contrast-agent 6.2.0 → 6.5.0

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -6,6 +6,7 @@ require 'contrast/components/agent'
 require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/utils/thread_tracker'
+require 'contrast/utils/assess/event_limit_utils'
 require 'contrast/utils/assess/split_utils'
 require 'contrast/agent/assess/events/event_data'
 
@@ -20,6 +21,7 @@ module Contrast
             extend Contrast::Components::Scope::InstanceMethods
             extend Contrast::Components::Logger::InstanceMethods
             extend Contrast::Utils::Assess::SplitUtils
+            extend Contrast::Utils::Assess::EventLimitUtils
 
             SPLIT_TRACKER = Contrast::Utils::ThreadTracker.new
 
@@ -42,6 +44,7 @@ module Contrast
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
 
                 update_element_properties(propagation_node, target, preshift, source_properties)
+                increment_event_count(propagation_node)
                 nil
               end
 

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -7,6 +7,7 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/source_method_utils'
+require 'contrast/utils/assess/event_limit_utils'
 require 'contrast/agent/assess/events/event_data'
 
 module Contrast
@@ -19,6 +20,7 @@ module Contrast
         module SourceMethod
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::SourceMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
           PARAMETER_TYPE     = 'PARAMETER'
           PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
@@ -35,30 +37,18 @@ module Contrast
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            # @return [Object, nil] the tracked Return or nil if no changes were made
             def apply_source method_policy, object, ret, args
               return unless analyze?(method_policy, object, ret, args)
+              return if event_limit?(method_policy)
               return unless (source_node = method_policy.source_node)
 
               # used to hold the object and ret
               source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
-              return unless (target = determine_target(source_node, source_data, args))
-
-              return_val = nil
-              if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
-                return unless ::Contrast::ASSESS.track_frozen_sources?
-                return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
-                return unless (dup = safe_dup(source_data.ret))
-                return unless Contrast::Agent::Assess::Tracker.trackable?(dup)
 
-                Contrast::Agent::Assess::Tracker.pre_freeze(dup)
-                return_val = dup.cs__freeze
-                target = dup
-              end
+              return unless (target = determine_target(source_node, source_data, args))
+              return if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
 
               process_source(source_node, target, source_data, source_node.type, nil, *args)
-
-              return_val
             end
             Contrast::Components::Logger.add_trace_log_timing_for(SourceMethod, :apply_source)
 
@@ -79,6 +69,8 @@ module Contrast
               context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
+              increment_event_count(source_node)
+
               source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
@@ -108,42 +100,10 @@ module Contrast
             #   map
             # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_hash_tags source_node, target, source_data, source_type, *args
-              to_replace = []
               target.each_pair do |key, value|
-                # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
-                # hash lookup and, therefore, the application
-                if replace_hash_key?(key, target)
-                  key = key.dup
-                  to_replace << key
-                end
                 process_source(source_node, key, source_data, key_type(source_type), key, *args)
                 process_source(source_node, value, source_data, source_type, key, *args)
               end
-              handle_hash_key(target, to_replace)
-            end
-
-            # Given an unfrozen hash, if the key is a String, we should replace it with one that we can finalize,
-            # allowing us to track that key. This method handles checking if that replace can and should occur.
-            #
-            # @param key [Object] the key in the hash that may need replacing.
-            # @param hash [Hash] the hash to which the key belongs.
-            # @return [Boolean] whether replace the key in the hash or not.
-            def replace_hash_key? key, hash
-              ::Contrast::ASSESS.track_frozen_sources? &&
-                  !hash.cs__frozen? &&
-                  key.is_a?(String) &&
-                  !Contrast::Agent::Assess::Tracker.trackable?(key)
-            end
-
-            # Hash is designed to keep one instance of the string key in it. We need to remove the existing one and
-            # replace it with our new tracked one.
-            def handle_hash_key target, to_replace
-              to_replace.each do |key|
-                Contrast::Agent::Assess::Tracker.pre_freeze(key)
-                key.cs__freeze
-                value = target.delete(key)
-                target[key] = value
-              end
             end
 
             # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -35,6 +35,7 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source and type
+          # @raise[ArgumentError] raises if any of the required fields is missing or invalid
           def validate
             super
             raise(ArgumentError, "Source #{ id } did not have a proper target. Unable to create.") unless targets&.any?

