contrast-agent 4.11.0 → 4.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ad97d601b81e16e1d0263d86b60a3acd0e5a5ff9cb3f42598c262774a518169
-  data.tar.gz: 749f87aefffd1e1504834dc7f919d45280cf560a20805184757dd9f6bda97477
+  metadata.gz: 6a0a50913c5c680462f9afd79070ca1f3d46d09d66ffdb943b1dc778f84830d6
+  data.tar.gz: bb3254c6a2cdc2b4add4e09b4bf1ed63c6a640f0dd82824db2769b911aacf96b
 SHA512:
-  metadata.gz: cfa15549565b4f17c431332c7bc7c6fe84bd5bea321860db84f24a2df5e2d5241675200ed6e50ebe53fc319d94ade6ebfed26fe664fc297dde54a1fc9f645fda
-  data.tar.gz: 017f02883faee2d281b7b052844653ddbb744fa27f02cf5739c38e50256eb054effb966c5b35b79b05e7d3af62f35d90509352f5c4327c9474e936c7e740ef19
+  metadata.gz: 78d5e66ee3ab7408e94348f6c2998e73cd78227a8b75cffa7add261b771092d470431ce8e44357dfb7d1a178e03e5033efc9f7a4c974a979f9dea88b2c55a3ec
+  data.tar.gz: d20f41b563778d84e63e4db7a9399e666a85fe1a2343772258f5248cd139f02e6a6bea33e51d9e5a0f954b1e2b4683ec08f3db7a52ab5a6990f7d725d2bc3dea

data/ext/cs__common/cs__common.c

@@ -73,11 +73,20 @@ VALUE contrast_register_singleton_patch(const char *module_name,
                                     IMPL_ALIAS_SINGLETON);
 }
 
-VALUE contrast_register_singleton_prepend_patch(
-    const char *module_name, const char *method_name,
-    VALUE(c_fn)(const int, VALUE *, const VALUE)) {
+VALUE contrast_register_prepend_patch(const char *module_name,
+                              const char *method_name,
+                              VALUE(c_fn)(const int, VALUE *,
+                                          const VALUE)) {
+    return _contrast_register_patch(module_name, method_name, c_fn,
+                                    IMPL_PREPEND_INSTANCE);
+}
+
+VALUE contrast_register_singleton_prepend_patch(const char *module_name,
+                              const char *method_name,
+                              VALUE(c_fn)(const int, VALUE *,
+                                          const VALUE)) {
     return _contrast_register_patch(module_name, method_name, c_fn,
-                                    IMPL_PREPEND);
+                                    IMPL_PREPEND_SINGLETON);
 }
 
 static VALUE
@@ -122,8 +131,10 @@ _contrast_register_patch(const char *module_name, const char *method_name,
     case IMPL_ALIAS_SINGLETON:
         impl = ID2SYM(rb_sym_alias_singleton);
         break;
-    case IMPL_PREPEND:
-        impl = ID2SYM(rb_sym_prepend);
+    case IMPL_PREPEND_INSTANCE:
+        impl = ID2SYM(rb_sym_prepend_instance);
+    case IMPL_PREPEND_SINGLETON:
+         impl = ID2SYM(rb_sym_prepend_singleton);
         break;
     }
 
@@ -152,7 +163,8 @@ void Init_cs__common(void) {
     rb_sym_register_c_patch = rb_intern("register_c_patch");
     rb_sym_alias_instance = rb_intern("alias_instance");
     rb_sym_alias_singleton = rb_intern("alias_singleton");
-    rb_sym_prepend = rb_intern("prepend");
+    rb_sym_prepend_instance = rb_intern("prepend_instance");
+    rb_sym_prepend_singleton = rb_intern("prepend_singleton");
 
