@contrast/agent-bundle 5.47.0 → 5.48.0

package/node_modules/@contrast/agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "5.47.0",
+  "version": "5.48.0",
   "description": "Assess and Protect agents for Node.js",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -28,15 +28,15 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.59.0",
-    "@contrast/architecture-components": "1.47.0",
-    "@contrast/assess": "1.65.0",
+    "@contrast/agentify": "1.59.1",
+    "@contrast/architecture-components": "1.47.1",
+    "@contrast/assess": "1.66.0",
     "@contrast/common": "1.38.0",
-    "@contrast/core": "1.59.0",
-    "@contrast/library-analysis": "1.49.0",
-    "@contrast/protect": "1.70.0",
-    "@contrast/route-coverage": "1.51.0",
-    "@contrast/sec-obs": "1.3.0",
-    "@contrast/telemetry": "1.34.0"
+    "@contrast/core": "1.59.1",
+    "@contrast/library-analysis": "1.49.1",
+    "@contrast/protect": "1.71.0",
+    "@contrast/route-coverage": "1.52.0",
+    "@contrast/sec-obs": "1.3.1",
+    "@contrast/telemetry": "1.34.1"
   }
 }

package/node_modules/@contrast/agentify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agentify",
-  "version": "1.59.0",
+  "version": "1.59.1",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,21 +21,21 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.0",
-    "@contrast/core": "1.59.0",
-    "@contrast/deadzones": "1.31.0",
-    "@contrast/dep-hooks": "1.28.0",
-    "@contrast/esm-hooks": "2.34.0",
+    "@contrast/config": "1.54.1",
+    "@contrast/core": "1.59.1",
+    "@contrast/deadzones": "1.31.1",
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/esm-hooks": "2.34.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/instrumentation": "1.38.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/metrics": "1.36.0",
-    "@contrast/patcher": "1.31.0",
+    "@contrast/instrumentation": "1.38.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/metrics": "1.36.1",
+    "@contrast/patcher": "1.31.1",
     "@contrast/perf": "1.4.0",
-    "@contrast/reporter": "1.57.0",
-    "@contrast/rewriter": "1.36.0",
-    "@contrast/scopes": "1.29.0",
-    "@contrast/sources": "1.5.0",
+    "@contrast/reporter": "1.57.1",
+    "@contrast/rewriter": "1.36.1",
+    "@contrast/scopes": "1.29.1",
+    "@contrast/sources": "1.5.1",
     "on-finished": "^2.4.1",
     "semver": "^7.6.0"
   }

package/node_modules/@contrast/architecture-components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/architecture-components",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "Detects external systems being connected to by applications.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,8 +21,8 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/dep-hooks": "1.28.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/patcher": "1.31.0"
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1"
   }
 }

package/node_modules/@contrast/assess/lib/configuration-analysis/install/apollo-server.js

@@ -39,7 +39,7 @@ module.exports = function (core) {
   const apolloServer = core.assess.configurationAnalysis.apolloServer = {};
 
   apolloServer.install = function () {
-    return depHooks.resolve({ name: '@apollo/server', version: '>=4', file: 'dist/cjs' }, (xport) => {
+    return depHooks.resolve({ name: '@apollo/server', version: '>=4' }, (xport) => {
       if (!xport.ApolloServer) return;
       patcher.patch(xport, 'ApolloServer', {
         name: '@apollo/server.ApolloServer',

package/node_modules/@contrast/assess/lib/configuration-analysis/install/graphql-yoga.js

@@ -39,7 +39,7 @@ module.exports = function (core) {
   const graphqlYoga = core.assess.configurationAnalysis.graphqlYoga = {};
 
   graphqlYoga.install = function () {
-    return depHooks.resolve({ name: '@graphql-yoga/plugin-disable-introspection', version: '*', file: 'cjs' }, (xport) => patcher.patch(xport, 'useDisableIntrospection', {
+    return depHooks.resolve({ name: '@graphql-yoga/plugin-disable-introspection', version: '*' }, (xport) => patcher.patch(xport, 'useDisableIntrospection', {
       name: '@graphql-yoga/plugin-disable-introspection.useDisableIntrospection',
       patchType,
       post(data) {

package/node_modules/@contrast/assess/lib/dataflow/sinks/install/fs.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
         tracker,
         sinks: { isVulnerable, reportFindings },
       },
+      ruleScopes
     },
   } = core;
 
@@ -60,12 +61,12 @@ module.exports = function(core) {
     }, []);
   }
 
-  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
+  const around = (name, method, moduleName = 'fs', fullMethodName = '') => (next, data) => {
     const { name: methodName, indices } = method;
-    if (!getSinkContext(ruleId)) return;
+    if (!getSinkContext(ruleId)) return next();
 
     const values = getValues(indices, data.args);
-    if (!values.length) return;
+    if (!values.length) return next();
 
     const args = values.map((v) => {
       const strInfo = tracker.getData(v);
@@ -111,6 +112,7 @@ module.exports = function(core) {
         });
       }
     }
+    return ruleScopes.run(ruleId, next);
   };
 
   core.assess.dataflow.sinks.pathTraversal = {
@@ -123,7 +125,7 @@ module.exports = function(core) {
             patcher.patch(fs, method.name, {
               name,
               patchType,
-              pre: pre(name, method),
+              around: around(name, method),
             });
           }
 
