@contrast/agent 4.16.0 → 4.17.0

package/node_modules/winston/node_modules/winston-transport/legacy.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const util = require('util');
+const { LEVEL } = require('triple-beam');
+const TransportStream = require('./');
+
+/**
+ * Constructor function for the LegacyTransportStream. This is an internal
+ * wrapper `winston >= 3` uses to wrap older transports implementing
+ * log(level, message, meta).
+ * @param {Object} options - Options for this TransportStream instance.
+ * @param {Transpot} options.transport - winston@2 or older Transport to wrap.
+ */
+
+const LegacyTransportStream = module.exports = function LegacyTransportStream(options = {}) {
+  TransportStream.call(this, options);
+  if (!options.transport || typeof options.transport.log !== 'function') {
+    throw new Error('Invalid transport, must be an object with a log method.');
+  }
+
+  this.transport = options.transport;
+  this.level = this.level || options.transport.level;
+  this.handleExceptions = this.handleExceptions || options.transport.handleExceptions;
+
+  // Display our deprecation notice.
+  this._deprecated();
+
+  // Properly bubble up errors from the transport to the
+  // LegacyTransportStream instance, but only once no matter how many times
+  // this transport is shared.
+  function transportError(err) {
+    this.emit('error', err, this.transport);
+  }
+
+  if (!this.transport.__winstonError) {
+    this.transport.__winstonError = transportError.bind(this);
+    this.transport.on('error', this.transport.__winstonError);
+  }
+};
+
+/*
+ * Inherit from TransportStream using Node.js built-ins
+ */
+util.inherits(LegacyTransportStream, TransportStream);
+
+/**
+ * Writes the info object to our transport instance.
+ * @param {mixed} info - TODO: add param description.
+ * @param {mixed} enc - TODO: add param description.
+ * @param {function} callback - TODO: add param description.
+ * @returns {undefined}
+ * @private
+ */
+LegacyTransportStream.prototype._write = function _write(info, enc, callback) {
+  if (this.silent || (info.exception === true && !this.handleExceptions)) {
+    return callback(null);
+  }
+
+  // Remark: This has to be handled in the base transport now because we
+  // cannot conditionally write to our pipe targets as stream.
+  if (!this.level || this.levels[this.level] >= this.levels[info[LEVEL]]) {
+    this.transport.log(info[LEVEL], info.message, info, this._nop);
+  }
+
+  callback(null);
+};
+
+/**
+ * Writes the batch of info objects (i.e. "object chunks") to our transport
+ * instance after performing any necessary filtering.
+ * @param {mixed} chunks - TODO: add params description.
+ * @param {function} callback - TODO: add params description.
+ * @returns {mixed} - TODO: add returns description.
+ * @private
+ */
+LegacyTransportStream.prototype._writev = function _writev(chunks, callback) {
+  for (let i = 0; i < chunks.length; i++) {
+    if (this._accept(chunks[i])) {
+      this.transport.log(
+        chunks[i].chunk[LEVEL],
+        chunks[i].chunk.message,
+        chunks[i].chunk,
+        this._nop
+      );
+      chunks[i].callback();
+    }
+  }
+
+  return callback(null);
+};
+
+/**
+ * Displays a deprecation notice. Defined as a function so it can be
+ * overriden in tests.
+ * @returns {undefined}
+ */
+LegacyTransportStream.prototype._deprecated = function _deprecated() {
+  // eslint-disable-next-line no-console
+  console.error([
+    `${this.transport.name} is a legacy winston transport. Consider upgrading: `,
+    '- Upgrade docs: https://github.com/winstonjs/winston/blob/master/UPGRADE-3.0.md'
+  ].join('\n'));
+};
+
+/**
+ * Clean up error handling state on the legacy transport associated
+ * with this instance.
+ * @returns {undefined}
+ */
+LegacyTransportStream.prototype.close = function close() {
+  if (this.transport.close) {
+    this.transport.close();
+  }
+
+  if (this.transport.__winstonError) {
+    this.transport.removeListener('error', this.transport.__winstonError);
+    this.transport.__winstonError = null;
+  }
+};

