@contrast/agent-bundle 5.41.0 → 5.45.1

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/server-inventory.d.ts

@@ -4,11 +4,11 @@ import { ContrastUIReporter } from '../types';
 import V1Endpoint from './v1-endpoint';
 export declare class ServerInventoryV1dot0 extends V1Endpoint {
     constructor(core: Core, uiReporter: ContrastUIReporter);
-    post(systemInfo: SystemInfo): Promise<import("axios").AxiosResponse<any, any>>;
+    post(systemInfo: SystemInfo): Promise<import("axios").AxiosResponse<any, any, {}>>;
 }
 export declare class ServerInventoryV1dot1 extends V1Endpoint {
     constructor(core: Core, uiReporter: ContrastUIReporter);
-    post(systemInfo: SystemInfo): Promise<import("axios").AxiosResponse<any, any>>;
+    post(systemInfo: SystemInfo): Promise<import("axios").AxiosResponse<any, any, {}>>;
 }
 type ServerInventoryEndpoint = ServerInventoryV1dot1 | ServerInventoryV1dot0;
 export default class ServerInventory extends V1Endpoint {
@@ -16,7 +16,7 @@ export default class ServerInventory extends V1Endpoint {
     uiReporter: ContrastUIReporter;
     endpoint: ServerInventoryEndpoint | null;
     constructor(core: Core, uiReporter: ContrastUIReporter);
-    post(): Promise<import("axios").AxiosResponse<any, any> | undefined>;
+    post(): Promise<import("axios").AxiosResponse<any, any, {}> | undefined>;
 }
 export {};
 //# sourceMappingURL=server-inventory.d.ts.map

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/index.d.ts

@@ -2,21 +2,22 @@ import { AxiosInstance } from 'axios';
 import { RequestStore } from '@contrast/common';
 import BaseReporter, { Core } from '../../../base';
 import NgEndpoint from '../ng-endpoint';
-export declare enum States {
-    INCOMPLETE = "INCOMPLETE",
-    COMPLETE = "COMPLETE"
-}
-export type Accum = {
-    messages: any[];
-    request?: any;
+export type AbstractFinding = {
+    events?: any[];
+    properties?: any;
+    ruleId: string;
+    time: number;
     routes?: any[];
-    state: States;
+};
+export type SourceFindingsAccum = {
+    findings: AbstractFinding[];
+    request?: any;
     store: RequestStore;
     timestamp: number;
 };
 export default class Traces extends NgEndpoint {
     hashSet: Set<any>;
-    accumMap: Map<RequestStore, Accum>;
+    findingsAccum: Map<RequestStore, SourceFindingsAccum>;
     reporter: BaseReporter;
     inProd: boolean;
     eventDetail: string;
@@ -26,8 +27,7 @@ export default class Traces extends NgEndpoint {
     initMessageListeners(): void;
     initIntervals(): void;
     getStore(msg: any): RequestStore | null;
-    getAccum(store: RequestStore): Accum;
-    initiateCompletenessCondition(accum: Accum): void;
+    getFindingsAccum(msg: any): SourceFindingsAccum | null;
     put(): Promise<void>;
     filter(): Promise<null | any[]>;
 }

