contrast-agent 4.14.0 → 5.2.0

data/ext/cs__scope/cs__scope.h

@@ -0,0 +1,88 @@
+#include <ruby.h>
+
+/* Calls to Contrast modules and classes */
+VALUE scope_interface;
+VALUE scope_inst_methods, scope_mod, scope_klass;
+
+/* IVs */
+static VALUE rb_iv_cntr_scope;
+static VALUE rb_iv_dslr_scope;
+static VALUE rb_iv_split_scope;
+
+/* Constants */
+static VALUE rb_const_ec;
+static VALUE rb_const_mon;
+static VALUE rb_const_ec_keys;
+
+/* Symbols */
+static VALUE rb_sym_scope_mod;
+static VALUE rb_sym_contrast;
+static VALUE rb_sym_deserialization;
+static VALUE rb_sym_split;
+
+/* methods names - only reusable ones */
+VALUE rb_method_name_init;
+VALUE rb_method_name_in_scope;
+VALUE rb_method_name_enter_scope;
+VALUE rb_method_name_exit_scope;
+VALUE rb_method_name_scope_for_current_ec;
+VALUE rb_method_name_in_cntr_scope;
+VALUE rb_method_name_enter_cntr_scope;
+VALUE rb_method_name_exit_cntr_scope;
+VALUE rb_method_name_in_dslr_scope;
+VALUE rb_method_name_enter_dslr_scope;
+VALUE rb_method_name_exit_dslr_scope;
+VALUE rb_method_name_in_split_scope;
+VALUE rb_method_name_enter_split_scope;
+VALUE rb_method_name_exit_split_scope;
+VALUE rb_method_name_split_scope_depth;
+
+/* Scope class */
+VALUE contrast_scope_klass_init(VALUE self, VALUE args);
+VALUE in_cntr_scope(VALUE self, VALUE args);
+VALUE enter_cntr_scope(VALUE self, VALUE args);
+VALUE exit_cntr_scope(VALUE self, VALUE args);
+VALUE in_split_scope(VALUE self, VALUE args);
+VALUE enter_split_scope(VALUE self, VALUE args);
+VALUE exit_split_scope(VALUE self, VALUE args);
+VALUE split_scope_depth(VALUE self, VALUE args);
+VALUE in_dsrl_scope_scope(VALUE self, VALUE args);
+VALUE enter_dsrl_scope(VALUE self, VALUE args);
+VALUE exit_dsrl_scope(VALUE self, VALUE args);
+VALUE scope_klass_in_scope(VALUE self, VALUE method_scope_sym);
+VALUE scope_klass_enter_scope(VALUE self, VALUE method_scope_sym);
+VALUE scope_klass_exit_scope(VALUE self, VALUE method_scope_sym);
+
+/* Scope interface */
+VALUE contrast_scope_interface_init(VALUE self, VALUE args);
+VALUE contrast_scope_for_current_ec(VALUE self, VALUE args);
+
+/* Scope instance methods */
+VALUE inst_methods_in_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_cntr_scope(VALUE self, VALUE args);
+VALUE inst_methods_in_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_split_scope(VALUE self, VALUE args);
+VALUE inst_methods_split_scope_depth(VALUE self, VALUE args);
+VALUE inst_methods_in_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_enter_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_exit_dsrl_scope(VALUE self, VALUE args);
+VALUE inst_methods_in_scope(VALUE self, VALUE method_scope_sym);
+VALUE inst_methods_enter_scope(VALUE self, VALUE method_scope_sym);
+VALUE inst_methods_exit_scope(VALUE self, VALUE method_scope_sym);
+
+/* Scope components module */
+VALUE scope_mod_sweep_dead_ecs(VALUE self, VALUE args);
+VALUE inst_methods_enter_method_scope(VALUE self, VALUE scopes_to_enter);
+VALUE inst_methods_exit_method_scope(VALUE self, VALUE scopes_to_exit);
+
+/* Helpers */
+VALUE is_in_scope(int scope);
+VALUE get_ec();
+VALUE rb_new_c_scope();
+void rb_raise_scope_no_method_err(const VALUE method_scope_sym);
+int scope_increase(int scope);
+int scope_decrease(int scope);
+
+void Init_cs__scope(void);

