@contrast/agent-bundle 5.39.1 → 5.41.0

package/node_modules/@contrast/sec-obs/node_modules/@contrast/patcher/README.md

@@ -1,51 +0,0 @@
-# `@contrast/patcher`
-
-Monkey patching.
-
-# Notes on v5 Parity
-
-This was ported directly from the `node-agent` but code with every dependency commented out. As a result there are differences in parity.
-
-1. Removed dependency on `AsyncStorage`.
-
-    **Old Behavior**
-
-    Pre and post hooks only run when async storage context indicates an active request scope.
-
-    **New Behavior**
-
-    Hooks always run, independent of request scope.
-
-1. Removed dependency on `agent` and `perf-logger`.
-
-    **Old Behavior**
-
-    A configuration setting would allow for logging of perf data of hooks and original function calls.
-
-    **New Behavior**
-
-    Performance logging of hooks is non-funcitonal.
-
-1. Removed the dependency on `scopes`.
-
-   **Old Behavior**
-
-   One could specify a `scope` in the hook options and the original function would be run in that scope. This allowed control over when to run instrumentaion based on current scope value.
-
-   Also, the `alwaysRun` option forced hooks to run independent of scope state.
-
-   **New Behavior**
-
-   There are no notions of scopes yet in v5. Patcher instrumentation always runs.
-
-   The `scope` and `alwaysRun` options are effectively ignored.
-
-1. Removed the dependency on `tracker`.
-
-    **Old Behavior**
-    
-    We used to short-circuit `__add` function if tracker showed all arguments to be untracked.
-    
-    **New Behavior**
-    
-    We do not make this check; no short-circuiting.

package/node_modules/@contrast/sec-obs/node_modules/@contrast/patcher/lib/index.d.ts

@@ -1,101 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-import { Logger } from '@contrast/logger';
-
-export interface Core {
-  logger: Logger;
-}
-
-export interface HookData<T, P extends readonly any[] = any[], R = any> {
-  hooked(...args: P): R;
-  orig(...args: P): R;
-  funcKey: string;
-  obj: T;
-  name: string;
-  args: P;
-}
-
-export interface ResultHookData<T, P extends readonly any[] = any[], R = any>
-  extends HookData<T, P, R> {
-  result: R;
-}
-
-export interface PreHook<T, P extends readonly any[] = any[], R = any> {
-  (data: HookData<T, P, R>): void;
-}
-
-export interface AroundHook<T, P extends readonly any[] = any[], R = any> {
-  (next: () => R, data: HookData<T, P, R>): void;
-}
-
-export interface PostHook<T, P extends readonly any[] = any[], R = any> {
-  (data: ResultHookData<T, P, R>): void
-}
-
-export type Hook<T, P extends readonly any[] = any[], R = any> =
-  PreHook<T, P, R> | AroundHook<T, P, R> | PostHook<T, P, R>;
-
-export interface PatchOptions<T, P extends readonly any[] = any[], R = any> {
-  name: string;
-  patchType: string;
-  pre?: PreHook<T, P, R>;
-  around?: AroundHook<T, P, R>;
-  post?: PostHook<T, P, R>;
-}
-
-export type HookedFunctionsMap = WeakMap<(...args: any[]) => any, {
-  fn: (...args: any[]) => any;
-}>;
-
-export type HooksMap = WeakMap<(...args: any[]) => any, {
-  pre: Map<string, PreHook<any>>,
-  around: Map<string, AroundHook<any>>,
-  post: Map<string, PostHook<any>>,
-  funcKeys: Set<string>,
-}>;
-
-export interface Patcher {
-  patch<F extends (...args: any[]) => any>(
-    fn: F,
-    options: PatchOptions<F, Parameters<F>, ReturnType<F>>,
-  ): F | null;
-
-  patch<T, K extends keyof T>(
-    obj: T,
-    method: K,
-    options: T[K] extends abstract new (...args: infer P) => infer R
-      ? PatchOptions<T, P, R>
-      : T[K] extends (...args: infer P) => infer R
-        ? PatchOptions<T, P, R>
-        : PatchOptions<T>,
-  ): T | null;
-
-  resetInstrumentation(): void;
-  unpatch<T extends (...args: any[]) => any>(
-    fn: T,
-    funcName: string,
-    patchType: string,
-  ): void;
-  unwrap<T extends (...args: any[]) => any>(fn: T): T;
-  isContrastHooked<T extends (...args: any[]) => any>(fn: T): boolean;
-  hookedFunctionToString<T extends (...args: any[]) => any>(fn: T): string;
-  hookedFunctions: HookedFunctionsMap;
-  hooks: HooksMap;
-}
-
-declare function init(core: Core): Patcher;
-
-export = init;

package/node_modules/@contrast/sec-obs/node_modules/@contrast/patcher/lib/index.js

@@ -1,544 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { threadId } = require('worker_threads');
-const { hrtime } = require('process');
-
-/**
- * Disable the prefer-rest-params rule, which disallows use of `arguments`.
