@contrast/agent-bundle 5.40.0 → 5.42.0

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/capture-stacktrace.js

@@ -1,256 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-// @ts-check
-'use strict';
-
-const process = require('process');
-const fnInspect = require('@contrast/fn-inspect');
-const { primordials: { StringPrototypeReplace, RegExpPrototypeExec } } = require('@contrast/common');
-
-/** @typedef {import('.').Frame} Frame */
-/** @typedef {import('.').CreateSnapshotOpts} CreateSnapshotOpts */
-
-const EVAL_ORIGIN_REGEX = /\((.*?):(\d+):\d+\)/;
-
-module.exports = function(core) {
-  const { config, isAgentPath } = core;
-
-  const stacktraceFactory = new StacktraceFactory({
-    stackTraceLimit: config.agent.stack_trace_limit,
-    isAgentPath
-  });
-
-  /** @type {StacktraceFactory['captureStacktrace']} */
-  core.captureStacktrace = function (obj, opts, key) {
-    return stacktraceFactory.captureStacktrace(obj, opts, key);
-  };
-
-  /** @type {StacktraceFactory['createSnapshot']} */
-  core.createSnapshot = function (opts) {
-    return stacktraceFactory.createSnapshot(opts);
-  };
-
-  return core.captureStacktrace;
-};
-
-class StacktraceFactory {
-  /**
-   * The factory will set stacktrace limit for stackframe lists created by it.
-   * @param {Object} opts
-   * @param {number} opts.stackTraceLimit set the stack trace limit
-   * @param {(path: string) => boolean} opts.isAgentPath function indicating if path is agent code
-   */
-  constructor({ stackTraceLimit, isAgentPath }) {
-    this.stackTraceLimit = stackTraceLimit;
-    this.isAgentPath = isAgentPath;
-  }
-
-  /**
-   * @template T
-   * @param {T} obj
-   * @param {CreateSnapshotOpts} opts
-   * @param {string} key
-   * @returns {T}
-   */
-  captureStacktrace(obj, opts, key = 'stack') {
-    let stack;
-    const snapshot = this.createSnapshot(opts);
-    Object.defineProperty(obj, key, {
-      enumerable: true,
-      configurable: true,
-      get() {
-        if (!stack) {
-          Object.defineProperty(obj, key, {
-            configurable: true,
-            writable: true,
-            enumerable: true,
-            value: snapshot()
-          });
-        }
-        return obj[key];
-      }
-    });
-    return obj;
-  }
-
-  /**
-   * @param {Frame} frame
-   * @returns {boolean}
-   */
-  shouldAppendFrame(frame) {
-    return (
-      !!frame.file &&
-      !this.isAgentPath(frame.file) &&
-      !`${frame.type}${frame.method}`.includes('ContrastMethods')
-    );
-  }
-
-  /**
-   * Creates a function that will build a stacktrace when invoked. It will keep
-   * an error in a closure whose stack will be generated and processed when the
-   * returned function executes. The result will be cached.
-   * @param {CreateSnapshotOpts} params
-   * @returns {() => Frame[]}
-   */
-  createSnapshot({ constructorOpt, prependFrames } = {}) {
-    const target = {};
-    this.appendStackGetter(target, constructorOpt);
-
-    let frames;
-
-    /**
-     * Generates array of frames from `target`'s `stack` getter
-     * @returns {Frame[]}
-     */
-    const snapshot = () => {
-      if (!frames) {
-        // @ts-expect-error target has had a stack getter appended above.
-        const callsites = StacktraceFactory.generateCallsites(target) ?? [];
-        frames = callsites.reduce(
-          /**
-           * @param {Frame[]} acc
-           * @param {NodeJS.CallSite} callsite
-           */
-          (acc, callsite) => {
-            if (StacktraceFactory.isCallsiteValid(callsite)) {
