contrast-agent 4.3.0 → 4.5.0

data/lib/contrast/api/decorators/library.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/message.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -26,27 +26,37 @@ module Contrast
           end
 
           # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          #
           # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @param url [String, nil] use url from string instead of journey object.
           # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_action_dispatch_journey journey_obj
+          def from_action_dispatch_journey journey_obj, url = nil
             msg = new
             msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
 
             verb = source_or_string(journey_obj.verb)
             msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
 
-            url = source_or_string(journey_obj.path.spec)
+            url ||= source_or_string(journey_obj.path.spec)
             msg.url = Contrast::Utils::StringUtils.force_utf8(url)
             msg
           end
 
-          def from_sinatra_route clazz, method, pattern
+          # Convert Sinatra route data to dtm message.
+          #
+          # @param controller [::Sinatra::Base] the route's final controller.
+          # @param method [String] GET, PUT, POST, etc...
+          # @param method [::Mustermann::Sinatra]  the pattern that was matched in routing.
+          # @param url [String, nil] use url from string instead matched pattern.
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_sinatra_route controller, method, pattern, url = nil
             safe_pattern = source_or_string(pattern)
+            safe_url = source_or_string(url || pattern)
 
             msg = new
-            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.route = "#{ controller }##{ method } #{ safe_pattern }"
             msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
             msg
           end
         end

data/lib/contrast/api/decorators/server_features.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'
@@ -13,8 +13,38 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
+        # The TeamServer uses the Event's type and action to render it in the Details page. These values control the
+        # left-hand "What happened" column and the data shown in the right-hand data
+        #
+        # @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
+        # @return [Contrast::Api::Dtm::TraceEvent]
+        def build_display_params! contrast_event
+          self.type = contrast_event.policy_node.node_type
+          self.action = contrast_event.policy_node.build_action
+          self
+        end
+
+        # The TeamServer uses the Event's representation of the data to render the actual data used in the dataflow on
+        # the Details page.
+        #
+        # @param contrast_event [Contrast::Agent::Assess::ContrastEvent]
+        # @return [Contrast::Api::Dtm::TraceEvent]
+        def build_dataflow! contrast_event
+          # Figure out what the target of this event was. This can't be pulled into the decorator because SourceEvent
+          # has a custom impl :/
+          taint_target = contrast_event.determine_taint_target(self)
+          truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
+          self.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
+          truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
+          self.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
+          build_event_args!(contrast_event, taint_target)
+          build_taint_ranges!(contrast_event)
+          self
+        end
+
         # Wrapper around build_event_object for the args array. Handles
         # tainting the correct argument.
+        # @return [Contrast::Api::Dtm::TraceEvent]
         def build_event_args! contrast_event, taint_target
           contrast_event.args.each_index do |idx|
             truncate_arg = taint_target != idx
@@ -29,6 +59,7 @@ module Contrast
         # their DTM form in order to report this.
         #
         # @param contrast_event [Contrast::Agent::AssessContrastEvent]
+        # @return [Contrast::Api::Dtm::TraceEvent]
         def build_taint_ranges! contrast_event
           # If there's no taint_target, this isn't a dataflow trace, but a
           # trigger one
@@ -38,6 +69,10 @@ module Contrast
           self
         end
 
+        # For each Parent in the ContrastEvent, capture its id and report it to TeamServer.
+        #
+        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
+        # @return [Contrast::Api::Dtm::TraceEvent]
         def build_parent_ids! contrast_event
           contrast_event&.parent_events&.each do |event|
             next unless event
@@ -49,6 +84,10 @@ module Contrast
           self
         end
 
+        # Convert the caller into the Stack DTM TeamServer consumes
+        #
+        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
+        # @return [Contrast::Api::Dtm::TraceEvent]
         def build_stack! contrast_event
           # We delayed doing this as long as possible b/c it's expensive
           stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
@@ -60,23 +99,12 @@ module Contrast
         module ClassMethods
           def build contrast_event
             event_dtm = new
-            # Figure out what the target of this event was. It's a little
-            # annoying for us since P can be named (thanks, Ruby) where
-            # as for everyone else it is idx based.
-            taint_target = contrast_event.determine_taint_target(event_dtm) # This can't be pulled into the decorator because SourceEvent has a custom impl :/
-
-            event_dtm.type = contrast_event.policy_node.node_type
-            event_dtm.action = contrast_event.policy_node.build_action
+            event_dtm.build_display_params!(contrast_event)
+            event_dtm.build_dataflow!(contrast_event)
+            event_dtm.build_stack!(contrast_event)
             event_dtm.timestamp_ms = contrast_event.time.to_i
             event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
-            truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
-            event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
-            truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
-            event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
-            event_dtm.build_event_args!(contrast_event, taint_target)
             event_dtm.build_parent_ids!(contrast_event)
-            event_dtm.build_taint_ranges!(contrast_event)
-            event_dtm.build_stack!(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
             event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
             event_dtm

