contrast-agent 4.7.0 → 4.10.0

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-
 module Contrast
   module Agent
     module Assess
@@ -13,16 +11,13 @@ module Contrast
           # results in new source nodes to track which columns in the database
           # have been tainted.
           class DatabaseWrite < Contrast::Agent::Assess::Policy::Propagator::Base
-            include Contrast::Components::Interface
-            access_component :analysis
-
             class << self
               def propagate propagation_node, preshift, target
                 class_type = preshift.object.cs__class
                 class_name = class_type.cs__name
                 tainted_columns = {}
 
-                known_tainted = ASSESS.tainted_columns[class_name]
+                known_tainted = ::Contrast::ASSESS.tainted_columns[class_name]
                 propagation_node.sources.each do |source|
                   handle_write(propagation_node, source, preshift, target, known_tainted, tainted_columns)
                 end
@@ -31,7 +26,7 @@ module Contrast
                 if known_tainted
                   known_tainted.concat(tainted_columns.keys)
                 else
-                  ASSESS.tainted_columns[class_name] = tainted_columns.keys
+                  ::Contrast::ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 
                 Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -14,16 +14,15 @@ module Contrast
               def square_bracket_tagger propagation_node, preshift, ret, _block
                 case ret
                 when Array
-                  ret.each_with_index do |return_value, index|
+                  idx = 0
+                  while idx < ret.size
+                    return_value = ret[idx]
+                    index = idx
+                    idx += 1
                     next unless return_value
 
-                    target_matchdata_index = if preshift.args[0].is_a?(Range)
-                                               arg_range = preshift.args[0]
-                                               arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
-                                             else
-                                               preshift.args[index]
-                                             end
-                    square_bracket_single(target_matchdata_index, preshift, return_value, propagation_node)
+                    square_bracket_single(target_matchdata_index(preshift, index), preshift, return_value,
+                                          propagation_node)
                   end
                 when String
                   target_matchdata_index = preshift.args[0]
@@ -34,7 +33,11 @@ module Contrast
               end
 
               def captures_tagger propagation_node, preshift, ret, _block
-                ret.each_with_index do |return_value, index|
+                idx = 0
+                while idx < ret.size
+                  return_value = ret[idx]
+                  index = idx
+                  idx += 1
                   next unless return_value
 
                   targetted_index = index + 1
@@ -44,7 +47,11 @@ module Contrast
               end
 
               def to_a_tagger propagation_node, preshift, ret, _block
-                ret.each_with_index do |return_value, index|
+                idx = 0
+                while idx < ret.size
+                  return_value = ret[idx]
+                  index = idx
+                  idx += 1
                   next unless return_value
 
                   square_bracket_single(index, preshift, return_value, propagation_node)
@@ -53,7 +60,11 @@ module Contrast
               end
 
               def values_at_tagger propagation_node, preshift, ret, _block
-                ret.each_with_index do |return_value, return_index|
+                idx = 0
+                while idx < ret.size
+                  return_value = ret[idx]
+                  return_index = idx
+                  idx += 1
                   next unless return_value
 
                   original_group_arg_index = preshift.args[return_index]
@@ -64,6 +75,15 @@ module Contrast
 
               private
 
+              def target_matchdata_index preshift, index
+                if preshift.args[0].is_a?(Range)
+                  arg_range = preshift.args[0]
+                  arg_range.to_a.empty? ? index + 1 : arg_range.to_a[index]
+                else
+                  preshift.args[index]
+                end
+              end
+
               def square_bracket_single argument_index, preshift, return_value, propagation_node
                 original_start_index = preshift.object.begin(argument_index)
                 original_end_index = preshift.object.end(argument_index)

