@contrast/agent-bundle 5.42.0 → 5.45.1

package/node_modules/@contrast/library-analysis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/library-analysis",
-  "version": "1.45.0",
+  "version": "1.47.1",
   "description": "Handles library reporting and library usage analysis",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,17 +14,17 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/code-events": "^3.1.0",
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
+    "@contrast/code-events": "^4.0.2",
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/logger": "1.28.0",
+    "@contrast/logger": "1.30.1",
     "semver": "^7.6.0"
   }
 }

package/node_modules/@contrast/logger/lib/index.js

@@ -29,18 +29,29 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.kChildren = void 0;
+exports.default = init;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = require("node:os");
@@ -128,5 +139,4 @@ function init(core, opts = {}) {
     }
     return logger;
 }
-exports.default = init;
 //# sourceMappingURL=index.js.map

package/node_modules/@contrast/logger/lib/serializers.js

@@ -14,7 +14,11 @@
  * way not consistent with the End User License Agreement.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.res = exports.req = exports.metrics = exports.err = exports.config = void 0;
+exports.err = void 0;
+exports.config = config;
+exports.metrics = metrics;
+exports.req = req;
+exports.res = res;
 const common_1 = require("@contrast/common");
 const pino_1 = require("pino");
 /**
@@ -34,7 +38,6 @@ function config(config) {
     }
     return safeCopy;
 }
-exports.config = config;
 /**
  * Hides the `stdout` and `stderr` fields from child_process errors since they
  * are extremely verbose.
@@ -44,7 +47,6 @@ exports.err = pino_1.stdSerializers.wrapErrorSerializer(({ stdout, stderr, ...er
 function metrics({ start, timeout, ...metrics }) {
     return metrics;
 }
-exports.metrics = metrics;
 /**
  * Serializes requests for the contrast-ui http logger.
  */
@@ -60,7 +62,6 @@ function req(config) {
         contentLength: config.headers?.['Content-Length'] // only present on response.config
     };
 }
-exports.req = req;
 /**
  * Serializes response for the contrast-ui http logger.
  */
@@ -71,5 +72,4 @@ function res(response) {
         data: response.data !== '' ? response.data : undefined,
     };
 }
-exports.res = res;
 //# sourceMappingURL=serializers.js.map

package/node_modules/@contrast/logger/lib/utils.d.ts

@@ -1,9 +1,3 @@
-/// <reference types="node" />
-/// <reference types="mocha" />
-/// <reference types="node" />
-/// <reference types="node" />
-/// <reference types="node" />
-/// <reference types="node" />
 /**
  * @deprecated this is a relic from when we used transports.
  *

package/node_modules/@contrast/logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/logger",
-  "version": "1.28.0",
+  "version": "1.30.1",
   "description": "Centralized logging for Contrast agent services",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,15 +14,15 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "build": "tsc --build src/",
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.1",
     "pino": "^8.15.0"
   }
 }

package/node_modules/@contrast/metrics/lib/index.d.ts

@@ -1,9 +1,9 @@
 declare function _exports(core: {
-    config: import('@contrast/config').Config;
-    depHooks: import('@contrast/dep-hooks').DepHooks;
-    logger: import('@contrast/logger').Logger;
-    patcher: import('@contrast/patcher').Patcher;
-    metrics?: import("@contrast/common").Installable | undefined;
-}): import('@contrast/common').Installable;
+    config: import("@contrast/config").Config;
+    depHooks: import("@contrast/dep-hooks").DepHooks;
+    logger: import("@contrast/logger").Logger;
+    patcher: import("@contrast/patcher").Patcher;
+    metrics?: import("@contrast/common").Installable;
+}): import("@contrast/common").Installable;
 export = _exports;
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@contrast/metrics/lib/index.js

@@ -13,7 +13,6 @@
  * way not consistent with the End User License Agreement.
  */
 'use strict';
-Object.defineProperty(exports, "__esModule", { value: true });
 const { randomUUID } = require('node:crypto');
 const { kServerResponse } = require('node:_http_server');
 const { symbols: { kMetrics } } = require('@contrast/common');

package/node_modules/@contrast/metrics/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/metrics",
-  "version": "1.32.0",
+  "version": "1.34.1",
   "description": "Records and logs route latency",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,17 +14,17 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >=8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "build": "tsc --build src/",
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/patcher": "1.27.0"
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.1",
+    "@contrast/dep-hooks": "1.26.1",
+    "@contrast/logger": "1.30.1",
+    "@contrast/patcher": "1.29.1"
   }
 }

package/node_modules/@contrast/patcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/patcher",
-  "version": "1.27.0",
+  "version": "1.29.1",
   "description": "Advanced monkey patching--registers hooks to run in and around functions",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,12 +14,12 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/logger": "1.28.0"
+    "@contrast/logger": "1.30.1"
   }
 }

package/node_modules/@contrast/perf/package.json

@@ -1,21 +1,24 @@
 {
   "name": "@contrast/perf",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Performance measurement",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
   "type": "commonjs",
   "types": "types/index.d.ts",
   "files": [
-    "lib/"
+    "lib/",
+    "!*.test.*",
+    "!tsconfig.*",
+    "!*.map"
   ],
   "main": "lib/index.js",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
-    "test": "../scripts/test.sh"
+    "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
     "sonic-boom": "^4.1.0"

package/node_modules/@contrast/protect/lib/hardening/handlers.js

@@ -18,6 +18,7 @@
 const {
   BLOCKING_MODES,
   isString,
+  InputType,
   Rule: { UNTRUSTED_DESERIALIZATION }
 } = require('@contrast/common');
 