     /* Ensure definition of core Contrast instrumentation modules */
     contrast = rb_define_module("Contrast");

data/ext/cs__common/cs__common.h

@@ -6,7 +6,8 @@
 typedef enum {
     IMPL_ALIAS_INSTANCE,
     IMPL_ALIAS_SINGLETON,
-    IMPL_PREPEND
+    IMPL_PREPEND_INSTANCE,
+    IMPL_PREPEND_SINGLETON,
 } patch_impl;
 
 static VALUE cs__send_method;
@@ -30,7 +31,8 @@ static VALUE rb_sym_instance_method;
 static VALUE rb_sym_register_c_patch;
 static VALUE rb_sym_alias_instance;
 static VALUE rb_sym_alias_singleton;
-static VALUE rb_sym_prepend;
+static VALUE rb_sym_prepend_instance;
+static VALUE rb_sym_prepend_singleton;
 
 void patch_via_funchook(void *original_function, void *hook_function);
 

data/ext/cs__contrast_patch/cs__contrast_patch.c

@@ -182,7 +182,8 @@ VALUE contrast_run_patches(const VALUE *wrapped_args) {
                                   contrast_patch_call_rescue,
                                   (VALUE)rescue_args, rb_eException, 0);
         break;
-    case IMPL_PREPEND:
+    case IMPL_PREPEND_INSTANCE:
+    case IMPL_PREPEND_SINGLETON:
         original_ret = rb_rescue2(contrast_call_super, original_args,
                                   contrast_patch_call_rescue,
                                   (VALUE)rescue_args, rb_eException, 0);
@@ -247,10 +248,14 @@ VALUE contrast_patch_dispatch(const int argc, const VALUE *argv,
      */
     switch (impl) {
     case IMPL_ALIAS_INSTANCE:
-    case IMPL_PREPEND:
+    case IMPL_PREPEND_INSTANCE:
         known =
             rb_funcall(patch_status, rb_sym_info_for, 3, object, method, Qtrue);
         break;
+    case IMPL_PREPEND_SINGLETON:
+       known =
+           rb_funcall(patch_status, rb_sym_info_for, 3, object, method, Qfalse);
+       break;
     case IMPL_ALIAS_SINGLETON:
         known = rb_funcall(patch_status, rb_sym_info_for, 3, object, method,
                            Qfalse);
@@ -323,7 +328,8 @@ call_original:
     case IMPL_ALIAS_INSTANCE:
     case IMPL_ALIAS_SINGLETON:
         return contrast_patch_call_original(original_args);
-    case IMPL_PREPEND:
+    case IMPL_PREPEND_INSTANCE:
+    case IMPL_PREPEND_SINGLETON:
         return contrast_call_super(original_args);
     };
 }
@@ -338,9 +344,14 @@ VALUE contrast_alias_singleton_patch(const int argc, const VALUE *argv,
     return contrast_patch_dispatch(argc, argv, IMPL_ALIAS_SINGLETON, object);
 }
 
-VALUE contrast_prepend_patch(const int argc, const VALUE *argv,
+VALUE contrast_prepend_instance_patch(const int argc, const VALUE *argv,
                              const VALUE object) {
-    return contrast_patch_dispatch(argc, argv, IMPL_PREPEND, object);
+    return contrast_patch_dispatch(argc, argv, IMPL_PREPEND_INSTANCE, object);
+}
+
+VALUE contrast_prepend_singleton_patch(const int argc, const VALUE *argv,
+                             const VALUE object) {
+    return contrast_patch_dispatch(argc, argv, IMPL_PREPEND_SINGLETON, object);
 }
 
 VALUE contrast_patch_define_method(const VALUE self, const VALUE clazz, const VALUE method_policy,
@@ -403,26 +414,37 @@ VALUE contrast_patch_define_method(const VALUE self, const VALUE clazz, const VA
 VALUE contrast_patch_prepend(const VALUE self, const VALUE originalModule,
                              const VALUE method_policy) {
 