data/ext/{cs__assess_active_record_named → cs__scope}/extconf.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 $TO_MAKE = File.basename(__dir__)

data/ext/extconf_common.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'mkmf'

data/lib/contrast/agent/assess/contrast_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/assess/tracking_util'
@@ -15,20 +15,27 @@ module Contrast
     module Assess
       # This class holds the data about an event in the application We'll use it to build an event that TeamServer can
       # consume if the object to which this event belongs ends in a trigger.
-      #
-      # @attr_reader event_id [Integer] the atomic id of this event
-      # @attr_reader policy_node [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event.
-      # @attr_reader stack_trace [Array<String>] the execution stack at the time the method for this event was invoked
-      # @attr_reader time [Integer] the time, in epoch ms, when this event was created
-      # @attr_reader thread [Integer] the object id of the thread on which this event was generated
-      # @attr_reader object [Contrast::Agent::Assess::ContrastObject] the safe representation of the Object on which
-      #   the method was invoked
-      # @attr_reader ret [Contrast::Agent::Assess::ContrastObject] the safe representation of the Return of the invoked
-      #   method
-      # @attr_reader args [Array<Contrast::Agent::Assess::ContrastObject>] the safe representation of the Arguments
-      #   with which the method was invoked
       class ContrastEvent
-        attr_reader :event_id, :policy_node, :stack_trace, :time, :thread, :object, :ret, :args, :tags
+        # @return [Integer] the atomic id of this event
+        attr_reader :event_id
+        # @return [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event.
+        attr_reader :policy_node
+        # @return [Array<String>] the execution stack at the time the method for this event was invoked
+        attr_reader :stack_trace
+        # @return [Integer] the time, in epoch ms, when this event was created
+        attr_reader :time
+        # @return [Integer] the object id of the thread on which this event was generated
+        attr_reader :thread
+        # @return [Contrast::Agent::Assess::ContrastObject] the safe representation of the Object on which the method
+        #   was invoked
+        attr_reader :object
+        # @return [Contrast::Agent::Assess::ContrastObject] the safe representation of the Return of the invoked method
+        attr_reader :ret
+        # @return [Array<Contrast::Agent::Assess::ContrastObject, nil>] the safe representation of the Arguments with
+        #   which the method was invoked
+        attr_reader :args
+        # @return [Hash<Contrast::Agent::Assess::Tag>]
+        attr_reader :tags
 
         # We need this to track the parent id's of events to build up a flow chart of the finding
         @atomic_id = 0
@@ -42,21 +49,17 @@ module Contrast
           end
         end
 
-        # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event.
-        # @param tagged [Object] the Target to which this event pertains.
-        # @param object [Object] the Object on which the method was invoked
-        # @param ret [Object] the Return of the invoked method
-        # @param args [Array<Object>] the Arguments with which the method was invoked
-        def initialize policy_node, tagged, object, ret, args
-          @policy_node = policy_node
+        # @param event_data [Contrast::Agent::Assess::Events::EventData]
+        def initialize event_data
+          @policy_node = event_data.policy_node
           @time = Contrast::Utils::Timer.now_ms
           @thread = Thread.current.object_id
 
           # These methods rely on the above being set. Don't move them!
           @event_id = Contrast::Agent::Assess::ContrastEvent.next_atomic_id
-          @tags = Contrast::Agent::Assess::Tracker.properties(tagged)&.get_tags
-          find_parent_events!(policy_node, object, ret, args)
-          snapshot!(object, ret, args)
+          @tags = Contrast::Agent::Assess::Tracker.properties(event_data.tagged)&.get_tags
+          find_parent_events!(event_data.policy_node, event_data.object, event_data.ret, event_data.args)
+          snapshot!(event_data.object, event_data.ret, event_data.args)
           capture_stacktrace!
         end
 

data/lib/contrast/agent/assess/contrast_object.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/class_util'
@@ -42,8 +42,11 @@ module Contrast
           end
         end
 
