contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/assess/events/event_data'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # This module is specifically for String#(g)sub propagation
+          #
+          # Disclaimer: there may be a better way, but we're
+          # in a 'get it work' state. hopefully, we'll be in
+          # a 'get it right' state soon.
+          module SubstitutionUtils
+            CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
+            CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze
+
+            private
+
+            # Update our properties of the object dependent on the substitution pattern used.
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            # @param preshift [Contrast::Agent::Assess::PreShift] instance of PreShift
+            # @param ret [String] the result of the substitution
+            # @param block, the given block
+            # @param global [Boolean] if this was a global or single substitution, optional
+            def substitution_tagger patcher, preshift, ret, block, global = true
+              return ret unless ret
+
+              begin
+                # define here what is used across private methods
+                @_preshift = preshift
+                args = @_preshift.args[1]
+                @_self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
+                @_incoming_tracked = args && determine_tracked(args)
+                @_ret = ret
+                return @_ret unless @_self_tracked || @_incoming_tracked
+
+                @_parent_events = []
+                if block
+                  block_sub
+                elsif args.is_a?(String)
+                  string_sub(args, global)
+                elsif args.is_a?(Hash)
+                  hash_sub
+                else # Enumerator, only for gsub
+                  pattern_gsub
+                end
+
+                self_tracked_handle(@_parent_events)
+                string_build_event(patcher)
+              rescue StandardError => e
+                logger.error('Unable to apply gsub propagator', e)
+              end
+              ret
+            end
+
+            def self_tracked_handle parent_events
+              return unless @_self_tracked
+
+              source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+              parent_event = source_properties&.event
+              parent_events.prepend(parent_event) if parent_event
+            end
+
+            def source
+              @_preshift.object
+            end
+
+            # @param args [String] the new String going into the substitution
+            def determine_tracked args
+              # if there's no arg, it can't be tracked
+              return false unless args
+
+              # if it's a string, just ask if it's tracked
+              case args
+              when String
+                Contrast::Agent::Assess::Tracker.tracked?(args)
+                # if it's a hash, ask if it has a tracked string
+              when Hash
+                args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
+                # this should never happen
+              else
+                false
+              end
+            end
+
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            def string_sub incoming, global
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+              @_parent_events << incoming_properties&.event if incoming_properties&.event
+
+              # We can't efficiently find the places that things were
+              # copied from regexp / captures. Trading accuracy for
+              # performance
+              if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
+                properties.splat_from(source, @_ret) if @_self_tracked
+                return
+              end
+
+              # if it's just a straight insert, that we can do
+              # Copy the tags from us to the return
+              ranges = find_string_sub_insert(properties, incoming, global)
+
+              properties.delete_tags_at_ranges(ranges)
+              properties.shift_tags(ranges)
+              return unless @_incoming_tracked
+              return unless incoming_properties
+
+              tags = incoming_properties.tag_keys
+              ranges.each do |range|
+                tags.each do |tag|
+                  properties.add_tag(tag, range)
+                end
+              end
+            end
+
+            # Find the points at which the new String was placed into the original
+            #
+            # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+            # @param incoming [String] the new String going into the substitution
+            # @param global [Boolean] if this was a global or single substitution
+            # @return [Array<Range>] the Ranges where substitution occurred
+            def find_string_sub_insert properties, incoming, global
+              pattern = @_preshift.args[0]
+              properties.copy_from(source, @_ret)
+              # Figure out where inserts occurred
+              last_idx = 0
+              ranges = []
+              # For each insert, move the tag ranges
+              while last_idx
+                idx = source.index(pattern, last_idx)
+                break unless idx
+
+                last_idx = idx ? idx + 1 : nil
+                start_index = idx
+                end_index = idx + incoming.length
+                ranges << (start_index...end_index)
+                break unless global
+              end
+              ranges
+            end
+
+            def block_sub
+              hash_sub
+            end
+
+            def hash_sub
+              return unless @_self_tracked
+
+              properties = Contrast::Agent::Assess::Tracker.properties!(@_ret)
+              properties&.splat_from(source, @_ret)
+            end
+
+            def pattern_gsub
+              return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
+              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(@_ret))
+
+              source_properties.tag_keys.each do |key|
+                properties.add_tag(key, 0...1)
+              end
+              parent_event = source_properties.event
+              @_parent_events << parent_event if parent_event
+            end
+
+            # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode]
+            #   the node that governs this event.
+            def string_build_event patcher
+              return unless Contrast::Agent::Assess::Tracker.tracked?(@_ret)
+
+              properties = Contrast::Agent::Assess::Tracker.properties(@_ret)
+              args = @_preshift.args
+              event_data = Contrast::Agent::Assess::Events::EventData.new(patcher, @_ret, @_preshift, @_ret, args)
+              properties.build_event(event_data, 2)
+              properties.event.instance_variable_set(:@_parent_events, @_parent_events)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,8 +24,12 @@ module Contrast
 
                 properties.copy_from(preshift.object, ret)
                 handle_tr(policy_node, preshift, ret, properties)
-
-                properties.build_event(policy_node, ret, preshift.object, ret, preshift.args, 1)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(policy_node,
+                                                                            ret,
+                                                                            preshift.object,
+                                                                            ret,
+                                                                            preshift.args)
+                properties.build_event(event_data, 1)
                 ret
               end
 