@@ -25,6 +26,7 @@ const NODE_SERIALIZE_RCE_TOKEN = '_$$ND_FUNC$$_';
 
 module.exports = function(core) {
   const {
+    protect,
     protect: {
       hardening,
       throwSecurityException,
@@ -40,32 +42,46 @@ module.exports = function(core) {
     return results;
   }
 
-  hardening.handleUntrustedDeserialization = function(sourceContext, sinkContext) {
-    const ruleId = UNTRUSTED_DESERIALIZATION;
-    const mode = sourceContext.policy[ruleId];
-    const { name, value, stacktraceOpts } = sinkContext;
+  function handleFindings(sourceContext, sinkContext, ruleId, result, findings, mode) {
+    const { stacktraceOpts } = sinkContext;
 
-    if (mode === 'off') return;
+    captureStacktrace(sinkContext, stacktraceOpts);
+    getResults(sourceContext, ruleId).push(result);
 
-    if (name === 'node-serialize.unserialize') {
-      if (!isString(value) || !value.indexOf(NODE_SERIALIZE_RCE_TOKEN)) return;
+    let blockInfo;
+    if (BLOCKING_MODES.includes(mode)) {
+      result.blocked = true;
+      blockInfo = [mode, ruleId];
+      sourceContext.securityException = blockInfo;
+    }
 
-      const blocked = BLOCKING_MODES.includes(mode);
-      const results = getResults(sourceContext, ruleId);
+    protect.reportFinding({ findings, result, sinkContext });
 
-      captureStacktrace(sinkContext, stacktraceOpts);
-      results.push({
-        value: sinkContext.value,
-        blocked,
-        exploitMetadata: [{ deserializer: name, command: false }],
-        sinkContext,
-      });
+    if (blockInfo) throwSecurityException(sourceContext);
+  }
 
-      if (blocked) {
-        sourceContext.securityException = [mode, ruleId];
-        throwSecurityException(sourceContext);
-      }
-    }
+  hardening.handleUntrustedDeserialization = function (sourceContext, sinkContext) {
+    const ruleId = UNTRUSTED_DESERIALIZATION;
+    const mode = sourceContext.policy.getRuleMode(ruleId);
+    const { name, value } = sinkContext;
+
+    if (
+      mode === 'off' ||
+      name !== 'node-serialize.unserialize' ||
+      !isString(value) ||
+      !value.indexOf(NODE_SERIALIZE_RCE_TOKEN)
+    ) return;
+
+    const result = {
+      value: sinkContext.value,
+      ruleId: UNTRUSTED_DESERIALIZATION,
+      blocked: false,
+      exploited: true,
+      inputType: InputType.UNKNOWN,
+    };
+    const findings = { deserializer: name, command: false };
+
+    handleFindings(sourceContext, sinkContext, ruleId, result, findings, mode);
   };
 
   return hardening;

package/node_modules/@contrast/protect/lib/index.d.ts

@@ -13,7 +13,7 @@
  * way not consistent with the End User License Agreement.
  */
 
-import { ReqData, ProtectMessage, ResultMap, ProtectRuleMode, Blocker } from '@contrast/common';
+import { ReqData, ProtectMessage, ResultMap, ProtectRuleMode, Blocker, ProtectFindingEventArg } from '@contrast/common';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import * as http from 'node:http';
 import * as https from 'node:https';
@@ -60,7 +60,8 @@ export interface Protect {
   makeSourceContext: (req: IncomingMessage, res: ServerResponse) => ProtectRequestStore,
   throwSecurityException: (sourceContext: ProtectRequestStore) => void,
   policy: ProtectPolicy,
-  getPolicy(): ProtectPolicy, // creates copy for request scope
+  getPolicy: () => ProtectPolicy, // creates copy for request scope
+  reportFindings: (e: ProtectFindingEventArg) => void,
   inputAnalysis: {
     handleConnect: (sourceContext: ProtectRequestStore, connectInputs: ConnectInputs) => undefined | [string, string],
     handleRequestEnd: (sourceContext: ProtectRequestStore) => void, //NYI

package/node_modules/@contrast/protect/lib/index.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { isMainThread } = require('node:worker_threads');
-const { callChildComponentMethodsSync } = require('@contrast/common');
+const { callChildComponentMethodsSync, Event } = require('@contrast/common');
 const { ConfigSource } = require('@contrast/config');
 
 module.exports = function(core) {
@@ -37,7 +37,7 @@ module.exports = function(core) {
   require('./hardening')(core);
   require('./semantic-analysis')(core);
 
-  protect.install = function() {
+  protect.install = function install() {
     // only force instrumentation if assess is explicitly enabled in local config
     const forceInstrumentation =
       config.preinstrument &&
@@ -60,6 +60,13 @@ module.exports = function(core) {
     ctx.store.protect = protect.makeSourceContext(ctx);
   });
 
+  protect.reportFinding = function reportFinding(data) {
+    core.messages.emit(Event.PROTECT_FINDING, {
+      store: core.scopes.sources.getStore(),
+      ...data,
+    });
+  };
+
   return protect;
 };