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -25,6 +25,7 @@ module Contrast
         module TriggerMethod # rubocop:disable Metrics/ModuleLength
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::TriggerMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
           # The level of TeamServer compliance our traces meet when in the abnormal condition of being dataflow rules
           # without routes.
@@ -48,6 +49,7 @@ module Contrast
             # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
+              return if event_limit_for_rule?(trigger_node.rule_id)
 
               context = Contrast::Agent::REQUEST_TRACKER.current
               # return if there is no context and the flag is set to default => false
@@ -102,6 +104,12 @@ module Contrast
               request = find_request(source)
               return unless reportable?(request&.env)
 
+              process_reportable_finding(trigger_node, source, object, ret, request, *args)
+            rescue StandardError => e
+              logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
+            end
+
+            def process_reportable_finding trigger_node, source, object, ret, request, *args
               if Contrast::Agent::Reporter.enabled?
                 handle_new_finding(trigger_node, source, object, ret, request, *args)
               else # TODO: RUBY-1438 -- remove
@@ -112,8 +120,6 @@ module Contrast
                                                 rule: trigger_node.rule_id)
                 report_finding(finding, request)
               end
-            rescue StandardError => e
-              logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
 
             # Given a finding, append it to an activity message and send it to the Service for processing. If an
@@ -211,7 +217,7 @@ module Contrast
 
               build_events(finding, properties.event) if properties.event
 
-              # Google::Protobuf::Map doesn't support merge!, so we have to do this long form
+              # CSGoogle::Protobuf::Map doesn't support merge!, so we have to do this long form
               source_props = properties.properties
               return unless source_props
 

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -4,6 +4,7 @@
 require 'contrast/agent/assess/policy/trigger/reflected_xss'
 require 'contrast/agent/assess/policy/trigger/xpath'
 require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -15,6 +16,8 @@ module Contrast
         # vulnerability (indicate points in the application where uncontrolled
         # user input can do damage).
         class TriggerNode < PolicyNode # rubocop:disable Metrics/ClassLength
+          include Contrast::Components::Logger::InstanceMethods
+
           JSON_BAD_VALUE = 'bad_value'
           JSON_GOOD_VALUE = 'good_value'
           JSON_DISALLOWED_TAGS = 'disallowed_tags'
@@ -59,6 +62,9 @@ module Contrast
             @trigger_method = trigger_hash['trigger_method']
             @trigger_method = @trigger_method.to_sym if @trigger_method
             validate
+          rescue ArgumentError => e
+            logger.error('Trigger Node initialization failed with: ', e)
+            nil
           end
 
           def node_class
@@ -143,6 +149,7 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source
+          # @raise[ArgumentError] raises if any of the required fields is invalid or missing
           def validate
             super
             # If this isn't a dataflow rule, it can't have a source
@@ -172,6 +179,7 @@ module Contrast
             @disallowed_tags << (VALIDATOR_START + loud_name)
           end
 
+          # @raise[ArgumentError] raises if any of the tags is invalid
           def validate_rule_tags tags
             return unless tags
 

data/lib/contrast/agent/assess/property/evented.rb

@@ -42,27 +42,13 @@ module Contrast
             return unless event.source_type
             return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
 
-            append_to_dtm(current_request, event)
             append_to_ruby_object(current_request, event)
           end
 
-          def append_to_dtm current_request, event
-            if current_request.observed_route.sources.any? do |source|
-                 source.type == event.forced_source_type &&
-                       source.name == event.forced_source_name # rubocop:disable Security/Module/Name
-               end
-
-              return
-            end
-
-            event_source_dtm = event.build_event_source_dtm
-            return unless event_source_dtm
-
-            current_request.observed_route.sources << event_source_dtm
-          end
-
+          # @param current_request [Contrast::Agent::RequestContext]
+          # @param event [Contrast::Agent::Assess::Events::ContrastEvent]
           def append_to_ruby_object current_request, event
-            if current_request.new_observed_route.sources.any? do |source|
+            if current_request.observed_route.sources.any? do |source|
               source.type == event.forced_source_type &&
                     source.name == event.forced_source_name # rubocop:disable Security/Module/Name
             end
@@ -73,7 +59,7 @@ module Contrast
             event_source = event.build_event_source
             return unless event_source
 
