@contrast/agent 4.2.0

package/lib/reporter/translations/enums.js

@@ -0,0 +1,268 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+/*
+ * This file exports lookup objects which support the mapping of integer-valued
+ * enums to their human-friendly string representations. We perform this mapping
+ * when a model is converted to a plain javascript object, by way of
+ * `model.toObject().
+ *
+ * We also use these objects to map strings to integers. The `google-protobuf`
+ * models require that the values used to set enums be integers; there is no
+ * built-in type conversion. If a string is used to set a value then the model
+ * will throw an exception during serialization.
+ *
+ * These objects are meant to be used only in the translation files located in
+ * `./to-protobuf/`. Those using the translation API simply pass domain models
+ * as function arguments, and these lookups happen behind the scenes in the
+ * translation functions and return the equivalent protobuf models.
+ *
+ * Example:
+ *  const model = new models.StringDefinition();
+ *  model.setType('KEYWORD'); // This sets the underlying value, _but_
+ *  model.serializeBinary(); // this will throw a type exception later on.
+ *
+ *  model.setType(0) // This is the proper way to set the `type` to KEYWORD
+ */
+
+'use strict';
+
+const {
+  ACTIONS,
+  ASSESS_STACKTRACES,
+  AUTHENTICATION,
+  CONNECTION_TYPES,
+  DEBUG_LOG_LEVELS,
+  DOCUMENT_TYPES,
+  EVENT_TYPES,
+  EXCLUSION_INPUT_TYPES,
+  EXCLUSION_TYPES,
+  EXCLUSION_MATCH_STRATEGIES,
+  IMPORTANCE,
+  INPUT_TYPES,
+  INSTRUMENTATION_MODE,
+  PROTECT_RULE_DEFINITION_TYPES,
+  PROTECTION_MODES,
+  REACTION_OPERATION,
+  RESPONSE_TYPES,
+  SYSLOG_SEVERITIES,
+  VIRTUAL_PATCH_INPUT_TYPES,
+  VIRTUAL_PATCH_EVALUATIONS
+} = require('../../constants');
+
+/**
+ * Transposes key/values of an object and assigns the values to the object.
+ * This mutate <code>object</code> argument; also assumes argument is "flat".
+ * @param {Object} object The object on which to operate
+ * @returns {Object}
+ */
+const assignInverse = (target) => Object.assign(target || {}, invert(target));
+module.exports.assignInverse = assignInverse;
+
+module.exports.ACTIONS = assignInverse({
+  [ACTIONS.CREATION]: 0,
+  [ACTIONS.PROPAGATION]: 1,
+  [ACTIONS.TRIGGER]: 2,
+  [ACTIONS.TAG]: 3,
+  [ACTIONS.A2A]: 4,
+  [ACTIONS.A2P]: 5,
+  [ACTIONS.A2O]: 6,
+  [ACTIONS.A2R]: 7,
+  [ACTIONS.O2A]: 8,
+  [ACTIONS.O2P]: 9,
+  [ACTIONS.O2O]: 10,
+  [ACTIONS.O2R]: 11,
+  [ACTIONS.P2A]: 12,
+  [ACTIONS.P2P]: 13,
+  [ACTIONS.P2O]: 14,
+  [ACTIONS.P2R]: 15
+});
+