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/index.js

@@ -29,37 +29,40 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.States = void 0;
 const common_1 = require("@contrast/common");
 const ng_endpoint_1 = __importDefault(require("../ng-endpoint"));
 const tx = __importStar(require("./translations"));
 const { StringPrototypeSplit } = common_1.primordials;
-var States;
-(function (States) {
-    States["INCOMPLETE"] = "INCOMPLETE";
-    States["COMPLETE"] = "COMPLETE";
-})(States || (exports.States = States = {}));
-// wait this long after request finishes before reporting in case findings occur in async activity
-const REPORT_WAIT_MS = 3000;
-const PROD = 'PRODUCTION';
+const FINDING_QUEUE_FLUSH_INTERVAL_MS = 2000;
+const DEDUPE_HASH_RESET_INTERVAL = 3000;
 class Traces extends ng_endpoint_1.default {
     constructor(core, uiReporter) {
         super(core, { ...uiReporter, url: '/api/ng/traces' });
         this.hashSet = new Set();
-        this.accumMap = new Map();
+        this.findingsAccum = new Map();
         this.reporter = uiReporter;
-        this.inProd = this.core.config.getEffectiveValue('server.environment') === PROD;
+        this.inProd = this.core.config.getEffectiveValue('server.environment') === common_1.ServerEnvironment.PRODUCTION;
         this.eventDetail = this.core.config.getEffectiveValue('assess.probabilistic_sampling.event_detail');
         this.initMessageListeners();
         this.initIntervals();
@@ -67,80 +70,76 @@ class Traces extends ng_endpoint_1.default {
     initMessageListeners() {
         this.reporter.subscribeWithLock(common_1.Event.SERVER_SETTINGS_UPDATE, (msg) => {
             // reset based on effective value
-            this.inProd = this.core.config.getEffectiveValue('server.environment') === PROD;
+            this.inProd = this.core.config.getEffectiveValue('server.environment') === common_1.ServerEnvironment.PRODUCTION;
         });
         this.reporter.subscribeWithLock(common_1.Event.ASSESS_DATAFLOW_FINDING, (msg) => {
-            const { ruleId, sinkEvent } = msg;
-            const store = this.getStore(msg);
-            if (!store)
+            const accum = this.getFindingsAccum(msg);
+            if (!accum)
                 return;
-            this.getAccum(store).messages.push({
+            const { store: { route } } = accum;
+            const { ruleId, sinkEvent } = msg;
+            accum.findings.push({
                 events: tx.getTraceEvents(sinkEvent, this.inProd, this.eventDetail),
                 properties: sinkEvent.properties,
+                routes: route ? tx.getRoutes(route, this.inProd) : undefined,
                 ruleId: ruleId === common_1.Rule.NOSQL_INJECTION_MONGO ? common_1.Rule.NOSQL_INJECTION : ruleId,
                 time: Date.now(),
             });
         });
         this.reporter.subscribeWithLock(common_1.Event.ASSESS_RESPONSE_SCANNING_FINDING, (msg) => {
-            const { ruleId, vulnerabilityMetadata } = msg;
-            const store = this.getStore(msg);
-            if (!store)
+            const accum = this.getFindingsAccum(msg);
+            if (!accum)
                 return;
-            this.getAccum(store).messages.push({
+            const { store: { route } } = accum;
+            const { ruleId, vulnerabilityMetadata } = msg;
+            accum.findings.push({
                 properties: vulnerabilityMetadata,
+                routes: route ? tx.getRoutes(route, this.inProd) : undefined,
                 ruleId,
                 time: Date.now(),
             });
         });
         this.reporter.subscribeWithLock(common_1.Event.ASSESS_SESSION_CONFIGURATION_FINDING, (msg) => {
-            const { ruleId, sinkEvent, properties } = msg;
-            const store = this.getStore(msg);
-            if (!store)
+            const accum = this.getFindingsAccum(msg);
+            if (!accum)
                 return;
-            this.getAccum(store).messages.push({
+            const { store: { route } } = accum;
+            const { ruleId, sinkEvent, properties } = msg;
+            accum.findings.push({
                 events: tx.getTraceEvents(sinkEvent, this.inProd, this.eventDetail),
                 properties,
+                routes: route ? tx.getRoutes(route, this.inProd) : undefined,
                 ruleId,
                 time: Date.now(),
             });
         });
         this.reporter.subscribeWithLock(common_1.Event.ASSESS_CRYPTO_ANALYSIS_FINDING, (msg) => {
-            const { ruleId, finding } = msg;
-            const store = this.getStore(msg);
-            if (!store)
+            const accum = this.getFindingsAccum(msg);
+            if (!accum)
                 return;
-            this.getAccum(store).messages.push({
+            const { store: { route } } = accum;
+            const { ruleId, finding } = msg;
+            accum.findings.push({
                 events: [tx.getCryptoEvent(finding)],
+                routes: route ? tx.getRoutes(route, this.inProd) : undefined,
                 ruleId,
                 time: Date.now(),
             });
         });
-        this.reporter.subscribeWithLock(common_1.Event.RESPONSE_FINISH, (store) => {
-            const { route, assess } = store;
-            // this event is emitted by agentify and is feature agnostic,
-            // so we need to check if the current request has assess enabled.
-            if (!assess?.policy)
-                return;
-            const accum = this.getAccum(store);
