contrast-agent 5.3.0 → 6.1.1

data/lib/contrast/agent/assess/policy/policy.rb

@@ -18,11 +18,20 @@ module Contrast
         # This is just a holder for our policy. Takes the policy JSON and
         # converts it into hashes that we can access nicely
         class Policy < Contrast::Agent::Patching::Policy::Policy
+          PROVIDER_CLASSES = [
+            Contrast::Agent::Assess::Rule::Provider::HardcodedKey,
+            Contrast::Agent::Assess::Rule::Provider::HardcodedPassword
+          ].cs__freeze
           # Indicates the folder in `resources` where this policy lives.
           def self.policy_folder
             'assess'
           end
 
+          def initialize
+            super
+            load_providers
+          end
+
           # Indicates is this feature has been disabled by the configuration,
           # read at startup, and therefore can never be enabled.
           def disabled_globally?
@@ -33,11 +42,6 @@ module Contrast
             Contrast::Agent::Assess::Policy::TriggerNode
           end
 
-          def initialize
-            super
-            load_providers
-          end
-
           # Our policy for dataflow rules is a 'dope ass' JSON file. Rather than
           # hard code in a bunch of things to monkey patch, we let the JSON file
           # define the conditions in which sources, propagators, and triggers are
@@ -88,11 +92,6 @@ module Contrast
               providers[instance.rule_id] = instance
             end
           end
-
-          PROVIDER_CLASSES = [
-            Contrast::Agent::Assess::Rule::Provider::HardcodedKey,
-            Contrast::Agent::Assess::Rule::Provider::HardcodedPassword
-          ].cs__freeze
         end
       end
     end

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -3,6 +3,8 @@
 
 require 'contrast/agent/patching/policy/policy_node'
 require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/utils/object_share'
+require 'contrast/agent/assess/policy/policy_node_utils'
 
 module Contrast
   module Agent
@@ -11,9 +13,38 @@ module Contrast
         # This class functions to translate our policy.json into an actionable
         # Ruby object, allowing for dynamic patching over hardcoded patching.
         class PolicyNode < Contrast::Agent::Patching::Policy::PolicyNode
+          include PolicyNodeUtils
+          JSON_TAGS = 'tags'
+          JSON_DATAFLOW = 'dataflow'
+          # The keys used to read from policy.json to create the individual
+          # policy nodes. These are common across node types
+          JSON_SOURCE = 'source'
+          ALL_TYPE = 'A'
+          JSON_TARGET = 'target'
+          TO_MARKER = '2'
+
           attr_accessor :tags, :type
           attr_reader   :sources, :targets, :source_string, :target_string
 
+          # Here are all methods that can use original objects without mutation the source.
+          # For methods with REMOVE action, their (!) bang alternative is not listed, since
+          # this methods tends to mutate the original (shortens it's length, remove special
+          # symbols..) and causes mismatch in tags range representation of the target. In
+          # short preshift is needed.
+          ORIGINAL_OBJECT_METHODS = %i[
+            capitalize
+            capitalize!
+            chomp
+            to_s
+            downcase
+            downcase!
+            lstrip
+            strip
+            upcase!
+            upcase
+          ].cs__freeze
+          TO_S = 'to_s'
+
           def initialize policy_hash = {}
             super(policy_hash)
             @source_string = policy_hash[JSON_SOURCE]
@@ -21,6 +52,20 @@ module Contrast
             @tags = Set.new(policy_hash[JSON_TAGS])
             @sources = convert_policy_markers(source_string)
             @targets = convert_policy_markers(target_string)
+            @_use_original_object = ORIGINAL_OBJECT_METHODS.include?(@method_name)
+            @_use_original_on_bang_method = assign_on_bang_check(policy_hash)
+          end
+
+          def assign_on_bang_check policy_hash
+            # If we have KEEP action on String, and the method is to_s, that method would return self:
+            # String#to_s => self or string. This method is included here to cover the situations such as
+            # String.to_s.html_safe, where normally the dynamic sources properties get lost. To solve this
+            # we will simply return the original object here.
+            return true if @_use_original_object && policy_hash[JSON_METHOD_NAME] == TO_S
+
+            @_use_original_object &&
+                # Check if method name ends with a (!) bang unless is the to_s method:
+                policy_hash[JSON_METHOD_NAME].end_with?(Contrast::Utils::ObjectShare::BANG)
           end
 
           def feature
@@ -79,8 +124,6 @@ module Contrast
             end
           end
 
-          ALL_TYPE = 'A'
-          TO_MARKER = '2'
           # Convert our action, built from our source and target, into
           # the TS appropriate action. That's a single source to single
           # target marker (A,O,P,R)
@@ -112,43 +155,22 @@ module Contrast
             @event_action
           end
 
