@contrast/agent 4.22.0 → 4.23.1

package/lib/assess/models/call-context.js

@@ -103,18 +103,25 @@ module.exports = class CallContext {
     return !!(str && typeof str === 'object' && str[PROXY_TARGET]);
   }
 
-  static getDisplayRange(arg) {
+  static getDisplayRange(arg, orgArg = arg, iteration = 0) {
     if (tracker.getData(arg)) {
       return new TagRange(0, arg.length - 1, 'untrusted');
     }
 
     if (arg && typeof arg === 'object') {
       for (const key in arg) {
+        if (arg[key] && typeof arg[key] === 'object' && iteration < 5) {
+          const nestedDisplayRange = CallContext.getDisplayRange(arg[key], orgArg, iteration += 1);
+          if (!_.isEmpty(nestedDisplayRange)) {
+            return nestedDisplayRange;
+          }
+        }
         const trackedData = tracker.getData(arg[key]);
-        if (trackedData) {
+        if (trackedData && trackedData.tagRanges.length > 0) {
           const { start, stop } = trackedData.tagRanges[0];
+          const offset = Array.isArray(orgArg) ? 2 : 0;
           const taintedString = arg[key].substring(start, stop + 1);
-          const taintRangeStart = CallContext.valueString(arg).indexOf(taintedString);
+          const taintRangeStart = CallContext.valueString(orgArg).indexOf(taintedString) + offset;
           if (taintRangeStart === -1) {
             // If tracked string is not in the abbreviated stringified obj, disable highlighting
             return new TagRange(0, 0, 'disable-highlighting');
@@ -178,9 +185,9 @@ module.exports = class CallContext {
       return value.toString();
     }
 
-    const constructorName = _.get(value, 'constructor.name', 'null');
+    const type = _.get(value, 'constructor.name', 'null');
 
-    if (constructorName === 'Object' && value) {
+    if ((type === 'Object' || type === 'Array') && value) {
       // make string representation uniform with no new lines and consistent spaces
       let str = util
         .inspect(value)
@@ -192,7 +199,7 @@ module.exports = class CallContext {
 
       return str;
     }
-    return constructorName;
+    return type;
   }
 };
 

package/lib/assess/propagators/JSON/stringify.js

@@ -331,7 +331,9 @@ module.exports.handle = function() {
       // always exist, even if an empty array, for production code.
       if (metadata.sourceEvents && !metadata.sourceEvents.length) {
         const { sourceEvents, braned } = data.metadata;
-        if (braned) {
+        // If it is a source membrane (could be deserialization membrane), then
+        // we need to get a source event.
+        if (braned && braned.membrane && braned.membrane.makeReqSourceEvent) {
           sourceEvents.push(
             braned.membrane.makeReqSourceEvent(data.result.length)
           );

package/lib/assess/sinks/dynamo.js

@@ -37,7 +37,6 @@ const requiredTags = ['untrusted'];
 const trackSchemaCommands = {
   'scan': {
     attributes: [
-      'ExpressionAttributeValues',
       'ExclusiveStartKey',
       'ScanFilter'
     ]

package/lib/core/arch-components/mongodb.js

@@ -19,36 +19,74 @@ const { PATCH_TYPES } = require('../../constants');
 const ModuleHook = require('../../hooks/require');
 const patcher = require('../../hooks/patcher');
 const logger = require('../logger')('contrast:arch-component');
-const semver = require('semver');
 
