contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/config/exception_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/heap_dump_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/inventory_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/logger_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/request_audit_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/root_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/ruby_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -33,7 +33,10 @@ module Contrast
           require_scan: Contrast::Utils::ObjectShare::TRUE,
           # controls whether or not we track frozen Strings by replacing them
           track_frozen_sources: Contrast::Utils::ObjectShare::TRUE,
+          # controls tracking outside of request
+          non_request_tracking: Contrast::Utils::ObjectShare::FALSE,
           uninstrument_namespace: DEFAULT_UNINSTRUMENTED_NAMESPACES
+
       }.cs__freeze
 
       def initialize hsh

data/lib/contrast/config/sampling_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/server_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/service_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/logger_configuration'

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/extension/assess/array.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch'
 require 'contrast/agent/patching/policy/patcher'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -52,7 +53,8 @@ module Contrast
               return ret unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
               properties.cleanup_tags
-              properties.build_event(ARRAY_JOIN_NODE, ret, ary, ret, [separator])
+              event_data = Contrast::Agent::Assess::Events::EventData.new ARRAY_JOIN_NODE, ret, ary, ret, [separator]
+              properties.build_event(event_data)
               properties.event.instance_variable_set(:@_parent_events, parent_events)
               ret
             end

data/lib/contrast/extension/assess/erb.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This module is used to track propagation through ERB template rendering
@@ -13,6 +13,20 @@ module ERBPropagator
 
       erb_pre_result = preshift.object.src
       parent_events = []
+      binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
+      properties.build_event(Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args), 1)
+      properties.event.instance_variable_set(:@_parent_events, parent_events)
+
+      ret
+    end
+
+    private
+
+    def binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
         next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
@@ -25,10 +39,6 @@ module ERBPropagator
         parent_event = Contrast::Agent::Assess::Tracker.properties(bound_variable_value)&.event
         parent_events << parent_event if parent_event
       end
-      properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
-      properties.event.instance_variable_set(:@_parent_events, parent_events)
-
-      ret
     end
   end
 end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -23,6 +23,8 @@ module Contrast
           end
 
           def apply_trigger obj, source, ret, clazz, method
+            return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
             # Since we know this is the source of the trigger, we can do some
             # optimization here and return when it is not tracked
             return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/at_exit_hook'
@@ -11,6 +11,7 @@ module Contrast
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
         def apply_trigger source
+          return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
           # Since we know this is the source of the trigger, we can do some
           # optimization here and return when it is not tracked
           return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)

data/lib/contrast/extension/assess/fiber.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -64,7 +65,8 @@ module Contrast
                 next unless (result_properties = Contrast::Agent::Assess::Tracker.properties!(result))
 
                 result_properties.splat_from(fiber, result)
-                result_properties.build_event(FIBER_YIELD_NODE, result, fiber, result, [])
+                event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_YIELD_NODE, result, fiber, result, [])
+                result_properties.build_event(event_data)
               end
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
@@ -80,7 +82,8 @@ module Contrast
               return unless properties
 
               properties.splat_from(underlying, fiber)
-              properties.build_event(FIBER_NEW_NODE, fiber, underlying, fiber, [])
+              event_data = Contrast::Agent::Assess::Events::EventData.new(FIBER_NEW_NODE, fiber, underlying, fiber, [])
+              properties.build_event(event_data)
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Fiber.new', e)

data/lib/contrast/extension/assess/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/assess/exec_trigger'
 require 'contrast/components/logger'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -45,8 +46,12 @@ module Contrast
 
             parent_events = []
             track_sprintf(ret, format_string, args, parent_events)
-
-            properties.build_event(patcher, ret, preshift.object, ret, preshift.args, 1)
+            event_data = Contrast::Agent::Assess::Events::EventData.new(patcher,
+                                                                        ret,
+                                                                        preshift.object,
+                                                                        ret,
+                                                                        preshift.args)
+            properties.build_event(event_data, 1)
 
             properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret

data/lib/contrast/extension/assess/marshal.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -29,6 +30,8 @@ module Contrast
 
           def cs__load_assess source, ret
             with_contrast_scope do
+              return unless ::Contrast::ASSESS.non_request_tracking? || Contrast::Agent::REQUEST_TRACKER.current
+
               args = [source]
               # source might not be all the args passed in, but it is the one we care
               # about. we could pass in all the args in the last param here if it
@@ -40,7 +43,8 @@ module Contrast
               properties.copy_from(source, ret)
 
               node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
-              properties.build_event(node, ret, self, ret, args)
+              event_data = Contrast::Agent::Assess::Events::EventData.new node, ret, self, ret, args
+              properties.build_event(event_data)
             rescue StandardError => e
               logger.error('Unable to run Assess for Marshal.load', e)
             end

data/lib/contrast/extension/assess/regexp.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -53,7 +54,12 @@ module Contrast
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
               properties.splat_from(string, target)
-              properties.build_event(REGEXP_EQUAL_SQUIGGLE_NODE, target, self, result, [string])
+              event_data = Contrast::Agent::Assess::Events::EventData.new(REGEXP_EQUAL_SQUIGGLE_NODE,
+                                                                          target,
+                                                                          self,
+                                                                          result,
+                                                                          [string])
+              properties.build_event(event_data)
             end
           rescue Exception => e # rubocop:disable Lint/RescueException
             logger.error('Unable to propagate during Regexp#=~', e)