+module.exports.ASSESS_STACKTRACES = assignInverse({
+  [ASSESS_STACKTRACES.UNDEFINED]: 0,
+  [ASSESS_STACKTRACES.ALL]: 1,
+  [ASSESS_STACKTRACES.SOME]: 2,
+  [ASSESS_STACKTRACES.NONE]: 3
+});
+
+module.exports.AUTHENTICATION = assignInverse({
+  [AUTHENTICATION.UNAUTHENTICATED]: 0,
+  [AUTHENTICATION.AUTHENTICATED]: 1,
+  [AUTHENTICATION.LOGIN_FAIL]: 2,
+  [AUTHENTICATION.LOGIN_SUCCESS]: 3,
+  [AUTHENTICATION.LOGIN_UNKNOWN]: 4
+});
+
+module.exports.DOCUMENT_TYPES = assignInverse({
+  [DOCUMENT_TYPES.NORMAL]: 0,
+  [DOCUMENT_TYPES.JSON]: 1,
+  [DOCUMENT_TYPES.XML]: 2
+});
+
+module.exports.EVENT_TYPES = assignInverse({
+  [EVENT_TYPES.METHOD]: 0,
+  [EVENT_TYPES.PROPAGATION]: 1,
+  [EVENT_TYPES.TAG]: 2
+});
+
+module.exports.EXCLUSION_TYPES = assignInverse({
+  [EXCLUSION_TYPES.URL]: 0,
+  [EXCLUSION_TYPES.INPUT]: 1,
+  [EXCLUSION_TYPES.CODE]: 2
+});
+
+module.exports.EXCLUSION_INPUT_TYPES = assignInverse({
+  [EXCLUSION_INPUT_TYPES.UNDEFINED]: 0,
+  [EXCLUSION_INPUT_TYPES.COOKIE]: 1,
+  [EXCLUSION_INPUT_TYPES.PARAMETER]: 2,
+  [EXCLUSION_INPUT_TYPES.HEADER]: 3,
+  [EXCLUSION_INPUT_TYPES.BODY]: 4,
+  [EXCLUSION_INPUT_TYPES.QUERYSTRING]: 5
+});
+
+module.exports.EXCLUSION_MATCH_STRATEGIES = assignInverse({
+  [EXCLUSION_MATCH_STRATEGIES.ALL]: 0,
+  [EXCLUSION_MATCH_STRATEGIES.ONLY]: 1
+});
+
+module.exports.INPUT_TYPES = assignInverse({
+  [INPUT_TYPES.UNDEFINED_TYPE]: 0,
+  [INPUT_TYPES.BODY]: 1,
+  [INPUT_TYPES.COOKIE_NAME]: 2,
+  [INPUT_TYPES.COOKIE_VALUE]: 3,
+  [INPUT_TYPES.HEADER]: 4,
+  [INPUT_TYPES.PARAMETER_NAME]: 5,
+  [INPUT_TYPES.PARAMETER_VALUE]: 6,
+  [INPUT_TYPES.QUERYSTRING]: 7,
+  [INPUT_TYPES.URI]: 8,
+  [INPUT_TYPES.SOCKET]: 9,
+  [INPUT_TYPES.JSON_VALUE]: 10,
+  [INPUT_TYPES.JSON_ARRAYED_VALUE]: 11,
+  [INPUT_TYPES.MULTIPART_CONTENT_TYPE]: 16,
+  [INPUT_TYPES.MULTIPART_VALUE]: 17,
+  [INPUT_TYPES.MULTIPART_FIELD_NAME]: 18,
+  [INPUT_TYPES.MULTIPART_NAME]: 19,
+  [INPUT_TYPES.XML_VALUE]: 20,
+  [INPUT_TYPES.DWR_VALUE]: 21,
+  [INPUT_TYPES.METHOD]: 22,
+  [INPUT_TYPES.REQUEST]: 23,
+  [INPUT_TYPES.URL_PARAMETER]: 24,
+  [INPUT_TYPES.UNKNOWN]: 99
+});
+
+module.exports.SCORE_TYPES = assignInverse({
+  [IMPORTANCE.NONE]: 0,
+  [IMPORTANCE.WORTH_WATCHING]: 1,
+  [IMPORTANCE.DEFINITE]: 2
+});
+
+module.exports.INSTRUMENTATION_MODE = assignInverse({
+  [INSTRUMENTATION_MODE.UNDEFINED]: 0,
+  [INSTRUMENTATION_MODE.AGENT_CONFIG]: 1,
+  [INSTRUMENTATION_MODE.DUPLEX]: 2,
+  [INSTRUMENTATION_MODE.PROFILER]: 3
+});
+
+module.exports.PROTECTION_RULE_MODES = assignInverse({
+  [PROTECTION_MODES.NO_ACTION]: 0,
+  [PROTECTION_MODES.MONITOR]: 1,
