lib/contrast/framework/rack/patch/session_cookie.rb in contrast-agent-4.8.0 vs lib/contrast/framework/rack/patch/session_cookie.rb in contrast-agent-4.9.0

- old
+ new

@@ -1,22 +1,22 @@ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details. # frozen_string_literal: true -require 'contrast/components/interface' +require 'contrast/components/logger' +require 'contrast/components/scope' module Contrast module Framework module Rack module Patch # Our patch into the Rack::Session::Cookie Class, allowing for the # runtime detection of insecure configurations on individual cookies # within the application class SessionCookie - include Contrast::Components::Interface + extend Contrast::Components::Logger::InstanceMethods + extend Contrast::Components::Scope::InstanceMethods - access_component :agent, :analysis, :logging, :scope - CS__SECURE_RULE_NAME = 'secure-flag-missing' CS__HTTPONLY_NAME = 'rails-http-only-disabled' CS__SESSION_TIMEOUT_NAME = 'session-timeout' SAFE_SESSION_TIMEOUT = (30 * 60 * 60) class << self @@ -34,11 +34,11 @@ true end end def analyze options - return unless AGENT.enabled? - return if ASSESS.forcibly_disabled? + return unless ::Contrast::AGENT.enabled? + return if ::Contrast::ASSESS.forcibly_disabled? apply_session_timeout(options) apply_httponly(options) apply_secure_session(options) end