+// Architecture component for versions <3.0.0
 ModuleHook.resolve(
   {
     name: 'mongodb',
     file: 'lib/mongo_client.js',
-    version: '>=3.3.0'
+    version: '<3.0.0'
   },
-  (MongoClient, { version }) => {
-    if (semver.lt(version, '4.0.0')) {
-      patcher.patch(MongoClient.prototype, 'connect', {
-        name: 'MongoClient.connect.arch_component',
-        patchType: PATCH_TYPES.ARCH_COMPONENT,
-        alwaysRun: true,
-        post(ctx) {
-          if (!ctx.result || !ctx.result.then) {
-            return;
-          }
-
-          // We should report only when connection is successful
-          ctx.result.then(function(client) {
+  (MongoClient) => {
+    patcher.patch(MongoClient, 'connect', {
+      name: 'MongoClient.connect.arch_component',
+      patchType: PATCH_TYPES.ARCH_COMPONENT,
+      alwaysRun: true,
+      pre(ctx) {
+        // check if typeof callback == 'function'
+        // if yes:
+        // - MongoClient.connect executes a cb function, which has access to the connection status
+        // if not:
+        // - MongoClient.connect should return a promise and we can check it's result in another hook, just as before
+        const callbackIndex = ctx.args[2] ? 2 : 1;
+        if (ctx.args[callbackIndex] instanceof Function || typeof ctx.args[callbackIndex] === 'function') {
+          ctx.args[callbackIndex] = patcher.patch(ctx.args[callbackIndex], {
+            name: 'MongoClient.connect.callback.arch_component',
+            patchType: PATCH_TYPES.ARCH_COMPONENT,
+            alwaysRun: true,
+            pre(ctx) {
+              const [, db] = ctx.args;
+              if (db && db.s.topology && db.s.topology.s) {
+                try {
+                  const server = db.s.topology.s.server.s;
+                  if (server.pool && server.pool.state == 'connected') {
+                    const connections = server.pool.availableConnections;
+                    for (const c of connections) {
+                      agentEmitter.emit('architectureComponent', {
+                        vendor: 'MongoDB',
+                        url: `mongodb://${c.host}:${c.port}`,
+                        remoteHost: '',
+                        remotePort: c.port
+                      });
+                    }
+                  }
+                } catch (err) {
+                  logger.warn('unable to report MongoDB architecture component, err: %o', err);
+                }
+              }
+            }
+          });
+        }
+      },
+      post(ctx) {
+        if (!ctx.result || !ctx.result.then) {
+          return;
+        }
+        // it never gets here if callbacks are used, because the result won't be then-able
+        ctx.result.then(db => {
+          if (db && db.s && db.s.topology && db.s.topology.s) {
             try {
-              const { servers = [] } = ctx.obj.s && ctx.obj.s.options;
-              for (const server of servers) {
-                agentEmitter.emit('architectureComponent', {
-                  vendor: 'MongoDB',
-                  url: `mongodb://${server.host}:${server.port}`,
-                  remoteHost: '',
-                  remotePort: server.port,
-                });
+              const server = db.s.topology.s.server.s;
+              if (server.pool && server.pool.state == 'connected') {
+                const connections = server.pool.availableConnections;
+                for (const c of connections) {
+                  agentEmitter.emit('architectureComponent', {
+                    vendor: 'MongoDB',
+                    url: `mongodb://${c.host}:${c.port}`,
+                    remoteHost: '',
+                    remotePort: c.port
+                  });
+                }
               }
             } catch (err) {
               logger.warn(
@@ -56,60 +94,96 @@ ModuleHook.resolve(
                 err,
               );
             }
-          });
-        },
-      });
-    }
+          }
+        });
+      }
+    });
+  }
+);
+
+// Architecture component for versions >=3.3.0 <4.0.0
+ModuleHook.resolve(
+  {
+    name: 'mongodb',
+    file: 'lib/mongo_client.js',
+    version: '>=3.0.0 <4.0.0'
+  },
+  (MongoClient, { version }) => {
+    patcher.patch(MongoClient.prototype, 'connect', {
+      name: 'MongoClient.connect.arch_component',
+      patchType: PATCH_TYPES.ARCH_COMPONENT,
+      alwaysRun: true,
+      post(ctx) {
+        if (!ctx.result || !ctx.result.then) {
+          return;
+        }
+
+        // We should report only when connection is successful
+        ctx.result.then(function(client) {
+          try {
+            const { servers = [] } = ctx.obj.s && ctx.obj.s.options;
+            for (const server of servers) {
+              agentEmitter.emit('architectureComponent', {
+                vendor: 'MongoDB',
+                url: `mongodb://${server.host}:${server.port}`,
+                remoteHost: '',
+                remotePort: server.port,
+              });
+            }
+          } catch (err) {
+            logger.warn(
+              'unable to report MongoDB architecture component, err: %o',
+              err,
+            );
+          }
+        });
+      },
+    });
   },
 );
 