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Rack::Protection offers several protections against vulnerabilities. Of these, some apply to dataflow and
+          # need to be accounted for in order to properly tag data. Others apply to configurations and may be used to
+          # suppress configuration vulnerabilities in the future.
+          class RackProtection < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # Our custom instrumentation for the Rack::Protection::EscapedParams#escape_string method
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def escaped_params propagation_node, preshift, ret, _block
+                Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                apply_escaper_tags(preshift.object, ret)
+                ret
+              end
+
+              private
+
+              # Rack::Protection::EscapedParams can be configured such that it only applies certain escape. We need
+              # to account for the configuration of the individual escapes when applying tags.
+              #
+              # @param escaper [Rack::Protection::EscapedParams] the instance of Rack::Protection::EscapedParams
+              #   applying the escape_string
+              # @param ret [String] the result of the escape
+              def apply_escaper_tags escaper, ret
+                # I don't know how this could not be an instance of Rack::Protection::EscapedParams, but I don't want
+                # to chance it.
+                return unless escaper.cs__is_a?(Rack::Protection::EscapedParams)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties(ret))
+
+                tags = []
+                untags = []
+                if escaper.instance_variable_get(:@html)
+                  tags << 'HTML_ENCODED'
+                  untags << 'HTML_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@javascript)
+                  tags << 'JAVASCRIPT_ENCODED'
+                  untags << 'JAVASCRIPT_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@url)
+                  tags << 'URL_ENCODED'
+                  untags << 'URL_DECODED'
+                end
+
+                length = Contrast::Utils::StringUtils.ret_length(ret)
+                tags.each do |tag|
+                  properties.add_tag(tag, 0...length)
+                end
+
+                untags.each do |tag|
+                  properties.delete_tags(tag)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -2,7 +2,9 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
-require 'contrast/components/interface'
+require 'contrast/components/agent'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 require 'contrast/utils/thread_tracker'
 
 module Contrast
@@ -13,9 +15,8 @@ module Contrast
           # This class is specifically for String#split & String#grapheme_clusters propagation
           # it propagates tag ranges from a string to elements within an untracked array
           class Split < Contrast::Agent::Assess::Policy::Propagator::Base
-            include Contrast::Components::Interface
-
-            access_component :agent, :logging, :scope
+            extend Contrast::Components::Scope::InstanceMethods
+            extend Contrast::Components::Logger::InstanceMethods
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
 
@@ -29,8 +30,9 @@ module Contrast
               #   patched method.
               # @param target [Array, String] the target to which to propagate.
               # @return [nil] so as not to risk changing the result of the propagation.
-
               def propagate propagation_node, preshift, target
+                return unless target.is_a?(Array) # apply_post_patch is called, but split with block returns a string.
+
                 logger.trace('Propagation detected', node_id: propagation_node.id, target_id: target.__id__)
 
                 source = find_source(propagation_node.sources[0], preshift)
@@ -108,7 +110,9 @@ module Contrast
               # Load patch.
               def instrument_string_split
                 @_instrument_string_split ||= begin
-                  require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
+                  if ::Contrast::AGENT.patch_yield? && Funchook.available?
+                    require 'cs__assess_yield_track/cs__assess_yield_track'
+                  end
                   true
                 rescue StandardError => e
                   logger.error('Error loading split rb_yield patch', e)

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/duck_utils'
 
 module Contrast
@@ -15,8 +15,8 @@ module Contrast
           # in a 'get it work' state. hopefully, we'll be in
           # a 'get it right' state soon.
           class Substitution
-            include Contrast::Components::Interface
-            access_component :logging
+            include Contrast::Components::Logger::InstanceMethods
+            extend Contrast::Components::Logger::InstanceMethods
 
             CAPTURE_GROUP_REGEXP = /\\[[:digit:]]/.cs__freeze
             CAPTURE_NAME_REGEXP = /\\k<[[:alpha:]]/.cs__freeze

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -21,6 +21,7 @@ module Contrast
           require 'contrast/agent/assess/policy/propagator/match_data'
           require 'contrast/agent/assess/policy/propagator/next'
           require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/rack_protection'
           require 'contrast/agent/assess/policy/propagator/remove'
           require 'contrast/agent/assess/policy/propagator/replace'
           require 'contrast/agent/assess/policy/propagator/reverse'

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -6,7 +6,7 @@ return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 require 'contrast/agent/patching/policy/patch_status'
 require 'contrast/agent/module_data'
 require 'contrast/agent/rewriter'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 
 module Contrast
@@ -20,8 +20,7 @@ module Contrast
         # @deprecated Changes to this class are discouraged as this approach is
         #   being phased out with support for those language versions.
         module RewriterPatch
-          include Contrast::Components::Interface
-          access_component :agent, :analysis, :logging
+          extend Contrast::Components::Logger::InstanceMethods
 
           class << self
             def rewrite_interpolations
@@ -72,16 +71,16 @@ module Contrast
             end
 
             def agent_should_rewrite?
-              return false unless ASSESS.enabled?
-              return false unless AGENT.rewrite_interpolation?
-              return false unless AGENT.interpolation_enabled?
+              return false unless ::Contrast::ASSESS.enabled?
+              return false unless ::Contrast::AGENT.rewrite_interpolation?
+              return false unless ::Contrast::AGENT.interpolation_enabled?
 
