contrast-agent 5.3.0 → 6.0.0

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -9,6 +9,7 @@ require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/propagation_method_utils'
 require 'contrast/agent/assess/events/event_data'
+require 'contrast/utils/assess/object_store'
 
 module Contrast
   module Agent
@@ -21,6 +22,8 @@ module Contrast
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::PropagationMethodUtils
 
+          @properties = Contrast::Utils::Assess::ObjectStore.new
+
           class << self
             # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that governs the
             #   patches to this method
@@ -33,10 +36,8 @@ module Contrast
             # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
             #   original function if not nil
             def apply_propagation method_policy, preshift, object, ret, args, block
-              return unless method_policy.propagation_node
-              return unless preshift
-
-              propagation_node = method_policy.propagation_node
+              return unless (propagation_node = method_policy.propagation_node)
+              return unless propagation_node.use_original_object? || preshift
 
               target = determine_target(propagation_node, ret, object, args)
               propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
@@ -211,20 +212,39 @@ module Contrast
                 # double check that we were able to finalize the replaced return
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
-              propagation_class.propagate(propagation_node, preshift, target)
+
+              # If we are using the original object tracking, the preshift object is not created.
+              # Instead identify the source as the original object itself and propagate with it.
+              source = propagation_node.use_original_object? ? propagation_data.object : preshift
+              handle_propagation propagation_class, propagation_node, source, target
               update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
             end
 
+            def handle_propagation propagation_class, propagation_node, source, target
+              if propagation_node.patch_method
+                propagation_class.send(propagation_node.patch_method, propagation_node, source, target)
+              else
+                propagation_class.propagate(propagation_node, source, target)
+              end
+            end
+
             def update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
-              # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
-              apply_tags(propagation_node, target)
-              # Even though we skipped propagating tags from the source if they were included in untags, the target may
-              # have already had some on it. Let's go ahead and remove them. In this order, untags takes precedent over
-              # tags; but we control both and there should never be a propagator that has a tag in its untag.
-              apply_untags(propagation_node, target)
-              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+              if propagation_node.use_original_on_bang_method?
+                properties = use_original_object_properties propagation_data
 
-              properties.add_properties(propagation_node.properties)
+                return unless properties
+              else
+                # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
+                apply_tags(propagation_node, target)
+                # Even though we skipped propagating tags from the source if they were included in untags, the target
+                # may have already had some on it. Let's go ahead and remove them. In this order, untags takes
+                # precedent over tags; but we control both and there should never be a propagator that has a
+                # tag in its untag.
+                apply_untags(propagation_node, target)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                properties.add_properties(propagation_node.properties)
+              end
               event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
                                                                           target,
                                                                           propagation_data.object,
@@ -259,6 +279,20 @@ module Contrast
               ::Contrast::ASSESS.track_frozen_sources? &&
                   propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
             end
+
+            # For certain bang methods we return the same object, no need to create expensive new properties.
+            #
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] used to hold object, args
+            # and ret.
+            # @return properties [Contrast::Agent::Assess::Properties] the original properties transfered to
+            # target.
+            def use_original_object_properties propagation_data
+              unless @properties[propagation_data.object.__id__]
+                @properties[propagation_data.object.__id__] = Contrast::Agent::Assess::Tracker.properties!(
+                    propagation_data.object)
+              end
+              @properties[propagation_data.object.__id__]
+            end
           end
         end
         # rubocop:enable Metrics/ModuleLength

