         end
 
         def sample? request
-          history = request_history(request)
-          history.hit
-
           # if sampling isn't enabled, we record all requests and take a
           # default amount of responses
           return [true, true] unless @enabled
 
+          history = request_history(request)
+          history.hit
+
           # if we've exceeded this sample window, reset it
           if history.elapsed >= @window_ms
             history.reset_window

data/lib/contrast/utils/assess/source_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/split_utils.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module extends the Split class which is specifically for String#split & String#grapheme_clusters
+      # propagation it propagates tag ranges from a string to elements within an untracked array
+      module SplitUtils
+        private
+
+        # Quick hook to the String#split propagation node in our Assess policy
+        #
+        # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
+        def split_node
+          @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+            node.class_name == 'String' && node.method_name == :split && node.instance_method?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,12 +19,13 @@ module Contrast
 
         # Find the request for this finding. This assumes, for now, that if there is an active request, then that
         # is the request to report. Otherwise, we'll use the first request found in the events of the
-        # source_object.
+        # source_object if the non request tracking flag is set.
         #
         # @param source [Object,nil] some Object used as the source of a trigger event
         # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
         def find_request source
           return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless ::Contrast::ASSESS.non_request_tracking?
           return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
 
           find_event_request(properties.event)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -39,7 +39,7 @@ module Contrast
       def self.resolve_corrected_path path
         tmp_path = path.dup
         start_match = START_UNDERSCORE.match(tmp_path)
-        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+        tmp_path = tmp_path[start_match.offset(0).last..] if start_match
 
         tmp_path.gsub!(REPEATING_UNDERSCORE, '__')
 

data/lib/contrast/utils/exclude_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/findings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -44,9 +44,11 @@ module Contrast
       #
       # We make sure the content-type is present before reporting, because some
       # findings do require it for validation.
+      #
+      # @return [true, nil]
       def report_collected_findings
-        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
         return if @_collection.empty?
+        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
 
         while @_collection.any?
           finding = @_collection.pop
@@ -56,6 +58,7 @@ module Contrast
                                                                        finding[:ret],
                                                                        finding[:args]
         end
+        true
       end
     end
   end

data/lib/contrast/utils/hash_digest.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -24,16 +24,43 @@ module Contrast
       CLASS_CONSTANT_NAME_KEY = 'name'
       CLASS_LINE_NO_KEY = 'lineNo'
 
+      # Update to CRC checksum the finding route and verb if finding route
+      # [Contrast::Api::Dtm::RouteCoverage] is available else update the passed
+      # request or Contrast::REQUEST_TRACKER.current.request uri and used request
+      # method.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding, Contrast::Agent::Reporting::Finding] finding to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [Integer, nil] returns nil if there is no request context or tracking
+      # is disabled.
       def update_on_request finding, request
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context || ::Contrast::ASSESS.non_request_tracking?
+
         if (route = finding.routes[0])
-          update(route.route)
-          update(route.verb)
-        elsif request ||= Contrast::Agent::REQUEST_TRACKER.current&.request
-          update(request.normalized_uri)
-          update(request.request_method)
+          if finding.cs__is_a?(Contrast::Agent::Reporting::Finding) && (observation = route.observations[0])
+            update(observation.url)
+            update(observation.verb)
+          else
+            update(route.route) # the normalized URL used to access the method in the route.
+            update(route.verb) # the HTTP Verb used  to access the method in the route.
+          end
+          return
         end
+
+        return unless request ||= context&.request
+
+        update(request.normalized_uri) # the normalized URL used to access the method in the route.
+        update(request.request_method) # The HTTP method used in the request
       end
 
+      # Update to CRC checksum the event source name and source type.
+      # Expects Contrast::Api::Dtm::TraceEvent || Contrast::Agent::Assess::Events::SourceEvent
+      #
+      # @param events [Protobuf::Field::FieldArray<Contrast::Api::Dtm::TraceEvent>,
+      #                                            <Contrast::Agent::Assess::Events::SourceEvent>]
+      #                                            Array of TraceEvents
+      # @return checksum [Integer, nil] returns nil if there is no events
       def update_on_sources events
         return unless events&.any?
 
