lib/contrast/framework/rack/patch/session_cookie.rb in contrast-agent-4.8.0 vs lib/contrast/framework/rack/patch/session_cookie.rb in contrast-agent-4.9.0
- old
+ new
@@ -1,22 +1,22 @@
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true
-require 'contrast/components/interface'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
module Contrast
module Framework
module Rack
module Patch
# Our patch into the Rack::Session::Cookie Class, allowing for the
# runtime detection of insecure configurations on individual cookies
# within the application
class SessionCookie
- include Contrast::Components::Interface
+ extend Contrast::Components::Logger::InstanceMethods
+ extend Contrast::Components::Scope::InstanceMethods
- access_component :agent, :analysis, :logging, :scope
-
CS__SECURE_RULE_NAME = 'secure-flag-missing'
CS__HTTPONLY_NAME = 'rails-http-only-disabled'
CS__SESSION_TIMEOUT_NAME = 'session-timeout'
SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
class << self
@@ -34,11 +34,11 @@
true
end
end
def analyze options
- return unless AGENT.enabled?
- return if ASSESS.forcibly_disabled?
+ return unless ::Contrast::AGENT.enabled?
+ return if ::Contrast::ASSESS.forcibly_disabled?
apply_session_timeout(options)
apply_httponly(options)
apply_secure_session(options)
end