# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true require 'contrast/agent/assess/tag' require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags' require 'contrast/utils/duck_utils' require 'contrast/agent/reporting/reporting_events/reportable_hash' module Contrast module Agent module Reporting # This is the new FindingEventTaintRange class which will include all the needed information for the new # reporting system to relay this information in the Finding/Trace messages. These FindingTaintRanges are used by # TeamServer to construct the vulnerability information for the assess feature. They represent those parts of the # objects that are tracked because of a security relevant operation acting on them. class FindingEventTaintRange < Contrast::Agent::Reporting::ReportableHash # @return [String] the range (inclusive:exclusive), that this tag covers. attr_reader :range # @return [String] the type of action this tag represents. attr_reader :tag class << self # @param tag [Contrast::Agent::Assess::Tag] the tag to convert # @return [Contrast::Agent::Reporting::FindingEventTaintRange] def convert tag report = new report.attach_data(tag) report end end # Parse the data from a Contrast::Agent::Assess::Tag to attach what is required for reporting to TeamServer to # this Contrast::Agent::Reporting::FindingEventTaintRange # # @param tag [Contrast::Agent::Assess::Tag] the tag to convert def attach_data tag @range = "#{ tag.start_idx }:#{ tag.end_idx }" @tag = tag.label end # Convert the instance variables on the class, and other information, into the identifiers required for # TeamServer to process the JSON form of this message. # # @return [Hash] # @raise [ArgumentError] def to_controlled_hash validate { range: range, tag: tag } end # @raise [ArgumentError] def validate if Contrast::Utils::DuckUtils.empty_duck?(range) # rubocop:disable Style/GuardClause raise(ArgumentError, "#{ self } did not have a proper range. Unable to continue.") elsif Contrast::Utils::DuckUtils.empty_duck?(tag) raise(ArgumentError, "#{ self } did not have a proper tag. Unable to continue.") end nil end end end end end