@@ -64,12 +91,23 @@ module Contrast
         @crc32 = 0
       end
 
+      # Converts  given string to CRC checksum. CRC32 checksum ensures that If error
+      # of a single bit occurs, the CRC checksum will fail, regardless of any other
+      # property of the transmitted data, including its length. Called several times
+      # with previous CRC to recalculate the new output.
+      #
+      # @param str [String]
+      # @return @crc32 [Integer, nil] updated value of crc 32 bit integer checksum or
+      # nil if passed string is nil or empty
       def update str
         return unless str
 
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
+      # Casts current CRC checksum to String
+      #
+      # @return @crc32 [String] String representation of CRC32 checksum
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/hash_digest_extend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -13,6 +13,11 @@ module Contrast
     # specification shared across all agent teams. The spec can be found here:
     # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
     module HashDigestExtend
+      # Generates the hash checksum for the request. Converts the request method, uri,
+      # param names and content length to CRC checksum and returns string representation
+      #
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_request_hash request
         hash = new
         hash.update(request.request_method)
@@ -25,6 +30,14 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for the event, either dataflow,
+      # crypto(crypto-bad-ciphers, crypto-bad-mac) rules or trigger event
+      # and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param source [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_event_hash finding, source, request
         return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
 
@@ -34,6 +47,11 @@ module Contrast
         generate_trigger_hash(finding, request)
       end
 
+      # Generates the hash checksum for configurations. Converts the finding rule_id, session_id and configPath and
+      # to CRC32 checksum and returns string representation to be appended to Contrast::Api::Dtm::Finding
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
       def generate_config_hash finding
         hash = new
         hash.update(finding.rule_id)
@@ -44,6 +62,11 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for class scanning. Converts the rule_id, finding.properties(source, name)
+      # to CRC32 checksum and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
       def generate_class_scanning_hash finding
         hash = new
         hash.update(finding.rule_id)
@@ -59,6 +82,14 @@ module Contrast
 
       private
 
+      # Generates the hash checksum for crypto(crypto-bad-ciphers, crypto-bad-mac) rules.
+      # used in #generate_event_hash.
+      #
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param algorithm [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_crypto_hash finding, algorithm, request
         hash = new
         hash.update(finding.rule_id)
@@ -67,6 +98,12 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for dataflow when the finding events are more than one
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_dataflow_hash finding, request
         hash = new
         hash.update(finding.rule_id)
@@ -75,6 +112,12 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for trigger
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_trigger_hash finding, request
         hash = new
         hash.update(finding.rule_id)

data/lib/contrast/utils/head_dump_utils_extend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'objspace'

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
@@ -33,9 +33,10 @@ module Contrast
           hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
           finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
           finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
-          if Contrast::Agent::Reporter.enabled?
-            cs__report_new_finding hash, rule_id, user_provided_options, call_location
+          if Contrast::Agent::Reporter.enabled? # TODO: RUBY-1438 -- remove
+            cs__report_new_finding(hash, rule_id, user_provided_options, call_location)
+          else
+            Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
           end
         end
       rescue StandardError => e
@@ -52,7 +53,7 @@ module Contrast
         ruby_finding = Contrast::Agent::Reporting::Finding.new rule_id
         ruby_finding.hash_code = hash_code
         set_new_finding_properties(ruby_finding, user_provided_options, call_location)
-        Contrast::Agent.reporter_queue.send_event_immediately(new_preflight)
+        Contrast::Agent.reporter&.send_event_immediately(new_preflight)
         Contrast::Agent::Reporting::ReportingStorage[hash_code] = ruby_finding
       end
 

data/lib/contrast/utils/io_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/utils/job_servers_running.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/utils/log_utils.rb