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/api/decorators/user_input.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/string_utils'

data/lib/contrast/common_agent_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # rubocop:disable Style/MissingRespondToMissing

data/lib/contrast/components/agent.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
@@ -31,6 +31,8 @@ module Contrast
 
         def disable!
           @_enabled = false
+          Contrast::Agent::TracePointHook.disable
+          Contrast::Agent.thread_watcher&.shutdown!
         end
 
         def ruleset

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
+require 'contrast/api/decorators/agent_startup'
+require 'contrast/api/decorators/application_startup'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -77,31 +79,11 @@ module Contrast
         end
 
         def build_app_startup_message
-          msg = Contrast::Api::Dtm::ApplicationCreate.new
-
-          msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
-          msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
-          msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
-          msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
-          # Other fields have limits in TeamServer, the rest don't.
-          msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
-          msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
-
-          msg
+          Contrast::Api::Dtm::ApplicationCreate.build
         end
 
         def build_agent_startup_message
-          msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name      = Contrast::Utils::StringUtils.protobuf_format server_name
-          msg.server_path      = Contrast::Utils::StringUtils.protobuf_format server_path
-          msg.server_type      = Contrast::Utils::StringUtils.protobuf_format server_type
-          msg.server_version   = Contrast::Agent::VERSION
-          msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
-          msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
-          msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
-          msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
-          msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
-          msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          msg = Contrast::Api::Dtm::AgentStartup.build(server_name, server_path, server_type)
           logger.info('Application context',
                       server_name: msg.server_name,
                       server_path: msg.server_path,

data/lib/contrast/components/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/env_configuration_item'

data/lib/contrast/components/contrast_service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'

data/lib/contrast/components/heap_dump.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/interface.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'delegate'

data/lib/contrast/components/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/logger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/logger/log'

data/lib/contrast/components/protect.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -32,7 +32,9 @@ module Contrast
         end
 
         def rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+          CONFIG.root.protect.rules[rule_id]&.applicable_mode ||
+              SETTINGS.modes_by_id[rule_id] ||
+              Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
         end
 
         def rule name

data/lib/contrast/components/sampling.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -25,14 +25,14 @@ module Contrast
 
         def sampling_control
           @_sampling_control ||= begin
-            cas = CONFIG.root.assess&.sampling
+            config_settings = CONFIG.root.assess&.sampling
             settings = SETTINGS&.assess_state&.[](:sampling_settings)
             {
-                enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0]),
-                baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?),
-                request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?),
-                response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-                window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+                enabled: enabled?(config_settings, settings),
+                baseline: baseline(config_settings, settings),
+                request_frequency: request_frequency(config_settings, settings),
+                response_frequency: response_frequency(config_settings, settings),
+                window: window(config_settings, settings)
             }
           end
         end
@@ -41,6 +41,48 @@ module Contrast
         def reset_sampling_control
           @_sampling_control = nil
         end
+
+        private
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Boolean] the resolution of the config_settings, settings, and default value
+        def enabled? config_settings, settings
+          true?([config_settings&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0])
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def baseline config_settings, settings
+          [config_settings&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def request_frequency config_settings, settings
+          [config_settings&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def response_frequency config_settings, settings
+          [config_settings&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def window config_settings, settings
+          [config_settings&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+        end
       end
 
       module InstanceMethods #:nodoc:

data/lib/contrast/components/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fiber'

data/lib/contrast/components/settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -28,8 +28,8 @@ module Contrast
 
         def assess_state
           @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              sampling_features: nil
+              enabled: false,        # Boolean
+              sampling_features: nil # Contrast::Api::Settings::Sampling
           }
         end
 
@@ -41,7 +41,7 @@ module Contrast
 
         def application_state
           @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              modes_by_id: Hash.new(:NO_ACTION),
+              modes_by_id: Hash.new(Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION),
               exclusion_matchers: [],
               disabled_assess_rules: []
           }
@@ -95,6 +95,7 @@ module Contrast
           exclusion_matchers.select(&:code?)
         end
 
+        # @param server_features [Contrast::Api::Settings::ServerFeatures]
         def update_from_server_features server_features
           # protect
 
@@ -109,6 +110,7 @@ module Contrast
           Contrast::Utils::Assess::SamplingUtil.instance.update
         end
 
+        # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
         def update_from_application_settings application_settings
           application_state.merge!(application_settings.application_state_translation)
         end
@@ -126,9 +128,8 @@ module Contrast
         end
 
         def build_assess_rules
+          # TODO: RUBY-1120 actually build assess_rules.
           @assess_rules = {}
-
-          Contrast::Agent::Assess::Rule::Redos.new
         end
 
         def build_protect_rules