+  [PROTECTION_MODES.BLOCK]: 2,
+  [PROTECTION_MODES.BLOCK_AT_PERIMETER]: 3,
+  [PROTECTION_MODES.PERMIT]: 4
+});
+
+module.exports.LOG_LEVEL = assignInverse({
+  [DEBUG_LOG_LEVELS.TRACE]: 0,
+  [DEBUG_LOG_LEVELS.DEBUG]: 1,
+  [DEBUG_LOG_LEVELS.INFO]: 2,
+  [DEBUG_LOG_LEVELS.WARN]: 3,
+  [DEBUG_LOG_LEVELS.ERROR]: 4
+});
+
+module.exports.REACTION_OPERATION = assignInverse({
+  [REACTION_OPERATION.NOOP]: 0,
+  [REACTION_OPERATION.DISABLE]: 1,
+  [REACTION_OPERATION.INVENTORY]: 2
+});
+
+module.exports.RESPONSE_TYPES = assignInverse({
+  [RESPONSE_TYPES.NO_ACTION]: 0,
+  [RESPONSE_TYPES.BLOCKED]: 1,
+  [RESPONSE_TYPES.MONITORED]: 2,
+  [RESPONSE_TYPES.PROBED]: 3,
+  [RESPONSE_TYPES.BLOCKED_AT_PERIMETER]: 4,
+  [RESPONSE_TYPES.AGGREGATED]: 5
+});
+
+module.exports.STRING_DEFINITION_TYPE = assignInverse({
+  [PROTECT_RULE_DEFINITION_TYPES.KEYWORD]: 0,
+  [PROTECT_RULE_DEFINITION_TYPES.PATTERN]: 1
+});
+
+module.exports.SYSLOG_CONNECTION_TYPES = assignInverse({
+  [CONNECTION_TYPES.UNENCRYPTED]: 0,
+  [CONNECTION_TYPES.ENCRYPTED]: 1
+});
+
+module.exports.SYSLOG_SEVERITIES = assignInverse({
+  [SYSLOG_SEVERITIES.UNDEFINED]: 0,
+  [SYSLOG_SEVERITIES.ALERT]: 1,
+  [SYSLOG_SEVERITIES.CRITICAL]: 2,
+  [SYSLOG_SEVERITIES.ERROR]: 3,
+  [SYSLOG_SEVERITIES.WARNING]: 4,
+  [SYSLOG_SEVERITIES.NOTICE]: 5,
+  [SYSLOG_SEVERITIES.INFO]: 6,
+  [SYSLOG_SEVERITIES.DEBUG]: 7
+});
+
+module.exports.VIRTUAL_PATCH_INPUT_TYPES = assignInverse({
+  [VIRTUAL_PATCH_INPUT_TYPES.UNKNOWN_INPUT]: 0,
+  [VIRTUAL_PATCH_INPUT_TYPES.USERAGENT]: 1,
+  [VIRTUAL_PATCH_INPUT_TYPES.REFERER]: 2,
+  [VIRTUAL_PATCH_INPUT_TYPES.URL]: 3,
+  [VIRTUAL_PATCH_INPUT_TYPES.PARAMETER]: 4,
+  [VIRTUAL_PATCH_INPUT_TYPES.HEADER]: 5,
+  [VIRTUAL_PATCH_INPUT_TYPES.CODE]: 6
+});
+
+module.exports.VIRTUAL_PATCH_EVALUATIONS = assignInverse({
+  [VIRTUAL_PATCH_EVALUATIONS.UNKNOWN_EVALUATION]: 0,
+  [VIRTUAL_PATCH_EVALUATIONS.MATCHES]: 1,
+  [VIRTUAL_PATCH_EVALUATIONS.DOESNT_MATCH]: 2,
+  [VIRTUAL_PATCH_EVALUATIONS.CONTAINS]: 3,
+  [VIRTUAL_PATCH_EVALUATIONS.DOESNT_CONTAIN]: 4,
+  [VIRTUAL_PATCH_EVALUATIONS.EQUALS]: 5,
+  [VIRTUAL_PATCH_EVALUATIONS.DOESNT_EQUAL]: 6
+});
+
+/**
+ * @param {Object} object The object to invert.
+ * @returns {Object} Returns the new inverted object.
+ * @example
+ *
+ * const object = { 'a': 1, 'b': 2, 'c': 1 }
+ *
+ * invert(object)
+ * // => { '1': 'c', '2': 'b' }
+ */
+function invert(object) {
+  const result = {};
+  if (object) {
+    Object.keys(object).forEach((key) => {
+      const value = object[key].toString();
+      result[value] = key;
+    });
+  }
+  return result;
+}

