contrast-agent 6.10.0 → 6.12.0

data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'zlib'
+require 'stringio'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/agent/reporting/reporting_events/application_startup'
@@ -49,6 +51,7 @@ module Contrast
         # This method will build headers of the request required for TS communication
         #
         # @param request [Net::HTTPRequest]
+        # @return [Net::HTTPRequest]
         def build_headers request
           app_version = @headers.app_version
           request['API-Key'] = @headers.api_key
@@ -57,12 +60,12 @@ module Contrast
           request['Application-Path'] = @headers.app_path
           request['Application-Version'] = app_version if app_version
           request['Authorization'] = @headers.authorization
-          request['Content-Type'] = @headers.content_type
           request['Server-Name'] = @headers.server_name
           request['Server-Path'] = @headers.server_path
           request['Server-Type'] = @headers.server_type
           request['X-Contrast-Agent'] = @headers.agent_version
           request['X-Contrast-Header-Encoding'] = @headers.encoding
+          build_encode_and_compress_headers(request)
           request
         end
 
@@ -134,10 +137,24 @@ module Contrast
                       end
             build_headers(request)
             event.attach_headers(request)
-            request.body = event.event_json
+            # compress:
+            gzip = Zlib::GzipWriter.new(StringIO.new)
+            gzip << event.event_json
+            request.body = gzip.close.string
             request
           end
         end
+
+        # Adds the compression and encoding Headers required for sending
+        # compress and encoded body payload.
+        #
+        # @param request [Net::HTTPRequest]
+        def build_encode_and_compress_headers request
+          request['Content-Type'] = @headers.content_type
+          request['X-Contrast-Header-Encoding'] = @headers.encoding
+          request['X-Contrast-Encoding'] = @headers.compression
+          request['Content-Encoding'] = @headers.compression
+        end
       end
     end
   end

data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/logger'

data/lib/contrast/agent/reporting/reporting_utilities/response.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/settings/application_settings'

data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/settings/assess_rule'
@@ -124,28 +124,8 @@ module Contrast
           exclusions = response_data[:exclusions]
           return unless exclusions
 
-          res.application_settings.exclusions.code_exclusions = exclusions[:code]
           res.application_settings.exclusions.url_exclusions = exclusions[:url]
-          extract_input_exclusions(response_data[:exclusions], res)
-        end
-
-        # Input exclusions between NG and non-NG are different, so need to be cast separately.
-        #
-        # @param exclusions [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_input_exclusions exclusions, res
-          res.application_settings.exclusions.input_exclusions = []
-          exclusions[:input].each do |exclusion_details|
-            input_exclusion = Contrast::Agent::Reporting::Settings::InputExclusion.new
-            input_exclusion.name = exclusion_details[:name]
-            input_exclusion.modes = exclusion_details[:modes]
-            input_exclusion.assess_rules = exclusion_details[:assess_rules]
-            input_exclusion.protect_rules = exclusion_details[:protect_rules]
-            input_exclusion.input_name = exclusion_details[:name]
-            input_exclusion.input_type = exclusion_details[:type]
-            input_exclusion.urls = exclusion_details[:urls]
-            res.application_settings.exclusions.input_exclusions << exclusion
-          end
+          res.application_settings.exclusions.input_exclusions = exclusions[:input]
         end
 
         # @param response_data [Hash]

data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/reporting_utilities/response'

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_mode.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/reporting_utilities/ng_response_extractor'
@@ -22,14 +22,14 @@ module Contrast
             unprocessable_entity: '422',
             too_many_requests: '429'
         }.cs__freeze
-        APP_NON_EXISTENT_MSG = 'Application does not exist! Either it has not been created or has '\
-                               'been deleted or archived. '\
+        APP_NON_EXISTENT_MSG = 'Application does not exist! Either it has not been created or has ' \
+                               'been deleted or archived. ' \
                                'Disabling permanently.'
         SUSPEND_MSG = 'Reporter is temporarily suspended.'
         UNSUCCESSFULLY_RECEIVED_MSG = 'The Reporter was unable to send message.'
-        FORBIDDEN_MSG = 'Access was forbidden for current Report because the request authentication '\
+        FORBIDDEN_MSG = 'Access was forbidden for current Report because the request authentication ' \
                         'information was not provided'
-        FORBIDDEN_NO_ACTION_MSG = 'Report access was forbidden because the supplied credentials failed '\
+        FORBIDDEN_NO_ACTION_MSG = 'Report access was forbidden because the supplied credentials failed ' \
                                   'to authenticate the Agent'
         UNPROCESSABLE_ENTITY_MSG = 'Reporter received Unprocessable Entity response. Disabling permanently.'
         RETRY_AFTER_MSG = "There are too many requests of this type being sent by this Agent. #{ SUSPEND_MSG }"
@@ -38,13 +38,20 @@ module Contrast
           @_last_response_code ||= ''
         end
 
