contrast-agent 4.14.0 → 5.2.0

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/source_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -38,13 +39,16 @@ module Contrast
             def source_patchers method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
               return unless (source_node = method_policy.source_node)
-              return unless (target = determine_target(source_node, object, ret, args))
+
+              # used to hold the object and ret
+              source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
+              return unless (target = determine_target(source_node, source_data, args))
 
               return_val = nil
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless ::Contrast::ASSESS.track_frozen_sources?
                 return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(source_data.ret))
                 return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
                 Contrast::Agent::Assess::Tracker.pre_freeze(dup)
@@ -52,8 +56,7 @@ module Contrast
                 target = dup
               end
 
-              apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret,
-                           source_node.type, nil, *args)
+              apply_source(source_node, target, source_data, source_node.type, nil, *args)
 
               return_val
             end
@@ -63,32 +66,31 @@ module Contrast
 
             # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
+            def apply_source source_node, target, source_data, source_type, source_name = nil, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
-              source_name ||= determine_source_name(source_node, object, ret, *args)
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Agent::Assess::Tracker.trackable?(target)
-                apply_tags(source_node, target, object, ret, source_type, source_name, *args)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
                 # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
                 # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each do |value|
-                  apply_source(context, source_node, value, object, ret, source_type, source_name, *args)
+                  apply_source(source_node, value, source_data, source_type, source_name, *args)
                 end
               end
             rescue StandardError => e
@@ -98,16 +100,14 @@ module Contrast
             # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
             # values back to ourselves and try again
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_hash_tags context, source_node, target, object, ret, source_type, *args
+            def apply_hash_tags source_node, target, source_data, source_type, *args
               to_replace = []
               target.each_pair do |key, value|
                 # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
@@ -116,8 +116,8 @@ module Contrast
                   key = key.dup
                   to_replace << key
                 end
-                apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
-                apply_source(context, source_node, value, object, ret, source_type, key, *args)
+                apply_source(source_node, key, source_data, key_type(source_type), key, *args)
+                apply_source(source_node, value, source_data, source_type, key, *args)
               end
               handle_hash_key(target, to_replace)
             end
@@ -146,7 +146,16 @@ module Contrast
               end
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, *args
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
               # don't apply tags if we can't track the thing
               return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
@@ -164,24 +173,28 @@ module Contrast
                 logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
               # make a representation of this method that TeamServer can render
-              properties.build_event(source_node, target, object, ret, args, source_type, source_name)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
             end
 
             # Find the literal target of the propagation
             #
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
-            def determine_target source_node, object, ret, args
+            def determine_target source_node, source_data, args
               source_target = source_node.targets[0]
               case source_target
               when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
+                source_data.ret
               when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
+                source_data.object
               else
                 args[source_target]
               end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_method'

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_validation/cross_site_validator'

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -32,7 +32,12 @@ module Contrast
                 interpolated_inputs = []
                 handle_binding_variables(scope, erb_template_prerender, ret, properties, interpolated_inputs)
                 handle_local_variables(args, erb_template_prerender, ret, properties, interpolated_inputs)
-                properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(TEMPLATE_PROPAGATION_NODE,
+                                                                            ret,
+                                                                            erb_template_prerender,
+                                                                            ret,
+                                                                            interpolated_inputs)
+                properties.build_event(event_data)
                 unless interpolated_inputs.empty?
                   current_event = properties.event
                   interpolated_inputs.each do |input|

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -7,6 +7,10 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/trigger_method_utils'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/agent/reporting/reporting_events/preflight'
+require 'contrast/agent/reporting/reporting_events/preflight_message'
+require 'contrast/agent/reporting/reporting_events/route_discovery'
 require 'contrast/agent/reporting/reporting_utilities/reporting_storage'
 
 module Contrast
@@ -26,6 +30,11 @@ module Contrast
           MINIMUM_FINDING_VERSION = 3
           # The level of TeamServer compliance our traces meet.
           CURRENT_FINDING_VERSION = 4
+          # Rules that always exists outside of Request Context
+          NON_REQUEST_RULES = [
+            'hardcoded-password', # Contrast::Agent::Assess::Rule::Provider::HardcodedPassword.NAME,
+            'hardcoded-key' # Contrast::Agent::Assess::Rule::Provider::HardcodedKey.NAME
+          ].cs__freeze
 
           class << self
             # This is called from within our woven proc. It will be called as if it were inline in the Rack
@@ -39,6 +48,14 @@ module Contrast
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
 
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              # return if there is no context and the flag is set to default => false
+              # we need to have request if the flag is default
+              # else proceed, if the flag is true we don't need to check for context we
+              # go as currently.
+              # When outside of a request, only track when the feature is enabled
+              return unless Contrast::ASSESS.non_request_tracking? || context
+
               if trigger_node.sources&.any?
                 trigger_node.sources.each do |marker|
                   source = determine_source(marker, object, ret, args)
@@ -53,12 +70,12 @@ module Contrast
               apply_trigger(trigger_node, source, object, ret, *args)
             end
 