-            current_request.new_observed_route.sources << event_source
+            current_request.observed_route.sources << event_source
           end
         end
       end

data/lib/contrast/agent/assess/tag.rb

@@ -1,12 +1,16 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Assess
       # A Tag represents a range in a given piece of data. It is used by the
       # Agent to determine if a vulnerable dataflow has occurred.
       class Tag
+        include Contrast::Components::Logger::InstanceMethods
+
         attr_reader :label,     # the label of this tag
                     :length,    # length of tagged text within string
                     :start_idx, # start of range
@@ -35,6 +39,8 @@ module Contrast
         def initialize label, length, start_idx = 0
           @label = label
           update_range(start_idx, start_idx + length)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Return true if the tag covers the given position in the string
@@ -74,22 +80,32 @@ module Contrast
 
         def shift idx
           update_range(@start_idx + idx, @end_idx + idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def shift_end idx
           update_range(@start_idx, @end_idx + idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def update_start start_idx
           update_range(start_idx, @end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def update_end end_idx
           update_range(@start_idx, end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         def repurpose start_idx, end_idx
           update_range(start_idx, end_idx)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Given a tag, merge its ranges with this one
@@ -104,6 +120,8 @@ module Contrast
           start = other.start_idx < @start_idx ? other.start_idx : @start_idx
           finish = other.end_idx > @end_idx ? other.end_idx : @end_idx
           update_range(start, finish)
+        rescue ArgumentError => e
+          logger.error('Range update for Tag failed with: ', e)
         end
 
         # Modification to tracked String can change the position and length of the tracked tag
@@ -160,6 +178,7 @@ module Contrast
 
         private
 
+        # @raise[ArgumentError] raises if start_idx is negative or the end_idx is smaller than the start_idx
         def update_range start_idx, end_idx
           raise(ArgumentError, ERROR_NEGATIVE_START) if start_idx.negative?
           raise(ArgumentError, ERROR_END_BEFORE_START) if end_idx < start_idx

data/lib/contrast/agent/assess/tracker.rb

@@ -12,6 +12,7 @@ module Contrast
       # have tightly coupled dependencies on each other.
       class Tracker
         PROPERTIES_HASH = Contrast::Agent::Assess::Finalizers::Hash.new
+        KEEP_AGE = 600_000.cs__freeze # 10 minutes
 
         class << self
           # Retrieve the properties of the given Object, iff they exist.
@@ -55,6 +56,17 @@ module Contrast
           def copy source, target
             PROPERTIES_HASH[target] ||= properties(source).dup
           end
+
+          # Clean PROPERTIES_HASH of any values older than KEEP_AGE ms or
+          # have nil properties
+          def cleanup!
+            PROPERTIES_HASH.delete_if do |_k, properties|
+              return true if properties.nil?
+              return false unless (event = properties&.event)
+
+              KEEP_AGE <= (Contrast::Utils::Timer.now_ms - event.time)
+            end
+          end
         end
       end
     end

data/lib/contrast/agent/at_exit_hook.rb

@@ -31,16 +31,16 @@ module Contrast
         context = Contrast::Agent::REQUEST_TRACKER.current
         return unless context
 
-        Contrast::Agent.reporter.send_event_immediately(context.observed_library_usage)
+        [
+          Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage,
+          context.observed_route
+        ].compact.each do |event|
+          Contrast::Agent.reporter&.send_event_immediately(event)
+        end
 
         if Contrast::Agent::Reporter.enabled?
-          [
-            context.new_observed_route,
-            Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
-            Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
-          ].each do |event|
-            Contrast::Agent.reporter&.send_event_immediately(event)
-          end
+          event = Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
+          Contrast::Agent.reporter&.send_event_immediately(event)
         else
           Contrast::Agent.messaging_queue&.send_event_immediately(context.activity)
         end

data/lib/contrast/agent/inventory/database_config.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/reporting_events/architecture_component'
 require 'contrast/api/decorators/architecture_component'
 require 'contrast/components/logger'
 require 'contrast/utils/object_share'
@@ -25,10 +26,11 @@ module Contrast
 
         class << self
           # Append the available database connection information to the message being sent to TeamServer. This message
-          # may be a Contrast::Api::Dtm::Activity or Contrast::Api::Dtm::ApplicationUpdate. Both report the same
+          # may be a Contrast::Api::Dtm::Activity or Contrast::Agent::Reporting::ApplicationUpdate.
+          # Both report the same
           # Contrast::Api::Dtm::ArchitectureComponent, but have different names for their fields.
           #
-          # @param activity_or_update [Contrast::Api::Dtm::Activity, Contrast::Api::Dtm::ApplicationUpdate]
+          # @param activity_or_update [Contrast::Api::Dtm::Activity, Contrast::Agent::Reporting::ApplicationUpdate]
           # @param hash_or_str [Hash, String] the database connection information
           def append_db_config activity_or_update, hash_or_str = active_record_config
             arr = build_from_db_config(hash_or_str)
@@ -40,7 +42,8 @@ module Contrast
               if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
                 activity_or_update.architectures << a
               else
-                activity_or_update.components << a
+                converted_comp = Contrast::Agent::Reporting::ArchitectureComponent.convert(a)
+                activity_or_update.components << converted_comp
               end
             end
           rescue StandardError => e