               true
             end
 
             def should_rewrite? mod
               return false unless agent_should_rewrite?
-              return false if AGENT.skip_instrumentation? mod.cs__name
+              return false if ::Contrast::AGENT.skip_instrumentation? mod.cs__name
               return false if mod.cs__frozen?
               return false if mod.singleton_class?
               return false if mid_defining?(mod)

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -3,7 +3,7 @@
 
 require 'set'
 require 'contrast/agent/assess/policy/source_validation/source_validation'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 
@@ -15,8 +15,7 @@ module Contrast
         # actions we should take in order to mark data as User Input and treat it as untrusted, starting the dataflows
         # used in Assess vulnerability detection.
         module SourceMethod
-          include Contrast::Components::Interface
-          access_component :analysis, :logging
+          extend Contrast::Components::Logger::InstanceMethods
 
           PARAMETER_TYPE     = 'PARAMETER'
           PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
@@ -26,8 +25,7 @@ module Contrast
           COOKIE_KEY_TYPE    = 'COOKIE_KEY'
 
           class << self
-            # This is called from within our woven proc. It will be called as if it were inline in the Rack
-            # application.
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack application.
             #
             # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
             #   method being called
@@ -37,29 +35,27 @@ module Contrast
             # @return [Object, nil] the tracked Return or nil if no changes were made
             def source_patchers method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
+              return unless (source_node = method_policy.source_node)
+              return unless (target = determine_target(source_node, object, ret, args))
 
-              source_node = method_policy.source_node
-              target = determine_target(source_node, object, ret, args)
-              restore_frozen_state = false
+              return_val = nil
               if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
-                return unless ASSESS.track_frozen_sources?
+                return unless ::Contrast::ASSESS.track_frozen_sources?
                 return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+                return unless (dup = safe_dup(ret))
+                return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
-                dup = safe_dup(ret)
-                return unless dup
-
-                restore_frozen_state = true
-                ret = dup
-                target = ret
-                Contrast::Agent::Assess::Tracker.pre_freeze(ret)
-                ret.cs__freeze
-                # double check that we were able to finalize the replaced return
-                return unless Contrast::Agent::Assess::Tracker.trackable?(target)
+                Contrast::Agent::Assess::Tracker.pre_freeze(dup)
+                return_val = dup.cs__freeze
+                target = dup
               end
+
               apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret,
                            source_node.type, nil, *args)
-              restore_frozen_state ? ret : nil
+
+              return_val
             end
+            Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :source_patchers)
 
             private
 
@@ -131,7 +127,7 @@ module Contrast
             # @param hash [Hash] the hash to which the key belongs.
             # @return [Boolean] whether replace the key in the hash or not.
             def replace_hash_key? key, hash
-              ASSESS.track_frozen_sources? &&
+              ::Contrast::ASSESS.track_frozen_sources? &&
                   !hash.cs__frozen? &&
                   key.is_a?(String) &&
                   !Contrast::Agent::Assess::Tracker.trackable?(key)
@@ -215,7 +211,7 @@ module Contrast
             # @return [boolean] if the invocation of this method should be analyzed
             def analyze? method_policy, object, ret, args
               return false unless method_policy&.source_node
-              return false unless ASSESS.enabled?
+              return false unless ::Contrast::ASSESS.enabled?
               return false unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
 
               !safe_invocation?(method_policy.source_node, object, ret, args)

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/components/interface'
-
 module Contrast
   module Agent
     module Assess
@@ -16,8 +14,6 @@ module Contrast
           # these objects to see if we were tracking on any of them and report
           # a finding if so.
           class Xpath
-            include Contrast::Components::Interface
-
             class << self
               def xpath_expression_trigger trigger_node, _source, object, ret, *args
                 return ret unless args