-            def append_to_finding finding, trigger_node, source, object, ret, request, *args
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
+            def append_to_finding finding, event_data, request
+              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(event_data.policy_node.rule_id)
               finding.version = determine_compliance_version(finding)
-              append_events(finding, trigger_node, source, object, ret, args)
+              append_events(finding, event_data)
               append_route(finding, request)
-              append_hash(finding, source, request)
+              append_hash(finding, event_data.tagged, request)
             end
 
             # This converts the source of the finding, and the events leading up to it into a Finding
@@ -84,12 +101,16 @@ module Contrast
               request = find_request(source)
               return unless reportable?(request&.env)
 
-              handle_new_finding trigger_node, source, object, ret, request, *args
-              finding = Contrast::Api::Dtm::Finding.new
-              append_to_finding finding, trigger_node, source, object, ret, request, *args
-              logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
-                                              rule: trigger_node.rule_id)
-              report_finding(finding, request)
+              if Contrast::Agent::Reporter.enabled?
+                handle_new_finding(trigger_node, source, object, ret, request, *args)
+              else # TODO: RUBY-1438 -- remove
+                finding = Contrast::Api::Dtm::Finding.new
+                event_data = Contrast::Agent::Assess::Events::EventData.new trigger_node, source, object, ret, args
+                append_to_finding finding, event_data, request
+                logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
+                                                rule: trigger_node.rule_id)
+                report_finding(finding, request)
+              end
             rescue StandardError => e
               logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
@@ -109,6 +130,8 @@ module Contrast
                 return
               end
 
+              return unless ::Contrast::ASSESS.non_request_tracking? || NON_REQUEST_RULES.include?(finding.rule_id)
+
               activity = Contrast::Api::Dtm::Activity.new
               activity.findings << finding
               if request
@@ -117,18 +140,12 @@ module Contrast
                 logger.debug('Attempted to report finding without request', finding: finding)
               end
 
-              # If we're out of request context, then we need to report this finding ourselves, so we'll send it in the
-              # one-off activity we created.
+              # If we're out of request context, then we need to report this finding ourselves,
+              # so we'll send it in the one-off activity we created.
               Contrast::Agent.messaging_queue.send_event_eventually(activity)
             end
 
             def handle_new_finding trigger_node, source, object, ret, request, *args
-              return unless Contrast::Agent::Reporter.enabled?
-
-              new_finding_and_reporting trigger_node, source, object, ret, request, *args
-            end
-
-            def new_finding_and_reporting trigger_node, source, object, ret, request, *args
               # sent to reporter
               # here we will generate new type of finding
               ruby_finding = Contrast::Agent::Reporting::Finding.new trigger_node.rule_id
@@ -140,11 +157,11 @@ module Contrast
 
               new_preflight = Contrast::Agent::Reporting::Preflight.new
               new_preflight_message = Contrast::Agent::Reporting::PreflightMessage.new
-              new_preflight_message.routes << request
+              new_preflight_message.routes << Contrast::Agent::Reporting::RouteDiscovery.convert(request.route)
               new_preflight_message.hash_code = hash_code
               new_preflight_message.data = "#{ trigger_node.rule_id },#{ hash_code }"
               new_preflight.messages << new_preflight_message
-              Contrast::Agent.reporter_queue.send_event_immediately(new_preflight)
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
             end
 
             private
@@ -186,10 +203,9 @@ module Contrast
               end
             end
 
-            def append_events finding, trigger_node, source, object, ret, args
-              append_from_source(finding, source)
-              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret,
-                                                                                    args).to_dtm_event
+            def append_events finding, event_data
+              append_from_source(finding, event_data.tagged)
+              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(event_data).to_dtm_event
             end
 
             def append_from_source finding, source

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger/reflected_xss'

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/properties.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'base64'

data/lib/contrast/agent/assess/property/evented.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -18,22 +18,15 @@ module Contrast
 
           # Create a new event and add it to the event set.
           #
-          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
-          #   the node that governs this event.
-          # @param tagged [Object] the Target to which this event pertains.
-          # @param object [Object] the Object on which the method was invoked
-          # @param ret [Object] the Return of the invoked method
-          # @param args [Array<Object>] the Arguments with which the method
-          #   was invoked
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
           # @param source_type [String] the type of this source, from the
           #   source_node, or a KEY_TYPE if invoked for a map
           # @param source_name [String, nil] the name of this source, i.e.
           #   the key used to accessed if from a map or nil if a type like
           #   BODY
-          def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            @event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args,
-                                                                         source_type, source_name)
-            report_sources(tagged, event)
+          def build_event event_data, source_type = nil, source_name = nil
+            @event = Contrast::Agent::Assess::Events::EventFactory.build(event_data, source_type, source_name)
+            report_sources(event_data.tagged, @event)
           end
 
           private
@@ -49,6 +42,11 @@ module Contrast
             return unless event.source_type
             return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
 