package/lib/reporter/translations/helpers.js

@@ -0,0 +1,115 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const {
+  AUTHENTICATION,
+  INPUT_TYPES,
+  RESPONSE_TYPES
+} = require('../../constants');
+const {
+  AUTHENTICATION: AUTH_ENUM,
+  INPUT_TYPES: INPUT_ENUM,
+  RESPONSE_TYPES: RESPONSE_ENUM,
+  DOCUMENT_TYPES
+} = require('./enums');
+
+const helpers = exports;
+
+/**
+ * We wrap the google-protobuf models so that we can customize `.toObject()`.
+ * When the method is invoked, we can provide custom logic to act on the return
+ * value. The main use case for this is to convert integer-valued enumerated
+ * types to their human-friendly string representations (see `./enums.js`).
+ * @param {Object} model A `google-protobuf` model instance
+ * @param {Function} fn Recieves the return value of `toObject()`
+ * @returns {Object} The model, having it's `toObject()` method patched
+ */
+helpers.wrapToObject = (model, fn = (x) => x) => {
+  if (!model || typeof model.toObject !== 'function') {
+    return model;
+  }
+
+  ((toObject) => {
+    model.toObject = function(...args) {
+      const value = toObject.apply(this, args);
+      return fn(value) || value;
+    };
+  })(model.toObject);
+
+  return model;
+};
+
+/**
+ * Given an input type, return the appropriate enum
+ * @param type
+ * @return {number}
+ */
+helpers.resolveInputType = (type) => INPUT_ENUM[INPUT_TYPES[type]];
+
+/**
+ * Given a doctype, return the appropriate enum.
+ * @param {string} type
+ * @return {number}
+ */
+helpers.resolveDocumentType = (type) => {
+  switch (type) {
+    case INPUT_TYPES.JSON_VALUE:
+      return DOCUMENT_TYPES.JSON;
+    case INPUT_TYPES.XML_VALUE:
+      return DOCUMENT_TYPES.XML_VALUE;
+    default:
+      return DOCUMENT_TYPES.NORMAL;
+  }
+};
+
+/**
+ * Given a response type, return the appropriate enum.
+ * @param {string} type
+ * @return {number}
+ */
+helpers.resolveResponseType = (type) => RESPONSE_ENUM[RESPONSE_TYPES[type]];
+
+/**
+ * Given an authentication result, return the appropriate enum
+ * @param {Object} opts
+ * @param {string} opts.result
+ * @return {number}
+ */
+helpers.resolveAuthentication = ({ result }) =>
+  AUTH_ENUM[result] || AUTH_ENUM[AUTHENTICATION.LOGIN_UNKNOWN];
+
+/**
+ * Given a model translation function and a collection, will map the collection
+ * over the function and return the <code>array</code> value of each result,
+ * producing a multi-dimensional array.
+ * @param {Function} Model The translation function returning a model instance
+ * @param {Array[*]} coll Collection of items to undergo translation
+ * @return {Array}
+ */
+helpers.mapToModelArray = (Model, coll = []) =>
+  coll.map((el) => Model(el).array);
+
+/**
+ * maps obj (flat object of <T, T>) to a protobuf-style map
+ * @param {Object} obj the object form of the mapping
+ */
+helpers.objToMap = function mapObj(obj = {}) {
+  const protobufMap = Object.keys(obj).map((key) => [key, obj[key]]);
+
+  // if the map is empty then we don't want to populate the array
+  // and instead want to report that there were no obj.
+  return protobufMap;
+};