data/lib/contrast/agent/assess/policy/propagator/buffer.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagator/select'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target at the point of insertion. The target's
+          # preexisting tags are shifted to account for this insertion.
+          class Buffer < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # For the source, append its tags to the target.
+              # Once the tag is applied, shift it to the location of the insert
+              # Unlike additive propagation, this currently only supports one source
+              # We assume that insert changes the preshift target
+              def propagate_insert propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source = find_source(propagation_node.sources[0], preshift)
+
+                patcher_target = propagation_node.targets[0]
+                preshift_target = case patcher_target
+                                  when Contrast::Utils::ObjectShare::OBJECT_KEY
+                                    preshift.object
+                                  else
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
+                                  end
+
+                # in case of situations, where buffer is initialized with X size and it's not fully
+                preshift_target = preshift_target.get_string
+                target = target.get_string
+                # Find the first difference between the source to which
+                # we inserted and the result. That is the insertion
+                # point on which all tags need to be adjusted
+                # If the insertion point is the end of the string, preshift length is returned
+                # https://stackoverflow.com/questions/31714522/find-the-first-differing-character-between-two-strings-in-ruby
+                insert_point = (0...preshift_target.length).find do |i|
+                  preshift_target[i] != target[i]
+                end || preshift_target.length
+                # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
+                # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
+                insert_point = target.rindex(source, insert_point)
+                overflow = insert_point...(insert_point + source.length)
+
+                # handle shifting the inserted range
+                properties.shift_tags([overflow])
+
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
+              end
+
+              # This method will implement both KEEP and SPLAT actions.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return target from method invocation.
+              def buffer_keep_splat propagation_node, preshift, ret
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is included in the preshift's UNDUPLICABLE_MODULES.
+                return unless preshift.object
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # we use this for the IO::Buffer#get_value and it requires 2 args always.
+                return unless ret || Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
+
+                if preshift.args[1] == 0 # rubocop:disable Style/NumericPredicate
+                  # KEEP
+                  Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, ret)
+                else
+                  # SPLAT
+                  Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                end
+              end
+
+              # This method will implement both SELECT and KEEP actions for
+              # IO::Buffer
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return targer from method invocation.
+              # @param _block [nil, {}] block passed.
+              def propagate_keep_select propagation_node, preshift, ret, _block
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is handled with no dup in preshift.
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret)) &&
+                    (source = preshift.object)
+
+                # KEEP means the tags just pass from the source to the target as is.
+                # There is a case with IO::Buffer use, when we don't pass any args,
+                # and the target (ret) in this case is the whole strings. We should
+                # use Keep action. Otherwise the SELECT action covers all other cases.
+                if preshift.args.empty?
+                  # KEEP
+                  properties.copy_from(source, ret, 0, propagation_node.untags)
+                  ret
+                else
+                  # SELECT
+                  Contrast::Agent::Assess::Policy::Propagator::Select.select_tagger propagation_node, preshift, ret, nil
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -11,12 +11,27 @@ module Contrast
           # are unaffected beyond any merging of overlapping tags.
           class Keep < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # Keep means the tags just pass from the source to the target
-              # as is.
-              def propagate propagation_node, preshift, target
+              # Keep means the tags just pass from the source to the target as is.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                source = find_source(propagation_node.sources[0], preshift)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object, so we will always return 'O' key which is the object itself.
+                           # Because preshift is disabled for this methods we use it's parameter to pass
+                           # in the original object, preshift = object. To see list of methods in which
+                           # this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
                 properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -13,10 +13,26 @@ module Contrast
             class << self
               # For the source, append its tags to the target. Once the tag is applied, remove the section that was
               # removed by the delete. Unlike additive propagation, this currently only supports one source.
-              def propagate propagation_node, preshift, target
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                source = find_source(propagation_node.sources[0], preshift)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object (clearing empty spaces, \n..) so we will always return 'O' key
+                           # which is the object itself. Because preshift is disabled for this methods
+                           # we use it's parameter to pass in the original object( in this case just a unchained
+                           # source), preshift = object. To see list of methods in which this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
                 properties.copy_from(source, target, 0, propagation_node.untags)
                 handle_removal(propagation_node, source, target)
               end

