@contrast/agent-bundle 5.46.0 → 5.48.0

package/node_modules/@pinojs/redact/test/prototype-pollution.test.js

@@ -0,0 +1,223 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+/* eslint-disable no-proto */
+
+test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property if it exists as a regular property
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: constructor.prototype path should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    constructor: {
+      prototype: { isAdmin: true }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['constructor.prototype.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the constructor.prototype property if it exists as a regular property
+  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: nested __proto__ should not pollute', () => {
+  const obj = {
+    user: {
+      settings: {
+        __proto__: { isAdmin: true }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.settings.__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the nested __proto__ property
+  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: bracket notation __proto__ should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['["__proto__"]["isAdmin"]'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property when accessed via bracket notation
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: wildcard with __proto__ should not pollute', () => {
+  const obj = {
+    users: {
+      __proto__: { isAdmin: true },
+      user1: { name: 'john' },
+      user2: { name: 'jane' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact only own properties
+  assert.strictEqual(result.users.user1, '[REDACTED]')
+  assert.strictEqual(result.users.user2, '[REDACTED]')
+
+  // __proto__ should only be redacted if it's an own property, not inherited
+  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
+    assert.strictEqual(result.users.__proto__, '[REDACTED]')
+  }
+})
+
+test('prototype pollution: malicious JSON payload should not pollute', () => {
+  // Simulate a malicious payload that might come from JSON.parse
+  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(maliciousObj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // The malicious payload should have been redacted
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: verify prototype chain is preserved', () => {
+  function CustomClass () {
+    this.data = 'test'
+  }
+  CustomClass.prototype.method = function () { return 'original' }
+
+  const obj = new CustomClass()
+
+  const redact = slowRedact({
+    paths: ['data'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should redact the data property
+  assert.strictEqual(result.data, '[REDACTED]')
+
+  // Should preserve the original prototype chain
+  assert.strictEqual(result.method(), 'original')
+  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
+})
+
+test('prototype pollution: setValue should not create prototype pollution', () => {
+  const obj = { user: { name: 'john' } }
+
+  // Try to pollute via non-existent path that could create __proto__
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should not create the path if it doesn't exist
+  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
+  if (result.__proto__) {
+    assert.strictEqual(result.__proto__.isAdmin, undefined)
+  }
+})
+
+test('prototype pollution: deep nested prototype properties should not pollute', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          __proto__: { isAdmin: true },
+          constructor: {
+            prototype: { isEvil: true }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: [
+      'level1.level2.level3.__proto__.isAdmin',
+      'level1.level2.level3.constructor.prototype.isEvil'
+    ],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual(Object.prototype.isEvil, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+  assert.strictEqual({}.isEvil, undefined)
+
+  // Should redact the deep nested properties
+  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
+  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
+})