-        # String format of the Header:<day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
+        # String format of the server last modified Header:<day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
         #
         # @return [String]
         def last_server_modified
           @_last_server_modified
         end
 
+        # String format of the app last modified Header:<day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
+        #
+        # @return [String]
+        def last_application_modified
+          @_last_application_modified
+        end
+
         private
 
         # check if response code is valid before analyze it
@@ -150,12 +157,21 @@ module Contrast
         # Extract the last modify headers with last update form TS.
         #
         # @param response [Net::HTTP::Response, nil]
+        # @param event [Contrast::Agent::Reporting::ServerSettings,
+        #               Contrast::Agent::Reporting::ApplicationSettings, nil]
         # @return last_modified[integer, nil] Time since last server update
-        def extract_response_last_modified response
+        def extract_response_last_modified response, event
           return unless response.cs__is_a?(Net::HTTPResponse)
           return unless (header = response['last-modified'])
 
-          @_last_server_modified = header
+          case event
+            # Server feature based events
+          when Contrast::Agent::Reporting::ServerSettings
+            @_last_server_modified = header
+            # Application settings based events
+          when Contrast::Agent::Reporting::ApplicationSettings
+            @_last_application_modified = header
+          end
         end
 
         # Cease reporting about this application
@@ -243,7 +259,7 @@ module Contrast
           response_data = JSON.parse(response_body, symbolize_names: true)
           return unless response_data.cs__is_a?(Hash)
 
-          extract_response_last_modified(response)
+          extract_response_last_modified(response, event)
           populate_response(response_data, event)
         rescue StandardError => e
           logger.error('Unable to convert response', e)
@@ -331,6 +347,7 @@ module Contrast
         # @param response_data [Hash] JSON of the response body from a Contrast::Agent::Reporting::ServerSettings event
         # @param response [Contrast::Agent::Reporting::Response] the object to populate with the body data
         def extract_server_settings response_data, response
+          response.server_features.telemetry = response_data[:telemetry] if response_data[:telemetry]
           extract_loggers(response_data, response)
           extract_protect_server_settings(response_data, response)
           extract_assess_server_settings(response_data, response)

data/lib/contrast/agent/reporting/reporting_workers/application_server_worker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/worker_thread'

data/lib/contrast/agent/reporting/reporting_workers/reporter_heartbeat.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/worker_thread'

data/lib/contrast/agent/reporting/reporting_workers/reporting_workers.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/reporting/reporting_workers/server_settings_worker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/worker_thread'

data/lib/contrast/agent/reporting/settings/application_settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/settings/assess'

data/lib/contrast/agent/reporting/settings/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/agent/reporting/settings/assess_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/agent/reporting/settings/assess_server_feature.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/agent/reporting/settings/bot_blocker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/reporting/settings/helpers'

data/lib/contrast/agent/reporting/settings/exclusion_base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,43 +7,121 @@ module Contrast
       module Settings
         # Base class to represent common exclusions fields.
         class ExclusionBase
-          BASE_ATTRIBUTES = %i[name modes assess_rules protect_rules].cs__freeze
+          BASE_ATTRIBUTES = %i[name modes assess_rules protect_rules urls match_strategy].cs__freeze
+          STRATEGIES = %w[ALL ONLY].cs__freeze
 
+          # Base attribute for exclusion name.
+          # For ng response it corresponds only for the name of the exclusion,
+          # in the new server settings endpoint it is used to store the name
+          # of the input to be excluded.
+          #
           # @return name [String]
           attr_accessor :name
           # @return modes [Array<String>]
           attr_accessor :modes
-          # @return assess_rules [Array<String>]
-          attr_accessor :assess_rules
-          # @return protect_rules [Array<String>]
-          attr_accessor :protect_rules
+          # @return urls [Array<String>]
+          attr_accessor :urls
 
           def initialize
             @modes = []
-            @assess_rules = []
-            @protect_rules = []
+            @urls = []
           end
 
-          # @return [Boolean] does this exclusion apply to Assess or not
+          # @return match_strategy [String] The type of the input.
+          def match_strategy
+            @_match_strategy ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # @param new_strategy [String] Set new input type.
+          # @return type [String] The type of the input.
+          def match_strategy= new_strategy
+            @_match_strategy = new_strategy if STRATEGIES.include?(new_strategy)
+          end
+
+          # @return [Boolean] does this exclusion apply to Assess or not.
           def assess
             @_assess = modes&.include?('assess') if @_assess.nil?
             @_assess
           end
 
