contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/framework/rails/railtie.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/job_servers_running'

data/lib/contrast/framework/rails/support.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/api/dtm.pb'
@@ -10,7 +10,7 @@ module Contrast
   module Framework
     module Rails
       # Used when Rails is present to define framework specific behavior
-      class Support
+      class Support # rubocop:disable Metrics/ClassLength
         extend Contrast::Framework::BaseSupport
         extend Contrast::Framework::Rails::Patch::Support
         include Contrast::Components::Logger::InstanceMethods
@@ -78,6 +78,38 @@ module Contrast
             nil
           end
 
+          # Find the current route, based on the provided Request wrapper
+          #
+          # @param request[Contrast::Agent::Request]
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request
+            return unless ::Rails.cs__respond_to?(:application)
+
+            # ActionDispatch::Journey::Path::Pattern::MatchData, Hash, ActionDispatch::Journey::Route, Array<String>
+            match, _params, route, path = get_full_route(request.rack_request)
+            unless route
+              logger.warn('Unable to determine the current route of this request')
+              return
+            end
+
+            original_url = request.rack_request.path_info
+            mounted_app = route&.app&.app
+            # Route is either the final rails route, or a router that points to a Sinatra controller.
+            if mounted_app && Contrast::Framework::Sinatra::Support.sinatra_controller?(mounted_app)
+              return mounted_new_sinatra_route(request, match, path, route, original_url)
+            end
+            if mounted_app && Contrast::Framework::Grape::Support.grape_controller?(mounted_app)
+              return mounted_new_grape_route(request, match, path, route, original_url)
+            end
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rails_data route, original_url
+          rescue StandardError => e
+            logger.warn('Unable to determine the current route of this request', e)
+            nil
+          end
+
           # Copy a request for modification.
           #
           # @param env [::ActionDispatch::Request] original env.
@@ -155,6 +187,12 @@ module Contrast
             Contrast::Framework::Sinatra::Support.current_route(new_req, route.app.app, original_url)
           end
 
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_sinatra_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Sinatra::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
           # @param request[Contrast::Agent::Request]
           # @param match [ActionDispatch::Journey::Path::Pattern::MatchData]
           # @param path [Array<String>] the path of this request, built out from each nested
@@ -167,6 +205,12 @@ module Contrast
             Contrast::Framework::Grape::Support.current_route(new_req, route.app.app, original_url)
           end
 
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil]
+          def mounted_new_grape_route request, match, path, route, original_url
+            new_req = unmounted_route(request, match, path)
+            Contrast::Framework::Grape::Support.current_route_coverage(new_req, route.app.app, original_url)
+          end
+
           # Create a request copied from current request, but with the base path removed from path_info, as that's
           # the mount.
           #

data/lib/contrast/framework/sinatra/support.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/framework/base_support'
+require 'contrast/agent/reporting/report'
 
 module Contrast
   module Framework
@@ -82,6 +83,27 @@ module Contrast
             Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(final_controller, method, route_pattern, full_route)
           end
 
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Sinatra::Base] optionally use this controller instead of global ::Sinatra::Base.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Sinatra::Base, full_route = nil
+            return unless sinatra_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find route match--checking superclasses if necessary.
+            final_controller, route_pattern = _route_recurse(controller, method, _cleaned_route(request))
+            return unless final_controller
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data final_controller, method, route_pattern, full_route
+          end
+
           # Search object space for sinatra controllers--any class that subclasses ::Sinatra::Base.
           #
           # @return [Array<::Sinatra::Base>] sinatra controlelrs
@@ -100,7 +122,7 @@ module Contrast
           #
           # @param controller [Sinatra::Base, #routes] a Sinatra application.
           # @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
-          # @param method [String] the relative route passed from Rack.
+          # @param route [String] the relative route passed from Rack.
           # @return [Array[Sinatra::Base, Mustermann::Sinatra], nil] Either the controller that
           # will handle the route along with the route pattern or nil if no match.
           def _route_recurse controller, method, route

data/lib/contrast/funchook/funchook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -17,26 +17,29 @@ module Funchook
 
   AGENT_ROOT = File.join(__dir__, '..', '..', '..')
 