+        # Is the object this represents tracked or not?
+        #
+        # @return [Boolean]
         def tracked?
-          tags&.any?
+          !!tags&.any?
         end
       end
     end

data/lib/contrast/agent/assess/events/event_data.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Events
+        # this class will gather and build event
+        class EventData
+          attr_reader :policy_node, :tagged, :object, :ret, :args
+
+          # Group event data together
+          #
+          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode, nil] the node that governs this event
+          # @param tagged      [Object, nil] the Target to which this event pertains
+          # @param object      [Object, nil] the Object on which the method was invoked
+          # @param ret         [Object, nil] the Return of the invoked method
+          # @param args        [Array<Object>, nil] the Arguments with which the method was invoked
+          def initialize policy_node, tagged, object, ret, args
+            @policy_node = policy_node
+            @tagged = tagged
+            @object = object
+            @ret = ret
+            @args = args
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/events/event_factory.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/contrast_event'
 require 'contrast/agent/assess/events/source_event'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -10,13 +11,20 @@ module Contrast
       module Events
         # This module returns the event type appropriate to the given Node
         module EventFactory
-          def self.build policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            case policy_node
+          # This method returns the event type appropriate to the given Node
+          #
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
+          # @param source_type [String] the type of this source, from the
+          #       source_node, or a KEY_TYPE if invoked for a map,
+          # @param source_name [String, nil] the name of this source, i.e.
+          #       the key used to accessed if from a map or nil if a type like,
+          # @return [Contrast::Agent::Assess::Events::SourceEvent, Contrast::Agent::Assess::ContrastEvent]
+          def self.build event_data, source_type = nil, source_name = nil
+            case event_data.policy_node
             when Contrast::Agent::Assess::Policy::SourceNode
-              Contrast::Agent::Assess::Events::SourceEvent.new(policy_node, tagged, object, ret, args, source_type,
-                                                               source_name)
+              Contrast::Agent::Assess::Events::SourceEvent.new(event_data, source_type, source_name)
             when Contrast::Agent::Assess::Policy::PolicyNode
-              Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args)
+              Contrast::Agent::Assess::ContrastEvent.new(event_data)
             end
           end
         end

data/lib/contrast/agent/assess/events/source_event.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/contrast_event'
+require 'contrast/agent/reporting/reporting_events/trace_event_source'
 require 'contrast/utils/string_utils'
 
 module Contrast
@@ -19,8 +20,13 @@ module Contrast
         class SourceEvent < Contrast::Agent::Assess::ContrastEvent
           attr_reader :request, :source_name, :source_type
 
-          def initialize policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            super(policy_node, tagged, object, ret, args)
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
+          # @param source_type [String] the type of this source, from the
+          #       source_node, or a KEY_TYPE if invoked for a map,
+          # @param source_name [String, nil] the name of this source, i.e.
+          #       the key used to accessed if from a map or nil if a type like,
+          def initialize event_data, source_type = nil, source_name = nil
+            super(event_data)
             @source_type = source_type
             @source_name = source_name
             @request = Contrast::Agent::REQUEST_TRACKER.current&.request
@@ -61,6 +67,19 @@ module Contrast
             dtm
           end
 
+          # Probably only for source events, but we'll go
+          # with source_type instead. java & .net support source_type
+          # in propagation events, so we'll future proof this
+          def build_event_source
+            # You can have a source w/o a name, but not w/o a type
+            return unless source_type
+
+            trace_event_source = Contrast::Agent::Reporting::TraceEventSource.new
+            trace_event_source.type = forced_source_type
+            trace_event_source.name = forced_source_name
+            trace_event_source
+          end
+
           # We have to do a little work to figure out what our TS appropriate
           # target is. To break this down, the logic is as follows:
           # 1) I'll set the event's source and target to TS values.

data/lib/contrast/agent/assess/finalizers/freeze.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/duck_utils'

