@contrast/agent 4.14.0 → 4.15.0

package/bin/VERSION

@@ -1 +1 @@
-2.28.17
+2.28.19

package/lib/assess/propagators/validator/init-hooks.js

@@ -22,6 +22,7 @@ const moduleHook = require('../../../hooks/require');
 const TagRange = require('../../models/tag-range');
 const tagRangeUtil = require('../../models/tag-range/util');
 const { PropagationEvent, Signature, CallContext } = require('../../models');
+const agent = require('../../../agent');
 
 /**
  * this override propagator instruments each of the classes of methods
@@ -88,7 +89,7 @@ module.exports.handle = function() {
       { name: 'validator', file: `lib/${validator}` },
       (index, meta) => {
         function post(data) {
-          if (data.result) {
+          if (data.result && (validator !== 'matches' || (validator === 'matches' && agent.config.assess.trust_custom_validators))) {
             const trackingData = tracker.getData(data.args[0]);
             if (trackingData) {
               tagRangeUtil.addInPlace(

package/lib/assess/propagators/validator/validator-methods.js

@@ -72,7 +72,8 @@ module.exports = {
     isSemVer: 'limited-chars',
     isTaxID: 'limited-chars',
     isUUID: 'alphanum-space-hyphen',
-    isVAT: 'alphanum-space-hyphen'
+    isVAT: 'alphanum-space-hyphen',
+    matches: 'string-type-checked'
   },
   untrackers: [
     // these methods have the tag 'trusted' which the node-agent doesn't support.

package/lib/protect/service.js

@@ -37,6 +37,8 @@ const UserInputKit = require('../reporter/models/utils/user-input-kit');
 const UserInputFactory = require('../reporter/models/utils/user-input-factory');
 const blockRequest = require('../util/block-request');
 
+const evalOptions = { preferWorthWatching: true };
+
 class ProtectService {
   /**
    * Configures the service to use the provided agent.
@@ -197,7 +199,6 @@ class ProtectService {
 
     const arg = {
       rules,
-      preferWorthWatching: true,
       // header names must be lowercase. should this be done in agent-lib?
       headers: req.rawHeaders.map((h, ix) => (ix & 1 ? h : h.toLowerCase()))
     };
@@ -207,7 +208,7 @@ class ProtectService {
       arg.queries = req.url.slice(questionMark + 1);
     }
 
-    const findings = this.agentLib.scoreRequestConnect(arg);
+    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
 
     return findings;
   }
@@ -218,14 +219,12 @@ class ProtectService {
       return {};
     }
     // also, if content-type has multipart...
-    const options = { preferWorthWatching: true };
-
     const bodyBuffer = Buffer.concat(chunks);
 
     const findings = this.agentLib.scoreRequestUnknownBody(
       rules,
       bodyBuffer,
-      options
+      evalOptions
     );
 
     // store body buffer on findings for nosqli sink.
@@ -902,11 +901,10 @@ class ProtectService {
 
     const arg = {
       rules: rulesMask,
-      preferWorthWatching: true,
       queries,
     };
 
-    const findings = this.agentLib.scoreRequestConnect(arg);
+    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
 
     this.handleAgentLibAnalysis({
       asyncStorageContext: event._ctxt,
@@ -922,11 +920,8 @@ class ProtectService {
       acc.unshift(key, value);
       return acc;
     }, []);
-    const findings = this.agentLib.scoreRequestConnect({
-      preferWorthWatching: true,
-      rules: this.getRulesMask(rules),
-      cookies
-    });
+    const arg = { rules: this.getRulesMask(rules), cookies };
+    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
     this.handleAgentLibAnalysis({
       asyncStorageContext: event._ctxt,
       appContext: {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.14.0",
+  "version": "4.15.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -76,7 +76,7 @@
     "@babel/template": "^7.10.4",
     "@babel/traverse": "^7.12.1",
     "@babel/types": "^7.12.1",
-    "@contrast/agent-lib": "^2.2.3",
+    "@contrast/agent-lib": "^2.2.4",
     "@contrast/distringuish-prebuilt": "^2.2.0",
     "@contrast/flat": "^4.1.1",
     "@contrast/fn-inspect": "^2.4.4",