-          # The keys used to read from policy.json to create the individual
-          # policy nodes. These are common across node types
-          JSON_SOURCE = 'source'
-          JSON_TARGET = 'target'
-          JSON_TAGS = 'tags'
-          JSON_DATAFLOW = 'dataflow'
-
-          private
-
-          # Given a policy string in the format A,B,C, populate the given array
-          # 1) Split on ','
-          # 2) If 'O' or 'R', add the array, else it's P and needs to be
-          #    converted. P type will either be P# where # is the index
-          #    of the parameter. Drop the P and store the # as an int.
+          # This method will check if a method is fit to use it's original object and
+          # that the method is without bang - it does not change the source, but rather
+          # creates a copy of it.
           #
-          # @param markers [String] the String from the policy to parse
-          # @return [Array] the array generated by converting the marker string
-          def convert_policy_markers markers
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless markers
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY if markers.empty?
-
-            converted = []
-            markers.split(Contrast::Utils::ObjectShare::COMMA).each do |t|
-              converted << case t
-                           when Contrast::Utils::ObjectShare::OBJECT_KEY,
-                   Contrast::Utils::ObjectShare::RETURN_KEY
-
-                             t
-                           else
-                             Integer(t[1..])
-                           end
-            end
-            converted
+          # @return true | false
+          def use_original_object?
+            @_use_original_object && Contrast::ASSESS.track_original_object?
           end
 
-          def all_type? marker
-            marker.include?(Contrast::Utils::ObjectShare::COMMA)
+          # This method will check if a method is fit to use it's original object and
+          # that the target return is the same as object - a bang method modifying the
+          # source.
+          #
+          # @return true | false
+          def use_original_on_bang_method?
+            @_use_original_on_bang_method && Contrast::ASSESS.track_original_object?
           end
         end
       end

data/lib/contrast/agent/assess/policy/policy_node_utils.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        # This module will extend the PolicyNode, which functions is to translate
+        # our policy.json into an actionable Ruby object, allowing for dynamic
+        # patching over hardcoded patching.
+        module PolicyNodeUtils
+          private
+
+          # Given a policy string in the format A,B,C, populate the given array
+          # 1) Split on ','
+          # 2) If 'O' or 'R', add the array, else it's P and needs to be
+          #    converted. P type will either be P# where # is the index
+          #    of the parameter. Drop the P and store the # as an int.
+          #
+          # @param markers [String] the String from the policy to parse
+          # @return [Array] the array generated by converting the marker string
+          def convert_policy_markers markers
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless markers
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY if markers.empty?
+
+            converted = []
+            markers.split(Contrast::Utils::ObjectShare::COMMA).each do |maker|
+              converted << case maker
+                           when Contrast::Utils::ObjectShare::OBJECT_KEY,
+                             Contrast::Utils::ObjectShare::RETURN_KEY
+
+                             maker
+                           else
+                             Integer(maker[1..])
+                           end
+            end
+            converted
+          end
+
+          def all_type? marker
+            marker.include?(Contrast::Utils::ObjectShare::COMMA)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/policy_scanner.rb

@@ -32,22 +32,8 @@ module Contrast
               mod = trace_point.self
               return if mod.cs__frozen? || mod.singleton_class?
 
-              different_ruby_version trace_point, provider_values, mod
-            end
-
-            def different_ruby_version trace_point, provider_values, mod
-              # TODO: RUBY-1014 - remove non-AST approach
-              if RUBY_VERSION >= '2.6.0'
-                # TODO: RUBY-714 EOL 2.5. That check will be removed and the code will be brought back in here.
-                ast = RubyVM::AbstractSyntaxTree.parse_file(trace_point.path)
-                provider_values.each do |provider|
-                  provider.parse(trace_point, ast)
-                end
-              else
-                provider_values.each do |provider|
-                  provider.analyze(mod)
-                end
-              end
+              ast = RubyVM::AbstractSyntaxTree.parse_file(trace_point.path)
+              provider_values.each { |provider| provider.parse(trace_point, ast) }
             end
 
             def policy

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -14,9 +14,12 @@ module Contrast
         extend Contrast::Components::Logger::InstanceMethods
 
         @lru_cache = Contrast::Utils::LRUCache.new
-        UNDUPLICABLE_MODULES = [
+        UNDUPLICABLE_MODULES = [ # rubocop: disable Style/MutableConstant
           Enumerator # dup'ing results in 'can't copy execution context'
-        ].cs__freeze
+        ]
+        # dup'ing IO::Buffer results in null buffer.
+        UNDUPLICABLE_MODULES << IO::Buffer if RUBY_VERSION >= '3.1.0'
+        UNDUPLICABLE_MODULES.cs__freeze
 
         attr_accessor :object, :object_length, :args, :arg_lengths
 
@@ -41,6 +44,9 @@ module Contrast
             return unless propagation_node
             return unless ::Contrast::ASSESS.enabled?
 
