@contrast/agent 4.15.0 → 4.15.1

package/lib/libraries.js

@@ -124,7 +124,7 @@ const getLibInfo = async (agent, eluEnabled) =>
 
       if (!nodeModsPath) {
         logger.error(
-          `unable to read installed dependencies because a node_modules directory could not be detected given a package.json located at %s - use the agent.node.app_root configuration variable if installed in non-standard location`,
+          'unable to read installed dependencies because a node_modules directory could not be detected given a package.json located at %s - use the agent.node.app_root configuration variable if installed in non-standard location',
           agent.appInfo.path
         );
         return AppUpdate.libraries;

package/lib/protect/service.js

@@ -198,7 +198,6 @@ class ProtectService {
     }
 
     const arg = {
-      rules,
       // header names must be lowercase. should this be done in agent-lib?
       headers: req.rawHeaders.map((h, ix) => (ix & 1 ? h : h.toLowerCase()))
     };
@@ -208,7 +207,7 @@ class ProtectService {
       arg.queries = req.url.slice(questionMark + 1);
     }
 
-    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
+    const findings = this.agentLib.scoreRequestConnect(rules, arg, evalOptions);
 
     return findings;
   }
@@ -813,9 +812,9 @@ class ProtectService {
     // for each key, check out the value. the key is set in the code so
     // is not vulnerable.
     for (const key in params) {
-      // items from scoreAtom() are only [{ruleId, score}, ...] because the key
+      // items from scoreAtom() return only [{ruleId, score}, ...] because the key
       // and inputType are already known and there is no path.
-      const items = this.agentLib.scoreAtom(params[key], type, libRules);
+      const items = this.agentLib.scoreAtom(libRules, params[key], type);
       if (!items) {
         continue;
       }
@@ -865,7 +864,7 @@ class ProtectService {
     const filenames = Object.keys(event.data);
 
     for (const filename of filenames) {
-      const items = this.agentLib.scoreAtom(filename, type, libRules);
+      const items = this.agentLib.scoreAtom(libRules, filename, type);
       if (!items) {
         continue;
       }
@@ -899,12 +898,9 @@ class ProtectService {
         queries.unshift(...q); return queries;
       }, []);
 
-    const arg = {
-      rules: rulesMask,
-      queries,
-    };
+    const arg = { queries };
 
-    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
+    const findings = this.agentLib.scoreRequestConnect(rulesMask, arg, evalOptions);
 
     this.handleAgentLibAnalysis({
       asyncStorageContext: event._ctxt,
@@ -920,8 +916,9 @@ class ProtectService {
       acc.unshift(key, value);
       return acc;
     }, []);
-    const arg = { rules: this.getRulesMask(rules), cookies };
-    const findings = this.agentLib.scoreRequestConnect(arg, evalOptions);
+    const rulesMask = this.getRulesMask(rules);
+    const arg = { cookies };
+    const findings = this.agentLib.scoreRequestConnect(rulesMask, arg, evalOptions);
     this.handleAgentLibAnalysis({
       asyncStorageContext: event._ctxt,
       appContext: {},
@@ -1167,7 +1164,7 @@ class ProtectService {
     const { _type, _value: input } = finding.sample.input;
     const type = this.agentLib.InputType[_type];
 
-    const alFinding = this.agentLib.scoreAtom(input, type, agentLibBit);
+    const alFinding = this.agentLib.scoreAtom(agentLibBit, input, type);
     if (!alFinding) {
       return false;
     }

package/lib/reporter/models/app-update/library.js

@@ -13,9 +13,10 @@ Copyright: 2022 Contrast Security, Inc
   way not consistent with the End User License Agreement.
 */
 'use strict';
-const readdir = require('recursive-readdir');
 const LibraryManifest = require('./library-manifest');
 const logger = require('../../../core/logger')('contrast:libraries');
+const fs = require('fs');
+const pathModule = require('path');
 
 module.exports = class Library {
   /**
@@ -53,7 +54,7 @@ module.exports = class Library {
       manifest: this.manifest.toSerializable(),
       usedClassCount: 0,
       classCount: this.fileCount,
-      tags: this.tags
+      tags: this.tags,
     };
   }
 
@@ -88,15 +89,68 @@ module.exports = class Library {
     );
   }
 
+  readdir(path, callback) {
+    if (!callback) {
+      return new Promise((resolve, reject) => {
+        this.readdir(path, (err, data) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve(data);
+          }
+        });
+      });
+    }
+
+    let list = [];
+
+    fs.readdir(path, (err, files) => {
+      if (err) {
+        return callback(err);
+      }
+
+      let pending = files.length;
+      if (!pending) {
+        return callback(null, list);
+      }
+
+      files.forEach((file) => {
+        const filePath = pathModule.join(path, file);
+        fs.stat(filePath, (_err, stats) => {
+          if (_err) {
+            return callback(_err);
+          }
+
+          if (stats.isDirectory() && !filePath.endsWith('/node_modules')) {
+            this.readdir(filePath, (__err, res) => {
+              if (__err) {
+                return callback(__err);
+              }
+
+              list = list.concat(res);
+              pending -= 1;
+              if (!pending) {
+                return callback(null, list);
+              }
+            });
+          } else {
+            list.push(filePath);
+            pending -= 1;
+            if (!pending) {
+              return callback(null, list);
+            }
+          }
+        });
+      });
+    });
+  }
+
   /**
    * Counts all the valid files in a module directory
    */
   getComposition() {
     // ignore nested node_modules
-    return readdir(this._path, [
-      `${this._path}/node_modules/*`,
-      `${this._path}/*/node_modules/*`
-    ])
+    return this.readdir(this._path)
       .then((files) => {
         this.fileCount = files.filter((file) =>
           Library.applicableFile(file)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.15.0",
+  "version": "4.15.1",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -76,7 +76,7 @@
     "@babel/template": "^7.10.4",
     "@babel/traverse": "^7.12.1",
     "@babel/types": "^7.12.1",
-    "@contrast/agent-lib": "^2.2.4",
+    "@contrast/agent-lib": "^3.0.0",
     "@contrast/distringuish-prebuilt": "^2.2.0",
     "@contrast/flat": "^4.1.1",
     "@contrast/fn-inspect": "^2.4.4",
@@ -107,7 +107,6 @@
     "parent-package-json": "^2.0.1",
     "parseurl": "^1.3.3",
     "prom-client": "^12.0.0",
-    "recursive-readdir": "^2.2.2",
     "semver": "^7.3.2",
     "uuid": "^8.3.2",
     "winston": "^3.1.0",