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/reporting_events/library_discovery'
 require 'contrast/agent/inventory/dependencies'
 require 'contrast/utils/object_share'
 
@@ -14,17 +15,17 @@ module Contrast
 
         # Report the dependencies of this application
         #
-        # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
+        # @return [Array<Contrast::Agent::Reporting::LibraryDiscovery>] direct report form of
         #   Gem::Specification that have been loaded for this application.
         def library_pb_list
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enabled?
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enable
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries
 
           loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
             next unless spec
             next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
 
-            reported_lib_list << Contrast::Api::Dtm::Library.build(digest, spec)
+            reported_lib_list << Contrast::Agent::Reporting::LibraryDiscovery.new(digest, spec)
           end
         end
       end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -52,7 +52,6 @@ module Contrast
           return unless enabled?
 
           spec_lookup_path = adjust_path_for_spec_lookup(path)
-
           spec = Gem::Specification.find_by_path(spec_lookup_path)
           unless spec
             logger.debug('Unable to resolve gem spec for path', path: path)
@@ -70,15 +69,13 @@ module Contrast
           logger.error('Unable to inventory file path', e, path: path)
         end
 
-        # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache.
+        # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache. If
+        # no libraries had files loaded, or inventory analysis is disabled, return nil instead.
         #
-        # TODO: RUBY-1355
-        # TODO: RUBY-1438 -- change to just use EventMessage
-        # @param observed_library_usage [Contrast::Agent::Reporting::ObservedLibraryUsage] the message to
-        #   which to append the usage data
-        def generate_library_usage observed_library_usage
+        # @return [Contrast::Agent::Reporting::ObservedLibraryUsage, nil]
+        def generate_library_usage
           return unless enabled?
-          return unless observed_library_usage
+          return unless @gemdigest_cache.any?
 
           # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
           # assignment and the replace
@@ -87,12 +84,15 @@ module Contrast
             @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
             hold
           end
+
+          observed_library_usage = Contrast::Agent::Reporting::ObservedLibraryUsage.new
           gem_spec_digest_to_files.each_pair do |digest, files|
-            usage = Contrast::Agent::Reporting::LibraryUsageObservation.new(digest, files)
-            next if usage.names.empty?
+            next unless files.any?
 
+            usage = Contrast::Agent::Reporting::LibraryUsageObservation.new(digest, files)
             observed_library_usage.observations << usage
           end
+          observed_library_usage.observations.any? ? observed_library_usage : nil
         rescue StandardError => e
           logger.error('Unable to generate library usage.', e)
         end
@@ -111,7 +111,7 @@ module Contrast
 
         # We only use this if inventory and library analysis are enabled
         def enabled?
-          @_enabled = ::Contrast::INVENTORY.enabled? && ::Contrast::INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled = ::Contrast::INVENTORY.enable && ::Contrast::INVENTORY.analyze_libraries if @_enabled.nil?
           @_enabled
         end
       end

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -21,7 +21,7 @@ module Contrast
             DATA_STORE_MARKER = 'data_store'
 
             def report_data_store _method, _exception, properties, object, _args
-              return unless ::Contrast::INVENTORY.enabled?
+              return unless ::Contrast::INVENTORY.enabled
 
               marker = properties[DATA_STORE_MARKER]
               return unless marker

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -19,7 +19,7 @@ module Contrast
           end
 
           def disabled_globally?
-            !::Contrast::INVENTORY.enabled?
+            !::Contrast::INVENTORY.enable
           end
 
           def node_type

data/lib/contrast/agent/middleware.rb

@@ -142,6 +142,8 @@ module Contrast
       #
       # @param context [Contrast::Agent::RequestContext]
       # @param request_handler [Contrast::Agent::RequestHandler]
+      # @raise [StandardError] raises an error if the exception is security concern
+      #    which is being triggered when there is a failure within the pre-call with the agent
       def pre_call_with_agent context, request_handler
         with_contrast_scope do
           context.service_extract_request
@@ -160,6 +162,8 @@ module Contrast
       #   this Request
       # @param request_handler [Contrast::Agent::RequestHandler]
       # @param response [Array,Rack::Response]
+      # @raise [StandardError] raises an error if the exception is security concern
+      #    which is being triggered when there is a failure within the post-call with the agent
       def post_call_with_agent context, env, request_handler, response
         with_contrast_scope do
           context.extract_after(response) # update context with final response information