+            # don't do preshift just use the original object
+            return if propagation_node.use_original_object?
+
             initializing = propagation_node.method_name == :initialize
             return if unsafe_io_object?(object, initializing)
 

data/lib/contrast/agent/assess/policy/propagation_method.rb

@@ -9,6 +9,7 @@ require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/propagation_method_utils'
 require 'contrast/agent/assess/events/event_data'
+require 'contrast/utils/assess/object_store'
 
 module Contrast
   module Agent
@@ -21,6 +22,8 @@ module Contrast
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::PropagationMethodUtils
 
+          @properties = Contrast::Utils::Assess::ObjectStore.new
+
           class << self
             # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that governs the
             #   patches to this method
@@ -33,10 +36,8 @@ module Contrast
             # @return [Object, nil] the tracked Return or nil if no changes were made; will replace the return of the
             #   original function if not nil
             def apply_propagation method_policy, preshift, object, ret, args, block
-              return unless method_policy.propagation_node
-              return unless preshift
-
-              propagation_node = method_policy.propagation_node
+              return unless (propagation_node = method_policy.propagation_node)
+              return unless propagation_node.use_original_object? || preshift
 
               target = determine_target(propagation_node, ret, object, args)
               propagation_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, args)
@@ -211,20 +212,39 @@ module Contrast
                 # double check that we were able to finalize the replaced return
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
-              propagation_class.propagate(propagation_node, preshift, target)
-              update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
+
+              # If we are using the original object tracking, the preshift object is not created.
+              # Instead identify the source as the original object itself and propagate with it.
+              source = propagation_node.use_original_object? ? propagation_data.object : preshift
+              handle_propagation(propagation_class, propagation_node, source, target)
+              update_properties(restore_frozen_state, propagation_node, target, propagation_data, ret)
+            end
+
+            def handle_propagation propagation_class, propagation_node, source, target
+              if propagation_node.patch_method
+                propagation_class.send(propagation_node.patch_method, propagation_node, source, target)
+              else
+                propagation_class.propagate(propagation_node, source, target)
+              end
             end
 
             def update_properties restore_frozen_state, propagation_node, target, propagation_data, ret
-              # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
-              apply_tags(propagation_node, target)
-              # Even though we skipped propagating tags from the source if they were included in untags, the target may
-              # have already had some on it. Let's go ahead and remove them. In this order, untags takes precedent over
-              # tags; but we control both and there should never be a propagator that has a tag in its untag.
-              apply_untags(propagation_node, target)
-              return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+              if propagation_node.use_original_on_bang_method?
+                properties = use_original_object_properties(propagation_data)
 
-              properties.add_properties(propagation_node.properties)
+                return unless properties
+              else
+                # Once we've propagated, attempt to tag the target if there is a tag(s) to be applied
+                apply_tags(propagation_node, target)
+                # Even though we skipped propagating tags from the source if they were included in untags, the target
+                # may have already had some on it. Let's go ahead and remove them. In this order, untags takes
+                # precedent over tags; but we control both and there should never be a propagator that has a
+                # tag in its untag.
+                apply_untags(propagation_node, target)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                properties.add_properties(propagation_node.properties)
+              end
               event_data = Contrast::Agent::Assess::Events::EventData.new(propagation_node,
                                                                           target,
                                                                           propagation_data.object,
@@ -259,6 +279,20 @@ module Contrast
               ::Contrast::ASSESS.track_frozen_sources? &&
                   propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
             end
+
+            # For certain bang methods we return the same object, no need to create expensive new properties.
+            #
+            # @param propagation_data [Contrast::Agent::Assess::Events::EventData] used to hold object, args
+            # and ret.
+            # @return properties [Contrast::Agent::Assess::Properties] the original properties transfered to
+            # target.
+            def use_original_object_properties propagation_data
+              unless @properties[propagation_data.object.__id__]
+                @properties[propagation_data.object.__id__] = Contrast::Agent::Assess::Tracker.properties!(
+                    propagation_data.object)
+              end
+              @properties[propagation_data.object.__id__]
+            end
           end
         end
         # rubocop:enable Metrics/ModuleLength

