# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator' require 'contrast/agent/assess/policy/trigger_validation/xss_validator' require 'contrast/agent/assess/policy/trigger_validation/redos_validator' module Contrast module Agent module Assess module Policy # Some of our triggers require transformation or validation prior to # reporting in order to account for false positives or other aberrant # conditions. This provides a single place from which those validations # can be called. module TriggerValidation VALIDATORS = [ Contrast::Agent::Assess::Policy::TriggerValidation::SSRFValidator, Contrast::Agent::Assess::Policy::TriggerValidation::XSSValidator, Contrast::Agent::Assess::Policy::TriggerValidation::REDOSValidator ].cs__freeze # Determines if the conditions in which this trigger was called are # valid and should result in the generation of a # Contrast::Api::Dtm::Finding. # # @param patcher [Contrast::Agent::Assess::Policy::TriggerNode] the # Node which applies to the Trigger Method # @param object [Object] the Object on which the Trigger Method was # invoked # @param ret [Object] the return of the Trigger Method # @param args [Array] the Arguments with which the Trigger # Method was invoked # @return [Boolean] if the conditions are valid for the generation of # a Contrast::Api::Dtm::Finding def self.valid? patcher, object, ret, args specific_validator = VALIDATORS.find { |validator| validator::RULE_NAME == patcher&.rule_id } return specific_validator.valid?(patcher, object, ret, args) if specific_validator true end end end end end end