@contrast/agent-bundle 5.41.0 → 5.45.1

package/node_modules/@contrast/reporter/lib/reporters/security-logger/index.js

@@ -29,13 +29,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -61,6 +71,12 @@ const LEVEL_VALUES = {
     trace: 0
 };
 const { StringPrototypeReplaceAll } = common_1.primordials;
+const rulesThatExploitWithoutFindings = new Set([
+    common_1.Rule.CMD_INJECTION_COMMAND_BACKDOORS,
+    common_1.Rule.CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
+    common_1.Rule.CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
+    common_1.Rule.PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
+]);
 class SecurityLogger extends base_1.default {
     constructor(core, name = 'security-logger') {
         super(core, name);
@@ -98,8 +114,8 @@ class SecurityLogger extends base_1.default {
             });
         });
         if (core.config.protect.enable) {
-            this.subscribeWithLock(common_1.Event.PROTECT, (store) => {
-                this.handleProtectEvent(store);
+            this.subscribeWithLock(common_1.Event.PROTECT_FINDING, (eventArg) => {
+                this.handleProtectEvent(eventArg);
             });
         }
     }
@@ -152,97 +168,67 @@ class SecurityLogger extends base_1.default {
             outcome,
         };
     }
-    handleProtectResult(store, rule, result) {
-        if (!store?.protect && !store?.sourceInfo)
+    async install() { }
+    /* c8 ignore next 3 */
+    handleAssessEvent(store) {
+        // Assess NYI
+    }
+    handleProtectEvent(eventArg) {
+        if (!eventArg.store.protect || !eventArg.store.sourceInfo)
             return;
-        const mode = store.protect?.policy[rule] || common_1.ProtectRuleMode.OFF;
-        if (mode === common_1.ProtectRuleMode.OFF)
+        const { findings, result, store: { sourceInfo } } = eventArg;
+        if (result.ruleId == common_1.Rule.VIRTUAL_PATCH) {
+            const level = this.loggerConfig.syslog.severity_blocked;
+            this.log(level, {
+                vpi: findings.uuid,
+                ...this.buildMetadata(sourceInfo, 'success'),
+            }, messages.virtualPatch({ name: result.key, uuid: findings.uuid }));
             return;
-        if (rule === common_1.Rule.BOT_BLOCKER) {
+        }
+        if (result.ruleId === common_1.Rule.BOT_BLOCKER) {
             const level = this.loggerConfig.syslog.severity_blocked;
             this.log(level, {
                 bbi: 'Contrast Bot Blocker',
-                ...this.buildMetadata(store.sourceInfo, 'success'),
+                ...this.buildMetadata(sourceInfo, 'success'),
             }, messages.botBlocker(result));
-            return;
         }
-        const detail = Array.isArray(result.exploitMetadata) && result.exploitMetadata.length > 0
-            ? result.exploitMetadata[0]
-            : null;
-        let level;
-        let outcome;
-        let message;
-        if (result.blocked) {
-            outcome = 'BLOCKED';
-            message = messages.successfulAttack;
-            level = this.loggerConfig.syslog.severity_blocked;
+        else if (result.ruleId == common_1.Rule.IP_DENYLIST) {
+            const level = this.loggerConfig.syslog.severity_blocked;
+            this.log(level, {
+                bli: findings.uuid,
+                ...this.buildMetadata(sourceInfo, 'success'),
+            }, messages.ipDenyList(sourceInfo.ip, findings));
         }
         else {
-            if (detail) {
-                level = this.loggerConfig.syslog.severity_exploited;
-                outcome = 'EXPLOITED';
+            let level;
+            let outcome;
+            let message;
+            if (result.blocked) {
+                outcome = 'BLOCKED';
                 message = messages.successfulAttack;
-            }
-            else if (result.score >= 90) {
-                level = this.loggerConfig.syslog.severity_probed;
-                outcome = 'INEFFECTIVE';
-                message = messages.ineffectiveAttack;
+                level = this.loggerConfig.syslog.severity_blocked;
             }
             else {
-                // is this suspicious?
-                return;
+                if (findings || rulesThatExploitWithoutFindings.has(result.ruleId)) {
+                    level = this.loggerConfig.syslog.severity_exploited;
+                    outcome = 'EXPLOITED';
+                    message = messages.successfulAttack;
+                }
+                else if ((result.score ?? 0) >= 90) {
+                    level = this.loggerConfig.syslog.severity_probed;
+                    outcome = 'INEFFECTIVE';
+                    message = messages.ineffectiveAttack;
+                }
+                else {
+                    // is this suspicious?
+                    return;
+                }
             }
+            this.log(level, {
+                pri: result.mappedId,
+                ...this.buildMetadata(sourceInfo, outcome),
+            }, message(result));
         }
-        this.log(level, {
-            pri: result.mappedId,
-            ...this.buildMetadata(store.sourceInfo, outcome),
-        }, message(result));
-    }
-    async install() { }
-    /* c8 ignore next 3 */
-    handleAssessEvent(store) {
-        // Assess NYI
-    }
-    handleProtectEvent(store) {
-        if (!store.protect || !store.sourceInfo)
-            return;
-        const { protect, sourceInfo } = store;
-        const virtualPatchResults = protect.resultsMap[common_1.Rule.VIRTUAL_PATCH];
-        if (virtualPatchResults) {
-            virtualPatchResults.forEach((result) => {
-                const level = this.loggerConfig.syslog.severity_blocked;
-                this.log(level, {
-                    vpi: result.uuid,
-                    ...this.buildMetadata(sourceInfo, 'success'),
-                }, messages.virtualPatch(result));
-            });
-        }
-        const ipDenyListResults = protect.resultsMap[common_1.Rule.IP_DENYLIST];
-        if (ipDenyListResults) {
-            ipDenyListResults.forEach((result) => {
-                const level = this.loggerConfig.syslog.severity_blocked;
-                this.log(level, {
-                    bli: result.uuid,
-                    ...this.buildMetadata(sourceInfo, 'success'),
-                }, messages.ipDenyList(sourceInfo.ip, result));
-            });
-        }
-        const { commonResultsMap, hardeningResultsMap, semanticResultsMap } = (0, common_1.groupResultsMap)(protect.resultsMap);
-        Object.entries(commonResultsMap).forEach(([rule, results]) => {
-            results.forEach((result) => {
-                this.handleProtectResult(store, rule, result);
-            });
-        });
-        Object.entries(hardeningResultsMap).forEach(([rule, results]) => {
-            results.forEach((result) => {
-                this.handleProtectResult(store, rule, result);
-            });
-        });
-        Object.entries(semanticResultsMap).forEach(([rule, results]) => {
-            results.forEach((result) => {
-                this.handleProtectResult(store, rule, result);
-            });
-        });
     }
 }
 exports.default = SecurityLogger;