package/node_modules/winston/node_modules/winston-transport/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "winston-transport",
+  "description": "Base stream implementations for winston@3 and up.",
+  "version": "4.5.0",
+  "main": "index.js",
+  "browser": "dist/index.js",
+  "scripts": {
+    "lint": "eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist",
+    "pretest": "npm run lint && npm run build",
+    "test": "nyc mocha test/*.test.js",
+    "report": "nyc report --reporter=lcov",
+    "build": "rimraf dist && babel *.js -d ./dist",
+    "prepublishOnly": "npm run build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:winstonjs/winston-transport.git"
+  },
+  "keywords": [
+    "winston",
+    "transport",
+    "winston3"
+  ],
+  "author": "Charlie Robbins <charlie.robbins@gmail.com>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/winstonjs/winston-transport/issues"
+  },
+  "homepage": "https://github.com/winstonjs/winston-transport#readme",
+  "dependencies": {
+    "logform": "^2.3.2",
+    "readable-stream": "^3.6.0",
+    "triple-beam": "^1.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^17.0.15",
+    "abstract-winston-transport": ">=0.5.1",
+    "assume": "^2.3.0",
+    "babel-cli": "^6.26.0",
+    "babel-preset-env": "^1.7.0",
+    "deep-equal": "^2.0.5",
+    "eslint": "^8.8.0",
+    "@dabh/eslint-config-populist": "^5.0.0",
+    "mocha": "^9.2.0",
+    "nyc": "^15.1.0",
+    "rimraf": "^3.0.2",
+    "winston-compat": "^0.1.5"
+  },
+  "engines": {
+    "node": ">= 6.4.0"
+  }
+
+,"_resolved": "https://registry.npmjs.org/winston-transport/-/winston-transport-4.5.0.tgz"
+,"_integrity": "sha512-YpZzcUzBedhlTAfJg6vJDlyEai/IFMIVcaEZZyl3UXIl4gmqRpU7AE89AHLkbzLUsv0NVmw7ts+iztqKxxPW1Q=="
+,"_from": "winston-transport@4.5.0"
+}

package/node_modules/winston/package.json

@@ -1,77 +1,78 @@
-{
-  "name": "winston",
-  "description": "A logger for just about everything.",
-  "version": "3.3.3",
-  "author": "Charlie Robbins <charlie.robbins@gmail.com>",
-  "maintainers": [
-    "Jarrett Cruger <jcrugzz@gmail.com>",
-    "Chris Alderson <chrisalderson@protonmail.com>",
-    "David Hyde <dabh@stanford.edu>"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/winstonjs/winston.git"
-  },
-  "keywords": [
-    "winston",
-    "logger",
-    "logging",
-    "logs",
-    "sysadmin",
-    "bunyan",
-    "pino",
-    "loglevel",
-    "tools",
-    "json",
-    "stream"
-  ],
-  "dependencies": {
-    "async": "^3.1.0",
-    "@dabh/diagnostics": "^2.0.2",
-    "is-stream": "^2.0.0",
-    "logform": "^2.2.0",
-    "one-time": "^1.0.0",
-    "readable-stream": "^3.4.0",
-    "stack-trace": "0.0.x",
-    "triple-beam": "^1.3.0",
-    "winston-transport": "^4.4.0"
-  },
-  "devDependencies": {
-    "@babel/cli": "^7.10.3",
-    "@babel/core": "^7.10.3",
-    "@babel/preset-env": "^7.10.3",
-    "@types/node": "^14.0.13",
-    "abstract-winston-transport": "^0.5.1",
-    "assume": "^2.2.0",
-    "colors": "^1.4.0",
-    "cross-spawn-async": "^2.2.5",
-    "eslint-config-populist": "^4.2.0",
-    "hock": "^1.4.1",
-    "mocha": "^8.0.1",
-    "nyc": "^15.1.0",
-    "rimraf": "^3.0.2",
-    "split2": "^3.1.1",
-    "std-mocks": "^1.0.1",
-    "through2": "^3.0.1",
-    "winston-compat": "^0.1.5"
-  },
-  "main": "./lib/winston",
-  "browser": "./dist/winston",
-  "types": "./index.d.ts",
-  "scripts": {
-    "lint": "populist lib/*.js lib/winston/*.js lib/winston/**/*.js",
-    "pretest": "npm run lint",
-    "test": "nyc --reporter=text --reporter lcov npm run test:mocha",
-    "test:mocha": "mocha test/*.test.js test/**/*.test.js --exit",
-    "build": "./node_modules/.bin/rimraf dist && babel lib -d dist",
-    "prepublishOnly": "npm run build"
-  },
-  "engines": {
-    "node": ">= 6.4.0"
-  },
-  "license": "MIT"
+{
+  "name": "winston",
+  "description": "A logger for just about everything.",
+  "version": "3.7.2",
+  "author": "Charlie Robbins <charlie.robbins@gmail.com>",
+  "maintainers": [
+    "David Hyde <dabh@alumni.stanford.edu>"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/winstonjs/winston.git"
+  },
+  "keywords": [
+    "winston",
+    "logger",
+    "logging",
+    "logs",
+    "sysadmin",
+    "bunyan",
+    "pino",
+    "loglevel",
+    "tools",
+    "json",
+    "stream"
+  ],
+  "dependencies": {
+    "@dabh/diagnostics": "^2.0.2",
+    "async": "^3.2.3",
+    "is-stream": "^2.0.0",
+    "logform": "^2.4.0",
+    "one-time": "^1.0.0",
+    "readable-stream": "^3.4.0",
+    "safe-stable-stringify": "^2.3.1",
+    "stack-trace": "0.0.x",
+    "triple-beam": "^1.3.0",
+    "winston-transport": "^4.5.0"
+  },
+  "devDependencies": {
+    "@babel/cli": "^7.17.0",
+    "@babel/core": "^7.17.2",
+    "@babel/preset-env": "^7.16.7",
+    "@colors/colors": "1.5.0",
+    "@dabh/eslint-config-populist": "^5.0.0",
+    "@types/node": "^17.0.17",
+    "abstract-winston-transport": "^0.5.1",
+    "assume": "^2.2.0",
+    "cross-spawn-async": "^2.2.5",
+    "eslint": "^8.9.0",
+    "hock": "^1.4.1",
+    "mocha": "8.1.3",
+    "nyc": "^15.1.0",
+    "rimraf": "^3.0.2",
+    "split2": "^4.1.0",
+    "std-mocks": "^1.0.1",
+    "through2": "^4.0.2",
+    "winston-compat": "^0.1.5"
+  },
+  "main": "./lib/winston",
+  "browser": "./dist/winston",
+  "types": "./index.d.ts",
+  "scripts": {
+    "lint": "eslint lib/*.js lib/winston/*.js lib/winston/**/*.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist",
+    "test": "mocha",
+    "test:coverage": "nyc npm run test:unit",
+    "test:unit": "mocha test/unit",
+    "test:integration": "mocha test/integration",
+    "build": "rimraf dist && babel lib -d dist",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">= 12.0.0"
+  },
+  "license": "MIT"
 
