# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true require 'contrast/agent/assess/tag' require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags' require 'contrast/components/logger' module Contrast module Agent module Reporting # This is the new FindingEventTaintRange class which will include all the needed information for the new # reporting system to relay this information in the Finding/Trace messages. These FindingTaintRanges are used by # TeamServer to construct the vulnerability information for the assess feature. They represent those parts of the # objects that are tracked because of a security relevant operation acting on them. class FindingEventTaintRange include Contrast::Components::Logger::InstanceMethods # @return [String] the range (inclusive:exclusive), that this tag covers. attr_reader :range # @return [String] the type of action this tag represents. attr_reader :tag class << self # @param tag [Contrast::Agent::Assess::Tag] the tag to convert # @return [Contrast::Agent::Reporting::FindingEventTaintRange] def convert tag report = new report.attach_data(tag) report end end # Parse the data from a Contrast::Agent::Assess::Tag to attach what is required for reporting to TeamServer to # this Contrast::Agent::Reporting::FindingEventTaintRange # # @param tag [Contrast::Agent::Assess::Tag] the tag to convert def attach_data tag @range = "#{ tag.start_idx }:#{ tag.end_idx }" @tag = tag.label end # Convert the instance variables on the class, and other information, into the identifiers required for # TeamServer to process the JSON form of this message. # # @return [Hash] # @raise [ArgumentError] def to_controlled_hash begin validate rescue ArgumentError => e logger.error('FindingEventTaintRange validation failed with: ', e) return end { range: range, tag: tag } end # @raise [ArgumentError] def validate unless range && !range.empty? raise(ArgumentError, "#{ self } did not have a proper range. Unable to continue.") end raise(ArgumentError, "#{ self } did not have a proper tag. Unable to continue.") unless tag && !tag.empty? end end end end end