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -19,6 +19,7 @@ module Contrast
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                     tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
+                    check_for_buffer(tracked_inputs, preshift.args[source])
                     find_argument_inputs(tracked_inputs, preshift.args[source])
                   end
                 end
@@ -47,9 +48,15 @@ module Contrast
               # @param tracked_inputs [Array] storage for the inputs to act on later
               # @param arg [Object] an input to the method which act as sources for this propagation.
               def find_argument_inputs tracked_inputs, arg
-                if arg.is_a?(String)
-                  tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
-                elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
+                if arg.is_a?(String) || arg.is_a?(File)
+                  tracked_inputs << arg if tracked_value?(arg)
+                else
+                  iterable_arg tracked_inputs, arg
+                end
+              end
+
+              def iterable_arg tracked_inputs, arg
+                if Contrast::Utils::DuckUtils.iterable_hash?(arg)
                   arg.each_pair do |key, value|
                     tracked_inputs << key if tracked_value?(key)
                     tracked_inputs << value if tracked_value?(value)
@@ -60,6 +67,13 @@ module Contrast
                   end
                 end
               end
+
+              def check_for_buffer tracked_inputs, arg
+                return if RUBY_VERSION < '3.1.0'
+                return unless  arg.is_a?(IO::Buffer) && tracked_value?(arg)
+
+                tracked_inputs << arg
+              end
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -33,7 +33,7 @@ module Contrast
               end
 
               def sub_tagger patcher, preshift, ret, block
-                substitution_tagger(patcher, preshift, ret, !block.nil?, false)
+                substitution_tagger(patcher, preshift, ret, !block.nil?, global: false)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/substitution_utils.rb

@@ -29,7 +29,7 @@ module Contrast
             # @param ret [String] the result of the substitution
             # @param block, the given block
             # @param global [Boolean] if this was a global or single substitution, optional
-            def substitution_tagger patcher, preshift, ret, block, global = true
+            def substitution_tagger patcher, preshift, ret, block, global: true
               return ret unless ret
 
               begin

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -92,7 +92,7 @@ module Contrast
                 end
                 # Be sure to capture the last range in the holder.
                 remove_ranges << (start...stop)
-                properties.delete_tags_at_ranges(remove_ranges, false)
+                properties.delete_tags_at_ranges(remove_ranges, shift: false)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -30,6 +30,7 @@ module Contrast
           require 'contrast/agent/assess/policy/propagator/split'
           require 'contrast/agent/assess/policy/propagator/substitution'
           require 'contrast/agent/assess/policy/propagator/trim'
+          require 'contrast/agent/assess/policy/propagator/buffer'
         end
       end
     end

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -36,7 +36,7 @@ module Contrast
             # @param ret [Object] the Return of the invoked method
             # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object, nil] the tracked Return or nil if no changes were made
-            def source_patchers method_policy, object, ret, args
+            def apply_source method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
               return unless (source_node = method_policy.source_node)
 
@@ -56,11 +56,11 @@ module Contrast
                 target = dup
               end
 
-              apply_source(source_node, target, source_data, source_node.type, nil, *args)
+              process_source(source_node, target, source_data, source_node.type, nil, *args)
 
               return_val
             end
-            Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :source_patchers)
+            Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
 
             private
 
@@ -75,7 +75,7 @@ module Contrast
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def apply_source source_node, target, source_data, source_type, source_name = nil, *args
+            def process_source source_node, target, source_data, source_type, source_name = nil, *args
               context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
@@ -90,7 +90,7 @@ module Contrast
                 # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each do |value|
-                  apply_source(source_node, value, source_data, source_type, source_name, *args)
+                  process_source(source_node, value, source_data, source_type, source_name, *args)
                 end
               end
             rescue StandardError => e
@@ -116,8 +116,8 @@ module Contrast
                   key = key.dup
                   to_replace << key
                 end
-                apply_source(source_node, key, source_data, key_type(source_type), key, *args)
-                apply_source(source_node, value, source_data, source_type, key, *args)
+                process_source(source_node, key, source_data, key_type(source_type), key, *args)
+                process_source(source_node, value, source_data, source_type, key, *args)
               end
               handle_hash_key(target, to_replace)
             end

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -157,7 +157,9 @@ module Contrast
 
               new_preflight = Contrast::Agent::Reporting::Preflight.new
               new_preflight_message = Contrast::Agent::Reporting::PreflightMessage.new
-              new_preflight_message.routes << Contrast::Agent::Reporting::RouteDiscovery.convert(request.route)
+              if request.route
+                new_preflight_message.routes << Contrast::Agent::Reporting::RouteDiscovery.convert(request.route)
+              end
               new_preflight_message.hash_code = hash_code
               new_preflight_message.data = "#{ trigger_node.rule_id },#{ hash_code }"
               new_preflight.messages << new_preflight_message

data/lib/contrast/agent/assess/property/tagged.rb

@@ -40,7 +40,7 @@ module Contrast
           # @param ranges [Array<Range>] the ranges to delete
           # @param shift [Boolean] move remaining tags to the left to account
           #   for the deletion
-          def delete_tags_at_ranges ranges, shift = true
+          def delete_tags_at_ranges ranges, shift: true
             return unless tracked?
 