@@ -36,7 +40,8 @@ module Contrast
                 source = preshift.object
                 args = preshift.args
                 properties.splat_from(source, ret)
-                properties.build_event(patcher, ret, source, ret, args)
+                event_data = Contrast::Agent::Assess::Events::EventData.new patcher, ret, source, ret, args
+                properties.build_event(event_data)
                 ret
               end
 

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/source_method_utils'
+require 'contrast/agent/assess/events/event_data'
 
 module Contrast
   module Agent
@@ -38,13 +39,16 @@ module Contrast
             def source_patchers method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
               return unless (source_node = method_policy.source_node)
-              return unless (target = determine_target(source_node, object, ret, args))
+
+              # used to hold the object and ret
+              source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
+              return unless (target = determine_target(source_node, source_data, args))
 
               return_val = nil
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
                 return unless ::Contrast::ASSESS.track_frozen_sources?
                 return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-                return unless (dup = safe_dup(ret))
+                return unless (dup = safe_dup(source_data.ret))
                 return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
                 Contrast::Agent::Assess::Tracker.pre_freeze(dup)
@@ -52,8 +56,7 @@ module Contrast
                 target = dup
               end
 
-              apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret,
-                           source_node.type, nil, *args)
+              apply_source(source_node, target, source_data, source_node.type, nil, *args)
 
               return_val
             end
@@ -63,32 +66,31 @@ module Contrast
 
             # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
+            def apply_source source_node, target, source_data, source_type, source_name = nil, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
-              source_name ||= determine_source_name(source_node, object, ret, *args)
+              source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Agent::Assess::Tracker.trackable?(target)
-                apply_tags(source_node, target, object, ret, source_type, source_name, *args)
+                apply_tags(source_node, target, source_data, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
+                apply_hash_tags(source_node, target, source_data, source_type, *args)
                 # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
                 # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each do |value|
-                  apply_source(context, source_node, value, object, ret, source_type, source_name, *args)
+                  apply_source(source_node, value, source_data, source_type, source_name, *args)
                 end
               end
             rescue StandardError => e
@@ -98,16 +100,14 @@ module Contrast
             # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
             # values back to ourselves and try again
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request context
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
             # @param target [Object] the target of the Source Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
             #   map
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_hash_tags context, source_node, target, object, ret, source_type, *args
+            def apply_hash_tags source_node, target, source_data, source_type, *args
               to_replace = []
               target.each_pair do |key, value|
                 # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
@@ -116,8 +116,8 @@ module Contrast
                   key = key.dup
                   to_replace << key
                 end
-                apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
-                apply_source(context, source_node, value, object, ret, source_type, key, *args)
+                apply_source(source_node, key, source_data, key_type(source_type), key, *args)
+                apply_source(source_node, value, source_data, source_type, key, *args)
               end
               handle_hash_key(target, to_replace)
             end
@@ -146,7 +146,16 @@ module Contrast
               end
             end
 
-            def apply_tags source_node, target, object, ret, source_type, source_name, *args
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param target [Object] the target of the Source Event
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            def apply_tags source_node, target, source_data, source_type, source_name, *args
               # don't apply tags if we can't track the thing
               return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
@@ -164,24 +173,28 @@ module Contrast
                 logger.trace('Source detected', node_id: source_node.id, target_id: target.__id__, tag: tag)
               end
               # make a representation of this method that TeamServer can render
-              properties.build_event(source_node, target, object, ret, args, source_type, source_name)
+              event_data = Contrast::Agent::Assess::Events::EventData.new(source_node,
+                                                                          target,
+                                                                          source_data.object,
+                                                                          source_data.ret,
+                                                                          args)
+              properties.build_event(event_data, source_type, source_name)
             end
 
             # Find the literal target of the propagation
             #
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
             #   event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
+            # @param source_data [Contrast::Agent::Asssess::Events::EventData] used to hold object and ret
             # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
-            def determine_target source_node, object, ret, args
+            def determine_target source_node, source_data, args
               source_target = source_node.targets[0]
               case source_target
               when Contrast::Utils::ObjectShare::RETURN_KEY
-                ret
+                source_data.ret
               when Contrast::Utils::ObjectShare::OBJECT_KEY
-                object
+                source_data.object
               else
                 args[source_target]
               end

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_method'

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_validation/cross_site_validator'

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -32,7 +32,12 @@ module Contrast
                 interpolated_inputs = []
                 handle_binding_variables(scope, erb_template_prerender, ret, properties, interpolated_inputs)
                 handle_local_variables(args, erb_template_prerender, ret, properties, interpolated_inputs)
-                properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+                event_data = Contrast::Agent::Assess::Events::EventData.new(TEMPLATE_PROPAGATION_NODE,
+                                                                            ret,
+                                                                            erb_template_prerender,
+                                                                            ret,
+                                                                            interpolated_inputs)
+                properties.build_event(event_data)
                 unless interpolated_inputs.empty?
                   current_event = properties.event
                   interpolated_inputs.each do |input|