package/lib/reporter/translations/to-protobuf/dtm/activity.js

@@ -0,0 +1,149 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const { RESPONSE_TYPES, ATTACK_STATUS } = require('../../../../constants');
+const { mapToModelArray } = require('../../helpers');
+const HttpRequest = require('./http-request');
+const AttackResult = require('./attack-result');
+const LibraryUsageUpdate = require('./library-usage-update');
+const ArchitectureComponent = require('./architecture-component');
+const Finding = require('./finding');
+
+module.exports = function Activity({
+  request,
+  queriesMonitored,
+  attackResults = [],
+  samples,
+  findings,
+  libs = [],
+  technologies = [],
+  architectures = []
+} = {}) {
+  const formattedAttacks = formatAttackResults(attackResults);
+  const formattedFindings = getFindingsArray(findings);
+  const formattedLibraryUsages = formatLibraryUsages(libs);
+  const formattedArchitectures = formatArchitectures(architectures);
+
+  return new dtm.Activity({
+    0: request ? HttpRequest(request).array : undefined, //  1   http_request
+    4: queriesMonitored, //                                  5    query_count
+    6: technologies.map((tech) => [tech, true]), //          7   technologies
+    7: formattedLibraryUsages, //                            8 library_usages
+    8: formattedArchitectures, //                            9  architectures
+    11: mapToModelArray(AttackResult, formattedAttacks), // 12        results
+    14: mapToModelArray(Finding, formattedFindings) //      15       findings
+  });
+};
+
+/**
+ * Given an array of architecture components, create an array
+ * of ArchitectureComponent DTMs.
+ * @param   {Object[]}                     architectures  architecture objects
+ * @returns {dtm.ArchitectureComponent[]}                 serialized DTMs
+ */
+function formatArchitectures(architectures) {
+  const serialized = [];
+
+  for (const arch of architectures) {
+    serialized.push(
+      new ArchitectureComponent({
+        type: 'db', // we only support database architecture components
+        vendor: arch.vendor, // MUST match teamserver flowmap/technologies.json entry.
+        url: arch.url,
+        remoteHost: arch.remoteHost || '',
+        remotePort: arch.remotePort
+      }).array
+    );
+  }
+
+  return serialized;
+}
+
+/**
+ * From a findings Map, will return the values of the map prepared for
+ * serialization/further translation.
+ * @param {Map} findings The findings Map
+ * @returns {Object[]}
+ */
+function getFindingsArray(findings) {
+  if (!findings) {
+    return undefined;
+  }
+
+  const partial = Array.from(findings.values());
+  return partial.map((f) => f.toSerializable());
+}
+
+/**
+ * Performs initial formatting of attack results data prior to protobuf mapping.
+ * @param {Object[]} attackResults The results stored by agent
+ * @returns {Object[]}
+ */
+function formatAttackResults(attackResults = []) {
+  const grouped = attackResults.reduce((acc, { ruleId, sample, status }) => {
+    const responseType = getResponseType(status);
+    const groupName = `${ruleId}-${responseType}`;
+
+    if (acc[groupName]) {
+      acc[groupName].samples.push(sample.toSerializable());
+    } else {
+      acc[groupName] = {
+        ruleId,
+        status: responseType,
+        samples: [sample.toSerializable()]
+      };
+    }
+
+    return acc;
+  }, {});
+
+  return Object.values(grouped);
+}
+
+/**
+ * Performs initial formatting of library usage updates prior to protobuf mapping.
+ * @param {LibraryUsage[]} an array of app-update/LibraryUsage objects
+ * @returns {Object[]}
+ */
+function formatLibraryUsages(libs = []) {
+  return libs.map((lib) => [
+    lib.hash,
+    new LibraryUsageUpdate({
+      hash: lib.hash,
+      classNames: lib.files
+    }).array
+  ]);
+}
+
+/**
+ * Given an attack status, will return the corresponding response type.
+ * @param {String} status The attack status of the sample
+ * @returns {String}
+ */
+function getResponseType(status) {
+  switch (status) {
+    case ATTACK_STATUS.INEFFECTIVE:
+      return RESPONSE_TYPES.PROBED;
+    case ATTACK_STATUS.BLOCKED:
+      return RESPONSE_TYPES.BLOCKED;
+    case ATTACK_STATUS.EXPLOITED:
+      return RESPONSE_TYPES.MONITORED;
+    case ATTACK_STATUS.BLOCKED_AT_PERIMETER:
+      return RESPONSE_TYPES.BLOCKED_AT_PERIMETER;
+  }
+}