             # Stage one - delete the tags w/o changing their

data/lib/contrast/agent/assess/rule/response/auto_complete_rule.rb

@@ -32,7 +32,7 @@ module Contrast
             # @return [Hash, nil] the evidence required to prove the violation of the rule
             def violated? response
               body = response.body
-              forms = html_elements(body, FORM_START_REGEXP, true)
+              forms = html_elements(body, FORM_START_REGEXP, capture_overflow: true)
               forms.each do |form|
                 # Because TeamServer will reject any subsequent form on the same page due to deduplication, we can
                 # skip out on the first violation.

data/lib/contrast/agent/assess/rule/response/body_rule.rb

@@ -45,7 +45,7 @@ module Contrast
             # @param section [String,nil] html section to find element
             # @param element_start_str [String] element to find in html section
             # @return [Array<Hash>] the found elements of this section, as well as their start and end indexes.
-            def html_elements section, element_start_str = '', capture_overflow = false
+            def html_elements section, element_start_str = '', capture_overflow: false
               elements = []
               section_start = 0
               return [] unless section
@@ -61,7 +61,7 @@ module Contrast
                 next unless element_stop
 
                 section_close = section_start + 6 + element_stop
-                elements << capture(section, section_start, section_close, element_stop, capture_overflow)
+                elements << capture(section, section_start, section_close, element_stop, overflow: capture_overflow)
                 section_start = section_close
               end
               elements
@@ -82,7 +82,7 @@ module Contrast
             # @param body_close [Integer] the end of the range to take from the body
             # @param tag_stop [Integer] the index of the end of the html tag from its start
             # @return [Hash]
-            def capture body, body_start, body_close, tag_stop, overflow = false
+            def capture body, body_start, body_close, tag_stop, overflow: false
               tag = {}
               # Capture the 50 characters in front of the form, or up to the start if the form starts before 50.
               if overflow

data/lib/contrast/agent/assess/rule/response/cache_control_header_rule.rb

@@ -54,7 +54,7 @@ module Contrast
               # rack response, we should use that value
               if framework_supported?
                 cache_control = response.rack_response.cache_control
-                has_header = !cache_control.empty?
+                has_header = !cache_control.blank?
                 not_valid = has_header && !((cache_control[:no_cache]) || (cache_control[:no_store]))
                 # evidence requires header value string, pull directly instead of rebuilding from hash
                 return has_header, evidence(HEADER_TYPE, NAME, cache_control_to_s(cache_control)) if not_valid

data/lib/contrast/agent/assess/rule/response/parameters_pollution_rule.rb

@@ -32,7 +32,7 @@ module Contrast
             # @return [Hash, nil] the evidence required to prove the violation of the rule
             def violated? response
               body = response.body
-              forms = html_elements(body, FORM_START_REGEXP, true)
+              forms = html_elements(body, FORM_START_REGEXP, capture_overflow: true)
               forms.each do |form|
                 # Because TeamServer will reject any subsequent form on the same page due to deduplication, we can
                 # skip out on the first violation.

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -24,13 +24,6 @@ module Contrast
           def method_scope
             :contrast
           end
-
-          # TODO: RUBY-99999 remove, used to clean up logs while debugging
-          # def validate
-          #   return if class_name
-          #
-          #   raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.")
-          # end
         end
       end
     end

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -35,12 +35,6 @@ module Contrast
             end
           end
 
-          def validate
-            return if class_name
-
-            raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.")
-          end
-
           def module_names
             @_module_names ||= Set.new(deadzones.map(&:class_name))
           end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -51,7 +51,7 @@ module Contrast
 