-          # @return [Boolean] does this exclusion apply to Protect or not
+          # @return [Boolean] does this exclusion apply to Protect or not.
           def protect
             @_protect = modes&.include?('defend') if @_protect.nil?
             @_protect
           end
 
+          # Array of all excluded protect rules.
+          #
+          # @return [Array<String>]
+          def protect_rules
+            @_protect_rules ||= rules
+          end
+
+          # Setter for protect rules array.
+          #
+          # @param new_rules [Array<String>]
+          # @return [Array<String>]
+          def protect_rules= new_rules
+            @_protect_rules = new_rules if new_rules.cs__is_a?(Array)
+          end
+
+          # Array of all excluded assess rules.
+          #
+          # @return [Array<String>]
+          def assess_rules
+            @_assess_rules ||= assessment_rules
+          end
+
+          # Setter for assess rules array.
+          #
+          # @param new_rules [Array<String>]
+          # @return [Array<String>]
+          def assess_rules= new_rules
+            @_assess_rules = new_rules if new_rules.cs__is_a?(Array)
+          end
+
           def to_controlled_hash
             {
                 name: name, # rubocop:disable Security/Module/Name
                 modes: modes,
-                assessRules: assess_rules,
-                protectRules: protect_rules
+                urls: urls,
+                assess_rules: assess_rules,
+                protect_rules: protect_rules,
+                match_strategy: match_strategy
             }
           end
+
+          private
+
+          # Private getter for assess_rules used with application create response parsing.
+          #
+          # @return [Array<String>]
+          def assessment_rules
+            @_assessment_rules ||= []
+          end
+
+          # Private setter for assess_rules used with application create response parsing.
+          #
+          # @param new_rules [Array<String>]
+          # @return [Array<String>]
+          def assessment_rules= new_rules
+            @_assessment_rules = new_rules if new_rules.cs__is_a?(Array)
+          end
+
+          # Private getter for protect rules used with application create response parsing.
+          #
+          # @return [Array<String>]
+          def rules
+            @_rules ||= []
+          end
+
+          # Private setter for protect rules used with application create response parsing.
+          #
+          # @param new_rules [Array<String>]
+          # @return [Array<String>]
+          def rules= new_rules
+            @_rules = new_rules if new_rules.cs__is_a?(Array)
+          end
         end
       end
     end

data/lib/contrast/agent/reporting/settings/exclusions.rb

@@ -1,7 +1,6 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/agent/reporting/settings/code_exclusion'
 require 'contrast/agent/reporting/settings/input_exclusion'
 require 'contrast/agent/reporting/settings/url_exclusion'
 require 'contrast/agent/reporting/settings/helpers'
@@ -14,30 +13,6 @@ module Contrast
         # Application level settings for the Exclusions featureset
         # (ApplicationStartupSettingsExclusions)
         class Exclusions
-          # Cases where rules should be excluded if violated in a method call
-          #
-          # @return code_exclusions [Array<Contrast::Agent::Reporting::Settings::CodeExclusion>] Array of CodeExclusion
-          def code_exclusions
-            @_code_exclusions ||= []
-          end
-
-          # set the CodeExclusions array
-          #
-          # @param new_code_exclusions [Array<CodeExclusion>] Array of CodeExclusion: {
-          #   name         [String] The name of the exclusion as defined by the user in TS.
-          #   modes        [String] If this exclusion applies to assess or protect. [assess, defend]
-          #   protect_rules  [Array] Array of ProtectRuleID [String] The protect rules to which this exclusion applies.
-          #   assess_rules [Array] Array of assess rules to which this exclusion applies. AssessRuleID [String]
-          #   denylist     [String] The call, if in the stack, should result in the agent not taking action.
-          # }
-          # @return code_exclusions [Array<Contrast::Agent::Reporting::Settings::CodeExclusion>] Array of CodeExclusion
-          def code_exclusions= new_code_exclusions
-            @_code_exclusions = Contrast::Agent::Reporting::Settings::Helpers.array_to_iv(
-                Contrast::Agent::Reporting::Settings::CodeExclusion,
-                code_exclusions,
-                new_code_exclusions)
-          end
-
           # Cases where rules should be excluded if violated from a given input.
           #
           # @return input_exclusions [Array<Contrast::Agent::Reporting::Settings::InputExclusion>]
@@ -46,7 +21,8 @@ module Contrast
             @_input_exclusions ||= []
           end
 