-,"_resolved": "https://registry.npmjs.org/winston/-/winston-3.3.3.tgz"
-,"_integrity": "sha512-oEXTISQnC8VlSAKf1KYSSd7J6IWuRPQqDdo8eoRNaYKLvwSb5+79Z3Yi1lrl6KDpU6/VWaxpakDAtb1oQ4n9aw=="
-,"_from": "winston@3.3.3"
+,"_resolved": "https://registry.npmjs.org/winston/-/winston-3.7.2.tgz"
+,"_integrity": "sha512-QziIqtojHBoyzUOdQvQiar1DH0Xp9nF1A1y7NVy2DGEsz82SBDtOalS0ulTRGVT14xPX3WRWkCsdcJKqNflKng=="
+,"_from": "winston@3.7.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.16.0",
+  "version": "4.17.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -48,7 +48,7 @@
     "initsecrets": "scripts/detect-secrets.sh"
   },
   "lint-staged": {
-    "*.js": "eslint --fix",
+    "*.{c,m,}js": "eslint --fix",
     "*.sh": "shellcheck -x"
   },
   "bin": {
@@ -109,14 +109,14 @@
     "prom-client": "^12.0.0",
     "semver": "^7.3.2",
     "uuid": "^8.3.2",
-    "winston": "^3.1.0",
+    "winston": "^3.7.2",
     "winston-daily-rotate-file": "^3.5.1",
     "yaml": "^1.10.0"
   },
   "devDependencies": {
     "@aws-sdk/client-dynamodb": "^3.39.0",
     "@bmacnaughton/string-generator": "^1.0.0",
-    "@contrast/eslint-config": "^3.0.0",
+    "@contrast/eslint-config": "^3.0.2",
     "@contrast/fake-module": "file:test/mock/contrast-fake",
     "@contrast/screener-service": "^1.12.9",
     "@hapi/boom": "file:test/mock/boom",
@@ -144,6 +144,8 @@
     "eslint-plugin-mocha": "^10.0.3",
     "eslint-plugin-node": "^11.1.0",
     "express": "file:test/mock/express",
+    "fastify-plugin": "file:test/mock/fastify-plugin",
+    "fastify-static": "file:test/mock/fastify-static",
     "fetch-cookie": "^0.11.0",
     "form-data": "^3.0.0",
     "glob": "^7.1.4",