@@ -134,19 +136,10 @@ module.exports = function(core) {
               patcher.patch(fs, syncName, {
                 name,
                 patchType,
-                pre: pre(name, method, 'fs', syncName),
+                around: around(name, method, 'fs', syncName),
               });
             }
           }
-
-          if (method.promises && fs.promises && fs.promises[method.name]) {
-            const name = `fs.promises.${method.name}`;
-            patcher.patch(fs.promises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fs.promises'),
-            });
-          }
         }
       });
 
@@ -157,7 +150,7 @@ module.exports = function(core) {
             patcher.patch(fsPromises, method.name, {
               name,
               patchType,
-              pre: pre(name, method, 'fsPromises'),
+              around: around(name, method, 'fsPromises'),
             });
           }
         }

package/node_modules/@contrast/assess/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,17 +21,17 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.0",
-    "@contrast/core": "1.59.0",
-    "@contrast/dep-hooks": "1.28.0",
+    "@contrast/config": "1.54.1",
+    "@contrast/core": "1.59.1",
+    "@contrast/dep-hooks": "1.28.1",
     "@contrast/distringuish": "^6.0.2",
-    "@contrast/instrumentation": "1.38.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/patcher": "1.31.0",
-    "@contrast/rewriter": "1.36.0",
-    "@contrast/route-coverage": "1.51.0",
-    "@contrast/scopes": "1.29.0",
-    "@contrast/sources": "1.5.0",
+    "@contrast/instrumentation": "1.38.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1",
+    "@contrast/rewriter": "1.36.1",
+    "@contrast/route-coverage": "1.52.0",
+    "@contrast/scopes": "1.29.1",
+    "@contrast/sources": "1.5.1",
     "semver": "^7.6.0"
   }
 }

package/node_modules/@contrast/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/config",
-  "version": "1.54.0",
+  "version": "1.54.1",
   "description": "An API for discovering Contrast agent configuration data",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/core": "1.59.0",
+    "@contrast/core": "1.59.1",
     "deepmerge": "^4.3.1",
     "yaml": "^2.2.2"
   }

package/node_modules/@contrast/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.59.0",
+  "version": "1.59.1",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,11 +20,11 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.0",
+    "@contrast/config": "1.54.1",
     "@contrast/find-package-json": "^1.1.0",
     "@contrast/fn-inspect": "^5.0.2",
-    "@contrast/logger": "1.32.0",
-    "@contrast/patcher": "1.31.0",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1",
     "@contrast/perf": "1.4.0",
     "@tsxper/crc32": "^2.1.3",
     "axios": "^1.12.2",

package/node_modules/@contrast/deadzones/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/deadzones",
-  "version": "1.31.0",
+  "version": "1.31.1",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,8 +21,8 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/dep-hooks": "1.28.0",
-    "@contrast/patcher": "1.31.0",
-    "@contrast/scopes": "1.29.0"
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/patcher": "1.31.1",
+    "@contrast/scopes": "1.29.1"
   }
 }

package/node_modules/@contrast/dep-hooks/lib/export-handler-registry.js

@@ -120,16 +120,7 @@ class ExportHandlerRegistry {
      * @returns {PackageFinder.Metadata?}
      */
     resolveMetadata(filename) {
-        let metadata = PackageFinder.resolveMetadata(filename, this.nodeModulesDir, this.logger);
-        // See NODE-3859
-        // In rare cases, a library can be structured in such a way that require()-able sub-directories
-        // also contain a package.json with little metadata which is resolved first and then
-        // instrumentation will fail because it doesn't match the target library
-        if (!metadata?.name || !metadata?.version) {
-            this.logger?.debug('incomplete info found in %s; searching in parent directories', filename);
-            metadata = PackageFinder.resolveMetadata(path.resolve(filename, '..'), this.nodeModulesDir, this.logger);
-        }
-        return metadata;
+        return PackageFinder.resolveMetadata(filename, this.nodeModulesDir, this.logger);
     }
     /**
      * Iterates all descriptors pertaining to the currently-loading export. It

package/node_modules/@contrast/dep-hooks/lib/export-hook-descriptor.js

@@ -52,7 +52,7 @@ class ExportHookDescriptor {
         this.name = Module.isBuiltin(name) ? StringPrototypeReplace.call(name, /^(node:)?/, 'node:') : name;
         /** @type {string=} */
         // @ts-ignore ts does not handle method overloads well
-        this.file = file ? StringPrototypeReplace.call(file, /\/?(index)?(\.js)?$/, '') : undefined;
+        this.file = file ? StringPrototypeReplace.call(file, /\/?(index)?(\.c?js)?$/, '') : undefined;
         /** @type {string} */
         this.shortname = this.file ? path.posix.join(this.name, this.file) : this.name;
         /** @type {string} */