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -5,6 +5,8 @@ require 'contrast/agent/patching/policy/after_load_patch'
 require 'contrast/components/logger'
 require 'contrast/framework/manager'
 require 'contrast/extension/extension'
+require 'contrast/extension/assess/kernel'
+require 'contrast/extension/assess/marshal'
 
 module Contrast
   module Agent
@@ -29,22 +31,31 @@ module Contrast
           # there are no require time side effects of loading our core
           # extensions.
           def apply_direct_patches!
-            @_apply_direct_patches ||= begin # TODO: RUBY-1541 - put 'kernel' back
+            @_apply_direct_patches ||= begin
               paths = %w[
                 array
                 basic_object
                 module
                 fiber_track
                 hash
+                kernel
                 marshal_module
                 regexp
                 string
-                string_interpolation26
+                string_interpolation
               ].cs__freeze
               paths.each do |p|
                 path_part = "cs__assess_#{ p }"
                 Contrast::Extension::Assess::InstrumentHelper.instrument("#{ path_part }/#{ path_part }")
               end
+              # apply Kernel#exec alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Kernel, :exec, false)
+                apply_kernel_exec_alias_patch
+              end
+              # apply Marshal load alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Marshal, :load, false)
+                apply_marshal_load_alias_patch
+              end
               true
             end
           end
@@ -96,6 +107,20 @@ module Contrast
             patch.instrument!
             after_load_patches.delete_if(&:applied?)
           end
+
+          # Applies the Kernel#exec alias patch
+          def apply_kernel_exec_alias_patch
+            Kernel.extend(Contrast::Extension::Assess::ContrastKernel)
+            Marshal.alias_method(:cs__kernel_exec, :exec)
+            Marshal.alias_method(:exec, :cs__kernel_exec)
+          end
+
+          # Applies the Marshal#load alias patch
+          def apply_marshal_load_alias_patch
+            Marshal.extend(Contrast::Extension::Assess::ContrastMarshal)
+            Marshal.alias_method(:cs__marshal_load, :load)
+            Marshal.alias_method(:load, :cs__marshal_load)
+          end
         end
       end
     end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -17,9 +17,9 @@ module Contrast
           #
           # @param method_policy [Hash]
           #  {
-          #   source_node       [ Contrast::Agent::Assesss::Policy::SourceNode      ]
-          #   propagation_node  [ Contrast::Agent::Assesss::Policy::PropagationNode ]
-          #   trigger_node      [ Contrast::Agent::Assesss::Policy::TriggerNode     ]
+          #   source_node       [ Contrast::Agent::Assess::Policy::SourceNode      ]
+          #   propagation_node  [ Contrast::Agent::Assess::Policy::PropagationNode ]
+          #   trigger_node      [ Contrast::Agent::Assess::Policy::TriggerNode     ]
           #   inventory_node    [ Contrast::Agent::Inventory::Policy::TriggerNode   ]
           #   protect_node      [ Contrast::Agent::Protect::Policy::TriggerNode     ]
           #   deadzone_node     [ Contrast::Agent::Deadzone::Policy::DeadzoneNode   ]

data/lib/contrast/agent/patching/policy/policy.rb

@@ -35,16 +35,21 @@ module Contrast
           end
 
           # Indicates the folder in `resources` where this policy lives.
+          #
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def self.policy_folder
             raise(NoMethodError, 'specify policy_folder for patching')
           end
 
           # Indicates is this feature has been disabled by the configuration, read at startup, and therefore can never
           # be enabled.
+          #
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def disabled_globally?
             raise(NoMethodError, 'specify disabled_globally? conditions for patching')
           end
 
+          # @raise[NoMethodError] raises if any of the subclasses, extending this class is not implementing this method
           def node_type
             raise(NoMethodError, 'specify the concrete node type for this poilcy')
           end