@contrast/agent 4.19.2 → 4.19.3

package/changelog.config.js

@@ -17,7 +17,7 @@ Copyright: 2022 Contrast Security, Inc
 module.exports = {
   jira: {
     baseUrl: `https://${process.env.JIRA_HOST}`,
-    ticketIDPattern: /(NODE+-?[0-9]{4})/i,
+    ticketIDPattern: /(NODE-?\s?[0-9]{4})/i,
     excludeIssueTypes: ['Sub-task', 'Release'],
     api: {
       host: process.env.JIRA_HOST,
@@ -33,7 +33,7 @@ module.exports = {
 ### Jira Tickets
 ---------------------
 <% blockTickets.forEach(ticket => { -%>
-  * <<%= ticket.fields.issuetype.name %>> - <%- ticket.fields.summary %>
+  * [<%= ticket.fields.issuetype.name %>] - <%- ticket.fields.summary %>
     [<%= ticket.key %>](<%= jira.baseUrl + '/browse/' + ticket.key %>)
 <% }); -%>
 <% if (!blockTickets.length) {%> ~ None ~ <% } %>

package/lib/assess/models/call-context.js

@@ -109,14 +109,18 @@ module.exports = class CallContext {
     }
 
     if (arg && typeof arg === 'object') {
-      for (let key in arg) {
+      for (const key in arg) {
         if (tracker.getData(arg[key])) {
           const start = CallContext.valueString(arg).indexOf(arg[key]);
+          if (start === -1) {
+            // If tracked string is not in the abbreviated stringified obj, disable highlighting
+            return new TagRange(0, 0, 'disable-highlighting');
+          }
           return new TagRange(start, start + arg[key].length - 1, 'untrusted');
         }
       }
     }
-    return {}
+    return {};
   }
 
   set result(result) {

package/lib/reporter/models/event-tag.js

@@ -12,6 +12,8 @@ Copyright: 2022 Contrast Security, Inc
   engineered, modified, repackaged, sold, redistributed or otherwise used in a
   way not consistent with the End User License Agreement.
 */
+'use strict';
+
 const { TAGS } = require('../../constants');
 
 /**
@@ -23,10 +25,11 @@ class EventTag {
    */
   constructor(tagRange) {
     this.tag = TAGS[tagRange.tag] || 'CUSTOM';
+    this.offset = this.tag === 'disable-highlighting' ? 0 : 1;
     // agent tracks ranges as [start,stop] (inclusive,inclusive)
     // but TS interprets as [start,stop) (inclusive,exclusive)
     // so we need to add 1 to stop
-    this.range = `${tagRange.start}:${tagRange.stop + 1}`;
+    this.range = `${tagRange.start}:${tagRange.stop + this.offset}`;
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.19.2",
+  "version": "4.19.3",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -200,7 +200,6 @@
   },
   "bundleDependencies": [
     "winston",
-    "winston-syslog",
     "winston-daily-rotate-file"
   ]
 }