lib/contrast/agent/protect/rule/cmd_injection.rb in contrast-agent-6.6.4 vs lib/contrast/agent/protect/rule/cmd_injection.rb in contrast-agent-6.6.5

- old
+ new

@@ -4,10 +4,11 @@ require 'contrast/agent/protect/rule/base_service' require 'contrast/utils/stack_trace_utils' require 'contrast/utils/object_share' require 'contrast/components/logger' require 'contrast/agent/reporting/input_analysis/input_type' +require 'contrast/agent/reporting/details/cmd_injection_details' module Contrast module Agent module Protect module Rule @@ -95,20 +96,20 @@ # Build a subclass of the RaspRuleSample using the query string and the # evaluation def build_sample context, input_analysis_result, candidate_string, **_kwargs sample = build_base_sample(context, input_analysis_result) - sample.cmdi = Contrast::Api::Dtm::CmdInjectionDetails.new + sample.details = Contrast::Agent::Reporting::Details::CmdInjectionDetails.new command = candidate_string || input_analysis_result.value command = Contrast::Utils::StringUtils.protobuf_safe_string(command) - sample.cmdi.command = command - sample.cmdi.end_idx = command.length + sample.details.cmd = command + sample.details.end_idx = command.length # This is a special case where the user input is UNKNOWN_USER_INPUT but # we want to send the attack value if input_analysis_result.nil? - ui = Contrast::Api::Dtm::UserInput.new + ui = Contrast::Agent::Reporting::UserInput.new ui.input_type = :UNKNOWN ui.value = command sample.user_input = ui end