package/node_modules/color-string/CHANGELOG.md

@@ -1,18 +0,0 @@
-# 0.4.0
-
-- Changed: Invalid conversions now return `null` instead of `undefined`
-- Changed: Moved to XO standard
-- Fixed: a few details in package.json
-- Fixed: readme output regarding wrapped hue values ([#21](https://github.com/MoOx/color-string/pull/21))
-
-# 0.3.0
-
-- Fixed: HSL alpha channel ([#16](https://github.com/harthur/color-string/pull/16))
-- Fixed: ability to parse signed number ([#15](https://github.com/harthur/color-string/pull/15))
-- Removed: component.json
-- Removed: browser build
-- Added: license field to package.json ([#17](https://github.com/harthur/color-string/pull/17))
-
----
-
-Check out commit logs for earlier releases

package/node_modules/colorspace/test.js

@@ -1,14 +0,0 @@
-describe('colorspace', function () {
-  var colorspace = require('./');
-  var assume = require('assume');
-
-  it('returns a consistent color for a given name', function () {
-    assume(colorspace('bigpipe')).equals('#20f95a');
-    assume(colorspace('bigpipe')).equals('#20f95a');
-    assume(colorspace('bigpipe')).equals('#20f95a');
-  });
-
-  it('tones the color when namespaced by a : char', function () {
-    assume(colorspace('bigpipe:pagelet')).equals('#00FF2C');
-  });
-});

package/node_modules/fecha/CHANGELOG.md

@@ -1,67 +0,0 @@
-### 4.2.0
-Added isoDate and isoDateTime masks
-
-### 4.1.0
-Added Z format/parse and fixed Peru timezone issue
-- Added `Z` format token. See readme for more info. Big thanks to @fer22f for writing the code.
-- Fixed a strange issue when Peru changed timezones in 1990. See #78 
-
-## 4.0.0
-**Major Features and  Breaking changes in this version**
-
-#### Improvements
-- *Valid date parsing* - By default fecha will check validity of dates. Previously `2019-55-01` or `2019-01-42` would parse correctly, since Javascript can handle it. Now invalid dates will return `null` instead
-- *ES Module and Tree Shaking Support* - You can now import fecha `parse` or `format` independently
-```js
-import {format, parse} from 'fecha';
-
-format(...);
-parse(...)
-```
-
-#### Breaking changes
-- `parseDate` may return `null` when previously returned a `Date`. See improvements above, but invalid dates will return `null` now
-- Change to how to set masks and i18n
-Previously
-```js
-import fecha from 'fecha';
-
-fecha.i18n = { ... }
-fecha.masks.myMask = 'DD , MM, YYYY' 
-```
-
-New
-```js
-import {parse, format, setGlobalDateI18n, setGlobalDateMasks} from 'fecha';
-
-setGlobalDateI18n({
-    // ...
-})
-setGlobalDateMasks({
-  myMask: 'DD , MM, YYYY'
-});
-```
-
-### 3.0.3
-- Fixed bug when using brackets when parsing dates
-### 3.0.2
-- Fixed issue where src files are not included correctly in npm
-
-### 3.0.0
-- Moved to ES modules
-- Changed invalid date from `false` to `null`
-
-### 2.3.3
-Fixed bug with year 999 not having leading zero
-
-### 2.3.2
-Added typescript definitions to NPM
-
-### 2.3.0
-Added strict version of date parser that returns null on invalid dates (may use strict version in v3)
-
-### 2.2.0
-Fixed a bug when parsing Do format dates
-
-## 2.0.0
-Fecha now throws errors on invalid dates in `fecha.format` and is stricter about what dates it accepts. Dates must pass `Object.prototype.toString.call(dateObj) !== '[object Date]'`.

package/node_modules/logform/.travis.yml

@@ -1,17 +0,0 @@
-sudo: false
-language: node_js
-node_js:
-  - "10"
-  - "12"
-  - "14"
-
-before_install:
-  - travis_retry npm install
-
-script:
-  - npm test
-
-notifications:
-  email:
-    - travis@nodejitsu.com
-  irc: "irc.freenode.org#nodejitsu"