-            if (route) {
-                accum.routes = tx.getRoutes(route, this.inProd);
-            }
-            if (store?.sourceInfo) {
-                accum.request = tx.getRequest(store, this.inProd);
-            }
-            this.initiateCompletenessCondition(accum);
-        });
         this.reporter.subscribeWithLock(common_1.Event.UNINSTALL, () => {
             // should we log that we're dropping this data?
             this.hashSet.clear();
-            this.accumMap.clear();
+            this.findingsAccum.clear();
         });
     }
     initIntervals() {
+        this.reporter.setInterval(() => {
+            this.put();
+        }, FINDING_QUEUE_FLUSH_INTERVAL_MS);
         this.reporter.setInterval(() => {
             // this will take a little bit of pressure off of TS /preflight if we can dedupe
             this.hashSet.clear();
-        }, 3000);
+        }, DEDUPE_HASH_RESET_INTERVAL);
     }
     getStore(msg) {
         const store = this.core.scopes.sources.getStore();
@@ -151,23 +150,27 @@ class Traces extends ng_endpoint_1.default {
         }, 'skipping traces accumulation - no source info during event handling');
         return null;
     }
-    getAccum(store) {
-        let meta = this.accumMap.get(store);
-        if (!meta) {
-            meta = {
-                messages: [],
-                state: States.INCOMPLETE,
+    getFindingsAccum(msg) {
+        const store = this.getStore(msg);
+        if (!store?.assess?.policy)
+            return null;
+        let accum = this.findingsAccum.get(store);
+        if (!accum) {
+            accum = {
+                findings: [],
+                request: null,
                 store,
-                timestamp: Date.now(),
+                timestamp: Date.now()
             };
-            this.accumMap.set(store, meta);
+            this.findingsAccum.set(store, accum);
         }
-        return meta;
-    }
-    initiateCompletenessCondition(accum) {
-        setTimeout(() => {
-            accum.state = States.COMPLETE;
-        }, REPORT_WAIT_MS).unref();
+        if (accum.request) {
+            // todo: make sure standardNormalizedUri value is up-to-date given latest store data
+        }
+        else {
+            accum.request = tx.getRequest(store, this.inProd);
+        }
+        return accum;
     }
     async put() {
         const filtered = await this.filter();
@@ -201,36 +204,33 @@ class Traces extends ng_endpoint_1.default {
         }
     }
     async filter() {
-        const complete = [];
-        for (const accum of this.accumMap.values()) {
-            if (accum.state === States.COMPLETE) {
-                this.accumMap.delete(accum.store);
-                // flatten
-                accum.messages.forEach(({ ruleId, events, properties, time }) => {
-                    const traceData = {
-                        ruleId,
-                        properties,
-                        events,
-                        routes: accum.routes,
-                        request: accum.request,
-                        time
-                    };
-                    const hash = tx.getEventHash(traceData);
-                    if (!this.hashSet.has(hash)) {
-                        this.hashSet.add(hash);
-                        complete.push({ ...traceData, hash });
-                    }
-                });
-            }
+        const findingsToFilter = [];
+        for (const accum of this.findingsAccum.values()) {
+            accum.findings.forEach(({ events, properties, routes, ruleId, time }) => {
+                const traceData = {
+                    ruleId,
+                    properties,
+                    events,
+                    routes,
+                    request: accum.request,
+                    time
+                };
+                const hash = tx.getEventHash(traceData);
+                if (!this.hashSet.has(hash)) {
+                    this.hashSet.add(hash);
+                    findingsToFilter.push({ ...traceData, hash });
+                }
+            });
         }
-        if (!complete.length)
+        this.findingsAccum.clear();
+        if (!findingsToFilter.length)
             return null;
         try {
             const res = await this.client({
                 method: 'put',
                 url: 'api/ng/preflight',
                 data: {
-                    messages: complete.map((traceData, i) => {
+                    messages: findingsToFilter.map((traceData, i) => {
                         const { ruleId, routes, hash } = traceData;
                         return {
                             appLanguage: 'Node',
@@ -246,14 +246,14 @@ class Traces extends ng_endpoint_1.default {
                     tags: this.core.config.assess.tags || '',
                 }
             });
-            const itemsToReport = [];
+            const findingsToReport = [];
             // eslint-disable-next-line @typescript-eslint/ban-ts-comment
             // @ts-ignore
             for (const idx of StringPrototypeSplit.call(res.data, ',')) {
-                const item = complete[Number(idx)];
-                item && itemsToReport.push(item);
+                const item = findingsToFilter[Number(idx)];
+                item && findingsToReport.push(item);
             }
-            return itemsToReport;
+            return findingsToReport;
         }
         catch (err) {
             this.core.logger.error({ err }, 'failed put request to preflight');

