contrast-agent 4.3.2 → 4.7.0

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'rubygems/version'
+require 'contrast/api/decorators/agent_startup'
+require 'contrast/api/decorators/application_startup'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -35,9 +37,9 @@ module Contrast
           end
         end
 
-        def name
-          @_name ||= begin
-            tmp = CONFIG.root.application.name
+        def app_name
+          @_app_name ||= begin
+            tmp = CONFIG.root.application.name # rubocop:disable Security/Module/Name
             tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
@@ -57,7 +59,7 @@ module Contrast
 
         def server_name
           @_server_name ||= begin
-            tmp = CONFIG.root.server.name
+            tmp = CONFIG.root.server.name # rubocop:disable Security/Module/Name
             tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
             tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
             Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
@@ -77,36 +79,16 @@ module Contrast
         end
 
         def build_app_startup_message
-          msg = Contrast::Api::Dtm::ApplicationCreate.new
-
-          msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
-          msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
-          msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
-          msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
-          # Other fields have limits in TeamServer, the rest don't.
-          msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
-          msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
-
-          msg
+          Contrast::Api::Dtm::ApplicationCreate.build
         end
 
         def build_agent_startup_message
-          msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name      = Contrast::Utils::StringUtils.protobuf_format server_name
-          msg.server_path      = Contrast::Utils::StringUtils.protobuf_format server_path
-          msg.server_type      = Contrast::Utils::StringUtils.protobuf_format server_type
-          msg.server_version   = Contrast::Agent::VERSION
-          msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
-          msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
-          msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
-          msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
-          msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
-          msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          msg = Contrast::Api::Dtm::AgentStartup.build(server_name, server_path, server_type)
           logger.info('Application context',
                       server_name: msg.server_name,
                       server_path: msg.server_path,
                       server_type: msg.server_type,
-                      application_name: name,
+                      application_name: app_name,
                       application_path: path,
                       application_language: Contrast::Utils::ObjectShare::RUBY)
 
@@ -126,7 +108,7 @@ module Contrast
         end
 
         def client_id
-          @_client_id ||= [name, pgid].join('-')
+          @_client_id ||= [app_name, pgid].join('-')
         end
 
         def instrument_middleware_stack?

data/lib/contrast/components/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -19,7 +19,7 @@ module Contrast
           return false if forcibly_disabled?
           return true  if forcibly_enabled?
 
-          SETTINGS.assess_enabled?
+          SETTINGS.assess_state.enabled == true
         end
 
         def tainted_columns
@@ -58,10 +58,9 @@ module Contrast
         # node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
         #
         # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
-        # @param return [Boolean] to capture or not to capture, that is the question.
+        # @return [Boolean] to capture or not to capture, that is the question.
         def capture_stacktrace? policy_node
           return true if capture_stacktrace_value == :ALL
-
           return false if capture_stacktrace_value == :NONE
 
           # Below here capture_stacktrace_value must be :SOME.
@@ -90,8 +89,9 @@ module Contrast
           CONFIG.root.assess&.tags
         end
 
-        def rules
-          SETTINGS.assess_rules
+        def disabled_rules
+          # TODO: RUBY-903
+          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.assess_state.disabled_assess_rules || []
         end
 
         private
@@ -100,11 +100,6 @@ module Contrast
           @_forcibly_enabled = true?(CONFIG.root.assess.enable) if @_forcibly_enabled.nil?
           @_forcibly_enabled
         end
-
-        def disabled_rules
-          # TODO: RUBY-903
-          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.disabled_assess_rules || []
-        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/env_configuration_item'
@@ -56,7 +56,8 @@ module Contrast
 
         private
 
-        SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
+        SESSION_VARIABLES = 'Invalid configuration. '\
+                            "Setting both application.session_id and application.session_metadata is not allowed.\n"
         def validate log: false
           # The config has information about how to construct the logger.
           # If the config is invalid, and you want to know about it, then

data/lib/contrast/components/contrast_service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'monitor'
@@ -25,14 +25,13 @@ module Contrast
         def use_bundled_service?
           # Validates the config to decide if it's suitable for starting
           # the bundled service
-          @_use_bundled_service ||= begin
-            # Requirement says "must be true" but that
-            # should be "must not be false" -- oops.
-            !false?(CONFIG.root.agent.start_bundled_service) &&
-                # Either a valid host or a valid socket
-                # Path validity is the service's problem
-                (LOCALHOST.match?(host) || !!socket_path)
-          end
+
+          # Requirement says "must be true" but that
+          # should be "must not be false" -- oops.
+          @_use_bundled_service ||= !false?(CONFIG.root.agent.start_bundled_service) &&
+              # Either a valid host or a valid socket
+              # Path validity is the service's problem
+              (LOCALHOST.match?(host) || !!socket_path)
         end
 