-              const frame = StacktraceFactory.makeFrame(callsite);
-              if (this.shouldAppendFrame(frame)) {
-                acc.push(frame);
-              }
-            }
-
-            return acc;
-          },
-          [],
-        );
-      }
-
-      if (!prependFrames) return frames;
-
-      return [
-        ...prependFrames.map((f) => (typeof f == 'function' ? fnInspect.funcInfo(f) : f)),
-        ...frames,
-      ];
-    };
-
-    return snapshot;
-  }
-
-  /**
-   * Based on stacktrace limit and constructor opt, will append a stack getter
-   * @param {any} obj
-   * @param {Function=} constructorOpt
-   */
-  appendStackGetter(obj, constructorOpt) {
-    const { stackTraceLimit } = Error;
-    Error.stackTraceLimit = this.stackTraceLimit;
-    Error.captureStackTrace(obj, constructorOpt);
-    Error.stackTraceLimit = stackTraceLimit;
-  }
-
-  /**
-   * @param {any} callsite
-   * @returns {boolean}
-   */
-  static isCallsiteValid(callsite) {
-    return callsite instanceof Callsite;
-  }
-
-  /**
-   * Creates an array frame objects from an array of Callsite instances
-   * @param {NodeJS.CallSite} callsite
-   * @returns {Frame}
-   */
-  static makeFrame(callsite) {
-    /** @type {string | undefined} */
-    let evalOrigin;
-    /** @type {string | undefined} */
-    let file;
-    /** @type {number | null} */
-    let lineNumber = null;
-    /** @type {string | null} */
-    let method = null;
-    /** @type {string | null} */
-    let type;
-
-    if (callsite.isEval()) {
-      evalOrigin = StacktraceFactory.formatFileName(callsite.getEvalOrigin());
-      const matches = RegExpPrototypeExec.call(EVAL_ORIGIN_REGEX, evalOrigin);
-      if (matches) {
-        file = matches[1];
-        lineNumber = parseInt(matches[2]);
-      }
-    }
-
-    file = file ?? callsite.getFileName();
-    lineNumber = lineNumber ?? callsite.getLineNumber();
-    method = callsite.getFunctionName();
-    type = callsite.getTypeName();
-
-    if (method === null && type === 'Object') {
-      method = '<anonymous>';
-      type = null;
-    }
-
-    return { eval: evalOrigin, file, lineNumber, method, type };
-  }
-
-  /**
-   * @param {string} fileName
-   * @returns {string}
-   */
-  static formatFileName(fileName = '') {
-    const cwd = `${process.cwd()}/`;
-    const idx = fileName.indexOf(cwd);
-
-    if (idx > -1) {
-      return StringPrototypeReplace.call(fileName, cwd, ''); // + 1 to remove /
-    }
-    return fileName;
-  }
-
-  /**
-   * Will access `stack` getter propery on the provided error to generate
-   * a stacktrace. We capture the callsite instances passed to `prepareStacktrace`
-   * using an ephemeral monkey patch.
-   * @param {Error} error object with a `stack` getter property
-   * @returns {NodeJS.CallSite[]}
-   */
-  static generateCallsites(error) {
-    let callsites = [];
-
-    const { prepareStackTrace } = Error;
-
-    Error.prepareStackTrace = function contrastPrepareStackTrace(_, _callsites) {
-      callsites = _callsites;
-      return _callsites;
-    };
-
-    // accessing the getter will call `Error.prepareStacktrace`
-    error.stack;
-
-    // restore original method
-    Error.prepareStackTrace = prepareStackTrace;
-
-    return callsites;
-  }
-}
-
-module.exports.StacktraceFactory = StacktraceFactory;
-module.exports.generateCallsites = StacktraceFactory.generateCallsites;
-
-const Callsite = (module.exports.Callsite = StacktraceFactory.generateCallsites(
-  new Error()
-)[0].constructor);