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/translations.js

@@ -14,7 +14,18 @@
  * way not consistent with the End User License Agreement.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTraceEvents = exports.maskSensitiveTraceData = exports.getRequest = exports.maskSensitiveRequestData = exports.getRoutes = exports.topologicalSort = exports.getCryptoEvent = exports.getTraceEvent = exports.getEventHash = exports.getSignature = exports.getEventAction = exports.getTaintRanges = void 0;
+exports.getTaintRanges = getTaintRanges;
+exports.getEventAction = getEventAction;
+exports.getSignature = getSignature;
+exports.getEventHash = getEventHash;
+exports.getTraceEvent = getTraceEvent;
+exports.getCryptoEvent = getCryptoEvent;
+exports.topologicalSort = topologicalSort;
+exports.getRoutes = getRoutes;
+exports.maskSensitiveRequestData = maskSensitiveRequestData;
+exports.getRequest = getRequest;
+exports.maskSensitiveTraceData = maskSensitiveTraceData;
+exports.getTraceEvents = getTraceEvents;
 const crc_32_1 = require("crc-32");
 const common_1 = require("@contrast/common");
 const types_1 = require("./types");
@@ -54,7 +65,6 @@ function getTaintRanges(tags) {
     });
     return taintRanges;
 }
-exports.getTaintRanges = getTaintRanges;
 function getEventAction(event) {
     if (!event.history) {
         return 'CREATION';
@@ -66,7 +76,6 @@ function getEventAction(event) {
     const t = StringPrototypeSubstr.call(event.target, 0, 1);
     return `${s}2${t}`;
 }
-exports.getEventAction = getEventAction;
 function getSignature(event) {
     return {
         argTypes: event.args ? event.args.map(() => TYPE_NAME) : [TYPE_NAME],
@@ -77,7 +86,6 @@ function getSignature(event) {
         voidMethod: false,
     };
 }
-exports.getSignature = getSignature;
 function getEventHash(traceData) {
     const { ruleId, route, request, events, type = 'DATAFLOW' } = traceData;
     if (type == 'DATAFLOW') {
@@ -101,7 +109,6 @@ function getEventHash(traceData) {
         return hash;
     }
 }
-exports.getEventHash = getEventHash;
 function getTraceEvent(event, eventDetail = 'FULL') {
     let base;
     const action = getEventAction(event);
@@ -167,7 +174,6 @@ function getTraceEvent(event, eventDetail = 'FULL') {
         time: event.time || Date.now(),
     };
 }
-exports.getTraceEvent = getTraceEvent;
 function getCryptoEvent(finding) {
     return {
         action: 'TRIGGER',
@@ -201,13 +207,11 @@ function getCryptoEvent(finding) {
         type: 'METHOD',
     };
 }
-exports.getCryptoEvent = getCryptoEvent;
 function topologicalSort(sinkEvent) {
     const eventSet = new Set();
     traverse(sinkEvent, eventSet);
     return Array.from(eventSet).reverse();
 }
-exports.topologicalSort = topologicalSort;
 function traverse(event, eventSet) {
     eventSet.add(event);
     if (event.history) {
@@ -235,7 +239,6 @@ function getRoutes(route, prod) {
             signature: route.signature
         }];
 }
-exports.getRoutes = getRoutes;
 function maskSensitiveRequestData(req) {
     // Mask headers
     if (req.headers) {
@@ -270,7 +273,6 @@ function maskSensitiveRequestData(req) {
         req.body = MASK;
     return req;
 }
-exports.maskSensitiveRequestData = maskSensitiveRequestData;
 function getRequest(store, prod) {
     const { 
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -300,7 +302,6 @@ function getRequest(store, prod) {
         return request;
     }
 }
-exports.getRequest = getRequest;
 function maskSensitiveTraceData(event) {
     if (event.result?.tracked)
         event.result.value = MASK;
@@ -323,7 +324,6 @@ function maskSensitiveTraceData(event) {
     });
     return event;
 }
-exports.maskSensitiveTraceData = maskSensitiveTraceData;
 function getTraceEvents(sinkEvent, prod, eventDetail) {
     const sortedEvents = topologicalSort(sinkEvent);
     if (prod) {
@@ -333,5 +333,4 @@ function getTraceEvents(sinkEvent, prod, eventDetail) {
         return sortedEvents.map((v) => getTraceEvent(v, eventDetail));
     }
 }
-exports.getTraceEvents = getTraceEvents;
 //# sourceMappingURL=translations.js.map