         def host

data/lib/contrast/components/heap_dump.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/interface.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'delegate'
@@ -134,7 +134,7 @@ module Contrast
           if (mods = component_map[sym]) # rubocop:disable Style/GuardClause
             # We may support multiple components via one access request.
             mods.each do |m|
-              name = Contrast::Components.component_const_name(m.name)
+              name = Contrast::Components.component_const_name(m.cs__name)
               cs__const_set(name, m::COMPONENT_INTERFACE) if m.cs__const_defined?(:COMPONENT_INTERFACE)
               include m::InstanceMethods               if m.cs__const_defined?(:InstanceMethods, false)
               extend  m::ClassMethods                  if m.cs__const_defined?(:ClassMethods, false)
@@ -181,7 +181,8 @@ require 'contrast/components/agent'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
 
 require 'contrast/components/contrast_service'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] = [Contrast::Components::ContrastService]
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] =
+  [Contrast::Components::ContrastService]
 
 require 'contrast/components/app_context'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]

data/lib/contrast/components/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/components/logger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/logger/log'

data/lib/contrast/components/protect.rb

@@ -1,14 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Components
     module Protect
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Protect
-      # product.
+      # A wrapper build around the Common Agent Configuration project to allow for access of the values contained in
+      # its parent_configuration_spec.yaml.  Specifically, this allows for querying the state of the Protect product.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
@@ -20,7 +17,7 @@ module Contrast
           return false if forcibly_disabled?
           return true  if forcibly_enabled?
 
-          SETTINGS.protect_enabled?
+          SETTINGS.protect_state.enabled == true
         end
 
         def rule_config
@@ -28,15 +25,17 @@ module Contrast
         end
 
         def rules
-          SETTINGS.protect_rules
+          SETTINGS.protect_state.rules
         end
 
         def rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+          CONFIG.root.protect.rules[rule_id]&.applicable_mode ||
+              SETTINGS.application_state.modes_by_id[rule_id] ||
+              Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
         end
 
         def rule name
-          SETTINGS.protect_rules[name]
+          SETTINGS.protect_state.rules[name]
         end
 
         def report_any_command_execution?
@@ -56,15 +55,13 @@ module Contrast
         end
 
         def forcibly_disabled?
-          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
-          @_forcibly_disabled
+          @_forcibly_disabled ||= false?(CONFIG.root.protect.enable)
         end
 
         private
 
         def forcibly_enabled?
-          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
-          @_forcibly_enabled
+          @_forcibly_enabled ||= true?(CONFIG.root.protect.enable)
         end
       end
 

data/lib/contrast/components/sampling.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -25,14 +25,14 @@ module Contrast
 
         def sampling_control
           @_sampling_control ||= begin
-            cas = CONFIG.root.assess&.sampling
+            config_settings = CONFIG.root.assess&.sampling
             settings = SETTINGS&.assess_state&.[](:sampling_settings)
             {
-                enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0]),
-                baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?),
-                request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?),
-                response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-                window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+                enabled: enabled?(config_settings, settings),
+                baseline: baseline(config_settings, settings),
+                request_frequency: request_frequency(config_settings, settings),
+                response_frequency: response_frequency(config_settings, settings),
+                window: window(config_settings, settings)
             }
           end
         end
@@ -41,6 +41,54 @@ module Contrast
         def reset_sampling_control
           @_sampling_control = nil
         end
+
+        private
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Boolean] the resolution of the config_settings, settings, and default value
+        def enabled? config_settings, settings
+          true?([config_settings&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0])
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def baseline config_settings, settings
+          [config_settings&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def request_frequency config_settings, settings
+          [
+            config_settings&.request_frequency, settings&.request_frequency,
+            DEFAULT_SAMPLING_REQUEST_FREQUENCY
+          ].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def response_frequency config_settings, settings
+          [
+            config_settings&.response_frequency, settings&.response_frequency,
+            DEFAULT_SAMPLING_RESPONSE_FREQUENCY
+          ].map(&:to_i).find(&:positive?)
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Api::Settings::Sampling] the Sampling settings as provided by TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def window config_settings, settings
+          [config_settings&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+        end
       end
 
       module InstanceMethods #:nodoc:

data/lib/contrast/components/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fiber'
@@ -109,6 +109,7 @@ module Contrast
 
         def with_deserialization_scope
           scope_for_current_ec.enter_deserialization_scope!
+          yield
         ensure
           scope_for_current_ec.exit_deserialization_scope!
         end

data/lib/contrast/components/settings.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/api/settings.pb'
+
 module Contrast
   module Components
     # This component encapsulates the statefulness of settings.
@@ -8,133 +10,61 @@ module Contrast
     # directives (likely provided by TeamServer) about product operation.
     # 'Settings' is not a generic term for 'configurable stuff'.
     module Settings
+      APPLICATION_STATE_BASE = Struct.new(:modes_by_id, :exclusion_matchers).
+          new(Hash.new(Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION), [])
+      PROTECT_STATE_BASE = Struct.new(:enabled, :rules).new(false, {})
+      ASSESS_STATE_BASE = Struct.new(:enabled, :sampling_settings, :disabled_assess_rules).new(false, nil, []) do
+        def sampling_settings= new_val
+          @sampling_settings = new_val
+          Contrast::Utils::Assess::SamplingUtil.instance.update
+        end
+      end
+
       # This is a class.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
         access_component :config
 
-        attr_reader :assess_rules,
-                    :protect_rules
-
-        # Other stateful information that doesn't yet cleanly fit anywhere:
-
         # tainted_columns are database columns that receive unsanitized input.
-        # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
-
-        # These three 'state' variables represent atomic config/setting state,
-        # outside of things like rule defs.
-
-        def assess_state
-          @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              sampling_features: nil
-          }
-        end
-
-        def protect_state
-          @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false
-          }
-        end
-
-        def application_state
-          @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              modes_by_id: Hash.new(:NO_ACTION),
-              exclusion_matchers: [],
-              disabled_assess_rules: []
-          }
-        end
-
-        # These are settings that we receive & store.
-        # Rules are settings too, but they're more involved.
-        # So, between this block and rules, that's setting state.
-        PROTECT_STATE_ATTRS       = %i[].cs__freeze
-        ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
-
-        # Meta-define an accessor for each state attribute.
-
-        PROTECT_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            protect_state[attr]
-          end
-        end
-
-        ASSESS_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            assess_state[attr]
-          end
-        end
-
-        APPLICATION_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            application_state[attr]
-          end
-        end
+        attr_reader :assess_state, :protect_state, :application_state
 
         def initialize
           reset_state
         end
 
-        def protect_enabled?
-          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
-          @_protect_enabled
-        end
-
-        def assess_enabled?
-          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
-          @_assess_enabled
-        end
-
         def code_exclusions
-          exclusion_matchers.select(&:code?)
+          @application_state.exclusion_matchers.select(&:code?)
         end
 
+        # @param server_features [Contrast::Api::Settings::ServerFeatures]
         def update_from_server_features server_features
-          # protect
-
-          @_protect_enabled = nil
-          protect_state[:enabled] = server_features.protect_enabled?
-
-          # assess
-
-          @_assess_enabled = nil
-          assess_state[:enabled] = server_features.assess_enabled?
-          assess_state[:sampling_settings] = server_features.assess.sampling
-          Contrast::Utils::Assess::SamplingUtil.instance.update
+          @protect_state.enabled = server_features.protect_enabled?
+          @assess_state.enabled = server_features.assess_enabled?
+          @assess_state.sampling_settings = server_features.assess.sampling
         end
 
+        # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
         def update_from_application_settings application_settings
-          application_state.merge!(application_settings.application_state_translation)
+          new_vals = application_settings.application_state_translation
+          @application_state.modes_by_id = new_vals[:modes_by_id]
+          @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+          @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
         end
 
         # Wipe state to zero.
         def reset_state
-          @assess_rules = {}
-          @protect_rules = {}
-
+          @protect_state = PROTECT_STATE_BASE.dup
+          @assess_state = ASSESS_STATE_BASE.dup
+          @application_state = APPLICATION_STATE_BASE.dup
           @tainted_columns = {}
-
-          @assess_state = nil
-          @protect_state = nil
-          @application_state = nil
-        end
-
-        def build_assess_rules
-          @assess_rules = {}
-
-          Contrast::Agent::Assess::Rule::Redos.new
         end
 
         def build_protect_rules
-          @protect_rules = {}
+          @protect_state.rules = {}
 
-          # rules
+          # Rules. They add themselves on initialize.
           Contrast::Agent::Protect::Rule::CmdInjection.new
           Contrast::Agent::Protect::Rule::Deserialization.new
           Contrast::Agent::Protect::Rule::HttpMethodTampering.new