-  def self.resolve_path!
-    actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
-      load_path = absolute_path(potential_funchook_path)
-      File.exist?(load_path)
+  class << self
+    def resolve_path!
+      actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+        load_path = absolute_path(potential_funchook_path)
+        File.exist?(load_path)
+      end
+
+      if actual_path_segments.nil?
+        logger.warn('Unable to find funchook')
+      else
+        @path = absolute_path(actual_path_segments)
+        logger.info('Funchook found', path: @path)
+      end
+      @path
     end
 
-    if actual_path_segments.nil?
-      logger.warn('Unable to find funchook')
-    else
-      @path = absolute_path(actual_path_segments)
-      logger.info('Funchook found', path: @path)
+    def absolute_path path_array
+      File.absolute_path(File.join(AGENT_ROOT, *path_array))
     end
-    @path
-  end
-
-  def self.absolute_path path_array
-    File.absolute_path(File.join(AGENT_ROOT, *path_array))
-  end
 
-  def self.available?
-    @_available ||= !!resolve_path!
+    def available?
+      @_available = !!resolve_path! if @_available.nil?
+      @_available
+    end
   end
 end

data/lib/contrast/logger/application.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/exclude_key'

data/lib/contrast/logger/format.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'ougai'

data/lib/contrast/logger/log.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'logger'

data/lib/contrast/logger/request.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/timer'

data/lib/contrast/logger/time.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/security_exception.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/tasks/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/tasks/service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/os'

data/lib/contrast/utils/assess/propagation_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/property/tagged_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'
@@ -29,13 +29,13 @@ module Contrast
         end
 
         def sample? request
-          history = request_history(request)
-          history.hit
-
           # if sampling isn't enabled, we record all requests and take a
           # default amount of responses
           return [true, true] unless @enabled
 
+          history = request_history(request)
+          history.hit
+
           # if we've exceeded this sample window, reset it
           if history.elapsed >= @window_ms
             history.reset_window

data/lib/contrast/utils/assess/source_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/assess/split_utils.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module extends the Split class which is specifically for String#split & String#grapheme_clusters
+      # propagation it propagates tag ranges from a string to elements within an untracked array
+      module SplitUtils
+        private
+
+        # Quick hook to the String#split propagation node in our Assess policy
+        #
+        # @return [Contrast::Agent::Assess::Policy::PropagationNode] String#split node
+        def split_node
+          @_split_node ||= Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+            node.class_name == 'String' && node.method_name == :split && node.instance_method?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'

data/lib/contrast/utils/assess/trigger_method_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,12 +19,13 @@ module Contrast
 
         # Find the request for this finding. This assumes, for now, that if there is an active request, then that
         # is the request to report. Otherwise, we'll use the first request found in the events of the
-        # source_object.
+        # source_object if the non request tracking flag is set.
         #
         # @param source [Object,nil] some Object used as the source of a trigger event
         # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
         def find_request source
           return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
+          return unless ::Contrast::ASSESS.non_request_tracking?
           return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
 
           find_event_request(properties.event)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -39,7 +39,7 @@ module Contrast
       def self.resolve_corrected_path path
         tmp_path = path.dup
         start_match = START_UNDERSCORE.match(tmp_path)
-        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+        tmp_path = tmp_path[start_match.offset(0).last..] if start_match
 
         tmp_path.gsub!(REPEATING_UNDERSCORE, '__')
 

data/lib/contrast/utils/exclude_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/findings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
@@ -44,9 +44,11 @@ module Contrast
       #
       # We make sure the content-type is present before reporting, because some
       # findings do require it for validation.
+      #
+      # @return [true, nil]
       def report_collected_findings
-        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
         return if @_collection.empty?
+        return if Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type.nil?
 
         while @_collection.any?
           finding = @_collection.pop
@@ -56,6 +58,7 @@ module Contrast
                                                                        finding[:ret],
                                                                        finding[:args]
         end
+        true
       end
     end
   end

data/lib/contrast/utils/hash_digest.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -24,16 +24,35 @@ module Contrast
       CLASS_CONSTANT_NAME_KEY = 'name'
       CLASS_LINE_NO_KEY = 'lineNo'
 
+      # Update to CRC checksum the finding route and verb if finding route
+      # [Contrast::Api::Dtm::RouteCoverage] is available else update the passed
+      # request or Contrast::REQUEST_TRACKER.current.request uri and used request
+      # method.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] finding to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [Integer, nil] returns nil if there is no request context or tracking
+      # is disabled.
       def update_on_request finding, request
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context || ::Contrast::ASSESS.non_request_tracking?
+
         if (route = finding.routes[0])
-          update(route.route)
-          update(route.verb)
-        elsif request ||= Contrast::Agent::REQUEST_TRACKER.current&.request
-          update(request.normalized_uri)
-          update(request.request_method)
+          update(route.route) # the normalized URL used to access the method in the route.
+          update(route.verb) # the HTTP Verb used  to access the method in the route.
+        elsif request ||= context&.request
+          update(request.normalized_uri) # the normalized URL used to access the method in the route.
+          update(request.request_method) # The HTTP method used in the request
         end
       end
 
+      # Update to CRC checksum the event source name and source type.
+      # Expects Contrast::Api::Dtm::TraceEvent || Contrast::Agent::Assess::Events::SourceEvent
+      #
+      # @param events [Protobuf::Field::FieldArray<Contrast::Api::Dtm::TraceEvent>,
+      #                                            <Contrast::Agent::Assess::Events::SourceEvent>]
+      #                                            Array of TraceEvents
+      # @return checksum [Integer, nil] returns nil if there is no events
       def update_on_sources events
         return unless events&.any?
 