package/lib/reporter/translations/to-protobuf/dtm/address.js

@@ -0,0 +1,25 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function Address(ip, host, port) {
+  return new dtm.Address({
+    0: ip, //   string ip = 1;
+    1: host, // string host = 2;
+    2: port //  int32 port = 3;
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/agent-startup.js

@@ -0,0 +1,40 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const {
+  AGENT_INFO: { VERSION }
+} = require('../../../../constants');
+
+module.exports = function AgentStartup({
+  config = { server: {} },
+  appInfo: { app_dir, serverEnvironment, serverVersion, version } = {}
+} = {}) {
+  const serverName = config.server.name;
+  const { tags, type } = config.server;
+  app_dir = config.server.path || app_dir;
+
+  return new dtm.AgentStartup({
+    1: VERSION, //           2 version
+    2: serverEnvironment, // 3 environment
+    3: tags, //              4 tags
+    4: serverName, //        5 server_name
+    5: app_dir, //           6 server_path
+    6: type, //              7 server_type
+    7: serverVersion //      8 server_version
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/application-create.js

@@ -0,0 +1,44 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function ApplicationCreate({
+  code,
+  group,
+  metadata,
+  session_id,
+  session_metadata,
+  tags,
+  version,
+  assess,
+  protect
+} = {}) {
+  return new dtm.ApplicationCreate({
+    0: group, //           1
+    1: version, //         2
+    2: tags, //            3
+    3: code, //            4
+    4: metadata, //        5
+    5: session_id, //      6
+    6: session_metadata, // 7
+    // InstrumentationMode DTM
+    9: {
+      0: protect,
+      1: assess
+    } // 10
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/application-update.js

@@ -0,0 +1,61 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+const { RoutesList } = require('./route-coverage');
+
+module.exports = function ApplicationUpdate(data) {
+  if (data.toSerializable) {
+    data = data.toSerializable();
+  }
+
+  const { libraries, coverage, routes } = data;
+  return new dtm.ApplicationUpdate({
+    1: coverage, //                         2 coverage_loc
+    7: translateLibs(libraries), //         8 libraries
+    8: routes ? RoutesList(routes) : [] //   9 routes
+  });
+};
+
+function translateLibs(libraries) {
+  if (!libraries) return libraries;
+  const serializedLibs = [];
+  for (const lib of libraries) {
+    // protobuf map for key: {a: b, c: d} looks like
+    // [key [b, d]].
+    const entry = [];
+    const tags = lib.tags || [];
+
+    entry.push(lib.hash);
+    entry.push(
+      new dtm.Library({
+        0: lib.hash, //                               1        hash_code
+        1: lib.file, //                               2        file_path
+        2: lib.url, //                                3              url
+        3: lib.version, //                            4          version
+        4: 0, //                                      5             tloc
+        5: lib.classCount, //                         6      class_count
+        6: lib.usedClassCount, //                     7 used_class_count
+        9: lib.manifest, //                          10         manifest
+        10: tags.join(',') //                        11             tags
+      }).array
+    );
+
+    serializedLibs.push(entry);
+  }
+
+  return serializedLibs;
+}