+    const VALUE instance = Qtrue;
+    const VALUE singleton = Qfalse;
     const VALUE original_method_name =
         rb_funcall(method_policy, rb_sym_method_name, 0);
     const VALUE is_private =
         rb_funcall(method_policy, rb_sym_private_method, 0);
     const VALUE is_instance_method =
         rb_funcall(method_policy, rb_sym_instance_method, 0);
-    rb_funcall(patch_status, rb_sym_set_info_for, 5, originalModule,
-               original_method_name, method_policy, Qtrue, Qnil);
+
+// Set the value for instance or singleton method
+    if (RTEST(is_instance_method)){
+        rb_funcall(patch_status, rb_sym_set_info_for, 5, originalModule,
+                   original_method_name, method_policy, instance, Qnil);
+
+    } else {
+        rb_funcall(patch_status, rb_sym_set_info_for, 5, originalModule,
+                   original_method_name, method_policy, singleton, Qnil);
+    }
+
     VALUE module = rb_define_module_under(originalModule, "ContrastPrepend");
     VALUE str = rb_funcall(original_method_name, rb_sym_cs_to_s, 0);
     char *cMethodName = StringValueCStr(str);
     if (RTEST(is_instance_method)) {
         if (RTEST(is_private)) {
             rb_define_private_method(module, cMethodName,
-                                     contrast_prepend_patch, -1);
+                                     contrast_prepend_instance_patch, -1);
         } else {
-            rb_define_method(module, cMethodName, contrast_prepend_patch, -1);
+            rb_define_method(module, cMethodName, contrast_prepend_instance_patch, -1);
         }
     } else {
-        rb_define_singleton_method(module, cMethodName, contrast_prepend_patch,
+        rb_define_singleton_method(module, cMethodName, contrast_prepend_singleton_patch,
                                    -1);
     }
     rb_prepend_module(originalModule, module);

data/ext/cs__contrast_patch/cs__contrast_patch.h

@@ -146,8 +146,11 @@ VALUE contrast_alias_instance_patch(const int argc, const VALUE *argv,
 VALUE contrast_alias_singleton_patch(const int argc, const VALUE *argv,
                                      const VALUE object);
 
-VALUE contrast_prepend_patch(const int argc, const VALUE *argv,
-                             const VALUE object);
+VALUE contrast_prepend_instance_patch(const int argc, const VALUE *argv,
+                                    const VALUE object);
+
+VALUE contrast_prepend_singleton_patch(const int argc, const VALUE *argv,
+                                     const VALUE object);
 
 /*
  * Patches a module's method by prepend:

data/lib/contrast/agent/assess/contrast_event.rb

@@ -54,7 +54,7 @@ module Contrast
 
           # These methods rely on the above being set. Don't move them!
           @event_id = Contrast::Agent::Assess::ContrastEvent.next_atomic_id
-          @tags = Contrast::Agent::Assess::Tracker.properties(tagged)&.tags
+          @tags = Contrast::Agent::Assess::Tracker.properties(tagged)&.get_tags
           find_parent_events!(policy_node, object, ret, args)
           snapshot!(object, ret, args)
           capture_stacktrace!

data/lib/contrast/agent/assess/contrast_object.rb

@@ -35,7 +35,7 @@ module Contrast
           if object
             @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
             @object_type = object.cs__class.cs__name
-            @tags = Contrast::Agent::Assess::Tracker.properties(object)&.tags
+            @tags = Contrast::Agent::Assess::Tracker.properties(object)&.get_tags
           else
             @object = Contrast::Utils::ObjectShare::NIL_STRING
             @object_type = nil.cs__class.cs__name

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -24,6 +24,8 @@ module Contrast
             #   the name of the method to taint, mapped to the properties it
             #   should apply
             def create_sources klass, tainted_columns
+              return unless Contrast::ASSESS.require_dynamic_sources?
+
               class_name = klass.cs__name
               instance_methods = klass.instance_methods
               instance_methods.concat(klass.private_instance_methods)

data/lib/contrast/agent/assess/policy/preshift.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
+require 'contrast/utils/lru_cache'
 
 module Contrast
   module Agent
@@ -12,6 +13,7 @@ module Contrast
         include Contrast::Components::Logger::InstanceMethods
         extend Contrast::Components::Logger::InstanceMethods
 