-          # set the InputExclusions array
+          # set the InputExclusions array. Pass boolean flag as end element of array for ng endpoint.
+          # example: input_exclusions = [array, boolean]
           #
           # @param new_input_exclusions [Array<InputExclusions>] Array of InputExclusions: {
           #   name           [String] The name of the input.
@@ -60,10 +36,13 @@ module Contrast
           # @return input_exclusions [Array<Contrast::Agent::Reporting::Settings::InputExclusions>]
           # Array of InputExclusions
           def input_exclusions= new_input_exclusions
+            # The ng_endpoint check is passed as boolean parameter in the setter method. We need to check and see
+            # if it is set:
             @_input_exclusions = Contrast::Agent::Reporting::Settings::Helpers.array_to_iv(
                 Contrast::Agent::Reporting::Settings::InputExclusion,
                 input_exclusions,
-                new_input_exclusions)
+                new_input_exclusions,
+                ng_endpoint: new_input_exclusions[-1] == !!new_input_exclusions[-1])
           end
 
           # A case where rules should be excluded if violated during a call to a given URL.
@@ -73,7 +52,8 @@ module Contrast
             @_url_exclusions ||= []
           end
 
-          # set the UrlExclusions array
+          # set the url_exclusions array. Pass boolean flag as end element of array for ng endpoint.
+          # example: url_exclusions = [array, boolean]
           #
           # @param new_url_exclusions [Array] Array of UrlExclusions: {
           #   name           [String] The name of the input.
@@ -89,12 +69,12 @@ module Contrast
             @_url_exclusions = Contrast::Agent::Reporting::Settings::Helpers.array_to_iv(
                 Contrast::Agent::Reporting::Settings::UrlExclusion,
                 url_exclusions,
-                new_url_exclusions)
+                new_url_exclusions,
+                ng_endpoint: new_url_exclusions[-1] == !!new_url_exclusions[-1])
           end
 
           def to_controlled_hash
             {
-                codeExceptions: code_exclusions.map(&:to_controlled_hash),
                 inputExceptions: input_exclusions.map(&:to_controlled_hash),
                 urlExceptions: url_exclusions.map(&:to_controlled_hash)
             }

data/lib/contrast/agent/reporting/settings/helpers.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,6 +8,15 @@ module Contrast
         # Helper methods used across the settings.
         module Helpers
           class << self
+            # Known exclusion, we need different result, or just memo the output,
+            # saving computing time. Reason to exist: different endpoints require different
+            # attributes.
+            NO_MORE_UNDERSCORE_EXCLUSIONS = {
+                protect_rules: :rules,
+                assess_rules: :assessmentRules,
+                match_strategy: :matchStrategy
+            }.cs__freeze
+
             # Fills instance variable [Array] with new settings as new instance type
             # for each entry.
             #
@@ -17,14 +26,24 @@ module Contrast
             # @param array [Array] array to be used to fill the iv.
             # fill the iv with the new type containing data from the provided array
             # param.
+            # @param ng_endpoint [Boolean]
             # @return instance_variable [Class]
-            def array_to_iv instance_type, instance_variable, array
+            def array_to_iv instance_type, instance_variable, array, ng_endpoint: false
               return unless array.is_a?(Array)
 
-              array.each_with_index do |entry, index|
+              # If we have a ng endpoint we have passed a boolean flag as param to the setter for the
+              # array, and we need to retrieve the original array.
+              payload = if ng_endpoint
+                          array[0]
+                        else
+                          array
+                        end
+
+              payload.each_with_index do |entry, index|
                 new_instance = instance_type.new
                 instance_type::ATTRIBUTES.each do |attr|
-                  new_instance.send("#{ attr }=".to_sym, entry[no_more_underscore(attr)])
+                  key = ng_attribute_filter(attr, ng_endpoint: ng_endpoint)
+                  new_instance.send("#{ attr }=".to_sym, entry[key])
                 end
                 instance_variable[index] = new_instance
               end
@@ -36,7 +55,7 @@ module Contrast
             # return original if no '_'
             #
             # @param attr_name [Symbol]
-            # @return normalized_name [Symbol]
+            # @return normalized_name [Symbol, nil]
             def no_more_underscore attr_name
               name = attr_name.to_s
               idx = name.index('_')
@@ -49,6 +68,23 @@ module Contrast
               result.index('_') ? no_more_underscore(result).to_sym : result.to_sym
             end
 
+            # Ng endpoints payload is different for exclusions.
+            # This method will filter the attributes needed for each
+            # each endpoint.
+            #
+            # @param attr_name [Symbol]
+            # @param ng_endpoint [Boolean]
+            # @return [Symbol, nil]
+            def ng_attribute_filter attr_name, ng_endpoint: false
+              if NO_MORE_UNDERSCORE_EXCLUSIONS.key?(attr_name)
+                return NO_MORE_UNDERSCORE_EXCLUSIONS[attr_name] if ng_endpoint
+
+                return attr_name
+              end
+
+              no_more_underscore(attr_name)
+            end
+
             # rule_id => rule-id
             #
             # @param id [String, Symbol]