@contrast/agent 4.19.5 → 4.19.6

package/lib/assess/hapi/sinks/xss.js

@@ -25,7 +25,7 @@ const {
 const stackFactory = require('../../../core/stacktrace').singleton;
 const { AsyncStorage, KEYS } = require('../../../core/async-storage');
 const semver = require('semver');
-const { funcinfo } = require('@contrast/fn-inspect');
+const { funcInfo } = require('@contrast/fn-inspect');
 const { PATCH_TYPES } = require('../../../constants');
 
 class HapiXssSink {
@@ -107,7 +107,7 @@ class HapiXssSink {
           // if route coverage is enabled we put the original function
           // on the wrap in a Symbol, use that if it exists
           handler = handler[ORIG_FUNC] || handler;
-          const topFrame = funcinfo(handler);
+          const topFrame = funcInfo(handler);
           const stacktrace = stackFactory.createSnapshot({
             constructorOpt: data.hooked,
             prependFrames: [topFrame]

package/lib/assess/loopback4/route-coverage.js

@@ -19,7 +19,7 @@ const agentEmitter = require('../../agent-emitter');
 const patcher = require('../../hooks/patcher');
 const moduleHook = require('../../hooks/require');
 const { PATCH_TYPES } = require('../../constants');
-const { funcinfo } = require('@contrast/fn-inspect');
+const { funcInfo } = require('@contrast/fn-inspect');
 
 class RouteCoverage {
   constructor(agent) {
@@ -54,7 +54,7 @@ class RouteCoverage {
    */
   getSignatureFunc(route) {
     const func = route._controllerName ? route._controllerCtor : route._handler;
-    const finfo = funcinfo(func);
+    const finfo = funcInfo(func);
     const path = finfo.file.replace(`${this.appDir}/`, '');
     const suffix = route._controllerName
       ? `${route._controllerName}.${route._methodName}`

package/lib/assess/models/call-context.js

@@ -110,13 +110,16 @@ module.exports = class CallContext {
 
     if (arg && typeof arg === 'object') {
       for (const key in arg) {
-        if (tracker.getData(arg[key])) {
-          const start = CallContext.valueString(arg).indexOf(arg[key]);
-          if (start === -1) {
+        const trackedData = tracker.getData(arg[key]);
+        if (trackedData) {
+          const { start, stop } = trackedData.tagRanges[0];
+          const taintedString = arg[key].substring(start, stop + 1);
+          const taintRangeStart = CallContext.valueString(arg).indexOf(taintedString);
+          if (taintRangeStart === -1) {
             // If tracked string is not in the abbreviated stringified obj, disable highlighting
             return new TagRange(0, 0, 'disable-highlighting');
           }
-          return new TagRange(start, start + arg[key].length - 1, 'untrusted');
+          return new TagRange(taintRangeStart, taintRangeStart + taintedString.length - 1, 'untrusted');
         }
       }
     }

package/lib/core/express/utils.js

@@ -414,7 +414,7 @@ const instrumentHandler = (layer, id, self, stack) => {
  */
 function getLayerHandleMethod(layer) {
   let methodName = 'handle';
-  const __handleData = fnInspect.funcinfo(layer.__handle);
+  const __handleData = fnInspect.funcInfo(layer.__handle);
   if (__handleData && __handleData.file.includes('express-async-errors')) {
     methodName = '__handle';
   }

package/lib/library-usage.js

@@ -30,7 +30,7 @@ module.exports.listen = function(evalInterval = 1) {
   const handler = (codeEvent) => {
     try {
       if (
-        codeEvent.type !== 'LAZY_COMPILE' ||
+        codeEvent.type !== 'LazyCompile' ||
         codeEvent.script.indexOf(`node_modules${path.sep}`) === -1 ||
         reportedFiles.has(codeEvent.script)
       ) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.19.5",
+  "version": "4.19.6",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -77,9 +77,9 @@
     "@babel/traverse": "^7.12.1",
     "@babel/types": "^7.12.1",
     "@contrast/agent-lib": "^4.2.0",
-    "@contrast/distringuish-prebuilt": "^2.2.0",
+    "@contrast/distringuish-prebuilt": "^3.0.1",
     "@contrast/flat": "^4.1.1",
-    "@contrast/fn-inspect": "^2.4.4",
+    "@contrast/fn-inspect": "^3.0.0",
     "@contrast/heapdump": "^1.1.0",
     "@contrast/protobuf-api": "^3.2.5",
     "@contrast/require-hook": "^3.0.0",