+        @lru_cache = Contrast::Utils::LRUCache.new
         UNDUPLICABLE_MODULES = [
           Enumerator # dup'ing results in 'can't copy execution context'
         ].cs__freeze
@@ -70,16 +72,23 @@ module Contrast
 
           def append_object_details preshift, initializing, object
             can = can_dup?(initializing, object)
-            preshift.object = can ? object.dup : object
+            preshift.object = if @lru_cache.key?(object.__id__) && !Contrast::Agent::Assess::Tracker.tracked?(object)
+                                @lru_cache[object.__id__]
+                              else
+                                can ? object.dup : object
+                              end
             preshift.object_length = if Contrast::Utils::DuckUtils.quacks_to?(preshift.object, :length)
                                        object.length
                                      else
                                        0
                                      end
+
             return unless can
+
             return unless Contrast::Agent::Assess::Tracker.tracked?(object)
 
             Contrast::Agent::Assess::Tracker.copy(object, preshift.object)
+            @lru_cache[object.__id__] = object
           end
 
           def append_arg_details preshift, args
@@ -88,15 +97,19 @@ module Contrast
             preshift.arg_lengths = Array.new(args_length)
             idx = 0
             while idx < args_length
-              original_arg = args[idx]
-              p_arg = can_dup?(false, original_arg) ? original_arg.dup : original_arg
+              or_arg = args[idx]
+              p_arg = if @lru_cache.key?(or_arg.__id__)
+                        @lru_cache[or_arg.__id__]
+                      else
+                        can_dup?(false, or_arg) ? or_arg.dup : or_arg
+                      end
               preshift.args[idx] = p_arg
               preshift.arg_lengths[idx] = Contrast::Utils::DuckUtils.quacks_to?(p_arg, :length) ? p_arg.length : 0
               idx += 1
-              next if p_arg.__id__ == original_arg.__id__
-              next unless Contrast::Agent::Assess::Tracker.tracked?(original_arg)
+              next if p_arg.__id__ == or_arg.__id__
 
-              Contrast::Agent::Assess::Tracker.copy(original_arg, p_arg)
+              Contrast::Agent::Assess::Tracker.copy(or_arg, p_arg)
+              @lru_cache[p_arg.__id__] = p_arg
             end
           end
         end

data/lib/contrast/agent/assess/policy/propagator/database_write.rb

@@ -13,6 +13,8 @@ module Contrast
           class DatabaseWrite < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
               def propagate propagation_node, preshift, target
+                return unless Contrast::ASSESS.require_dynamic_sources?
+
                 class_type = preshift.object.cs__class
                 class_name = class_type.cs__name
                 tainted_columns = {}

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -14,7 +14,7 @@ module Contrast
         # specifically for those methods which result in the trigger of a
         # vulnerability (indicate points in the application where uncontrolled
         # user input can do damage).
-        class TriggerNode < PolicyNode
+        class TriggerNode < PolicyNode # rubocop:disable Metrics/ClassLength
           JSON_BAD_VALUE = 'bad_value'
           JSON_GOOD_VALUE = 'good_value'
           JSON_DISALLOWED_TAGS = 'disallowed_tags'
@@ -104,8 +104,7 @@ module Contrast
 
             properties = Contrast::Agent::Assess::Tracker.properties(source)
             # find the ranges that violate the rule (untrusted, etc)
-            vulnerable_ranges = ranges_with_all_tags(Contrast::Utils::StringUtils.ret_length(source), properties,
-                                                     required_tags)
+            vulnerable_ranges = ranges_with_all_tags(properties, required_tags)
             # if there aren't any vulnerable ranges, nope out
             return false if vulnerable_ranges.empty?
 