- * With the way we're monkey patching, it's more semantically correct to use
- * the arguments keyword instead of providing a `...args` rest param.
- */
-/* eslint-disable prefer-rest-params */
-
-/**
- * Checks if the argument is a function
- */
-function isFunction(fn) {
-  // why do both need to be checked?
-  return fn instanceof Function || typeof fn === 'function';
-}
-
-/**
- * Attempts to find a descriptor for a property on an object or its parents
- *
- * @param {Object} obj        the object containing the property we want to get the descriptor of
- * @param {string} prop       the property of which we want the get the descriptor of
- * @return {Object|undefined} the descriptor, or undefined if it couldn't get one
- */
-function getDescriptor(obj, prop) {
-  // if it isn't its own property, but a parent's, return writability for the parent
-  if (obj && obj[prop] && !Object.getOwnPropertyDescriptor(obj, prop)) {
-    const proto = Object.getPrototypeOf(obj);
-    return getDescriptor(proto, prop);
-  }
-
-  return Object.getOwnPropertyDescriptor(obj, prop);
-}
-
-module.exports = function init(core) {
-  const logger = core.logger.child({ name: 'contrast:patcher', tid: threadId });
-  const promisifyCustom = Symbol.for('nodejs.util.promisify.custom');
-  const perf = new core.Perf('patcher');
-  const perfIsEnabled = core.Perf.isEnabled;
-
-  /**
-   * @type {WeakMap<Function, { fn: Function }>}
-   * allows us to check if a function is hooked without pinning random properties
-   * to the function, and lets us reference the original function any time we want
-   */
-  const hookedFunctions = new WeakMap();
-
-  /**
-   * @type {WeakMap<Function, {
-   *  pre: Map<string, Function>,
-   *  post: Map<string, Function>,
-   *  around: Map<string, Function>,
-   *  funcKeys: Set<string>,
-   * }>}
-   * mapping of hooked func -> maps of pre/post/around funcs
-   */
-  let hooks = new WeakMap();
-
-  /**
-   * clears instrumentation for all patched functions
-   * used in testing for better isolation between tests
-   */
-  function resetInstrumentation() {
-    hooks = new WeakMap();
-  }
-
-  /**
-   * Invoke the original function in the current context with the
-   * passed-in arguments and store its result
-   *
-   * @param {Function} fn         the function we want to execute
-   * @param {Object}   data       object with the arguments and name of the function
-   * @param {any}      data.args  the arguments for the function execution
-   * @param {String}   data.name  the name of the function
-   * @param {any}      target     the constructor being called (if called with new)
-   */
-  function runOriginalFunction(fn, { args, name }, target) {
-    if (target) {
-      // NODE-818 need to unwrap Object because it does not
-      // properly reflect
-      if (name === 'Object') {
-        target = unwrap(target);
-      }
-
-      return Reflect.construct(fn, args, target);
-    }
-
-    return fn.apply(this, args);
-  }
-
-  /**
-   * Hook the provided function by adding hook calls where appropriate
-   *
-   * @param {Function} fn original function being hooked
-   * @param {Object}   options
-   * @param {string}   options.name - name of the function (usually signature)
-   * @returns {Function} the hooked function
-   */
-  function hookFunction(fn, options) {
-    if (hookedFunctions.has(fn)) {
-      // fn has already been hooked
-      return fn;
-    }
-
-    // get the hooked function. it will be either the hooked function with perf
-    // or without.
-    const hooked = perfIsEnabled && options.usePerf === 'sync' ?
-      makePerfHookedFunction(fn, options) :
-      makeHookedFunction(fn, options);
-
-    /**
-     * copy over all properties if there are properties on the original function.
-     * an example of this is the version of buffer you get from require('buffer')
-     * see NODE-335 for further background.