+            append_to_dtm current_request, event
+            append_to_ruby_object current_request, event
+          end
+
+          def append_to_dtm current_request, event
             if current_request.observed_route.sources.any? do |source|
                  source.type == event.forced_source_type &&
                        source.name == event.forced_source_name # rubocop:disable Security/Module/Name
@@ -62,6 +60,21 @@ module Contrast
 
             current_request.observed_route.sources << event_source_dtm
           end
+
+          def append_to_ruby_object current_request, event
+            if current_request.new_observed_route.sources.any? do |source|
+              source.type == event.forced_source_type &&
+                    source.name == event.forced_source_name # rubocop:disable Security/Module/Name
+            end
+
+              return
+            end
+
+            event_source = event.build_event_source
+            return unless event_source
+
+            current_request.new_observed_route.sources << event_source
+          end
         end
       end
     end

data/lib/contrast/agent/assess/property/tagged.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tag'

data/lib/contrast/agent/assess/property/updated.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/duck_utils'

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -95,24 +95,6 @@ module Contrast
 
               children[1] == :bytes
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a byte array, or at least an array of numbers, it
-            # passes for this rule
-            def value_type_passes? value
-              return false unless value.is_a?(Array) && value.any?
-
-              value.each do |byte|
-                return false unless byte.is_a?(Integer)
-              end
-              true
-            end
-
-            # There isn't a filter for the byte value. The check is not evaluated
-            # for this rule
-            def value_passes? _value
-              true
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -71,18 +71,6 @@ module Contrast
             def redacted_marker
               REDACTED_MARKER
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a string, it passes for this rule
-            def value_type_passes? value
-              value.is_a?(String)
-            end
-
-            # If the value probably isn't a property name, it passes for this
-            # rule
-            def value_passes? value
-              !probably_property_name?(value)
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
@@ -25,53 +25,6 @@ module Contrast
               !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
             end
 
-            # TODO: RUBY-1014 - remove `#analyze`
-            COMMON_CONSTANTS = %i[CONTRAST_ASSESS_POLICY_STATUS VERSION].cs__freeze
-            def analyze clazz
-              return if disabled?
-
-              # we only want the constants explicitly defined in this class, not
-              # those of its ancestor(s)
-              constants = clazz.cs__constants(false)
-
-              # if there are no constants, let's just leave
-              return unless constants&.any?
-
-              constants.each do |constant|
-                next if COMMON_CONSTANTS.include?(constant)
-
-                # if this class autoloads its constant, get the hell away from it
-                # I mean it! Don't even think about it.
-                #
-                # Autoload means this constant (usually [always?] a class or
-                # module) won't be required until something in the application
-                # tries to load it. We CANNOT be that thing. We'll just have to
-                # wait until it's loaded, at which point we'll be handed it
-                # again.
-                next if clazz.cs__autoload?(constant)
-
-                # constant comes to us as a symbol. that sucks. we need to do
-                # some string methods on it, so stringify it.
-                constant_string = constant.to_s
-
-                # if this is another class or a module, move on
-                next unless constant_name?(constant_string)
-
-                next unless name_passes?(constant_string)
-
-                value = clazz.cs__const_get(constant, false)
-
-                # if the constant isn't holding a string, skip it
-                next unless value_type_passes?(value)
-
-                # if it looks like a placeholder / pointer to a config, skip it
-                next unless value_passes?(value)
-
-                new_finding_and_reporting clazz, constant_string
-                build_finding clazz, constant_string
-              end
-            end
-
             # Parse the file pertaining to the given TracePoint to walk its AST
             # to determine if a Constant is hardcoded. For our purposes, this
             # hard coding means directly set rather than as an interpolated
@@ -93,14 +46,6 @@ module Contrast
               logger.error('Unable to parse AST for hardcoded keys', e, module: trace_point.self)
             end
 
-            # Constants can be variable or classes defined in the given
-            # class. We ONLY want the variables, which should be defined in
-            # the MACRO_CASE (upper case & underscore format)
-            CONSTANT_NAME_PATTERN = /^[A-Z_]+$/.cs__freeze
-            def constant_name? constant
-              constant.match?(CONSTANT_NAME_PATTERN)
-            end
-
             # The name of the field
             CONSTANT_NAME_KEY = 'name'
             # The code line, recreated, with the password obfuscated
@@ -140,8 +85,11 @@ module Contrast
               # sort. We leave it to each rule to properly handle these nodes.
               return unless value_node_passes?(value)
 
-              new_finding_and_reporting mod, name
-              build_finding mod, name
+              if Contrast::Agent::Reporter.enabled?
+                new_finding_and_reporting mod, name
+              else # TODO: RUBY-1438 -- remove
+                build_finding mod, name
+              end
             end
 
             # Constants can be set as frozen directly. We need to account for
@@ -210,7 +158,7 @@ module Contrast
 
             def save_and_report_finding ruby_finding, new_preflight
               Contrast::Agent::Reporting::ReportingStorage[hash] = ruby_finding
-              Contrast::Agent.reporter_queue.send_event_immediately(new_preflight)
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
             end
           end
         end

data/lib/contrast/agent/assess/rule/provider.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast