contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger/reflected_xss'
@@ -47,8 +47,8 @@ module Contrast
             TRIGGER
           end
 
-          def apply_custom_trigger context, trigger_node, source, object, ret, *args
-            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, *args)
+          def apply_custom_trigger trigger_node, source, object, ret, *args
+            custom_trigger_class.send(@trigger_method, trigger_node, source, object, ret, *args)
           end
 
           def custom_trigger_class
@@ -104,7 +104,8 @@ module Contrast
 
             properties = Contrast::Agent::Assess::Tracker.properties(source)
             # find the ranges that violate the rule (untrusted, etc)
-            vulnerable_ranges = ranges_with_all_tags(Contrast::Utils::StringUtils.ret_length(source), properties, required_tags)
+            vulnerable_ranges = ranges_with_all_tags(Contrast::Utils::StringUtils.ret_length(source), properties,
+                                                     required_tags)
             # if there aren't any vulnerable ranges, nope out
             return false if vulnerable_ranges.empty?
 

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -35,9 +35,10 @@ module Contrast
               # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/redos.md
               def regexp_vulnerable? regexp
                 # A pattern is considered vulnerable if it has 2 or more levels of nested multi-matching.
-                # A level is defined as any set of opening and closing control characters immediately followed by a multi match control character.
-                # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS,
-                # or MULTI_MATCH_CHARS that is not immediately preceded by an escaping \ character.
+                # A level is defined as any set of opening and closing control characters immediately followed by a
+                #   multi match control character.
+                # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS, or MULTI_MATCH_CHARS that
+                #   is not immediately preceded by an escaping \ character.
                 # OPENING_CHARS are ( and [ CLOSING_CHARS are ) and ] MULTI_MATCH_CHARS are +, *, and ?
 
                 # Nota bene about Regexp#to_s:  it doesn't necessarily give you the original Regexp back

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,8 +10,7 @@ module Contrast
           # before serializing that finding as a DTM to report to the service.
           module SSRFValidator
             RULE_NAME = 'ssrf'
-            URL_PATTERN =
-              %r{(?<protocol>http|https|ftp|sftp|telnet|gopher|rtsp|rtsps|ssh|svn)://(?<host>[^/?]+)(?<path>/?[^?]*)(?<query_string>\?.*)?}i.cs__freeze
+            URL_PATTERN = %r{(?<protocol>http|https|ftp|sftp|telnet|gopher|rtsp|rtsps|ssh|svn)://(?<host>[^/?]+)(?<path>/?[^?]*)(?<query_string>\?.*)?}i.cs__freeze # rubocop:disable Layout/LineLength
             # The Net::HTTP class validates host format on instantiation. Since
             # our triggers for that class are on the instance, they already
             # have this validation done for them. We do not need to apply the

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -11,14 +11,7 @@ module Contrast
           # the service.
           module XSSValidator
             RULE_NAME = 'reflected-xss'
-            SAFE_CONTENT_TYPES = %w[
-              /csv
-              /javascript
-              /json
-              /pdf
-              /x-javascript
-              /x-json
-            ].cs__freeze
+            SAFE_CONTENT_TYPES = %w[/csv /javascript /json /pdf /x-javascript /x-json].cs__freeze
 
             # A finding is valid for XSS if the response type is not one of
             # those assumed to be safe

data/lib/contrast/agent/assess/properties.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'base64'

data/lib/contrast/agent/assess/property/evented.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -14,7 +14,7 @@ module Contrast
         # @attr_reader event [Contrast::Agent::Assess::ContrastEvent] the
         #   latest event to track
         module Evented
-          attr_accessor :event
+          attr_reader :event
 
           # Create a new event and add it to the event set.
           #
@@ -31,7 +31,8 @@ module Contrast
           #   the key used to accessed if from a map or nil if a type like
           #   BODY
           def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            @event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
+            @event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args,
+                                                                         source_type, source_name)
             report_sources(tagged, event)
           end
 
@@ -46,10 +47,12 @@ module Contrast
             return unless tagged && !tagged.to_s.empty?
             return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
             return unless event.source_type
+            return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
+
+            if current_request.observed_route.sources.any? do |source|
+                 source.type == event.forced_source_type && source.name == event.forced_source_name
+               end
 
-            current_request = Contrast::Agent::REQUEST_TRACKER.current
-            return unless current_request
-            if current_request.observed_route.sources.any? { |source| source.type == event.forced_source_type && source.name == event.forced_source_name }
               return
             end
 

data/lib/contrast/agent/assess/property/tagged.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tag'

data/lib/contrast/agent/assess/property/updated.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/duck_utils'

data/lib/contrast/agent/assess/rule/provider.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -55,9 +55,12 @@ module Contrast
               value_node.children.each do |child|
                 next unless child
 
-                return false unless child.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
-                    child.type == :LIT &&
-                    child.children[0]&.cs__is_a?(Integer)
+                unless child.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
+                      child.type == :LIT &&
+                      child.children[0]&.cs__is_a?(Integer)
+
+                  return false
+                end
               end
 
               true
@@ -84,8 +87,11 @@ module Contrast
               return false unless children.length >= 2
 
               potential_string_node = children[0]
-              return false unless potential_string_node.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
-                  potential_string_node.type == :STR
+              unless potential_string_node.cs__is_a?(RubyVM::AbstractSyntaxTree::Node) &&
+                    potential_string_node.type == :STR
+
+                return false
+              end
 
               children[1] == :bytes
             end

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -29,7 +29,10 @@ module Contrast
             # These are markers whose presence indicates that a field is more
             # likely to be a descriptor or requirement than an actual password.
             # We should ignore fields that contain them.
-            NON_PASSWORD_PARTIAL_NAMES = %w[DATE FORGOT FORM ENCODE PATTERN PREFIX PROP SUFFIX URL BASE FILE URI].cs__freeze
+            NON_PASSWORD_PARTIAL_NAMES = %w[
+              DATE FORGOT FORM ENCODE PATTERN PREFIX PROP SUFFIX URL BASE FILE
+              URI
+            ].cs__freeze
 
             # If the constant looks like a password and it doesn't look like a
             # password descriptor, it passes for this rule

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
@@ -26,10 +26,7 @@ module Contrast
             end
 
             # TODO: RUBY-1014 - remove `#analyze`
-            COMMON_CONSTANTS = %i[
-              CONTRAST_ASSESS_POLICY_STATUS
-              VERSION
-            ].cs__freeze
+            COMMON_CONSTANTS = %i[CONTRAST_ASSESS_POLICY_STATUS VERSION].cs__freeze
             def analyze clazz
               return if disabled?
 
@@ -171,7 +168,8 @@ module Contrast
 
               finding.properties[SOURCE_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(class_name)
               finding.properties[CONSTANT_NAME_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(constant_string)
-              finding.properties[CODE_SOURCE_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(constant_string + redacted_marker)
+              finding.properties[CODE_SOURCE_KEY] =
+                Contrast::Utils::StringUtils.protobuf_safe_string(constant_string + redacted_marker)
 
               hash = Contrast::Utils::HashDigest.generate_class_scanning_hash(finding)
               finding.hash_code = Contrast::Utils::StringUtils.protobuf_safe_string(hash)

data/lib/contrast/agent/assess/tag.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/tracker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/finalizers/hash'

data/lib/contrast/agent/at_exit_hook.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/agent/class_reopener.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+
 require 'ripper'
 require 'contrast/extension/module'
 require 'contrast/components/interface'
@@ -48,7 +50,7 @@ module Contrast
                   :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
 
       def initialize module_data
-        @class_module_path = module_data.name
+        @class_module_path = module_data.mod_name
         clazz = module_data.mod
         @is_class = clazz.is_a?(Class)
         @public_instance_methods = []

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/deadzone/policy/deadzone_node'
@@ -8,8 +8,8 @@ module Contrast
   module Agent
     module Deadzone
       module Policy
-        # This is just a holder for our policy. Takes the policy JSON and
-        # converts it into hashes that we can access nicely
+        # This is just a holder for our policy. Takes the policy JSON and converts it into hashes that we can access
+        # nicely.
         class Policy < Contrast::Agent::Patching::Policy::Policy
           def self.policy_folder
             'deadzone'
@@ -35,6 +35,10 @@ module Contrast
             end
           end
 
+          def module_names
+            @_module_names ||= Set.new(deadzones.map(&:class_name))
+          end
+
           def add_node node, _node_type = :deadzones
             unless node
               logger.error('Node was nil when adding node to policy')

data/lib/contrast/agent/disable_reaction.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -13,9 +13,7 @@ module Contrast
       access_component :agent, :logging
 
       def self.run _reaction, level
-        logger.with_level(
-            level,
-            'Contrast received instructions to disable itself - Disabling now')
+        logger.with_level(level, 'Contrast received instructions to disable itself - Disabling now')
         AGENT.disable!
       end
     end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -47,7 +47,7 @@ module Contrast
         return if @wildcard_url
         return unless @exclusion.urls&.any?
 
-        @wildcard_url ||= @exclusion.urls.any? { |test| test == '/.*' }
+        @wildcard_url ||= @exclusion.urls.any?('/.*')
         return if @wildcard_url
 
         @urls = []
@@ -95,8 +95,8 @@ module Contrast
         @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
-      def name
-        @exclusion.name
+      def exc_name
+        @exclusion.name # rubocop:disable Security/Module/Name -- part of the API.
       end
 
       def match_all?
@@ -109,10 +109,7 @@ module Contrast
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def protection_rule? rule
-        protect? &&
-            (@exclusion.protection_rules.empty? ||
-                @exclusion.protection_rules.include?(rule)
-            )
+        protect? && (@exclusion.protection_rules.empty? || @exclusion.protection_rules.include?(rule))
       end
 
       # Determine if the given rule is excluded by this exclusion.
@@ -121,10 +118,7 @@ module Contrast
       #
       # @param rule - the id of the rule which we're checking for exclusion
       def assess_rule? rule
-        assess? &&
-            (@exclusion.assessment_rules.empty? ||
-                @exclusion.assessment_rules.include?(rule)
-            )
+        assess? && (@exclusion.assessment_rules.empty? || @exclusion.assessment_rules.include?(rule))
       end
 
       def match_code? stack_trace

data/lib/contrast/agent/inventory.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,6 +10,5 @@ module Contrast
 end
 
 require 'contrast/agent/inventory/dependencies'
-require 'contrast/agent/inventory/gemfile_digest_cache'
 require 'contrast/agent/inventory/dependency_usage_analysis'
 require 'contrast/agent/inventory/dependency_analysis'

data/lib/contrast/agent/inventory/dependencies.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -33,6 +33,7 @@ module Contrast
         # then contrast depends on it. If its array of dependents is 1, then contrast is the
         # only dependency in that list. Since only contrast depends on it, we should ignore it.
         def find_contrast_gems
+          # rubocop:disable Security/Module/Name -- here name is part of Ruby Gems.
           ignore = Set.new([CONTRAST_AGENT])
           contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
             dependency.name == CONTRAST_AGENT
@@ -43,6 +44,7 @@ module Contrast
             ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
           end
           ignore
+          # rubocop:enable Security/Module/Name
         end
       end
     end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/inventory/dependencies'

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/agent/inventory/gemfile_digest_cache'
 require 'contrast/agent/inventory/dependencies'
 require 'contrast/components/interface'
 require 'contrast/utils/object_share'
+require 'set'
 
 module Contrast
   module Agent
@@ -20,33 +20,35 @@ module Contrast
         def initialize
           return unless enabled?
 
-          @gemdigest_cache = Contrast::Agent::Inventory::GemfileDigestCache.new
+          @lock = Mutex.new
+          @lock.synchronize { @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new } }
         end
 
-        # This method is invoked once, along with the rest of our catchup code
-        # to report libraries and their associated files that have already been loaded pre-contrast
+        # This method is invoked once, along with the rest of our catchup code to report libraries and their associated
+        # files that have already been loaded pre-contrast.
         def catchup
           return unless enabled?
 
           loaded_specs.each do |_name, spec|
-            # Get a digest of the Gem file itself
+            # Get a digest of the Gem file itself.
             next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
 
-            @gemdigest_cache.use_cache(digest) do |existing_files|
-              loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
-              loaded_files_from_gem.each do |file_path|
-                logger.trace('Recording loaded file for inventory analysis', line: file_path)
-                existing_files << adjust_path_for_reporting(file_path, spec)
-              end
+            loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+
+            new_files = loaded_files_from_gem.each_with_object(Set.new) do |file_path, set|
+              set << adjust_path_for_reporting(file_path, spec)
+              logger.trace('Recording loaded file for inventory analysis', line: file_path)
             end
+
+            # Even if new_files is empty, still need to add digest key for library discovery.
+            @lock.synchronize { @gemdigest_cache[digest].merge(new_files) }
           end
         end
 
-        # This method is invoked once per TracePoint :end - to map a specific
-        # file being required to the gem it belongs to
+        # This method is invoked once per TracePoint :end - to map a specific file being required to the gem to which
+        # it belongs.
         #
-        # @param path [String] the result of TracePoint#path from the :end
-        #   event in which the Module was defined
+        # @param path [String] the result of TracePoint#path from the :end event in which the Module was defined.
         def associate_file path
           return unless enabled?
 
@@ -64,21 +66,31 @@ module Contrast
             return
           end
           report_path = adjust_path_for_reporting(path, spec)
-          @gemdigest_cache.get(digest) << report_path
+          @lock.synchronize { @gemdigest_cache[digest] << report_path }
         rescue StandardError => e
           logger.error('Unable to inventory file path', e, path: path)
         end
 
-        # Populate the library_usages filed of the Activity message using the
-        # data stored in the @gemdigest_cache
+        # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache.
         #
-        # @param activity [Contrast::Api::Dtm::Activity] the message to which
-        #   to append the usage data
+        # @param activity [Contrast::Api::Dtm::Activity] the message to which to append the usage data
         def generate_library_usage activity
           return unless enabled?
-          return if @gemdigest_cache.empty?
+          return unless activity
+
+          # Copy gemdigest_cache and clear it in sync.
+          gem_spec_digest_to_files = @lock.synchronize do
+            copy = @gemdigest_cache.dup
+            @gemdigest_cache.clear
+            copy
+          end
 
-          @gemdigest_cache.generate_usage_data(activity)
+          gem_spec_digest_to_files.each_pair do |digest, files|
+            usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
+            activity.library_usages[usage.hash_code] = usage
+          end
+        rescue StandardError => e
+          logger.error('Unable to generate library usage.', e)
         end
 
         private