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -22,6 +22,8 @@ module Contrast
           attr_reader :untags, :patch_method
           attr_accessor :action, :patch_class
 
+          TAGGER = 'Tagger'
+          PROPAGATOR = 'Propagator'
           # Most things here carry over from PolicyNode.
           # A couple things are new / have new rules
           #
@@ -41,9 +43,6 @@ module Contrast
             validate
           end
 
-          TAGGER = 'Tagger'
-          PROPAGATOR = 'Propagator'
-
           def node_class
             @_node_class ||= tagger? ? TAGGER : PROPAGATOR
           end

data/lib/contrast/agent/assess/policy/propagator/base.rb

@@ -26,7 +26,7 @@ module Contrast
               end
 
               def propagate _propagation_node, _preshift, _target
-                raise NoMethodError("Expected Base propagator subclass: #{ cs__class } to implement #propagate")
+                raise(NoMethodError("Expected Base propagator subclass: #{ cs__class } to implement #propagate"))
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/buffer.rb

@@ -0,0 +1,119 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/policy/propagator/select'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Propagation that results in all the tags of the source being
+          # applied to the target at the point of insertion. The target's
+          # preexisting tags are shifted to account for this insertion.
+          class Buffer < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # For the source, append its tags to the target.
+              # Once the tag is applied, shift it to the location of the insert
+              # Unlike additive propagation, this currently only supports one source
+              # We assume that insert changes the preshift target
+              def propagate_insert propagation_node, preshift, target
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
+
+                source = find_source(propagation_node.sources[0], preshift)
+
+                patcher_target = propagation_node.targets[0]
+                preshift_target = case patcher_target
+                                  when Contrast::Utils::ObjectShare::OBJECT_KEY
+                                    preshift.object
+                                  else
+                                    # this is hardly reached b/c insert supports only one source
+                                    # changed to second argument: string.insert[idx, string_to_insert]
+                                    # previously was args[int] => produces exception
+                                    preshift.args[1]
+                                  end
+
+                # in case of situations, where buffer is initialized with X size and it's not fully
+                preshift_target = preshift_target.get_string
+                target = target.get_string
+                # Find the first difference between the source to which
+                # we inserted and the result. That is the insertion
+                # point on which all tags need to be adjusted
+                # If the insertion point is the end of the string, preshift length is returned
+                # https://stackoverflow.com/questions/31714522/find-the-first-differing-character-between-two-strings-in-ruby
+                insert_point = (0...preshift_target.length).find do |i|
+                  preshift_target[i] != target[i]
+                end || preshift_target.length
+                # Depending what's inserted, we might be wrong. For instance, inserting 'foo'
+                # into 'asdfasdf' could result in 'asdfoofasdf'. we'd be off by one b/c of the 'f'
+                insert_point = target.rindex(source, insert_point)
+                overflow = insert_point...(insert_point + source.length)
+
+                # handle shifting the inserted range
+                properties.shift_tags([overflow])
+
+                properties.copy_from(source, target, insert_point, propagation_node.untags)
+                properties.cleanup_tags
+              end
+
+              # This method will implement both KEEP and SPLAT actions.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return target from method invocation.
+              def buffer_keep_splat propagation_node, preshift, ret
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is included in the preshift's UNDUPLICABLE_MODULES.
+                return unless preshift.object
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # we use this for the IO::Buffer#get_value and it requires 2 args always.
+                return unless ret || Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
+
+                if preshift.args[1] == 0 # rubocop:disable Style/NumericPredicate
+                  # KEEP
+                  Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, ret)
+                else
+                  # SPLAT
+                  Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                end
+              end
+
+              # This method will implement both SELECT and KEEP actions for
+              # IO::Buffer
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode]
+              # @param preshift [Contrast::Agent::Assess::Preshift]
+              # @param ret [Object] Return targer from method invocation.
+              # @param _block [nil, {}] block passed.
+              def propagate_keep_select propagation_node, preshift, ret, _block
+                # We need the return in both propagation cases. So this propagation is
+                # applied in the Contrast::Utils::Patching::PatchUtils.apply_post_patch.
+                # If IO::Buffer gets duplicated the dup buffer is not allocated,
+                # it's empty, So a way of doing it is to use the original object
+                # itself. The class is handled with no dup in preshift.
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret)) &&
+                    (source = preshift.object)
+
+                # KEEP means the tags just pass from the source to the target as is.
+                # There is a case with IO::Buffer use, when we don't pass any args,
+                # and the target (ret) in this case is the whole strings. We should
+                # use Keep action. Otherwise the SELECT action covers all other cases.
+                if preshift.args.empty?
+                  # KEEP
+                  properties.copy_from(source, ret, 0, propagation_node.untags)
+                  ret
+                else
+                  # SELECT
+                  Contrast::Agent::Assess::Policy::Propagator::Select.select_tagger(propagation_node, preshift, ret,
+                                                                                    nil)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -31,7 +31,7 @@ module Contrast
                   ::Contrast::ASSESS.tainted_columns[class_name] = tainted_columns.keys
                 end
 