-/* Architecture component for >= mongodb@4
- * It's not limited in the require hook to >=4.0.0 because
- * that would result in confusing logs for the customer that
- * we don't support older versions (which is not true) */
+// Architecture component for versions >=4.0.0
 ModuleHook.resolve(
   {
     name: 'mongodb',
-    version: '>=3.3.0'
+    version: '>=4.0.0'
   },
   (MongoDB, { version }) => {
-    if (semver.gte(version, '4.0.0')) {
-      patcher.patch(MongoDB.MongoClient.prototype, 'connect', {
-        name: 'MongoClient.connect.arch_component',
-        patchType: PATCH_TYPES.ARCH_COMPONENT,
-        alwaysRun: true,
-        post(ctx) {
-          if (!ctx.result || !ctx.result.then) {
-            return;
-          }
+    patcher.patch(MongoDB.MongoClient.prototype, 'connect', {
+      name: 'MongoClient.connect.arch_component',
+      patchType: PATCH_TYPES.ARCH_COMPONENT,
+      alwaysRun: true,
+      post(ctx) {
+        if (!ctx.result || !ctx.result.then) {
+          return;
+        }
 
-          // We should report only when connection is successful
-          ctx.result.then(function(client) {
-            if (client && client.topology && client.topology.s) {
-              try {
-                const { servers } = client.topology.s;
-                for (const [, server] of servers) {
-                  if (server.s && server.s.state === 'connected') {
-                    const { srvServiceName } = server.s.options;
-                    const { address } = server.s.description;
-                    agentEmitter.emit('architectureComponent', {
-                      vendor: 'MongoDB',
-                      url: `${srvServiceName}://${address}`,
-                      remoteHost: '',
-                      remotePort: address.split(':').pop()
-                    });
-                  }
+        // We should report only when connection is successful
+        ctx.result.then(function(client) {
+          if (client && client.topology && client.topology.s) {
+            try {
+              const { servers } = client.topology.s;
+              for (const [, server] of servers) {
+                if (server.s && server.s.state === 'connected') {
+                  const { srvServiceName } = server.s.options;
+                  const { address } = server.s.description;
+                  agentEmitter.emit('architectureComponent', {
+                    vendor: 'MongoDB',
+                    url: `${srvServiceName}://${address}`,
+                    remoteHost: '',
+                    remotePort: address.split(':').pop()
+                  });
                 }
-              } catch (err) {
-                logger.warn(
-                  'unable to report MongoDB architecture component, err: %o',
-                  err,
-                );
               }
+            } catch (err) {
+              logger.warn(
+                'unable to report MongoDB architecture component, err: %o',
+                err,
+              );
             }
-          });
-        },
-      });
-    }
+          }
+        });
+      },
+    });
   },
 );

package/lib/core/async-storage/index.js

@@ -44,7 +44,7 @@ const KEYS = {
   REQUEST: 'request',
   REQ: 'req',
   RES: 'res',
-  RESPONSE_CONTENT_TYPE: 'res.contentType',
+  RESPONSE_CONTENT_TYPE: 'response.contentType',
   ROUTE: 'route',
   RULES: 'defend.rules',
   SAMPLES: 'defend.samples',

package/lib/core/express/index.js

@@ -59,6 +59,7 @@ class ExpressFramework {
     // Express middleware error handler.
     this.errorHandler = ExpressFramework.ContrastErrorHandler.bind(this);
     moduleHook.resolve({ name: 'express' }, this.hookExpress.bind(this));
+    moduleHook.resolve({ name: 'body-parser' }, this.hookBodyParser.bind(this));
   }
 
   /**
@@ -227,6 +228,80 @@ class ExpressFramework {
     agentEmitter.on(HTTP_EVENTS.SERVER_LISTEN, this.onServerListen.bind(this));
   }
 