@@ -64,12 +83,23 @@ module Contrast
         @crc32 = 0
       end
 
+      # Converts  given string to CRC checksum. CRC32 checksum ensures that If error
+      # of a single bit occurs, the CRC checksum will fail, regardless of any other
+      # property of the transmitted data, including its length. Called several times
+      # with previous CRC to recalculate the new output.
+      #
+      # @param str [String]
+      # @return @crc32 [Integer, nil] updated value of crc 32 bit integer checksum or
+      # nil if passed string is nil or empty
       def update str
         return unless str
 
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
+      # Casts current CRC checksum to String
+      #
+      # @return @crc32 [String] String representation of CRC32 checksum
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/hash_digest_extend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -13,6 +13,11 @@ module Contrast
     # specification shared across all agent teams. The spec can be found here:
     # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
     module HashDigestExtend
+      # Generates the hash checksum for the request. Converts the request method, uri,
+      # param names and content length to CRC checksum and returns string representation
+      #
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_request_hash request
         hash = new
         hash.update(request.request_method)
@@ -25,6 +30,14 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for the event, either dataflow,
+      # crypto(crypto-bad-ciphers, crypto-bad-mac) rules or trigger event
+      # and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param source [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_event_hash finding, source, request
         return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
 
@@ -34,6 +47,11 @@ module Contrast
         generate_trigger_hash(finding, request)
       end
 
+      # Generates the hash checksum for configurations. Converts the finding rule_id, session_id and configPath and
+      # to CRC32 checksum and returns string representation to be appended to Contrast::Api::Dtm::Finding
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
       def generate_config_hash finding
         hash = new
         hash.update(finding.rule_id)
@@ -44,6 +62,11 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for class scanning. Converts the rule_id, finding.properties(source, name)
+      # to CRC32 checksum and returns string representation.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @return checksum [String] String representation of CRC32 checksum.
       def generate_class_scanning_hash finding
         hash = new
         hash.update(finding.rule_id)
@@ -59,6 +82,14 @@ module Contrast
 
       private
 
+      # Generates the hash checksum for crypto(crypto-bad-ciphers, crypto-bad-mac) rules.
+      # used in #generate_event_hash.
+      #
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param algorithm [Object] the source of the Trigger Event
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_crypto_hash finding, algorithm, request
         hash = new
         hash.update(finding.rule_id)
@@ -67,6 +98,12 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for dataflow when the finding events are more than one
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_dataflow_hash finding, request
         hash = new
         hash.update(finding.rule_id)
@@ -75,6 +112,12 @@ module Contrast
         hash.finish
       end
 
+      # Generates the hash checksum for trigger
+      # used in #generate_event_hash.
+      #
+      # @param finding [Contrast::Api::Dtm::Finding] to be reported
+      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
+      # @return checksum [String] String representation of CRC32 checksum
       def generate_trigger_hash finding, request
         hash = new
         hash.update(finding.rule_id)

data/lib/contrast/utils/head_dump_utils_extend.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'objspace'

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
@@ -33,9 +33,10 @@ module Contrast
           hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
           finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
           finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
-          if Contrast::Agent::Reporter.enabled?
-            cs__report_new_finding hash, rule_id, user_provided_options, call_location
+          if Contrast::Agent::Reporter.enabled? # TODO: RUBY-1438 -- remove
+            cs__report_new_finding(hash, rule_id, user_provided_options, call_location)
+          else
+            Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
           end
         end
       rescue StandardError => e
@@ -52,7 +53,7 @@ module Contrast
         ruby_finding = Contrast::Agent::Reporting::Finding.new rule_id
         ruby_finding.hash_code = hash_code
         set_new_finding_properties(ruby_finding, user_provided_options, call_location)
-        Contrast::Agent.reporter_queue.send_event_immediately(new_preflight)
+        Contrast::Agent.reporter&.send_event_immediately(new_preflight)
         Contrast::Agent::Reporting::ReportingStorage[hash_code] = ruby_finding
       end
 

data/lib/contrast/utils/io_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/utils/job_servers_running.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/utils/log_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/lru_cache.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast