@contrast/agent 4.19.1 → 4.19.2

package/lib/assess/models/call-context.js

@@ -20,6 +20,7 @@ const tracker = require('../../tracker');
 const stackFactory = require('../../core/stacktrace').singleton;
 const distringuish = require('@contrast/distringuish-prebuilt');
 const { PROXY_TARGET } = require('../../../lib/constants');
+const TagRange = require('../models/tag-range');
 
 /**
  * Holds information about the call context of a function
@@ -102,6 +103,22 @@ module.exports = class CallContext {
     return !!(str && typeof str === 'object' && str[PROXY_TARGET]);
   }
 
+  static getDisplayRange(arg) {
+    if (tracker.getData(arg)) {
+      return new TagRange(0, arg.length - 1, 'untrusted');
+    }
+
+    if (arg && typeof arg === 'object') {
+      for (let key in arg) {
+        if (tracker.getData(arg[key])) {
+          const start = CallContext.valueString(arg).indexOf(arg[key]);
+          return new TagRange(start, start + arg[key].length - 1, 'untrusted');
+        }
+      }
+    }
+    return {}
+  }
+
   set result(result) {
     this.__result = CallContext.valueString(result);
     this.resultTracked = CallContext.isTracked(result);
@@ -113,6 +130,7 @@ module.exports = class CallContext {
   set args(args) {
     this.__args = args.map(CallContext.valueString);
     this.argsTracked = args.map((arg) => CallContext.isTracked(arg));
+    this.argsDisplayRanges = args.map((arg) => CallContext.getDisplayRange(arg));
   }
 
   get args() {

package/lib/core/async-storage/hooks/mongodb.js

@@ -25,6 +25,7 @@ const utils = require('./utils');
  * Hooks a method to properly bind to AsyncStorage
  * @param {Object} prototype to hook
  * @param {String} method to hook
+ * @param {String} patchName of the patch
  */
 function hookMethod(obj, method, patchName) {
   patcher.patch(obj, method, {
@@ -72,23 +73,24 @@ function init() {
       file: 'lib/topologies/server.js',
       version: '>=3.3.0 <4.0.0'
     },
-    (server) => patcher.patch(server, {
-      name: 'mongodb.Server',
-      patchType: ASYNC_CONTEXT,
-      alwaysRun: true,
-      post: (data) => {
-        const methods = ['command', 'insert', 'update', 'remove'];
-        for (const method of methods) {
-          hookMethod(data.result, method, 'mongodb.Server');
+    (server) =>
+      patcher.patch(server, {
+        name: 'mongodb.Server',
+        patchType: ASYNC_CONTEXT,
+        alwaysRun: true,
+        post: (data) => {
+          const methods = ['command', 'insert', 'update', 'remove'];
+          for (const method of methods) {
+            hookMethod(data.result, method, 'mongodb.Server');
+          }
         }
-      }
-    })
+      })
   );
 
   requireHook.resolve(
     { name: 'mongodb', file: 'lib/cursor.js', version: '>=3.3.0 <4.0.0' },
-    (cursor) => patcher.patch(cursor,
-      {
+    (cursor) =>
+      patcher.patch(cursor, {
         name: 'mongodb.Cursor',
         patchType: ASYNC_CONTEXT,
         alwaysRun: true,

package/lib/reporter/models/finding/event.js

@@ -102,6 +102,12 @@ class Event {
       this.args.push(
         new ObjectDTM(event.context.args[i], event.context.argsTracked[i])
       );
+      if (event.tagRanges[i] 
+        && event.context.argsDisplayRanges
+        && Object.keys(event.context.argsDisplayRanges[i]).length
+        ) {
+        event.tagRanges[i] = event.context.argsDisplayRanges[i];
+      }
     }
 
     if (event.code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.19.1",
+  "version": "4.19.2",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",