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -3,7 +3,7 @@
 
 require 'contrast/agent/assess/events/event_factory'
 require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 
@@ -11,31 +11,28 @@ module Contrast
   module Agent
     module Assess
       module Policy
-        # A trigger method is one which can perform a dangerous action, as
-        # described by the Contrast::Agent::Assess::Policy::TriggerNode class.
-        # Each such method will call to this module just after invocation in
-        # order to determine if the call was done safely. In those cases where
-        # it was not, a Finding report is issued to the Service
+        # A trigger method is one which can perform a dangerous action, as described by the
+        # Contrast::Agent::Assess::Policy::TriggerNode class. Each such method will call to this module just after
+        # invocation in order to determine if the call was done safely. In those cases where it was not, a Finding
+        # report is issued to the Service.
         module TriggerMethod
-          include Contrast::Components::Interface
-          access_component :analysis, :logging
+          extend Contrast::Components::Logger::InstanceMethods
 
-          # The level of TeamServer compliance our traces meet when in the
-          # abnormal condition of being dataflow rules without routes
+          # The level of TeamServer compliance our traces meet when in the abnormal condition of being dataflow rules
+          # without routes.
           MINIMUM_FINDING_VERSION = 3
-          # The level of TeamServer compliance our traces meet
+          # The level of TeamServer compliance our traces meet.
           CURRENT_FINDING_VERSION = 4
 
           class << self
-            # This is called from within our woven proc. It will be called as if it
-            # were inline in the Rack application.
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack
+            # application.
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node that applies to the method being called
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node that applies to the method
+            #   being called
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
 
@@ -53,19 +50,16 @@ module Contrast
               apply_trigger(trigger_node, source, object, ret, *args)
             end
 
-            # This converts the source of the finding, and the events leading
-            # up to it into a Finding
+            # This converts the source of the finding, and the events leading up to it into a Finding
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+            #   trigger event
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Contrast::Api::Dtm::Finding, nil] the
-            #   Contrast::Api::Dtm::Finding to send to TeamServer or nil if
-            #   conditions were not met
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Contrast::Api::Dtm::Finding, nil] the Contrast::Api::Dtm::Finding to send to TeamServer or
+            #   nil if conditions were not met
             def build_finding trigger_node, source, object, ret, *args
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
@@ -86,13 +80,12 @@ module Contrast
               logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
 
-            # Given a finding, append it to an activity message and send it to
-            # the Service for processing.
+            # Given a finding, append it to an activity message and send it to the Service for processing. If an
+            # activity message does not exist, b/c we're invoked outside of a request context, build an activity and
+            # immediately report it with the finding.
             #
-            # @param finding [Contrast::Api::Dtm::Finding] the Finding to
-            #    report.
-            # @param request [Contrast::Agent::Request] our wrapper around the
-            #   Rack::Request.
+            # @param finding [Contrast::Api::Dtm::Finding] the Finding to report.
+            # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
             def report_finding finding, request = nil
               context = Contrast::Agent::REQUEST_TRACKER.current
               if context
@@ -108,9 +101,8 @@ module Contrast
                 logger.debug('Attempted to report finding without request', finding: finding)
               end
 
-              # If we're out of request context, then we need to report this
-              # finding ourselves, so we'll send it in the one-off activity we
-              # created.
+              # If we're out of request context, then we need to report this finding ourselves, so we'll send it in the
+              # one-off activity we created.
               Contrast::Agent.messaging_queue.send_event_eventually(activity)
             end
 
@@ -126,15 +118,12 @@ module Contrast
                 env['action_controller.instance'].cs__class.included_modules.include?(ActionController::Live))
             end
 
-            # Find the request for this finding. This assumes, for now, that if
-            # there is an active request, then that is the request to report.
-            # Otherwise, we'll use the first request found in the events of the
+            # Find the request for this finding. This assumes, for now, that if there is an active request, then that
+            # is the request to report. Otherwise, we'll use the first request found in the events of the
             # source_object.
             #
-            # @param source [Object,nil] some Object used as the source of a
-            #   trigger event
-            # @return [Contrast::Agent::Request,nil] the request from which the
-            #   dataflow on the request originated.
+            # @param source [Object,nil] some Object used as the source of a trigger event
+            # @return [Contrast::Agent::Request,nil] the request from which the dataflow on the request originated.
             def find_request source
               return Contrast::Agent::REQUEST_TRACKER.current.request if Contrast::Agent::REQUEST_TRACKER.current
               return unless (properties = Contrast::Agent::Assess::Tracker.properties(source))
@@ -151,16 +140,14 @@ module Contrast
               Contrast::Agent::FeatureState.instance
             end
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets.
+            # This is our method that actually checks the taint on the object our trigger_node targets.
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+            #   trigger event
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_trigger trigger_node, source, object, ret, *args
               return unless trigger_node
               return if trigger_node.rule_disabled?
@@ -179,23 +166,17 @@ module Contrast
               logger.warn('Unable to apply trigger', e, node_id: trigger_node.id)
             end
 