@@ -1,6 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'socket'
+require 'contrast/agent/version'
+
 module Contrast
   module Utils
     # Method utility used by Contrast::Logger::log
@@ -106,3 +109,114 @@ module Contrast
     end
   end
 end
+
+module Contrast
+  module Utils
+    # These are the utilities for the CEF Logger, which will use the default ruby logger as we are not
+    # interested in special logging. We have the format we need and that's all we need. It would be useless
+    # to use Ougai
+    module CEFLogUtils
+      include Contrast::Utils::LogUtils
+      # <date> <host> CEF:<version>|<company>|<product>|<agent version>|<event type>
+      # |<event message>|<severity>|<other name-value pairs>
+      DEFAULT_CEF_NAME = 'security.log'
+      DEFAULT_LEVEL    = ::Logger::Severity::INFO
+      VALID_LEVELS     = ::Logger::SEV_LABEL
+      PROGNAME         = 'Contrast Agent Ruby'
+      DATE_TIME_FORMAT = '%b %d %Y %H:%M:%S.%L%z'
+      AGENT_VERSION    = Contrast::Agent::VERSION
+      EVENT_TYPE       = 'SECURITY'
+      DEFAULT_METADATA = '-'
+
+      private
+
+      def build path: STDOUT_STR, level_const: DEFAULT_LEVEL
+        logger = case path
+                 when STDOUT_STR, STDERR_STR
+                   ::Logger.new(Object.cs__const_get(path))
+                 else
+                   ::Logger.new(path)
+                 end
+        logger.progname = PROGNAME
+        logger.level = level_const
+        change_logger_formatter logger
+        logger
+      end
+
+      def context
+        Contrast::Agent::REQUEST_TRACKER.current
+      end
+
+      def change_logger_formatter logger
+        ip_address = extract_ip_address
+        logger.formatter = proc do |severity, datetime, progname, msg|
+          date_format = datetime.strftime(DATE_TIME_FORMAT)
+          message = []
+          message << "#{ date_format } #{ ip_address }"
+          message << 'CEF:0|Contrast Security'
+          message << progname
+          message << AGENT_VERSION
+          message << EVENT_TYPE
+          message << msg[0]
+          message << severity
+          message << extract_metadata(msg[1], msg[2])
+          message.join('|') + "\n"
+        end
+      end
+
+      # This method will extract the metadata information from context and other places
+      #
+      # initial structure of the data:
+      # <metadata> := <message-source>" "<source-ip>" "<source-port>" "<request-url>" "<request-method>" \
+      # "<application>" "<outcome>
+      # it could come from: blockEntry, lei, bbi(bot blocker), vp(virtual patch) or pri(rule)
+      # initially here we will use case to add it
+      def extract_metadata rule_id = nil, outcome = nil
+        message = []
+        sender_info = context&.activity&.http_request&.sender
+        rule_id ? message << "pri=#{ rule_id } " : 'asd'
+        request_method = if context.request.rack_request.env['REQUEST_METHOD'].length.positive?
+                           context.request.rack_request.env['REQUEST_METHOD']
+                         else
+                           DEFAULT_METADATA
+                         end
+        app_name = ::Contrast::APP_CONTEXT.app_name
+        attach_request_and_sender_info message, sender_info
+        message << "request=#{ context.request.url } "
+        message << "requestMethod=#{ request_method } "
+        message << "app=#{ app_name } "
+        message << "outcome=#{ outcome } "
+      end
+
+      def attach_request_and_sender_info message, sender_info
+        # here, instead of the ip, we need to report the first non-private 'X-Forwarded-For' Header if available.
+        # if not we return '-'
+        needed_header = extract_sender_ip
+        # I'm not sure if we should report the sender ip from the ActivityDtm
+        src = if needed_header
+                needed_header
+              else
+                sender_info.ip.length > 1 ? sender_info.ip : DEFAULT_METADATA
+              end
+        message << "src=#{ src }"
+        message << "port=#{ sender_info.port }"
+      end
+
+      def extract_ip_address
+        res = Socket.getifaddrs.reject do |ifaddr|
+          !ifaddr.addr.ipv4? ||
+              (ifaddr.flags & Socket::IFF_MULTICAST).zero? ||
+              ifaddr.name != 'en0' # rubocop:disable Security/Module/Name
+        end
+        return unless res.length.positive?
+
+        res[0].addr.ip_address
+      end
+
+      def extract_sender_ip
+        request_headers = context.activity.http_request.request_headers&.transform_keys(&:to_s)
+        request_headers['X-Forwarded-For']
+      end
+    end
+  end
+end

data/lib/contrast/utils/lru_cache.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/metrics_hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -15,7 +15,7 @@ module Contrast
       ERROR_MESSAGES = [
         'The key is not string or does not meet the requirements.',
         'The key extends the allowed length.',
-        'VThe provided value is not the right data type'
+        'The provided value is not the right data type'
       ].cs__freeze
       KEY_REGEXP = /[a-zA-Z0-9_-]{1,63}/.cs__freeze
 

data/lib/contrast/utils/middleware_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -51,14 +51,13 @@ module Contrast
       # deprecated and soon to be removed functionality. This method handles doing that by leveraging the standard
       # Kernel#warn approach
       def inform_deprecations
-        # Ruby 2.5 is currently in security maintenance, meaning int is only receiving updates for security issues. It
-        # will move to eol on 31 March 2021. As such, we can remove support for it in Q3. We'll begin the deprecation
-        # warnings now so that customers have time to reach out if they'll be impacted.
-        # TODO: RUBY-715 remove this part of the method, leaving it empty if there are no other deprecations, when we
-        #   drop 2.5 support.
-        return unless RUBY_VERSION < '2.6.0'
+        # Ruby 2.6 will be dropped in april of 2022. We'll begin the deprecation warnings
+        # now so that customers have time to reach out if they'll be impacted.
+        # TODO: RUBY-1188 remove this part of the method, leaving it empty if there are no other deprecations, when we
+        #   drop 2.6 support.
+        return unless RUBY_VERSION < '2.7.0'
 
-        Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\
+        Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.6 will be removed in April 2022. '\
                     'Please contact Customer Support prior if you require continued support.')
       end