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/contrast-methods.js

@@ -1,155 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { primordials: { StringPrototypeSlice } } = require('@contrast/common');
-
-module.exports = function (core) {
-  const { logger, patcher } = core;
-
-  const getOrig = (v) => patcher.unwrap(v);
-  const toUntrackedString = (v) => StringPrototypeSlice.call(` ${v}`, 1);
-
-  /**
-   * Components e.g. Assess, Protect, can
-   * 1) configure rewriter to add desired ContrastMethod functions to source code
-   * 2) patch those functions on `contrastMethods.api` in order to add instrumentation
-   */
-  core.contrastMethods = {
-    api: {
-      eval(val) {
-        return val;
-      },
-
-      // Assignment Operators
-      addAssign(left, right) {
-        return this.add(left, right);
-      },
-
-      // Binary Operators
-      add(left, right) {
-        const ret = getOrig(left) + getOrig(right);
-        return ret;
-      },
-      eqEq(left, right) {
-        left = getOrig(left);
-        right = getOrig(right);
-
-        return left == right;
-      },
-      eqEqEq(left, right) {
-        left = getOrig(left);
-        right = getOrig(right);
-
-        return left === right;
-      },
-      notEq(left, right) {
-        left = getOrig(left);
-        right = getOrig(right);
-
-        return left != right;
-      },
-      notEqEq(left, right) {
-        left = getOrig(left);
-        right = getOrig(right);
-
-        return left !== right;
-      },
-
-      // Computed Properties
-      // Used to force a copy of handle:
-      // https://stackoverflow.com/a/31733628
-      // This is a workaround for CONTRAST-30333, in which something we
-      // suspect is a v8 bug means that handle will otherwise be clobbered
-      // and if it was externalized, we will lose the data associated with it
-      forceCopy(handle) {
-        if (typeof handle === 'string') {
-          handle = toUntrackedString(handle);
-        }
-        return handle;
-      },
-
-      // Switch Case
-      cast(val) {
-        return getOrig(val);
-      },
-
-      /**
-       * Tagged Templates
-       * The first argument received by the tag function is an array of strings.
-       * For any template literal, its length is equal to the number of
-       * substitutions (occurrences of ${...}) plus one, and is therefore always
-       * non-empty.
-       * see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates
-       * @param {string[]} strings length n+1
-       * @param {string[]} args length n
-       * @returns {string}
-       */
-      tag(strings, ...args) {
-        const [first, ...rest] = strings;
-
-        return rest.reduce(
-          (result, str, i) => result.concat(args[i], str),
-          first,
-        );
-      },
-
-      // Injections
-      Function: core.patcher.patch(global.Function, {
-        name: 'global.Function',
-        patchType: 'rewrite-injection',
-      }),
-      Number: core.patcher.patch(global.Number, {
-        name: 'global.Number',
-        patchType: 'rewrite-injection',
-      }),
-      Object: core.patcher.patch(global.Object, {
-        name: 'global.Object',
-        patchType: 'rewrite-injection',
-      }),
-      String: core.patcher.patch(global.String, {
-        name: 'global.String',
-        patchType: 'rewrite-injection',
-      }),
-    },
-
-    installed: false,
-
-    getGlobal() {
-      return global;
-    },
-
-    install() {
-      if (this.installed) return;
-
-      try {
-        Object.defineProperty(this.getGlobal(), 'ContrastMethods', {
-          enumerable: true,
-          configurable: false,
-          value: this.api,
-        });
-
-        this.installed = true;
-      } catch (err) {
-        // We should never expect this since the installation process is well
-        // controlled, but still we should have the defensive code.
-        logger.error({ err }, 'Unable to define global.ContrastMethods');
-      }
-    },
-  };
-
-  return core.contrastMethods;
-};

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/index.d.ts

@@ -1,52 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-import { AppInfo, Messages, SystemInfo, ThreadTransferData } from '@contrast/common';
-
-interface Frame {
-  eval: string | undefined;
-  file: string | undefined;
-  lineNumber: number | null;
-  method: string | null;
-  type: string | null;
-}
-
-/* eslint-disable @typescript-eslint/ban-types */
-interface CreateSnapshotOpts {
-  constructorOpt?: Function;
-  prependFrames?: (Function | Frame)[];
-}
-
-export interface Core {
-  threadTransferData: ThreadTransferData;
-  agentName: string;
-  agentVersion: string;
-  reportingInstance: string;
-
-  appInfo: AppInfo;
-
-  captureStackTrace<T>(obj: T, opts: CreateSnapshotOpts, key: string): T;
-  createSnapshot(opts?: CreateSnapshotOpts): () => Frame[];
-
-  isAgentPath(path: string): boolean;
-
-  messages: Messages;
-
-  sensitiveDataMasking: any;
-
-  getSystemInfo(): Promise<SystemInfo>;
-  getBuildId(): Promse<number | void>;
-  Perf: any;
-}