+  hookBodyParser(bodyParser) {
+    const instrumentation = this;
+    const origBodyParser = bodyParser;
+
+    const { json: origJson, raw: origRaw, text: origText, urlencoded: origUrlencoded } = bodyParser;
+    const fnArr = [
+      {
+        key: 'json',
+        original: origJson,
+      },
+      {
+        key: 'raw',
+        original: origRaw,
+      },
+      {
+        key: 'text',
+        original: origText,
+      },
+      {
+        key: 'urlencoded',
+        original: origUrlencoded,
+      }
+    ];
+
+    bodyParser = function bodyParser(...args) {
+      const parser = origBodyParser(...args);
+      const hookedParser = function(req, res, next) {
+        parser(req, res, instrumentation.contrastNext(req, res, next, 'bodyParser'));
+      };
+
+      Object.defineProperty(hookedParser, 'name', {
+        value: 'bodyParser'
+      });
+
+      return hookedParser;
+    };
+
+    fnArr.forEach((fn) => {
+      const fnName = `bodyParser.${fn.key}`;
+      function contrastHooked(...args) {
+        const parser = fn.original(...args);
+        const hookedParser = function (req, res, next) {
+          parser(req, res, instrumentation.contrastNext(req, res, next, fnName));
+        };
+
+        Object.defineProperty(hookedParser, 'name', {
+          value: `${fn.key}Parser`
+        });
+
+        return hookedParser;
+      }
+
+      Object.defineProperty(bodyParser, fn.key, {
+        configurable: true,
+        enumerable: true,
+        get: () => contrastHooked,
+      });
+    });
+
+    return bodyParser;
+  }
+
+  contrastNext(req, res, origNext, fnName) {
+    return function next() {
+      if (fnName == 'bodyParser.json') {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
+      } else {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
+      }
+
+      origNext();
+    };
+  }
+
   onServerListen(args, server) {
     if (!this.serversSeen.has(server)) {
       logger.debug('ignore server.listen: non-express handler');
@@ -316,35 +391,6 @@ class ExpressFramework {
       next();
     }, 'multerMiddleware');
 
-    // ... body-parser ...............................................
-    this.useAfter(function ContrastRawBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'rawParser');
-
-    // ... bodyParser in Sails Framework ............................
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      if (req._sails && req.body) {
-        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      }
-      next();
-    }, '_parseHTTPBody');
-
-    this.useAfter(function ContrastTextBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'textParser');
-
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'urlencodedParser');
-
-    this.useAfter(function ContrastJSONParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
-      next();
-    }, 'jsonParser');
-
     // ... cookie-parser .............................................
     this.useAfter(function ContrastCookiesParsed(req, res, next) {
       agentEmitter.emit(

package/lib/protect/sinks/mongodb.js

@@ -16,13 +16,11 @@ Copyright: 2022 Contrast Security, Inc
 
 const _ = require('lodash');
 const semver = require('semver');
-const constants = require('../../constants');
-const BaseSensor = require('../../hooks/frameworks/base');
 const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
+const BaseSensor = require('../../hooks/frameworks/base');
+const { PATCH_TYPES, SINK_TYPES } = require('../../constants');
 const { emitSinkEvent } = require('../../hooks/frameworks/common');
 
-const { SINK_TYPES } = constants;
 const ID = 'mongodb';
 
 function getCursorQueryData(args, version) {
@@ -61,84 +59,98 @@ class MongoDBSensor extends BaseSensor {
   }
 
   install({ ModuleHook }) {
-    ModuleHook.resolve({ name: 'mongodb' }, (mongodb, { version }) => {
-      // command(ns, cmd, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'command', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          emitSinkEvent(
-            getCursorQueryData(wrapCtx.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
-      });
-
-      // cursor(ns, cmd, options)
-      patcher.patch(mongodb.CoreServer.prototype, 'cursor', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(
-            getCursorQueryData(data.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
+    const v4MethodsWithFilter = [
+      'updateOne',
+      'replaceOne',
+      'updateMany',
+      'deleteOne',
+      'deleteMany',
+      'findOneAndDelete',
+      'findOneAndReplace',
+      'findOneAndUpdate',
+      'countDocuments',
+      'count',
+      'distinct',
+    ];
+
+    ModuleHook.resolve({ name: ID, version: '<4.0.0' }, (mongodb, { version }) => {
+      ['command', 'cursor'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.CoreServer.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            emitSinkEvent(
+              getCursorQueryData(wrapCtx.args, version),
+              SINK_TYPES.NOSQL_QUERY,
+              ID
+            );
+          }
+        });
       });
 