-     */
-    const descriptors = Object.getOwnPropertyDescriptors(fn);
-
-    for (const key of Object.getOwnPropertyNames(descriptors)) {
-      Object.defineProperty(hooked, key, descriptors[key]);
-    }
-
-    let descriptor;
-
-    for (const key of Object.getOwnPropertySymbols(descriptors)) {
-      // promisify custom might be the same as the original function. make the property
-      // writable and save the descriptor so it can be modified outside of this loop.
-      // doing so in the loop causes infinite recursion.
-      if (key === promisifyCustom && typeof descriptors[key].value === 'function') {
-        descriptors[key].writable = true;
-        descriptor = descriptors[key];
-      }
-      // set the property to a writable copy of the descriptor.
-      Object.defineProperty(hooked, key, descriptors[key]);
-    }
-
-    if (descriptor) {
-      if (descriptor.value === fn) {
-        // promisifyCustom was a circular reference pointing to the original function.
-        // change it to point to the hooked function.
-        descriptor.value = hooked;
-      } else {
-        // promisify custom was a function, but it's not the original function. so it
-        // must be hooked.
-        descriptor.value = hookFunction(descriptor.value, options);
-      }
-      // for both cases above, we make the property unwritable again.
-      descriptor.writable = false;
-      Object.defineProperty(hooked, promisifyCustom, descriptor);
-    }
-
-    if (!fn.prototype) hooked.prototype = undefined;
-    hookedFunctions.set(hooked, { fn });
-
-    return hooked;
-  }
-
-  /**
-   * Attempt to hook a given function or object's property/method
-   *
-   * @param   {Object} obj  the object that contains the property/method we want to hook
-   * @param   {string} prop the property/method of the object that we want to hook
-   * @param   {Object} opts options for hooking
-   * @returns {Function}    the hooked function/method
-   */
-  function hook(obj, prop, opts) {
-    const desc = getDescriptor(obj, prop);
-    if (desc.writable || desc.set) {
-      obj[prop] = hookFunction(obj[prop], opts);
-      return obj[prop];
-    }
-
-    const { name, funcKey } = opts;
-
-    try {
-      logger.debug(
-        { funcKey },
-        '%s may be unwritable. hooking by defineProperty',
-        name,
-      );
-      if (desc.configurable) {
-        if (desc.get) {
-          const f = hookFunction(obj[prop], opts);
-          Object.defineProperty(obj, prop, {
-            get() {
-              return f;
-            },
-            set: desc.set,
-          });
-        } else if (desc.value) {
-          Object.defineProperty(obj, prop, {
-            enumerable: desc.enumerable,
-            writable: desc.writable,
-            configurable: desc.configurable,
-            value: hookFunction(obj[prop], opts),
-          });
-        } else {
-          throw new Error('unknown object descriptor setup');
-        }
-      } else {
-        logger.debug(
-          { funcKey },
-          'unable to patch unconfigurable property %s',
-          name,
-        );
-      }
-    } catch (err) {
-      logger.debug(
-        { err, funcKey },
-        'unable to patch unconfigurable property %s',
-        name,
-      );
-    }
-
-    return obj[prop];
-  }
-
-  /**
-   * factory to make a hooked function either with or without perf data. the
-   * arguments are exactly the same as `hookFunction`. it exists to create a
-   * closure around the `fn` and `options` arguments and to isolate the
-   * logic differences in the hooked function to a single place.
-   *
-   * @param {Function} fn original function being hooked
-   * @param {Object}   options
-   * @param {string}   options.name - name of the function (usually signature)
-   * @param {'sync'|'async'|undefined} options.usePerf - collect perf data for this hooked function
-   * @returns {Function} the hooked function
-   *
-   */
-  function makeHookedFunction(fn, options) {
-    //
-    // the hooked function that does not capture perf data. this is very close
-    // to the original hooked function. the primary difference is that it does
-    // the pre/post hooks in a loop rather than calling a function.