data/lib/contrast/extension/assess/string.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Extension
@@ -46,7 +47,12 @@ module Contrast
                 parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
                 parent_events << parent_event if parent_event
               end
-              properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(INTERPOLATION_NODE,
+                                                                          result,
+                                                                          inputs,
+                                                                          result,
+                                                                          inputs)
+              properties.build_event(event_data)
               properties.event.instance_variable_set(:@_parent_events, parent_events)
             end
           rescue StandardError => e

data/lib/contrast/extension/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/delegator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # Some developers override various methods on Delegator, which can often

data/lib/contrast/extension/extension.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -36,10 +36,8 @@ module Contrast
           # conditions
           def assign_value path
             case path
-            when /fiber/
+            when /fiber/, /interpolation26/
               require path if Funchook.available?
-            when /interpolation26/
-              require path if ::Contrast::AGENT.patch_interpolation? && Funchook.available?
             else
               require path
             end

data/lib/contrast/extension/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/kernel.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/scope'

data/lib/contrast/extension/module.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/extension/protect/psych.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 if defined?(Psych)

data/lib/contrast/extension/protect.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/thread.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # ensure that we're being loaded with an agent

data/lib/contrast/framework/base_support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -30,6 +30,10 @@ module Contrast
         raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
       end
 
+      def current_route_coverage
+        raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
+      end
+
       def current_route
         raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
       end

data/lib/contrast/framework/grape/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'
@@ -91,6 +91,30 @@ module Contrast
             Contrast::Api::Dtm::RouteCoverage.from_grape_controller(final_controller, method, route_pattern, full_route)
           end
 
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Grape::API] optionally use this controller instead of global ::Grape::API.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Grape::API, full_route = nil
+            return unless grape_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find final controller - actually we gotta match the route to the scanned application
+            # Initially Grape compiles all routes on startup, so we can use the url from the request
+            # and create the observed route
+            # Class < Grape::API, Grape::Router::Route
+            final_controller, route_pattern = _route_recurse(method, _cleaned_route(request), grape_controllers)
+            return unless final_controller
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data final_controller, method, route_pattern, full_route
+          end
+
           # Search object space for grape controllers--any class that subclasses ::Grape::API.
           #
           # @return [Array<::Grape::API>] grape controllers

data/lib/contrast/framework/manager.rb

@@ -1,15 +1,17 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/reporting_events/application_update'
+require 'contrast/agent/reporting/reporting_events/application_inventory'
 require 'contrast/components/logger'
 require 'contrast/extension/module'
+require 'contrast/framework/grape/support'
+require 'contrast/framework/manager_extend'
 require 'contrast/framework/platform_version'
 require 'contrast/framework/rack/support'
 require 'contrast/framework/rails/support'
-require 'contrast/framework/grape/support'
 require 'contrast/framework/sinatra/support'
 require 'contrast/utils/class_util'
-require 'contrast/framework/manager_extend'
 
 module Contrast
   module Framework
@@ -126,12 +128,21 @@ module Contrast
             reject(&:nil?).first
       end
 
+      # Iterate through current frameworks and return the current request's route. This will be the first non-nil
+      # result.
+      #
+      # @param request [Contrast::Agent::Request] the current request.
+      # @return [Contrast::Agent::Reporting::RouteCoverage] the current route as a Dtm.
+      def get_route_information request
+        @_frameworks.lazy.map { |framework_support| framework_support.current_route_coverage(request) }.
+            reject(&:nil?).first
+      end
+
       # Sometimes the framework we want to instrument is loaded after our agent code. To catch that case, we'll detect
       # if the loaded_module is the marker class for any of our supported frameworks. If it is, and we don't already
       # have support enabled, we'll enable it now. We'll also need to catch up on any other startup actions that we've
       # missed. Most likely, this is only necessary for those applications which have applications mounted on them.
       #
-      # TODO: RUBY-1354
       # TODO: RUBY-1356
       #
       # @param mod [Module] the module or class that was just loaded
@@ -146,8 +157,18 @@ module Contrast
 
           @_frameworks << framework
           # Report the registered routes of that framework now that we know we need to find them
+          # TODO: RUBY-1438 -- remove and build ReportingEvent directly
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
-          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+          if Contrast::Agent.reporter
+            report = Contrast::Agent::Reporting::DtmMessage.dtm_to_event(app_update_msg)
+            Contrast::Agent.reporter.send_event(report)
+
+            # This is being reported separately because we extract the data from the same message
+            inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
+            Contrast::Agent.reporter.send_event(inventory_report)
+          else
+            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+          end
           logger.info('Framework detected after initialization. Enabling support.',
                       framework: framework.detection_class,
                       frameworks: @_frameworks)

data/lib/contrast/framework/manager_extend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/framework/platform_version.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/after_load_patch'

data/lib/contrast/framework/rack/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/invalid_configuration_util'

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/rails/patch/assess_configuration'

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/rails/patch/rails_application_configuration'