-      // remove(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'remove', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+      ['remove', 'update'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: 'mongodb.CoreServer.prototype.remove',
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const ops = Array.isArray(wrapCtx.args[1]) ? wrapCtx.args[1] : [wrapCtx.args[1]];
+
+            for (const op of ops) {
+              const eData = getOpQueryData(op);
+              if (eData) {
+                emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+              }
             }
           }
-        }
+        });
       });
 
-      // update(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'update', {
+      patcher.patch(mongodb.Db.prototype, 'eval', {
         alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
+        name: 'mongodb.Db.prototype.eval',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
-            }
-          }
+        pre: (wrapCtx) => {
+          emitSinkEvent(wrapCtx.args[0], SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
+    });
 
-      // eval(code, parameters, options, cb)
-      patcher.patch(mongodb.Db.prototype, 'eval', {
+    ModuleHook.resolve({ name: ID, version: '>=4.0.0' }, (mongodb) => {
+      v4MethodsWithFilter.forEach((method) => {
+        patcher.patch(mongodb.Collection.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.Collection.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const value = typeof wrapCtx.args[0] == 'function' ? null : wrapCtx.args[0];
+            emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+          },
+        });
+      });
+
+      patcher.patch(mongodb.Db.prototype, 'command', {
         alwaysRun: true,
-        name: 'mongodb.Db.prototype',
+        name: 'mongodb.Db.prototype.command',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(data.args[0], SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (wrapCtx) => {
+          const value = wrapCtx.args[0] && wrapCtx.args[0].filter;
+          emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
     });
 
+    ModuleHook.resolve({ name: ID, file: 'lib/cursor/find_cursor', version: '>=4.0.0' }, (cursor) => patcher.patch(cursor, 'FindCursor', {
+      alwaysRun: true,
+      name: 'mongodb.FindCursor',
+      patchType: PATCH_TYPES.PROTECT_SINK,
+      pre: (wrapCtx) => {
+        const value = wrapCtx.args[2];
+        emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+      }
+    }));
+
     return this;
   }
 }

package/lib/reporter/translations/to-protobuf/dtm/finding.js

@@ -29,15 +29,19 @@ module.exports = function Finding(details = {}) {
   }
 
   const routes = RoutesListWithObservations(details.routes);
+  const properties = objToMap(details.properties).map(
+    // ensure string values
+    ([key, value]) => [key, String(value)]
+  );
 
   return new dtm.Finding({
-    0: String(details.hash || ''), //                   1  hash_code
-    2: details.ruleId, //                               3    rule_id
-    5: objToMap(details.properties), //                 6 properties
-    6: mapToModelArray(TraceEvent, details.events), //  7     events
-    7: preflight, //                                    8  preflight
-    8: details.tags, //                                 9       tags
-    9: details.version, //                             10    version
+    0: String(details.hash || ''), //                  1  hash_code
+    2: details.ruleId, //                              3    rule_id
+    5: properties, //                                  6 properties
+    6: mapToModelArray(TraceEvent, details.events), // 7     events
+    7: preflight, //                                   8  preflight
+    8: details.tags, //                                9       tags
+    9: details.version, //                            10    version
     10: routes //                                     11     routes
   });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.22.0",
+  "version": "4.23.1",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -163,7 +163,7 @@
     "mock-fs": "^5.1.2",
     "mongodb": "file:test/mock/mongodb",
     "mongodb-npm": "npm:mongodb@^3.6.5",
-    "mongoose": "^6.1.1",
+    "mongoose": "^6.4.6",
     "mustache": "^3.0.1",
     "mysql": "file:test/mock/mysql",
     "mysql2": "file:test/mock/mysql2",