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/method_policy'
@@ -90,12 +90,12 @@ module Contrast
             # @return [Contrast::Agent::Patching::Policy::MethodPolicy] the
             #   policy to apply to the given method
             def build_source_policy method_name, dynamic_source_node
-              method_policy = Contrast::Agent::Patching::Policy::MethodPolicy.new
-              method_policy.method_visibility = :public
-              method_policy.instance_method = true
-              method_policy.method_name = method_name
-              method_policy.source_node = dynamic_source_node
-              method_policy
+              Contrast::Agent::Patching::Policy::MethodPolicy.new({
+                                                                      method_visibility: :public,
+                                                                      instance_method: true,
+                                                                      method_name: method_name,
+                                                                      source_node: dynamic_source_node
+                                                                  })
             end
 
             # @param request [Contrast::Agent::Request] the request during

data/lib/contrast/agent/assess/policy/patcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy'
@@ -42,40 +42,6 @@ module Contrast
             rescue StandardError => e
               logger.warn('Unable to patch assess during eval', e, module: mod.cs__name)
             end
-
-            # Exposed so that methods can be dynamically patched on creation at
-            # runtime, like those generated by
-            # ActiveRecord::AttributeMethods::Read::ClassMethods#define_method_attribute
-            CLASS_TYPES = [Contrast::Utils::ObjectShare::CLASS, Contrast::Utils::ObjectShare::MODULE].cs__freeze
-            def patch_assess_method mod, method_name
-              # Module.define_method is called a lot in Class and Module. We
-              # currently do not expect these define_methods to result in methods
-              # that require patching, so for the sake of performance, we're going
-              # to skip evaluating them
-              mod = mod.cs__class unless mod.cs__is_a?(Module)
-              class_name = mod.cs__class
-              return if CLASS_TYPES.include?(class_name)
-              return unless ASSESS.enabled?
-
-              source_nodes = Contrast::Agent::Patching::Policy::ModulePolicy.nodes_for_module(policy.sources,
-                                                                                              class_name)
-              return if source_nodes.empty?
-
-              method_array = []
-              method_array << method_name
-              source_nodes.each do |source_node|
-                next unless source_node.method_name.to_s == method_name
-
-                method_policy =
-                  Contrast::Agent::Patching::Policy::MethodPolicy.new(source_node: source_node,
-                                                                      method_name: source_node.method_name,
-                                                                      method_visibility: source_node.method_visibility,
-                                                                      instance_method: true)
-                patcher.patch_method(mod, method_array, method_policy)
-              end
-            rescue StandardError => e
-              logger.warn('Unable to patch assess during define_method_attribute', e, module: mod.cs__name)
-            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'json'

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'
@@ -141,7 +141,7 @@ module Contrast
 
                              t
                            else
-                             Integer(t[1..-1])
+                             Integer(t[1..])
                            end
             end
             converted

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -8,6 +8,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/propagation_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -15,6 +16,7 @@ module Contrast
       module Policy
         # This class is responsible for the continuation of traces. A Propagator is any method that transforms an
         # untrusted value. In general, these methods work on the String class or a holder of Strings.
+        # rubocop:disable Metrics/ModuleLength
         module PropagationMethod
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::PropagationMethodUtils
@@ -37,7 +39,8 @@ module Contrast
               propagation_node = method_policy.propagation_node
 
               target = determine_target(propagation_node, ret, object, args)
-              PropagationMethod.apply_propagator(propagation_node, preshift, target, object, ret, args, block)
+              propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
+              PropagationMethod.apply_propagator(propagation_node, preshift, target, propagation_data, block)
             end
 