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/trigger_method_utils'
+require 'contrast/agent/assess/events/event_data'
 require 'contrast/agent/reporting/reporting_utilities/reporting_storage'
 
 module Contrast
@@ -26,6 +27,11 @@ module Contrast
           MINIMUM_FINDING_VERSION = 3
           # The level of TeamServer compliance our traces meet.
           CURRENT_FINDING_VERSION = 4
+          # Rules that always exists outside of Request Context
+          NON_REQUEST_RULES = [
+            'hardcoded-password', # Contrast::Agent::Assess::Rule::Provider::HardcodedPassword.NAME,
+            'hardcoded-key' # Contrast::Agent::Assess::Rule::Provider::HardcodedKey.NAME
+          ].cs__freeze
 
           class << self
             # This is called from within our woven proc. It will be called as if it were inline in the Rack
@@ -39,6 +45,14 @@ module Contrast
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
 
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              # return if there is no context and the flag is set to default => false
+              # we need to have request if the flag is default
+              # else proceed, if the flag is true we don't need to check for context we
+              # go as currently.
+              # When outside of a request, only track when the feature is enabled
+              return unless Contrast::ASSESS.non_request_tracking? || context
+
               if trigger_node.sources&.any?
                 trigger_node.sources.each do |marker|
                   source = determine_source(marker, object, ret, args)
@@ -53,12 +67,12 @@ module Contrast
               apply_trigger(trigger_node, source, object, ret, *args)
             end
 
-            def append_to_finding finding, trigger_node, source, object, ret, request, *args
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
+            def append_to_finding finding, event_data, request
+              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(event_data.policy_node.rule_id)
               finding.version = determine_compliance_version(finding)
-              append_events(finding, trigger_node, source, object, ret, args)
+              append_events(finding, event_data)
               append_route(finding, request)
-              append_hash(finding, source, request)
+              append_hash(finding, event_data.tagged, request)
             end
 
             # This converts the source of the finding, and the events leading up to it into a Finding
@@ -84,12 +98,16 @@ module Contrast
               request = find_request(source)
               return unless reportable?(request&.env)
 
-              handle_new_finding trigger_node, source, object, ret, request, *args
-              finding = Contrast::Api::Dtm::Finding.new
-              append_to_finding finding, trigger_node, source, object, ret, request, *args
-              logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
-                                              rule: trigger_node.rule_id)
-              report_finding(finding, request)
+              if Contrast::Agent::Reporter.enabled?
+                handle_new_finding(trigger_node, source, object, ret, request, *args)
+              else # TODO: RUBY-1438 -- remove
+                finding = Contrast::Api::Dtm::Finding.new
+                event_data = Contrast::Agent::Assess::Events::EventData.new trigger_node, source, object, ret, args
+                append_to_finding finding, event_data, request
+                logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
+                                                rule: trigger_node.rule_id)
+                report_finding(finding, request)
+              end
             rescue StandardError => e
               logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
@@ -109,6 +127,8 @@ module Contrast
                 return
               end
 
+              return unless ::Contrast::ASSESS.non_request_tracking? || NON_REQUEST_RULES.include?(finding.rule_id)
+
               activity = Contrast::Api::Dtm::Activity.new
               activity.findings << finding
               if request
@@ -117,18 +137,12 @@ module Contrast
                 logger.debug('Attempted to report finding without request', finding: finding)
               end
 
-              # If we're out of request context, then we need to report this finding ourselves, so we'll send it in the
-              # one-off activity we created.
+              # If we're out of request context, then we need to report this finding ourselves,
+              # so we'll send it in the one-off activity we created.
               Contrast::Agent.messaging_queue.send_event_eventually(activity)
             end
 
             def handle_new_finding trigger_node, source, object, ret, request, *args
-              return unless Contrast::Agent::Reporter.enabled?
-
-              new_finding_and_reporting trigger_node, source, object, ret, request, *args
-            end
-
-            def new_finding_and_reporting trigger_node, source, object, ret, request, *args
               # sent to reporter
               # here we will generate new type of finding
               ruby_finding = Contrast::Agent::Reporting::Finding.new trigger_node.rule_id
@@ -144,7 +158,7 @@ module Contrast
               new_preflight_message.hash_code = hash_code
               new_preflight_message.data = "#{ trigger_node.rule_id },#{ hash_code }"
               new_preflight.messages << new_preflight_message
-              Contrast::Agent.reporter_queue.send_event_immediately(new_preflight)
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
             end
 
             private
@@ -186,10 +200,9 @@ module Contrast
               end
             end
 
-            def append_events finding, trigger_node, source, object, ret, args
-              append_from_source(finding, source)
-              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret,
-                                                                                    args).to_dtm_event
+            def append_events finding, event_data
+              append_from_source(finding, event_data.tagged)
+              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(event_data).to_dtm_event
             end
 
             def append_from_source finding, source

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger/reflected_xss'

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/properties.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'base64'