@contrast/agent 4.20.2 → 4.21.0

package/lib/assess/hapi/sources.js

@@ -28,7 +28,7 @@ class HapiAssessSources {
    * Handles emitting of all assess source events
    */
   registerSourcesHandler() {
-    agentEmitter.on(EVENTS.HAPI_PRE_HANDLER, ({ request }) => {
+    agentEmitter.on(EVENTS.HAPI_POST_AUTH, ({ request }) => {
       emitWatchableObjects(request);
     });
   }

package/lib/assess/policy/signatures.json

@@ -1000,6 +1000,12 @@
       "methodName": "isCreditCard",
       "isModule": true
     },
+    "validator.isDate": {
+      "moduleName": "validator",
+      "version": ">=13.0.0",
+      "methodName": "isDecimal",
+      "isModule": true
+    },
     "validator.isDecimal": {
       "moduleName": "validator",
       "version": ">=13.0.0",
@@ -1018,6 +1024,12 @@
       "methodName": "isEAN",
       "isModule": true
     },
+    "validator.isEmail": {
+      "moduleName": "validator",
+      "version": ">=13.0.0",
+      "methodName": "isEmail",
+      "isModule": true
+    },
     "validator.isEthereumAddress": {
       "moduleName": "validator",
       "version": ">=13.0.0",

package/lib/assess/propagators/validator/init-hooks.js

@@ -39,11 +39,11 @@ const agent = require('../../../agent');
  * https://docs.google.com/spreadsheets/d/17p5C6NOISNuWi8D-07d8gNg8byQytuwjtgBgzGpfU_w/edit#gid=0
  *
  */
-module.exports.handle = function() {
+module.exports.handle = function () {
   const {
     validators,
     untrackers,
-    sanitizers
+    sanitizers,
   } = require('./validator-methods.js');
 
   const patchType = PATCH_TYPES.ASSESS_PROPAGATOR;
@@ -62,7 +62,7 @@ module.exports.handle = function() {
     const patched = patcher.patch(obj, {
       name,
       patchType,
-      post
+      post,
     });
     // babel adds a self-referential default property so if present in the unpatched
     // object update the patched object
@@ -89,7 +89,12 @@ module.exports.handle = function() {
       { name: 'validator', file: `lib/${validator}` },
       (index, meta) => {
         function post(data) {
-          if (data.result && (validator !== 'matches' || (validator === 'matches' && agent.config.assess.trust_custom_validators))) {
+          if (
+            data.result &&
+            (validator !== 'matches' ||
+              (validator === 'matches' &&
+                agent.config.assess.trust_custom_validators))
+          ) {
             const trackingData = tracker.getData(data.args[0]);
             if (trackingData) {
               tagRangeUtil.addInPlace(
@@ -104,7 +109,7 @@ module.exports.handle = function() {
                 signature,
                 tagRanges: trackingData.tagRanges,
                 source: 'O',
-                target: 'R'
+                target: 'R',
               });
 
               event.parents.push(trackingData.event);
@@ -210,4 +215,38 @@ module.exports.handle = function() {
       }
     );
   }
+
+  moduleHook.resolve({ name: 'validator', file: 'lib/isEmail' }, (isEmail) => {
+    const signature = new Signature('validator.isEmail');
+
+    function post(data) {
+      const trackingData = tracker.getData(data.args[0]);
+      // The default options for the two fields of interest are:
+      // `{ allow_display_name: false, require_display_name: false }`
+      // so we can use an empty object as it will also yield
+      // falsy values for these two fields
+      const options = data.args[1] ? data.args[1] : {};
+      if (data.result && trackingData && !options.allow_display_name && !options.require_display_name) {
+        tagRangeUtil.addInPlace(
+          trackingData.tagRanges,
+          new TagRange(0, data.args[0].length - 1, 'limited-chars')
+        );
+        tagRangeUtil.removeInPlace(trackingData.tagRanges, ['untrusted']);
+
+        const context = new CallContext(data);
+        const event = new PropagationEvent({
+          context,
+          signature,
+          tagRanges: trackingData.tagRanges,
+          source: 'O',
+          target: 'R',
+        });
+
+        event.parents.push(trackingData.event);
+        trackingData.event = event;
+      }
+    }
+
+    return patch(isEmail, 'isEmail', post);
+  });
 };

package/lib/assess/propagators/validator/validator-methods.js

@@ -32,6 +32,7 @@ module.exports = {
     isBoolean: 'limited-chars',
     isBtcAddress: 'alphanum-space-hyphen',
     isCreditCard: 'limited-chars',
+    isDate: 'limited-chars',
     isDecimal: 'limited-chars',
     // calls toFloat() which calls isFloat() so no need to hook.
     //isDivisibleBy: 'limited-chars',
@@ -88,5 +89,10 @@ module.exports = {
     escape: 'html-encoded'
     // toFloat uses isFloat which is hooked, so no need to do so again
     // toFloat: 'limited-chars'
+  },
+  customLogic: {
+    // this value is not used and it's added just for storing the information
+    // about what's patched in one place
+    isEmail: 'limited-chars'
   }
 };

package/lib/core/hapi/index.js

@@ -42,6 +42,7 @@ const constants = {
     HAPI_ROUTES: 'hapi-routes', // used to instrument registered routes
     HAPI_ADD_ROUTE: 'hapi-add-route', // used to instrument adding a route
     HAPI_PRE_AUTH: 'hapi-pre-auth', // used to implement hapi onPreAuth hooks
+    HAPI_POST_AUTH: 'hapi-post-auth', // uses to implement hapi onPostAuth hooks
     HAPI_PRE_HANDLER: 'hapi-pre-handler', // used to implement hapi onPreHandler hooks
     HAPI_FINISHED: 'hapi-response-finished', // used to implement when hapi response is finished
     HAPI_PRE_RES: 'hapi-pre-response', // used to implement hapi onPreResponse hooks
@@ -162,12 +163,13 @@ class HapiCore {
       return h.continue;
     });
 
-    server.ext('onPreHandler', function onPreHandler(request, h) {
-      agentEmitter.emit(constants.EVENTS.HAPI_PRE_HANDLER, {
+    server.ext('onPostAuth', function onPostAuth(request, h) {
+      agentEmitter.emit(constants.EVENTS.HAPI_POST_AUTH, {
         request,
         h,
         server
       });
+
       // Update the domain's model of the request with body and params since it has been
       // fully parsed and validated
       decorateRequest({
@@ -176,6 +178,17 @@ class HapiCore {
         parameters: request.params,
         query: request.query
       });
+
+      return h.continue;
+    });
+
+    server.ext('onPreHandler', function onPreHandler(request, h) {
+      agentEmitter.emit(constants.EVENTS.HAPI_PRE_HANDLER, {
+        request,
+        h,
+        server
+      });
+
       return h.continue;
     });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.20.2",
+  "version": "4.21.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",