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/ioc/core.js

@@ -1,95 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const EventEmitter = require('events');
-const Perf = require('@contrast/perf');
-
-const kComponentName = Symbol('kComponentName');
-
-class Core {
-  constructor(initData = {}) {
-    const core = this;
-    // setup perf tools
-
-    this.Perf = Perf;
-    this.perf = new Perf('core');
-    Perf.setInterval();
-
-    // setup messaging
-    this.messages = new EventEmitter();
-    // pad for number of components that listen for server-settings-update messages
-    this.messages.setMaxListeners(10 + this.messages.getMaxListeners());
-
-    // merge init data
-    Object.assign(this, { ...initData });
-
-    if (process.env.CONTRAST_EXT_PATH) {
-      const path = require('path');
-      require(path.resolve(process.env.CONTRAST_EXT_PATH))(this);
-    }
-
-    this.messages.on('ext:core.init', (fullName) => {
-      // if scopes is composed, then run our event handlers in a no-instrumentation scope
-      if (fullName == 'scopes') {
-        const store = { name: 'core.messages.emit', lock: true };
-        const emit = core.messages.emit.bind(core.messages);
-        core.messages.emit = function(...args) {
-          return core.scopes.instrumentation.isLocked() ?
-            core.scopes.instrumentation.run(store, emit, ...args) :
-            emit(...args);
-        };
-      }
-    });
-  }
-
-  /**
-   * Given a component factory and spec name will initialize the factory using perf.
-   * @param {function} factory the component factory function
-   * @param {string} specName id used by perf
-   */
-  initComponentFactory(factory, specName) {
-    this.perf.wrapInit(factory, specName)(this);
-  }
-
-  /**
-   * If component factory is decorated with metadata, then we can
-   * use the metadata to hook into core's extension events.
-   * @param {function} component
-   * @param {string} component.fullName
-   * @throws {Error} if component doesn't have appropriate metadata
-   */
-  initComponentSync(component) {
-    this.perf.wrapInit(component, component[kComponentName])(this);
-    this.messages.emit('ext:core.init', component[kComponentName]);
-  }
-
-  static isComponent(target) {
-    return typeof target == 'function' && target[kComponentName]?.length > 0;
-  }
-
-  static makeComponent(meta) {
-    if (!meta.factory || !meta.name) throw new Error('makeComponent requires factory and name');
-
-    // decorate with metadata
-    meta.factory[kComponentName] = meta.name;
-
-    return meta.factory;
-  }
-}
-
-module.exports = Core;
-module.exports.Core = Core;

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/is-agent-path.js

@@ -1,37 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-'use strict';
-
-module.exports = function(core) {
-  const { config } = core;
-
-  /**
-   * Returns true if the provided path matches any of the configured filters.
-   * @param {string} path
-   * @returns {boolean}
-   */
-  function isAgentPath(path) {
-    for (const seg of config.agent.stack_trace_filters) {
-      if (path.indexOf(seg) > -1) {
-        return true;
-      }
-    }
-    return false;
-  }
-
-  core.isAgentPath = isAgentPath;
-
-  return isAgentPath;
-};

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/messages.js

@@ -1,28 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const EventEmitter = require('events');
-
-module.exports = function init(core) {
-  const perf = new core.Perf('messages');
-  const messages = perf.wrapEmitter(new EventEmitter());
-
-  // pad for number of components that listen for server-settings-update messages
-  messages.setMaxListeners(10 + messages.getMaxListeners());
-
-  return core.messages = messages;
-};

package/node_modules/@contrast/sec-obs/node_modules/@contrast/core/lib/sensitive-data-masking/index.js

@@ -1,63 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { traverseKeys, primordials: { StringPrototypeToLowerCase } } = require('@contrast/common');
-const { CONTRAST_REDACTED } = require('./constants');
-
-module.exports = function(core) {
-  const idMap = new Map();
-  const keywordSets = [];
-
-  function getRedactedText(key) {
-    key = StringPrototypeToLowerCase.call(key);
-    for (const set of keywordSets) {
-      if (set.has(key)) {
-        return `${CONTRAST_REDACTED}-${idMap.get(set)}`;
-      }
-    }
-  }
-
-  function traverseAndMask(target, unmasked) {
-    let redactedText;
-    if (!target) return;
-
-    traverseKeys(target, (path, type, value, obj) => {
-      redactedText = getRedactedText(value);
-      if (redactedText) {
-        if (unmasked) unmasked.add(obj[value]);
-        obj[value] = redactedText;
-        redactedText = undefined;
-      }
-    });
-  }
-
-  const sensitiveDataMasking = core.sensitiveDataMasking = {
-    policy: {
-      idMap,
-      keywordSets,
-      maskHttpBody: false,
-      maskAttackVector: false,
-    },
-    getRedactedText,
-    traverseAndMask
-  };
-
-  require('./server-settings-listener')(core);
-  require('./protect-listener')(core);
-
-  return sensitiveDataMasking;
-};