@contrast/agent-bundle 5.40.0 → 5.42.0

package/node_modules/@contrast/sources/lib/source-info.js

@@ -0,0 +1,183 @@
+/*
+ * Copyright: 2025 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  primordials: {
+    RegExpPrototypeExec,
+    StringPrototypeReplace,
+    StringPrototypeSlice,
+    StringPrototypeSplit,
+    StringPrototypeToLowerCase,
+  }
+} = require('@contrast/common');
+
+const NormalizationPatterns = {
+  UUID: [/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, '{uuid}'],
+  NUMERICAL: [/^\d+$/i, '{n}'],
+  HASH: [/([a-fA-F0-9]{2}){16,}/, '{hash}'],
+  // we can extend these as needed
+};
+
+class HttpSourceInfo {
+  /**
+   * @param {object} param
+   * @param {string} param.serverType
+   * @param {any} param.normalizedUriMapper
+   * @param {IncomingMessage} param.raw
+   */
+  constructor({
+    serverType,
+    normalizedUriMapper,
+    raw,
+  }) {
+    this._headerLookupCache = {};
+    this._normalizedUri = null;
+    this._normalizedUriMasked = null;
+    this._normalizedUriSegments = [];
+    this._normalizedUriMapper = normalizedUriMapper;
+    //
+    this.httpVersion = raw.httpVersion;
+    this.ip = raw.socket.remoteAddress ? StringPrototypeReplace.call(raw.socket.remoteAddress, /::ffff:/, '') : undefined;
+    this.port = raw.socket.address?.()?.port || 0;
+    this.protocol = serverType == 'http' ? 'http' : 'https'; // todo
+    this.serverType = serverType;
+    this.time = Date.now();
+    this.method = StringPrototypeToLowerCase.call(raw.method);
+    this.rawHeaders = [];
+
+    for (let i = 0; i < raw.rawHeaders.length; i += 2) {
+      const iNext = i + 1;
+      const headerName = StringPrototypeToLowerCase.call(raw.rawHeaders[i]);
+
+      headerName == 'content-type' && (this.contentType = raw.rawHeaders[iNext]);
+
+      this.rawHeaders[i] = headerName;
+      this.rawHeaders[iNext] = headerName == 'content-type' ?
+        StringPrototypeToLowerCase.call(raw.rawHeaders[iNext]) :
+        raw.rawHeaders[iNext];
+
+      if (
+        headerName == 'upgrade' &&
+        StringPrototypeToLowerCase.call(this.rawHeaders[iNext]) == 'websocket'
+      ) {
+        this.protocol = 'ws';
+      }
+    }
+
+    const idx = raw.url.indexOf('?');
+    if (idx >= 0) {
+      this.uriPath = StringPrototypeSlice.call(raw.url, 0, idx);
+      this.queries = StringPrototypeSlice.call(raw.url, idx + 1);
+    } else {
+      this.uriPath = raw.url;
+      this.queries = '';
+    }
+  }
+
+  /**
+   * Looks through rawHeaders to find it. Caches results to avoid subsequent lookups.
+   * @param {string} name needs to be lowercase
+   * @returns {string}
+   */
+  getHeader(name) {
+    if (name in this._headerLookupCache) return this._headerLookupCache[name];
+
+    for (let i = 0; i < this.rawHeaders.length; i += 2) {
+      if (name == this.rawHeaders[i]) {
+        return (this._headerLookupCache[name] = this.rawHeaders[i + 1]);
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * The normalizedUri is a computed field
+   */
+  get normalizedUri() {
+    const r = Reflect.get(this, '_normalizedUri');
+    if (!r) this.generateNormalizedUri();
+    return Reflect.get(this, '_normalizedUri');
+  }
+
+  set normalizedUri(value) {
+    Reflect.set(this, '_normalizedUri', value);
+  }
+
+  generateNormalizedUri() {
+    let normalizedUri;
+
+    // leverage route discovery data to try to find route template
+    normalizedUri = this._normalizedUriMapper?.map?.(this.uriPath);
+
+    if (normalizedUri) {
+      // if we can map to the template we can use it for masked value too
+      this._normalizedUri = normalizedUri;
+      this._normalizedUriMasked = normalizedUri;
+    } else {
+      // if we can't find the template then test against common
+      // regular expressions to normalize/mask each segment per spec
+      const arr = StringPrototypeSplit.call(this.uriPath, '/');
+      let maskedUri = '';
+
+      normalizedUri = '';
+
+      for (let idx = 1; idx < arr.length; idx++) {
+        let normalSeg = arr[idx];
+        let maskedSeg = normalSeg;
+
+        let isPattern;
+
+        for (const [rx, substitution] of Object.values(NormalizationPatterns)) {
+          isPattern = !!RegExpPrototypeExec.call(rx, normalSeg);
+          if (isPattern) {
+            normalSeg = maskedSeg = substitution;
+            break;
+          }
+        }
+
+        if (!isPattern) {
+          if (idx > 1) {
+            maskedSeg = `${StringPrototypeSlice.call(normalSeg, 0, 2)}xxxx`;
+          } else {
+            // no masking/normalizing for first seg (called "context" in spec)
+            maskedSeg = arr[idx];
+          }
+        }
+
+        maskedUri += `/${maskedSeg}`;
+        normalizedUri += `/${normalSeg}`;
+      }
+
+      this._normalizedUri = normalizedUri;
+      this._normalizedUriMasked = maskedUri;
+    }
+  }
+
+  get normalizedUriMasked() {
+    const r = Reflect.get(this, '_normalizedUriMasked');
+    if (!r) this.generateNormalizedUri();
+    return Reflect.get(this, '_normalizedUriMasked');
+  }
+
+  set normalizedUriMasked(value) {
+    Reflect.set(this, '_normalizedUriMasked', value);
+  }
+}
+
+module.exports.HttpSourceInfo = HttpSourceInfo;
+module.exports.NORMALIZE_PATTERNS = NormalizationPatterns;