-    //
-    function hooked(...args) {
-      const target = new.target;
-
-      const data = {
-        hooked,
-        orig: fn,
-        funcKey: options.funcKey,
-        obj: new.target || this,
-        name: options.name,
-        args,
-        result: undefined,
-      };
-
-      const fnHooks = hooks.get(hooked);
-      if (!fnHooks) {
-        return (data.result = runOriginalFunction.call(this, fn, data, target));
-      }
-
-      // Run pre hooks
-      if (fnHooks.pre.size) {
-        for (const pre of fnHooks.pre.values()) {
-          pre.call(this, data);
-        }
-      }
-
-      if (fnHooks.around.size === 0) {
-        data.result = runOriginalFunction.call(this, fn, data, target);
-      } else {
-        // chain around hooks, from last to first to original, via recursion
-        const self = this;
-        const arounds = Array.from(fnHooks.around.values()).reverse();
-
-        const pipe = arounds.reduce(
-          (innerNext, around) =>
-            function next() {
-              return around(innerNext, data);
-            },
-          function next() {
-            return runOriginalFunction.call(self, fn, data, target);
-          }
-        );
-
-        data.result = pipe();
-      }
-
-      // Run post hooks
-      if (fnHooks.post.size) {
-        for (const post of fnHooks.post.values()) {
-          post.call(this, data);
-        }
-      }
-
-      return data.result;
-    }
-
-    return hooked;
-  }
-
-  function makePerfHookedFunction(fn, options) {
-    //
-    // a functional duplicate of hooked, but has perf measurement of the hooked
-    // and original functions.
-    //
-    function perfHooked(...args) {
-      // do perf work before getting the start time
-      const outerTag = `patcher:${options.name}:wrapper`;
-      const innerTag = `${options.name}:native`; // name is patcher:original-function-name
-      const start = hrtime.bigint();
-
-      const target = new.target;
-
-      const data = {
-        hooked: perfHooked,
-        orig: fn,
-        funcKey: options.funcKey,
-        obj: new.target || this,
-        name: options.name, //String.prototype.substring
-        args,
-        result: undefined,
-      };
-      // create functions to run the original function. this replaces the original
-      // `runOriginalFunction()` with one that doesn't require passing arguments. my
-      // thinking is that minimizes wrapping overhead.
-      let runOriginalFunction;
-      if (target) {
-        runOriginalFunction = () => Reflect.construct(fn, args, options.name !== 'Object' ? target : unwrap(target));
-      } else {
-        runOriginalFunction = () => fn.apply(this, args);
-      }
-      runOriginalFunction = perf.wrapSync(runOriginalFunction, innerTag);
-
-      // if the function isn't hooked, just run the original function and records the
-      // time with a modified tag indicating that it wasn't hooked. i don't think this
-      // should happen (why are we in the hooked function if there are no hooks?), but
-      // it's here just in case.
-      const fnHooks = hooks.get(perfHooked);
-      if (!fnHooks) {
-        const result = (data.result = runOriginalFunction());
-        perf.record(`${outerTag}:unhooked`, start);
-        return result;
-      }
-
-      // Run any pre hooks
-      if (fnHooks.pre.size) {
-        for (const pre of fnHooks.pre.values()) {
-          pre.call(this, data);
-        }
-      }
-
-      // if there are no around hooks, then no need to do the work to chain them.
-      if (fnHooks.around.size === 0) {
-        data.result = runOriginalFunction();
-      } else {
-        // chain around hooks, from last to first to original, via recursion
-        const arounds = Array.from(fnHooks.around.values()).reverse();
-
-        const pipe = arounds.reduce(
-          (innerNext, around) =>
-            function next() {
-              return around(innerNext, data);
-            },
-          function next() {
-            return runOriginalFunction();
-          }
-        );
-
-        // execute the chained hooks then the original function
-        data.result = pipe();
-      }
-
-      // Run any post hooks
-      if (fnHooks.post.size) {
-        for (const post of fnHooks.post.values()) {
-          post.call(this, data);
-        }
-      }
-
-      perf.record(outerTag, start);
-      return data.result;
-    }
-
-    return perfHooked;
-  }
-
-  /**
-   * Patch a given function or object's property with 'pre', 'post',
-   * and/or 'around' hooks
-   *
-   * @param   {Function|Object} obj     the function we want to patch or the object that contains the said function/method
-   * @param   {string}          prop    the object's property/method we want to patch
-   * @param   {Object}          options object containing the different hooks and identifiers for them
-   * @returns {Function|Object}         the patched function or the object with the patched property/method
-   */
-  function patch(obj, prop, options) {
-    // If the prop argument was omitted, shift the arguments.