@@ -170,49 +169,56 @@ module Contrast
 
             tags.each do |tag|
               raise(ArgumentError, "Rule #{ rule_id } had an invalid tag. #{ tag } is not a known value.") unless
-                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
-                      Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
+                Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
+                    Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
             end
           end
 
           # Find the ranges that satisfy all of the given tags.
           #
-          # @param length [Integer] the length of the object which may have the
-          #   given tags -- used as the maximum index to search for all of the
-          #   tags.
           # @param properties [Contrast::Agent::Assess::Properties] the
           #   properties to check for the tags
           # @param required_tags [Set<String>] the list of tags on which to match
           # @return [Array<Contrast::Agent::Assess::Tag>] the ranges satisfied
           #   by the given conditions
-          def ranges_with_all_tags length, properties, required_tags
+          def ranges_with_all_tags properties, required_tags
             return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless matches_tags?(properties, required_tags)
 
-            ranges = []
             chunking = false
+            ranges = []
+            # find the start and end range of required tags:
+            search_ranges = find_required_ranges properties, required_tags
+            start_range = search_ranges.first
+            end_range = search_ranges.last + 1
+
             # find all the indicies on the source that have all the given tags
-            (0..length).each do |idx|
-              tags_at = properties.tags_at(idx).to_a
+            while start_range < end_range
+
+              tags_at = properties.tags_at(start_range).to_a
               # only those that have all the required tags in the tags_at
               # satisfy the requirement
               satisfied = tags_at.any? && required_tags.all? { |tag| tags_at.any? { |found| found.label == tag } }
               # if this range matches all the required tags and we're already
               # chunking, meaning the previous range matched, do nothing
-              next if satisfied && chunking
+              if satisfied && chunking
+                start_range += 1
+                next
+              end
 
               # if we are satisfied and we were not chunking, this represents
               # the start of the next range, so create a new entry.
               if satisfied
-                ranges << Contrast::Agent::Assess::Tag.new('required', 0, idx)
+                ranges << Contrast::Agent::Assess::Tag.new('required', 0, start_range)
                 chunking = true
-              # if we are chunking and not satisfied, this represents the end
-              # of the range, meaning the last index is what satisfied the
-              # range. Because the range is exclusive end, we can just use this
-              # index.
+                # if we are chunking and not satisfied, this represents the end
+                # of the range, meaning the last index is what satisfied the
+                # range. Because the range is exclusive end, we can just use this
+                # index.
               elsif chunking
-                ranges[-1]&.update_end(idx)
+                ranges[-1]&.update_end(start_range)
                 chunking = false
               end
+              start_range += 1
             end
             ranges
           end
@@ -265,6 +271,33 @@ module Contrast
 
             true
           end
+
+          # Range finder helper for #ranges_with_all_tags
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the properties to check for the tags
+          # @param required_tags [Set<String>] the list of tags on which to match
+          # @return [Array] of required tags ranges to search
+          def find_required_ranges properties, required_tags
+            start_range = 0
+            end_range = 0
+            required_tags_arr = required_tags.to_a
+            idx = 0
+
+            while idx < required_tags_arr.length
+              # find the start and end range of required tags:
+              start_temp = properties.fetch_tag(required_tags_arr[idx])[0].start_idx
+              end_temp = properties.fetch_tag(required_tags_arr[idx])[0].end_idx
+              # first iteration only
+              start_range = start_temp if idx.zero?
+              end_range = end_temp if idx.zero?
+
+              # find the tag with smallest ranges
+              start_range = start_temp if start_range < start_temp
+              end_range = end_temp if end_range > end_temp
+              idx += 1
+            end
+            [start_range, end_range]
+          end
         end
       end
     end

data/lib/contrast/agent/assess/property/tagged.rb

@@ -125,6 +125,27 @@ module Contrast
             tags[label] = tag_ranges
           end
 
+          # Returns a list of all current tags.
+          #
+          # @return [Hash<Contrast::Agent::Assess::Tag>]
+          def get_tags # rubocop:disable Naming/AccessorMethodName
+            return Contrast::Utils::ObjectShare::EMPTY_HASH unless tracked?
+
+            tags
+          end
+
+          # We'll use this as a helper method to retrieve tags from the hash.
+          # Because the hash auto-populates an empty array when we try to
+          # access a tag in it, we cannot use the [] method without side
+          # effect. To get around this, we'll use a fetch work around.
+          #
+          # @param label [Symbol] the label to look up
+          # @return [Array<Contrast::Agent::Assess::Tag>] all the tags with
+          #   that label
+          def fetch_tag label
+            get_tags.fetch(label, nil) if tracked?
+          end
+
           # Remove all tags with a given label
           def delete_tags label
             tags.delete(label) if tracked?
@@ -152,18 +173,6 @@ module Contrast
             tags.delete_if { |_, value| value.empty? }
           end
 