package/node_modules/@contrast/sources/lib/source-info.test.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const { expect } = require('chai');
+const mocks = require('@contrast/test/mocks');
+
+const { HttpSourceInfo } = require('./source-info');
+
+describe('sources SourceInfo', function () {
+  [
+    {
+      uriPath: '/index',
+      expectedNormalized: '/index',
+      expectedNormalizedMasked: '/index',
+    },
+    {
+      uriPath: '/orders/abc-123',
+      expectedNormalized: '/orders/abc-123',
+      expectedNormalizedMasked: '/orders/abxxxx',
+    },
+    {
+      uriPath: '/orders/abc-123/item/123',
+      expectedNormalized: '/orders/abc-123/item/{n}',
+      expectedNormalizedMasked: '/orders/abxxxx/itxxxx/{n}',
+    },
+    {
+      uriPath: '/orders/1234',
+      expectedNormalized: '/orders/{n}',
+      expectedNormalizedMasked: '/orders/{n}',
+    },
+    {
+      uriPath: '/orders/93a0862a-09be-4292-bc6a-50d38dded69c',
+      expectedNormalized: '/orders/{uuid}',
+      expectedNormalizedMasked: '/orders/{uuid}',
+    },
+    {
+      uriPath: '/orders/0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c',
+      expectedNormalized: '/orders/{hash}',
+      expectedNormalizedMasked: '/orders/{hash}',
+    },
+  ].forEach(({
+    uriPath,
+    expectedNormalized,
+    expectedNormalizedMasked,
+  }) => {
+    it(`normalizedUri and normalizedUriMasked are built correctly: ${uriPath}`, function () {
+      const req = mocks.incomingMessage();
+      req.url = `${uriPath}?${req.queries}`;
+
+      const info = new HttpSourceInfo({
+        serverType: 'http',
+        raw: req
+      });
+      expect(info.normalizedUri).to.equal(expectedNormalized);
+      expect(info.normalizedUriMasked).to.equal(expectedNormalizedMasked);
+    });
+  });
+
+  it('trims IPv6 prefixes from mapped IPv4 addresses', function () {
+    const req = mocks.incomingMessage();
+    req.socket.remoteAddress = '::ffff:127.0.0.1';
+
+    const info = new HttpSourceInfo({
+      serverType: 'http',
+      raw: req
+    });
+    expect(info.ip).to.equal('127.0.0.1');
+  });
+});

package/node_modules/@contrast/sources/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@contrast/sources",
+  "version": "1.1.0",
+  "description": "Instruments to have incoming messages run in async-local request scope.",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "@contrast/common": "1.35.0",
+    "@contrast/core": "1.55.0",
+    "on-finished": "^2.4.1"
+  }
+}

package/node_modules/@contrast/telemetry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/telemetry",
-  "version": "1.29.2",
+  "version": "1.30.0",
   "description": "Telemetry reporting for the Contrast Node.js agent.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,11 +19,11 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.34.2",
-    "@contrast/config": "1.49.2",
-    "@contrast/core": "1.54.2",
-    "@contrast/logger": "1.27.2",
-    "axios": "^1.7.4",
+    "@contrast/common": "1.35.0",
+    "@contrast/config": "1.50.0",
+    "@contrast/core": "1.55.0",
+    "@contrast/logger": "1.28.0",
+    "axios": "^1.11.0",
     "getmac": "^6.3.0"
   }
 }