package/node_modules/@pinojs/redact/test/selective-clone.test.js

@@ -0,0 +1,115 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+test('selective cloning shares references for non-redacted paths', () => {
+  const sharedObject = { unchanged: 'data' }
+  const obj = {
+    toRedact: 'secret',
+    shared: sharedObject,
+    nested: {
+      toRedact: 'secret2',
+      shared: sharedObject
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['toRedact', 'nested.toRedact'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Redacted values should be different
+  assert.strictEqual(result.toRedact, '[REDACTED]')
+  assert.strictEqual(result.nested.toRedact, '[REDACTED]')
+
+  // Non-redacted references should be shared (same object reference)
+  assert.strictEqual(result.shared, obj.shared)
+  assert.strictEqual(result.nested.shared, obj.nested.shared)
+
+  // The shared object should be the exact same reference
+  assert.strictEqual(result.shared, sharedObject)
+  assert.strictEqual(result.nested.shared, sharedObject)
+})
+
+test('selective cloning works with arrays', () => {
+  const sharedItem = { unchanged: 'data' }
+  const obj = {
+    items: [
+      { secret: 'hidden1', shared: sharedItem },
+      { secret: 'hidden2', shared: sharedItem },
+      sharedItem
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Secrets should be redacted
+  assert.strictEqual(result.items[0].secret, '[REDACTED]')
+  assert.strictEqual(result.items[1].secret, '[REDACTED]')
+
+  // Shared references should be preserved where possible
+  // Note: array items with secrets will be cloned, but their shared properties should still reference the original
+  assert.strictEqual(result.items[0].shared, sharedItem)
+  assert.strictEqual(result.items[1].shared, sharedItem)
+
+  // The third item gets cloned due to wildcard, but should have the same content
+  assert.deepStrictEqual(result.items[2], sharedItem)
+  // Note: Due to wildcard '*', all array items are cloned, even if they don't need redaction
+  // This is still a significant optimization for object properties that aren't in wildcard paths
+})
+
+test('selective cloning with no paths returns original object', () => {
+  const obj = { data: 'unchanged' }
+  const redact = slowRedact({
+    paths: [],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should return the exact same object reference
+  assert.strictEqual(result, obj)
+})
+
+test('selective cloning performance - large objects with minimal redaction', () => {
+  // Create a large object with mostly shared data
+  const sharedData = { large: 'data'.repeat(1000) }
+  const obj = {
+    secret: 'hidden',
+    shared1: sharedData,
+    shared2: sharedData,
+    nested: {
+      secret: 'hidden2',
+      shared3: sharedData,
+      deep: {
+        shared4: sharedData,
+        moreShared: sharedData
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['secret', 'nested.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Verify redaction worked
+  assert.strictEqual(result.secret, '[REDACTED]')
+  assert.strictEqual(result.nested.secret, '[REDACTED]')
+
+  // Verify shared references are preserved
+  assert.strictEqual(result.shared1, sharedData)
+  assert.strictEqual(result.shared2, sharedData)
+  assert.strictEqual(result.nested.shared3, sharedData)
+  assert.strictEqual(result.nested.deep.shared4, sharedData)
+  assert.strictEqual(result.nested.deep.moreShared, sharedData)
+})

package/node_modules/@pinojs/redact/tsconfig.json

@@ -0,0 +1,19 @@
+{
+    "compilerOptions": {
+        "module": "commonjs",
+        "lib": [
+            "es6"
+        ],
+        "noImplicitAny": true,
+        "noImplicitThis": true,
+        "strictFunctionTypes": true,
+        "strictNullChecks": true,
+        "types": [],
+        "noEmit": true,
+        "forceConsistentCasingInFileNames": true
+    },
+    "files": [
+        "index.d.ts",
+        "index.test-d.ts"
+    ]
+}

package/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Thu, 02 Oct 2025 02:06:47 GMT
+ * Last updated: Tue, 11 Nov 2025 23:33:13 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/node/assert.d.ts