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/utils.js

@@ -17,7 +17,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createV1Client = exports.createNgClient = exports.getSessionMetadata = exports.base64Encode = exports.isAuthError = exports.checkIsArchived = void 0;
+exports.checkIsArchived = checkIsArchived;
+exports.isAuthError = isAuthError;
+exports.base64Encode = base64Encode;
+exports.getSessionMetadata = getSessionMetadata;
+exports.createNgClient = createNgClient;
+exports.createV1Client = createV1Client;
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const https_1 = require("https");
@@ -32,14 +37,12 @@ const AUTH_ERR_STATUS_CODES = [401, 403];
 function checkIsArchived(response) {
     return (response?.status === 404 && response?.data?.success === false) || response?.status === 409;
 }
-exports.checkIsArchived = checkIsArchived;
 /**
  * 401 or 403 indicate an authentication error.
  */
 function isAuthError(response) {
     return response?.status && AUTH_ERR_STATUS_CODES.includes(response?.status);
 }
-exports.isAuthError = isAuthError;
 /**
  * Returns `true` when an error response indicates that the agent should uninstall.
  */
@@ -49,7 +52,6 @@ function shouldUninstall(err) {
 function base64Encode(str, urlSafe) {
     return BufferPrototypeToString.call(BufferFrom(str), urlSafe ? 'base64url' : 'base64');
 }
-exports.base64Encode = base64Encode;
 /**
  * Retrieve the configured session_metadata, appending the computed `buildId`.
  */
@@ -61,7 +63,6 @@ async function getSessionMetadata(core) {
     const artifactMetadata = `artifactHash=${buildId}`;
     return metadata ? `${metadata},${artifactMetadata}` : artifactMetadata;
 }
-exports.getSessionMetadata = getSessionMetadata;
 function createClient(core, options) {
     const { certificate, proxy } = core.config.api;
     const logger = core.logger.child({ name: 'contrast:http' });
@@ -165,7 +166,6 @@ function createNgClient(core) {
         },
     });
 }
-exports.createNgClient = createNgClient;
 function createV1Client(core) {
     return createClient(core, {
         headers: {
@@ -177,5 +177,4 @@ function createV1Client(core) {
         },
     });
 }
-exports.createV1Client = createV1Client;
 //# sourceMappingURL=utils.js.map

package/node_modules/@contrast/reporter/lib/reporters/file.js

@@ -39,7 +39,7 @@ class FileReporter extends base_1.default {
             common_1.Event.ASSESS_CRYPTO_ANALYSIS_FINDING,
             common_1.Event.LIBRARY_USAGE,
             common_1.Event.LIBRARY,
-            common_1.Event.PROTECT,
+            common_1.Event.PROTECT_FINDING,
             common_1.Event.ARCHITECTURE_COMPONENT,
             common_1.Event.ROUTE_COVERAGE_DISCOVERY_FINISHED,
             common_1.Event.ROUTE_COVERAGE_OBSERVATION,

package/node_modules/@contrast/reporter/lib/reporters/security-logger/index.d.ts

@@ -1,4 +1,4 @@
-import { RequestStore } from '@contrast/common';
+import { ProtectFindingEventArg, RequestStore } from '@contrast/common';
 import { SyslogLevel } from '@contrast/config';
 import BaseReporter, { Core } from '../base';
 type Outcome = 'INEFFECTIVE' | 'BLOCKED' | 'EXPLOITED' | 'SUSPICIOUS' | 'success';
@@ -25,10 +25,9 @@ export default class SecurityLogger extends BaseReporter {
     private formatDate;
     log(level: SyslogLevel, metadata: Metadata, message: string): void;
     private buildMetadata;
-    private handleProtectResult;
     install(): Promise<void>;
     handleAssessEvent(store: RequestStore): void;
-    handleProtectEvent(store: RequestStore): void;
+    handleProtectEvent(eventArg: ProtectFindingEventArg): void;
 }
 export {};
 //# sourceMappingURL=index.d.ts.map