-                Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources class_type, tainted_columns
+                Contrast::Agent::Assess::Policy::DynamicSourceFactory.create_sources(class_type, tainted_columns)
               end
 
               private

data/lib/contrast/agent/assess/policy/propagator/keep.rb

@@ -11,12 +11,27 @@ module Contrast
           # are unaffected beyond any merging of overlapping tags.
           class Keep < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
-              # Keep means the tags just pass from the source to the target
-              # as is.
-              def propagate propagation_node, preshift, target
+              # Keep means the tags just pass from the source to the target as is.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                source = find_source(propagation_node.sources[0], preshift)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object, so we will always return 'O' key which is the object itself.
+                           # Because preshift is disabled for this methods we use it's parameter to pass
+                           # in the original object, preshift = object. To see list of methods in which
+                           # this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
                 properties.copy_from(source, target, 0, propagation_node.untags)
               end
             end

data/lib/contrast/agent/assess/policy/propagator/remove.rb

@@ -13,10 +13,26 @@ module Contrast
             class << self
               # For the source, append its tags to the target. Once the tag is applied, remove the section that was
               # removed by the delete. Unlike additive propagation, this currently only supports one source.
-              def propagate propagation_node, preshift, target
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] Current node
+              # governing the propagation.
+              # @param preshift_or_object [Contrast::Agent::Assess::Preshift] current preshift state or
+              # source object passed if track_original_object flag is active.
+              # @param target [Object] To where the tainted data flows.
+              def propagate propagation_node, preshift_or_object, target
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-                source = find_source(propagation_node.sources[0], preshift)
+                source = if propagation_node.use_original_object?
+                           # for now this is used with string based object and with methods not mutating
+                           # original object (clearing empty spaces, \n..) so we will always return 'O' key
+                           # which is the object itself. Because preshift is disabled for this methods
+                           # we use it's parameter to pass in the original object( in this case just a unchained
+                           # source), preshift = object. To see list of methods in which this is used:
+                           # Contrast::Utils::MethodCheck::ORIGINAL_OBJECT_METHODS
+                           preshift_or_object
+                         else
+                           find_source(propagation_node.sources[0], preshift_or_object)
+                         end
                 properties.copy_from(source, target, 0, propagation_node.untags)
                 handle_removal(propagation_node, source, target)
               end

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -19,6 +19,7 @@ module Contrast
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
                     tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
+                    check_for_buffer(tracked_inputs, preshift.args[source])
                     find_argument_inputs(tracked_inputs, preshift.args[source])
                   end
                 end
@@ -47,9 +48,15 @@ module Contrast
               # @param tracked_inputs [Array] storage for the inputs to act on later
               # @param arg [Object] an input to the method which act as sources for this propagation.
               def find_argument_inputs tracked_inputs, arg
-                if arg.is_a?(String)
-                  tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
-                elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
+                if arg.is_a?(String) || arg.is_a?(File)
+                  tracked_inputs << arg if tracked_value?(arg)
+                else
+                  iterable_arg(tracked_inputs, arg)
+                end
+              end
+
+              def iterable_arg tracked_inputs, arg
+                if Contrast::Utils::DuckUtils.iterable_hash?(arg)
                   arg.each_pair do |key, value|
                     tracked_inputs << key if tracked_value?(key)
                     tracked_inputs << value if tracked_value?(value)
@@ -60,6 +67,13 @@ module Contrast
                   end
                 end
               end
+
+              def check_for_buffer tracked_inputs, arg
+                return if RUBY_VERSION < '3.1.0'
+                return unless  arg.is_a?(IO::Buffer) && tracked_value?(arg)
+
+                tracked_inputs << arg
+              end
             end
           end
         end