-          # We'll use this as a helper method to retrieve tags from the hash.
-          # Because the hash auto-populates an empty array when we try to
-          # access a tag in it, we cannot use the [] method without side
-          # effect. To get around this, we'll use a fetch work around.
-          #
-          # @param label [Symbol] the label to look up
-          # @return [Array<Contrast::Agent::Assess::Tag>] all the tags with
-          #   that label
-          def fetch_tag label
-            tags.fetch(label, nil) if tracked?
-          end
-
           # Remove all tags within the given ranges.
           # This does not delete an entire tag if part of that tag is
           # outside this range, meaning we may reduce sizes of tags
@@ -218,19 +227,6 @@ module Contrast
             end
           end
 
-          # Because of the auto-fill thing, we should not allow direct access to
-          # the tags hash. Instead, the methods above should be used to do
-          # operations like add, delete, and fetch.
-          #
-          # CONTRAST-22914
-          # please do NOT expose this w/ an attr_reader / accessor. there are
-          # helper methods in this class that safely access the hash. the tags
-          # method is private to avoid the side effect of a direct lookup with
-          # `[]` adding an empty array to the hash.
-          def tags
-            @_tags ||= Hash.new { |h, k| h[k] = [] }
-          end
-
           # Remove the tag ranges covering the given range
           def remove_tags range
             return unless tracked?
@@ -334,6 +330,19 @@ module Contrast
 
           private
 
+          # Because of the auto-fill thing, we should not allow direct access to
+          # the tags hash. Instead, the methods above should be used to do
+          # operations like add, delete, and fetch.
+          #
+          # CONTRAST-22914
+          # please do NOT expose this w/ an attr_reader / accessor. there are
+          # helper methods in this class that safely access the hash. the tags
+          # method is private to avoid the side effect of a direct lookup with
+          # `[]` adding an empty array to the hash.
+          def tags
+            @_tags ||= Hash.new { |h, k| h[k] = [] }
+          end
+
           # Given a tag, compare it to a given range and, if any part of that tag is within the range, return a new tag
           # covering the union of the original tag and the range. This new tag will start at the
           # max(tag.start, range.start) and end at min(tag.end, range.end)

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -35,6 +35,12 @@ module Contrast
             end
           end
 
+          def validate
+            return if class_name
+
+            raise(ArgumentError, "#{ @node_class } #{ id } did not have a proper class name. Unable to create.")
+          end
+
           def module_names
             @_module_names ||= Set.new(deadzones.map(&:class_name))
           end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -46,7 +46,6 @@ module Contrast
                 path_part = "cs__assess_#{ p }"
                 Contrast::Extension::Assess::InstrumentHelper.instrument "#{ path_part }/#{ path_part }"
               end
-              Contrast::Extension::Assess::InstrumentHelper.instrument 'cs__protect_kernel/cs__protect_kernel'
               true
             end
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -81,15 +81,21 @@ module Contrast
               deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
               method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
                                                   inventory_node, deadzone_node)
-              MethodPolicy.new(method_name: method_name,
-                               method_visibility: method_visibility,
-                               instance_method: instance_method,
-                               source_node: source_node,
-                               propagation_node: propagation_node,
-                               trigger_node: trigger_node,
-                               protect_node: protect_node,
-                               inventory_node: inventory_node,
-                               deadzone_node: deadzone_node)
+              method_policy = MethodPolicy.new(method_name: method_name,
+                                               method_visibility: method_visibility,
+                                               instance_method: instance_method,
+                                               source_node: source_node,
+                                               propagation_node: propagation_node,
+                                               trigger_node: trigger_node,
+                                               protect_node: protect_node,
+                                               inventory_node: inventory_node,
+                                               deadzone_node: deadzone_node)
+
+              return method_policy unless check_method_policy_nodes_empty? source_node, propagation_node, trigger_node,
+                                                                           protect_node, inventory_node, deadzone_node
+
+              create_new_node(module_policy, method_policy) if module_policy.deadzone_nodes&.any?
+              method_policy
             end
 
