Contents

# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

# This module is used to track propagation through ERB template rendering
module ERBPropagator
  class << self
    def result_tagger patcher, preshift, ret, _block
      return unless preshift.args.length >= 1

      properties = Contrast::Agent::Assess::Tracker.properties(ret)
      return unless properties

      used_binding = preshift.args[0]
      binding_variable_set = used_binding.local_variables

      erb_pre_result = preshift.object.src
      binding_variable_set.each do |bound_var_symbol|
        bound_variable_value = used_binding.local_variable_get(bound_var_symbol)
        next unless Contrast::Agent::Assess::Tracker.tracked?(bound_variable_value)
        next unless erb_pre_result.include?(bound_var_symbol.to_s)

        start_index = ret.index(bound_variable_value)
        next if start_index.nil?

        properties.copy_from(bound_variable_value, ret, start_index)
      end
      properties.build_event(
          patcher,
          ret,
          preshift.object,
          ret,
          preshift.args,
          1)
      ret
    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
contrast-agent-3.15.0	lib/contrast/extension/assess/erb.rb