-            # Given the marker from the trigger_node (the pointer indicating
-            # the entity from which the taint originated), return the entity on
-            # which this trigger needs to operate.
+            # Given the marker from the trigger_node (the pointer indicating the entity from which the taint
+            # originated), return the entity on which this trigger needs to operate.
             #
-            # In an effort to speed up this lookup, we've changed the marker
-            # for parameters to be implicit - if it is not a return or an
-            # object, it must be a parameter, which we can reference either by
-            # index or by name.
+            # In an effort to speed up this lookup, we've changed the marker for parameters to be implicit - if it is
+            # not a return or an object, it must be a parameter, which we can reference by index.
             #
-            # @param marker [String] the source marker that indicates which
-            #   Object
+            # @param marker [String] the source marker that indicates which Object
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Object] the literal object that this Trigger Event
-            #   verifies
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Object] the literal object that this Trigger Event verifies
             def determine_source marker, object, ret, args
               case marker
               when Contrast::Utils::ObjectShare::RETURN_KEY
@@ -218,16 +199,15 @@ module Contrast
               end
             end
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets for our Regexp based rules.
+            # This is our method that actually checks the taint on the object our trigger_node targets for our Regexp
+            # based rules.
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+            #   trigger event
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_regexp_rule trigger_node, source, object, ret, *args
               return unless source.is_a?(String)
               return if trigger_node.good_value && source.match?(trigger_node.good_value)
@@ -236,16 +216,15 @@ module Contrast
               build_finding(trigger_node, source, object, ret, *args)
             end
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets for our Dataflow based rules.
+            # This is our method that actually checks the taint on the object our trigger_node targets for our Dataflow
+            # based rules.
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+            #   trigger event
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_dataflow_rule trigger_node, source, object, ret, *args
               return unless source
 
@@ -288,8 +267,7 @@ module Contrast
 
               build_events finding, properties.event if properties.event
 
-              # Google::Protobuf::Map doesn't support merge!, so we have to do this
-              # long form
+              # Google::Protobuf::Map doesn't support merge!, so we have to do this long form
               source_props = properties.properties
               return unless source_props
 
@@ -305,8 +283,8 @@ module Contrast
               event.parent_events&.each do |parent_event|
                 build_events(finding, parent_event)
               end
-              # events could technically be nil, but we would have failed
-              # the rule check before getting here. not worth the nil check
+              # events could technically be nil, but we would have failed the rule check before getting here. not
+              # worth the nil check
               finding.events << event.to_dtm_event
             end
 
@@ -325,21 +303,18 @@ module Contrast
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
             end
 
-            # Because our APIs are not versioned, TeamServer relies on a field,
-            # version, to tell it what, if any, validation it can preform on
-            # the findings we send it. Examine the finding and determine the
-            # level to which it conforms.
+            # Because our APIs are not versioned, TeamServer relies on a field, version, to tell it what, if any,
+            # validation it can preform on the findings we send it. Examine the finding and determine the level to
+            # which it conforms.
             #
             # @param finding [Contrast::Api::Dtm::Finding]
             # @return [int] the version of compliance
             def determine_compliance_version finding
               return MINIMUM_FINDING_VERSION unless finding
-              # as routes are the only variable between findings, in the case
-              # where we couldn't determine one, any finding with a route is at
-              # maximum compliance
+              # as routes are the only variable between findings, in the case where we couldn't determine one, any
+              # finding with a route is at maximum compliance
               return CURRENT_FINDING_VERSION if finding.routes.any?
-              # any finding without events is not of a dataflow type and
-              # therefore at maximum compliance
+              # any finding without events is not of a dataflow type and therefore at maximum compliance
               return CURRENT_FINDING_VERSION unless finding.events.any?
 
               MINIMUM_FINDING_VERSION