package/node_modules/@contrast/reporter/lib/reporters/security-logger/messages.js

@@ -14,7 +14,12 @@
  * way not consistent with the End User License Agreement.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.suspiciousAttack = exports.ineffectiveAttack = exports.successfulAttack = exports.botBlocker = exports.ipDenyList = exports.virtualPatch = void 0;
+exports.virtualPatch = virtualPatch;
+exports.ipDenyList = ipDenyList;
+exports.botBlocker = botBlocker;
+exports.successfulAttack = successfulAttack;
+exports.ineffectiveAttack = ineffectiveAttack;
+exports.suspiciousAttack = suspiciousAttack;
 const INPUT_TYPE_MAP = {
     Body: 'body segment',
     CookieName: 'cookie',
@@ -33,15 +38,12 @@ const INPUT_TYPE_MAP = {
 function virtualPatch(result) {
     return `Virtual Patch ${result.name} - ${result.uuid} was triggered by this request.`;
 }
-exports.virtualPatch = virtualPatch;
 function ipDenyList(ip, result) {
     return `IP Address ${ip} matched the disallowed value ${result.ip} in the IP Blacklist ${result.uuid}`;
 }
-exports.ipDenyList = ipDenyList;
 function botBlocker(result) {
     return `User agent ${result.value} matched the disallowed value ${result?.idsList?.[0]}`;
 }
-exports.botBlocker = botBlocker;
 function successfulAttack(result) {
     if (!result.key) {
         return `An effective attack was detected against "${result.mappedId}"`;
@@ -49,7 +51,6 @@ function successfulAttack(result) {
     const inputType = INPUT_TYPE_MAP[result.inputType] || INPUT_TYPE_MAP.Unknown;
     return `The ${inputType} "${result.key}" had a value that successfully exploited "${result.mappedId}" - "${result.value}"`;
 }
-exports.successfulAttack = successfulAttack;
 function ineffectiveAttack(result) {
     if (!result.key) {
         return `An unsuccessful attack was detected against "${result.mappedId}"`;
@@ -57,7 +58,6 @@ function ineffectiveAttack(result) {
     const inputType = INPUT_TYPE_MAP[result.inputType] || INPUT_TYPE_MAP.Unknown;
     return `The ${inputType} "${result.key}" had a value that matched a signature for, but did not successfully exploit "${result.mappedId}" - "${result.value}"`;
 }
-exports.ineffectiveAttack = ineffectiveAttack;
 /* c8 ignore next 8 */
 function suspiciousAttack(result) {
     if (!result.key) {
@@ -66,5 +66,4 @@ function suspiciousAttack(result) {
     const inputType = INPUT_TYPE_MAP[result.inputType] || INPUT_TYPE_MAP.Unknown;
     return `The ${inputType} "${result.key}" included a potential attack that was detected as suspcious using "${result.mappedId}" - "${result.value}"`;
 }
-exports.suspiciousAttack = suspiciousAttack;
 //# sourceMappingURL=messages.js.map

package/node_modules/@contrast/reporter/lib/validators.js

@@ -13,7 +13,6 @@
  * way not consistent with the End User License Agreement.
  */
 'use strict';
-Object.defineProperty(exports, "__esModule", { value: true });
 const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-ignore

package/node_modules/@contrast/reporter/node_modules/sonic-boom/.husky/pre-commit