             # I lied above. We had to figure out what the target of the propagation was. Now that we know, we'll
@@ -49,27 +52,33 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
             # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
             #   original function if not nil
-            def apply_propagator propagation_node, preshift, target, object, ret, args, block
+            def apply_propagator propagation_node, preshift, target, propagation_data, block
               return unless propagation_possible?(propagation_node, target)
 
               if propagation_node.action == DB_WRITE_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node, preshift, ret)
+                Contrast::Agent::Assess::Policy::Propagator::DatabaseWrite.propagate(propagation_node,
+                                                                                     preshift,
+                                                                                     propagation_data.ret)
               elsif propagation_node.action == CUSTOM_ACTION
-                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node, preshift, ret, block)
+                Contrast::Agent::Assess::Policy::Propagator::Custom.propagate(propagation_node,
+                                                                              preshift,
+                                                                              propagation_data.ret,
+                                                                              block)
               elsif propagation_node.action == SPLIT_ACTION
                 Contrast::Agent::Assess::Policy::Propagator::Split.propagate(propagation_node, preshift, target)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                handle_hash_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_hash_propagation(propagation_node, preshift, target, propagation_data, block)
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
-                handle_enumerable_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_enumerable_propagation(propagation_node, preshift, target, propagation_data, block)
               else
-                handle_cs_properties_propagation(propagation_node, preshift, target, object, ret, args, block)
+                handle_cs_properties_propagation(propagation_node, preshift, target, propagation_data, block)
               end
             rescue StandardError => e
               logger.warn('Unable to apply propagation', e, node_id: propagation_node.id)
@@ -90,6 +99,10 @@ module Contrast
               end
             end
 
+            def context_available?
+              !!Contrast::Agent::REQUEST_TRACKER.current
+            end
+
             # If this patcher has tags, remove them from the entire target
             #
             # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
@@ -113,6 +126,7 @@ module Contrast
             # @return [Boolean]
             def propagation_possible? propagation_node, target
               return false unless propagation_node && valid_target?(target, propagation_node)
+              return false unless context_available? || Contrast::ASSESS.non_request_tracking?
               return false unless valid_length?(target, propagation_node.action)
 
               true
@@ -135,14 +149,15 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_hash_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_hash_propagation propagation_node, preshift, target, propagation_data, block
               target.each_pair do |key, value|
-                apply_propagator(propagation_node, preshift, key, object, ret, args, block)
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, key, propagation_data, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -153,15 +168,16 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param block [Block] the Block passed to the original method
-            def handle_enumerable_propagation propagation_node, preshift, target, object, ret, args, block
+            def handle_enumerable_propagation propagation_node, preshift, target, propagation_data, block
               target.each do |value|
                 next if target == value
 
-                apply_propagator(propagation_node, preshift, value, object, ret, args, block)
+                apply_propagator(propagation_node, preshift, value, propagation_data, block)
               end
             end
 
@@ -172,11 +188,12 @@ module Contrast
             # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
             #   the invocation of the patched method.
             # @param target [Object] the Target to which to propagate.
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+            #                         object [Object] the Object on which the method was invoked
+            #                         ret [Object] the Return of the invoked method
+            #                         args [Array<Object>] the Arguments with which the method was invoked
             # @param _block [Block] the Block passed to the original method
-            def handle_cs_properties_propagation propagation_node, preshift, target, object, ret, args, _block
+            def handle_cs_properties_propagation propagation_node, preshift, target, propagation_data, _block
               return if propagation_node.action == NOOP_ACTION
               return unless can_propagate?(propagation_node, preshift, target)
               return unless (propagation_class = find_propagation_class(propagation_node))
@@ -184,7 +201,7 @@ module Contrast
               restore_frozen_state = false
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless can_handle_frozen?(propagation_node)
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(propagation_data.ret))
 
                 restore_frozen_state = true
                 ret = dup
@@ -195,6 +212,10 @@ module Contrast
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
               propagation_class.propagate(propagation_node, preshift, target)
+              update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
+            end
+
+            def update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
               # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
               apply_tags(propagation_node, target)
               # Even though we skipped propagating tags from the source if they were included in untags, the target may
@@ -204,7 +225,12 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.add_properties(propagation_node.properties)
-              properties.build_event(propagation_node, target, object, ret, args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
+                                                                          target,
+                                                                          propagation_data.object,
+                                                                          ret,
+                                                                          propagation_data.args)
+              properties.build_event(event_data)
               logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
               restore_frozen_state ? ret : nil
             end
@@ -235,6 +261,7 @@ module Contrast
             end
           end
         end
+        # rubocop:enable Metrics/ModuleLength
       end
     end
   end