package/node_modules/@contrast/dep-hooks/lib/index.d.ts

@@ -51,7 +51,7 @@ declare class DepHooks {
     /** @type {Set<string>} */
     resets: Set<string>;
     /**
-     * Registers handlers to run afer the described module is required.
+     * Registers handlers to run after the described module is required.
      * @template {Object} T
      * @param {ExportHookDescriptor.Descriptor | string} descriptor describes the module to hook
      * @param {ExportHookDescriptor.Handler<T>[]} handlers the function hooks to execute after require

package/node_modules/@contrast/dep-hooks/lib/index.js

@@ -52,7 +52,7 @@ class DepHooks {
         this.resets = new Set();
     }
     /**
-     * Registers handlers to run afer the described module is required.
+     * Registers handlers to run after the described module is required.
      * @template {Object} T
      * @param {ExportHookDescriptor.Descriptor | string} descriptor describes the module to hook
      * @param {ExportHookDescriptor.Handler<T>[]} handlers the function hooks to execute after require

package/node_modules/@contrast/dep-hooks/lib/package-finder.d.ts

@@ -38,7 +38,8 @@ export type Metadata = {
  * @param {string=} file Absolute path to the module file
  * @param {string=} nodeModulesDir Absolute path to the node_modules directory
  * @param {import('pino').Logger=} logger
+ * @param {string=} startAt Optional path to start searching for package.json from when recursing
  * @returns {Metadata?}
  */
-export function resolveMetadata(file?: string | undefined, nodeModulesDir?: string | undefined, logger?: import("pino").Logger | undefined): Metadata | null;
+export function resolveMetadata(file?: string | undefined, nodeModulesDir?: string | undefined, logger?: import("pino").Logger | undefined, startAt?: string | undefined): Metadata | null;
 //# sourceMappingURL=package-finder.d.ts.map

package/node_modules/@contrast/dep-hooks/lib/package-finder.js

@@ -33,9 +33,10 @@ const { primordials: { StringPrototypeReplace, StringPrototypeSubstring, JSONPar
  * @param {string=} file Absolute path to the module file
  * @param {string=} nodeModulesDir Absolute path to the node_modules directory
  * @param {import('pino').Logger=} logger
+ * @param {string=} startAt Optional path to start searching for package.json from when recursing
  * @returns {Metadata?}
  */
-function resolveMetadata(file, nodeModulesDir, logger) {
+function resolveMetadata(file, nodeModulesDir, logger, startAt) {
     if (!file) {
         return null;
     }
@@ -50,7 +51,7 @@ function resolveMetadata(file, nodeModulesDir, logger) {
             shortname: file,
         };
     }
-    const resolved = path.dirname(file);
+    const resolved = path.dirname(startAt ?? file);
     const pdj = findPackageJsonSync({ cwd: resolved, stopAt: nodeModulesDir });
     if (!pdj) {
         logger?.error('unable to find package.json for %s', file);
@@ -60,6 +61,14 @@ function resolveMetadata(file, nodeModulesDir, logger) {
         const json = FsReadFileSync(pdj, 'utf8');
         const { name, version, main } = JSONParse(json);
         const packageDir = path.dirname(pdj);
+        // See NODE-3859
+        // In rare cases, a library can be structured in such a way that require()-able sub-directories
+        // also contain a package.json with little metadata which is resolved first and then
+        // instrumentation will fail because it doesn't match the target library
+        if (!name || !version) {
+            logger?.trace({ file }, 'incomplete package.json found at %s; searching in parent directories', pdj);
+            return resolveMetadata(file, nodeModulesDir, logger, packageDir);
+        }
         return {
             name,
             version: semver.clean(version, { loose: true }),

package/node_modules/@contrast/dep-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/dep-hooks",
-  "version": "1.28.0",
+  "version": "1.28.1",
   "description": "Post hooks for Module.prototype.require",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/core": "1.59.0",
+    "@contrast/core": "1.59.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/logger": "1.32.0",
+    "@contrast/logger": "1.32.1",
     "semver": "^7.6.3"
   }
 }

package/node_modules/@contrast/esm-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/esm-hooks",
-  "version": "2.34.0",
+  "version": "2.34.1",
   "type": "module",
   "description": "Support for loading and instrumenting ECMAScript modules",
   "license": "SEE LICENSE IN LICENSE",
@@ -23,10 +23,10 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.0",
-    "@contrast/core": "1.59.0",
+    "@contrast/config": "1.54.1",
+    "@contrast/core": "1.59.1",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/rewriter": "1.36.0"
+    "@contrast/logger": "1.32.1",
+    "@contrast/rewriter": "1.36.1"
   }
 }

package/node_modules/@contrast/instrumentation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/instrumentation",
-  "version": "1.38.0",
+  "version": "1.38.1",
   "description": "Shared hooks and patches between Protect and Assess components",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,8 +21,8 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/dep-hooks": "1.28.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/patcher": "1.31.0"
+    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1"
   }
 }