         @urls = []
         @exclusion.urls.each do |url|
-          url_pattern = build_regexp(url, true, true)
+          url_pattern = build_regexp(url, start_anchor: true, end_anchor: true)
           @urls << url_pattern if url_pattern
         end
       end
@@ -66,7 +66,7 @@ module Contrast
         @wildcard_exclusions = []
         @exclusion.denylist.each do |code|
           class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
-          class_pattern = build_regexp(class_name, false, true)
+          class_pattern = build_regexp(class_name, start_anchor: false, end_anchor: true)
           method_pattern = build_regexp(method_name)
           next unless class_pattern && method_pattern
 
@@ -74,7 +74,7 @@ module Contrast
         end
       end
 
-      def build_regexp pattern, start_anchor = false, end_anchor = false
+      def build_regexp pattern, start_anchor: false, end_anchor: false
         pattern = Contrast::Utils::ObjectShare::CARROT + pattern if start_anchor
         pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
         Regexp.compile(pattern)

data/lib/contrast/agent/middleware.rb

@@ -13,7 +13,7 @@ require 'contrast/utils/heap_dump_util'
 require 'contrast/utils/telemetry'
 require 'contrast/agent/request_handler'
 require 'contrast/agent/static_analysis'
-require 'contrast/agent/startup_metrics_telemetry_event'
+require 'contrast/agent/telemetry/events/startup_metrics_telemetry_event'
 require 'contrast/utils/middleware_utils'
 
 require 'contrast/utils/timer'
@@ -163,6 +163,8 @@ module Contrast
 
           # Build and report all collected findings prior response
           Contrast::Agent::FINDINGS.report_collected_findings unless Contrast::Agent::FINDINGS.collection.empty?
+          # All protect rules, which are trigger but require response to be reported
+          Contrast::Agent::EXPLOITS.report_recorded_exploits context unless Contrast::Agent::EXPLOITS.collection.empty?
 
           if Contrast::Agent.framework_manager.streaming?(env)
             context.reset_activity

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -133,7 +133,7 @@ module Contrast
             # @param module_data [Contrast::Agent::ModuleData] the module, and its name, that's being patched into
             # @param redo_patch [Boolean] a trigger to force patching regardless of the state of the
             #   Contrast::Agent::Patching::Policy::PatchStatus status on the Module
-            def patch_into_module module_data, redo_patch = false
+            def patch_into_module module_data, redo_patch: false
               status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod)
               return if (status&.patched? || status&.patching?) && !redo_patch
 
@@ -179,7 +179,7 @@ module Contrast
             # @param private [Boolean] Indicate if the query should include
             #   private, as well as public, instance methods
             # @return [Array<Symbol>]
-            def all_instance_methods mod, private = false
+            def all_instance_methods mod, private: false
               instance_methods = mod.instance_methods(false)
               # C magic rb_define_global_function creates private instance
               # methods. We need to instrument those dudes
@@ -206,7 +206,7 @@ module Contrast
             #   this module, sorted by type.
             def patch_into_instance_methods module_data, module_policy
               mod = module_data.mod
-              methods = all_instance_methods(mod, true)
+              methods = all_instance_methods(mod, private: true)
               methods.delete(:initialize) if mod.to_s.starts_with?('RSpec') && mod.to_s.include?('Matchers')
               patch_into_methods(mod, methods, module_policy, true)
             end

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/scope'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent
@@ -14,8 +15,20 @@ module Contrast
         class PolicyNode
           include Contrast::Components::Scope::InstanceMethods
 
-          attr_accessor :class_name, :instance_method, :method_name, :method_visibility
-          attr_reader :properties, :method_scope
+          # Name of the class in which the method is being invoked.
+          attr_accessor :class_name
+          # Check for instance method.
+          #
+          # @return true | false
+          attr_accessor :instance_method
+          # The symbol representation of the invoked method.
+          attr_accessor :method_name
+          # Visibility of the invoked method [Private, Public, Protected]
+          attr_accessor :method_visibility
+          # Properties parsed from our JSON policy.
+          attr_reader :properties
+          # Scope of the method parsed from our JSON policy.
+          attr_reader :method_scope
 
           def node_class
             raise NoMethodError, 'specify the type of the feature for which this node patches'