@@ -44,6 +44,13 @@ declare module "assert" {
              * @default true
              */
             strict?: boolean | undefined;
+            /**
+             * If set to `true`, skips prototype and constructor
+             * comparison in deep equality checks.
+             * @since v24.9.0
+             * @default false
+             */
+            skipPrototype?: boolean | undefined;
         }
         interface Assert extends Pick<typeof assert, AssertMethodNames> {
             readonly [kOptions]: AssertOptions & { strict: false };
@@ -67,7 +74,8 @@ declare module "assert" {
              * ```
              *
              * **Important**: When destructuring assertion methods from an `Assert` instance,
-             * the methods lose their connection to the instance's configuration options (such as `diff` and `strict` settings).
+             * the methods lose their connection to the instance's configuration options (such
+             * as `diff`, `strict`, and `skipPrototype` settings).
              * The destructured methods will fall back to default behavior instead.
              *
              * ```js
@@ -81,6 +89,33 @@ declare module "assert" {
              * strictEqual({ a: 1 }, { b: { c: 1 } });
              * ```
              *
+             * The `skipPrototype` option affects all deep equality methods:
+             *
+             * ```js
+             * class Foo {
+             *   constructor(a) {
+             *     this.a = a;
+             *   }
+             * }
+             *
+             * class Bar {
+             *   constructor(a) {
+             *     this.a = a;
+             *   }
+             * }
+             *
+             * const foo = new Foo(1);
+             * const bar = new Bar(1);
+             *
+             * // Default behavior - fails due to different constructors
+             * const assert1 = new Assert();
+             * assert1.deepStrictEqual(foo, bar); // AssertionError
+             *
+             * // Skip prototype comparison - passes if properties are equal
+             * const assert2 = new Assert({ skipPrototype: true });
+             * assert2.deepStrictEqual(foo, bar); // OK
+             * ```
+             *
              * When destructured, methods lose access to the instance's `this` context and revert to default assertion behavior
              * (diff: 'simple', non-strict mode).
              * To maintain custom options when using destructured methods, avoid
@@ -88,7 +123,7 @@ declare module "assert" {
              * @since v24.6.0
              */
             new(
-                options?: AssertOptions & { strict?: true },
+                options?: AssertOptions & { strict?: true | undefined },
             ): AssertStrict;
             new(
                 options: AssertOptions,

package/node_modules/@types/node/buffer.buffer.d.ts

@@ -451,7 +451,16 @@ declare module "buffer" {
              */
             subarray(start?: number, end?: number): Buffer<TArrayBuffer>;
         }
+        // TODO: remove globals in future version
+        /**
+         * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+         * TypeScript versions earlier than 5.7.
+         */
         type NonSharedBuffer = Buffer<ArrayBuffer>;
+        /**
+         * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+         * TypeScript versions earlier than 5.7.
+         */
         type AllowSharedBuffer = Buffer<ArrayBufferLike>;
     }
     /** @deprecated Use `Buffer.allocUnsafeSlow()` instead. */

package/node_modules/@types/node/buffer.d.ts

@@ -59,7 +59,7 @@ declare module "buffer" {
      * @since v19.4.0, v18.14.0
      * @param input The input to validate.
      */
-    export function isUtf8(input: Buffer | ArrayBuffer | NodeJS.TypedArray): boolean;
+    export function isUtf8(input: ArrayBuffer | NodeJS.TypedArray): boolean;
     /**
      * This function returns `true` if `input` contains only valid ASCII-encoded data,
      * including the case in which `input` is empty.
@@ -68,7 +68,7 @@ declare module "buffer" {
      * @since v19.6.0, v18.15.0
      * @param input The input to validate.
      */
-    export function isAscii(input: Buffer | ArrayBuffer | NodeJS.TypedArray): boolean;
+    export function isAscii(input: ArrayBuffer | NodeJS.TypedArray): boolean;
     export let INSPECT_MAX_BYTES: number;
     export const kMaxLength: number;
     export const kStringMaxLength: number;
@@ -113,7 +113,11 @@ declare module "buffer" {
      * @param fromEnc The current encoding.
      * @param toEnc To target encoding.
      */
-    export function transcode(source: Uint8Array, fromEnc: TranscodeEncoding, toEnc: TranscodeEncoding): Buffer;
+    export function transcode(
+        source: Uint8Array,
+        fromEnc: TranscodeEncoding,
+        toEnc: TranscodeEncoding,
+    ): NonSharedBuffer;
     /**
      * Resolves a `'blob:nodedata:...'` an associated `Blob` object registered using
      * a prior call to `URL.createObjectURL()`.
@@ -330,7 +334,7 @@ declare module "buffer" {
              * @return The number of bytes contained within `string`.
              */
             byteLength(
-                string: string | Buffer | NodeJS.ArrayBufferView | ArrayBuffer | SharedArrayBuffer,
+                string: string | NodeJS.ArrayBufferView | ArrayBufferLike,
                 encoding?: BufferEncoding,
             ): number;
             /**