@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
 
 npm test

package/node_modules/@contrast/reporter/node_modules/sonic-boom/.taprc

@@ -0,0 +1,5 @@
+flow: false
+ts: false
+jsx: false
+timeout: 120
+check-coverage: false

package/node_modules/@contrast/reporter/node_modules/sonic-boom/README.md

@@ -68,7 +68,7 @@ The options are:
 * `mode`: specify the creating file `mode` (see [fs.open()](https://nodejs.org/api/fs.html#fsopenpath-flags-mode-callback) from Node.js core).
 * `mkdir`: ensure directory for dest file exists when `true` (default `false`).
 * `retryEAGAIN(err, writeBufferLen, remainingBufferLen)`: a function that will be called when sonic-boom
-    write/writeSync/flushSync encounters a EAGAIN or EBUSY error. If the return value is
+    write/writeSync/flushSync encounters a EAGAIN error. If the return value is
     true sonic-boom will retry the operation, otherwise it will bubble the
     error. `err` is the error that caused this function to be called,
     `writeBufferLen` is the length of the buffer sonic-boom tried to write, and
@@ -83,13 +83,11 @@ For `sync:true` this is not relevant because the `'ready'` event will be fired w
 Writes the string to the file.
 It will return false to signal the producer to slow down.
 
-### SonicBoom#flush([cb])
+### SonicBoom#flush()
 
 Writes the current buffer to the file if a write was not in progress.
 Do nothing if `minLength` is zero or if it is already writing.
 
-call the callback when the flush operation is completed. when failed the callback is called with an error.
-
 ### SonicBoom#reopen([file])
 
 Reopen the file in place, useful for log rotation.

package/node_modules/@contrast/reporter/node_modules/sonic-boom/bench.js

@@ -11,16 +11,15 @@ const sonic = new SonicBoom({ fd })
 const sonic4k = new SonicBoom({ fd, minLength: 4096 })
 const sonicSync = new SonicBoom({ fd, sync: true })
 const sonicSync4k = new SonicBoom({ fd, minLength: 4096, sync: true })
-const sonicBuffer = new SonicBoom({ fd, contentMode: 'buffer' })
-const sonic4kBuffer = new SonicBoom({ fd, contentMode: 'buffer', minLength: 4096 })
-const sonicSyncBuffer = new SonicBoom({ fd, contentMode: 'buffer', sync: true })
-const sonicSync4kBuffer = new SonicBoom({ fd, contentMode: 'buffer', minLength: 4096, sync: true })
 const dummyConsole = new Console(fs.createWriteStream('/dev/null'))
 
 const MAX = 10000
 
-const buf = Buffer.alloc(50, 'hello', 'utf8')
-const str = buf.toString()
+let str = ''
+
+for (let i = 0; i < 10; i++) {
+  str += 'hello'
+}
 
 setTimeout(doBench, 100)
 
@@ -60,36 +59,6 @@ const run = bench([
       dummyConsole.log(str)
     }
     setImmediate(cb)
-  },
-  function benchSonicBuf (cb) {
-    sonicBuffer.once('drain', cb)
-    for (let i = 0; i < MAX; i++) {
-      sonicBuffer.write(buf)
-    }
-  },
-  function benchSonicSyncBuf (cb) {
-    sonicSyncBuffer.once('drain', cb)
-    for (let i = 0; i < MAX; i++) {
-      sonicSyncBuffer.write(buf)
-    }
-  },
-  function benchSonic4kBuf (cb) {
-    sonic4kBuffer.once('drain', cb)
-    for (let i = 0; i < MAX; i++) {
-      sonic4kBuffer.write(buf)
-    }
-  },
-  function benchSonicSync4kBuf (cb) {
-    sonicSync4kBuffer.once('drain', cb)
-    for (let i = 0; i < MAX; i++) {
-      sonicSync4kBuffer.write(buf)
-    }
-  },
-  function benchCoreBuf (cb) {
-    core.once('drain', cb)
-    for (let i = 0; i < MAX; i++) {
-      core.write(buf)
-    }
   }
 ], 1000)