             def find_method_node nodes, method_name, is_instance_method
@@ -103,6 +109,45 @@ module Contrast
             def find_visibility *nodes
               nodes.find { |node| node }&.method_visibility
             end
+
+            def check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node, protect_node,
+                                                 inventory_node, deadzone_node)
+              return false unless source_node.nil? && propagation_node.nil? && trigger_node.nil? && protect_node.nil? &&
+                  inventory_node.nil? && deadzone_node.nil?
+
+              true
+            end
+
+            private
+
+            def create_new_node module_policy, method_policy
+              return if module_policy.deadzone_nodes.empty?
+
+              module_policy.deadzone_nodes.map do |node|
+                next unless node.method_name.nil?
+
+                klass = Module.cs__const_get(node.class_name)
+                next unless it_defined? klass, method_policy.method_name
+
+                new_node = {}
+                new_node['instance_method'] = method_policy.instance_method
+                new_node['method_visibility'] =
+                  klass.private_method_defined?(method_policy.method_name) ? 'private' : 'public'
+                new_node['method_name'] = method_policy.method_name
+                new_node['class_name'] = node.class_name
+                new_node = Contrast::Agent::Deadzone::Policy::DeadzoneNode.new(new_node)
+                method_policy.instance_variable_set(:@method_visibility, new_node.method_visibility)
+                method_policy.instance_variable_set(:@deadzone_node, new_node)
+                module_policy.deadzone_nodes << new_node
+                break unless method_policy.deadzone_node.nil?
+              end
+            end
+
+            def it_defined? klass, method_name
+              klass.instance_methods(false).include?(method_name) ||
+                  klass.private_instance_methods(false).include?(method_name) ||
+                  klass.singleton_methods(false).include?(method_name)
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/patch.rb

@@ -337,13 +337,13 @@ module Contrast
             #   :prepend            -> prepend instance method of module
             #   [prepending singleton is easily supported too, just not implemented yet.]
             # @return [Symbol] new alias for the underlying method (presumably, so the patched method can call it)
-            def register_c_patch target_module_name, unbound_method, impl = :alias_instance
+            def register_c_patch target_module_name, unbound_method, impl = :alias_instance # rubocop:disable  Metrics/AbcSize
               # These could be set as AfterLoadPatches.
               method_name = unbound_method.name.to_sym # rubocop:disable Security/Module/Name -- ruby built in attribute.
               underlying_method_name = build_unbound_method_name(method_name).to_sym
 
               target_module = Module.cs__const_get(target_module_name)
-
+              target_module = target_module.cs__singleton_class if %i[prepend_singleton prepend].include? impl
               target_module = target_module.cs__singleton_class if %i[alias_singleton prepend].include? impl
 
               visibility = if target_module.private_instance_methods(false).include?(method_name)
@@ -370,14 +370,20 @@ module Contrast
                   target_module.send(:define_method, method_name, unbound_method.bind(target_module))
                 end
                 target_module.send(visibility, method_name) # e.g., module.private(:my_method)
-              when :prepend
-                prepending_module = Module.new
-                prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                prepending_module.send(visibility, method_name)
+              when :prepend_instance, :prepend_singleton
+
+                unless target_module.instance_methods(false).include? underlying_method_name
+
+                  prepending_module = Module.new
+                  prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                  prepending_module.send(visibility, method_name)
+
+                end
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
                 # rubocop:enable Performance/Kernel/DefineMethod
               end
+
               # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
               # can't invoke this logging method or we'll seg fault as we'd
               # change the method definition mid-call