# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true module Contrast module Agent module Reporting # This is the new FindingStack class which will include all the needed information for the new reporting system # to relay this information in the Finding/Trace messages. These FindingStack are used by TeamServer to construct # the vulnerability information for the assess feature. They represent the callstack at the time that each # FindingEvent was generated. # # @attr_reader eval [String] unused # @attr_reader file [String] the stack frame to show in TeamServer; the value of an entry in #caller # @attr_reader line_number [String] unused # @attr_reader method [String] unused # @attr_reader signature [String] unused # @attr_reader type [String] unused class FindingStack attr_reader :eval, :file, :line_number, :method, :signature, :type AGENT_CLASS_MARKER = '/lib/contrast/' class << self # @param stack [Array] # @return [Contrast::Agent::Reporting::FindingStack,nil] def convert stack return unless stack return if stack.include?(AGENT_CLASS_MARKER) report = new report.attach_data(stack) report end end # Parse the data from a Contrast::Agent::Assess::Tag to attach what is required for reporting to TeamServer to # this Contrast::Agent::Reporting::FindingTaintRange # # @param stack [Array] def attach_data stack @file = stack end # Convert the instance variables on the class, and other information, into the identifiers required for # TeamServer to process the JSON form of this message. # # @return [Hash] # @raise [ArgumentError] def to_controlled_hash validate { # eval: eval, file: file # , # line_number: line_number, # This is unused by the Ruby agent # method: method, # This is unused by the Ruby agent # signature: signature, # This is unused by the Ruby agent # type: type # This is unused by the Ruby agent } end def validate raise(ArgumentError, "#{ self } did not have a proper hash. Unable to continue.") unless file && !file.empty? end end end end end