-    if (options == null) {
-      options = prop;
-      prop = null;
-    }
-    const { patchType, name, pre, post, around } = options;
-
-    if (!patchType || !name) {
-      const err = new Error('patchType and name are required options');
-      logger.error({ err, options });
-      return null;
-    }
-
-    const funcKey = `${patchType}:${name}`;
-    options.funcKey = funcKey;
-
-    if (obj === undefined) {
-      logger.error(
-        { funcKey },
-        prop ? 'attempted to hook property %s in nonexistent object' : 'attempted to hook nonexistent function',
-        prop,
-      );
-      return null;
-    }
-
-    if (!isFunction(obj) && !isFunction(obj[prop])) {
-      logger.error(
-        { funcKey, obj },
-        prop ? 'attempted to hook property %s that is not a method or does not exist' : 'attempted to hook an object that is not a function',
-        prop,
-      );
-      return null;
-    }
-
-    // hmmm. if we wrap the fn then hooks.get(fn) won't work if it's patched again.
-    // should we hook the wrapped function?
-
-    // if no property, hook a function directly.
-    const fn = prop ? hook(obj, prop, options) : hookFunction(obj, options);
-    const fnHooks = hooks.get(fn) || {
-      pre: new Map(),
-      post: new Map(),
-      around: new Map(),
-      funcKeys: new Set(),
-    };
-
-    if (fnHooks.funcKeys.has(funcKey)) {
-      logger.debug({ funcKey }, '%s already patched. ignoring', funcKey);
-    } else {
-      if (pre) fnHooks.pre.set(funcKey, pre);
-      if (post) fnHooks.post.set(funcKey, post);
-      if (around) fnHooks.around.set(funcKey, around);
-      fnHooks.funcKeys.add(funcKey);
-    }
-    hooks.set(fn, fnHooks);
-
-    if (fn[promisifyCustom] && fn[promisifyCustom] !== fn) {
-      hooks.set(fn[promisifyCustom], fnHooks);
-    }
-
-    /*
-     * special case - if a function was being directly hooked, not a property
-     * on an object (i.e. module export set to a function) return the patched
-     * function
-     */
-    if (typeof obj === 'function' && !prop) {
-      return fn;
-    }
-    return obj;
-  }
-
-  /**
-   * Remove a handler for an event given an id (rule name, key, etc) and an
-   * event name
-   *
-   * @param {Function}  fn        the function which we want to unpatch
-   * @param {string}    funcName  identifier for thе patch patchType:funcName
-   * @param {string}    patchType one of patcher.PATCH_TYPES
-   */
-  function unpatch(fn, funcName, patchType) {
-    const fnHooks = hooks.get(fn);
-
-    if (!fnHooks) {
-      return;
-    }
-    Object.keys(fnHooks).forEach((key) => {
-      fnHooks[key].delete(`${patchType}:${funcName}`);
-    });
-  }
-
-  /**
-   * WeakMap lookup to get original, unwrapped version of a function.
-   * @param  {Function} fn  the function of which we want the original
-   * @return {Function}     the original unpatched function
-   */
-  function unwrap(fn) {
-    const hooked = hookedFunctions.get(fn);
-    return (hooked && hooked.fn) || fn;
-  }
-
-  /**
-   * WeakMap lookup to whether the given function is hooked by our hooks.
-   * @param  {Function} fn  the function which we want to check
-   * @return {Boolean}      true if the function is hooked with Contrast hooks
-   */
-  function isContrastHooked(fn) {
-    return hookedFunctions.has(fn);
-  }
-
-  /**
-   * In case we've monkey-patched the `Function.prototype.toString()` method we
-   * may need a way to return the `toString()` value for the hooked function (debug purposes?)
-   * @param  {Function} fn  the function which hooked version we want to run `toString()` against
-   * @return {String}       returns the `.toString()` result for the hooked version of the function if it's hooked
-   *                        or the `.thoString() value of the non-hooked function otherwise
-   */
-  function hookedFunctionToString(fn) {
-    const hooked = hookedFunctions.get(fn);
-    if (hooked && hooked.fn) {
-      return Reflect.apply(Function.prototype.toString, hooked.fn, arguments);
-    }
-    return Reflect.apply(Function.prototype.toString, fn, arguments);
-  }
-
-  core.patcher = {
-    patch,
-    resetInstrumentation,
-    unpatch,
-    unwrap,
-    isContrastHooked,
-    hookedFunctionToString,
-    hookedFunctions,
-    hooks
-  };
-
-  return core.patcher;
-};