@contrast/agent 4.22.1 → 4.24.0

package/lib/assess/models/base-event.js

@@ -112,7 +112,17 @@ class BaseEvent {
     this._expanded = true;
     this.thread = process.pid;
     if (this.source === 'P') {
-      this.source = 'P0';
+      const numArgs = this.context.hasArgsTracked.length;
+      if (numArgs === 1) {
+        this.source = 'P0'
+      } else {
+        this.source = '';
+        for (let i = 0; i < numArgs; i++) {
+          if (this.context.hasArgsTracked[i]) {
+            this.source += `P${i},`;
+          }
+        }  
+      }
     }
 
     if (this.signature) {

package/lib/assess/models/call-context.js

@@ -103,6 +103,25 @@ module.exports = class CallContext {
     return !!(str && typeof str === 'object' && str[PROXY_TARGET]);
   }
 
+  static hasTrackedArg(arg, iteration = 0) {
+    if (tracker.getData(arg)) {
+      return true;
+    }
+
+    if (arg && typeof arg === 'object') {
+
+      for (const key in arg) {
+        if (tracker.getData(arg[key])) {
+          return true;
+        }
+        if (arg[key] && typeof arg[key] === 'object' && iteration < 100) {
+          return CallContext.hasTrackedArg(arg[key], iteration += 1);
+        }  
+      }
+    }
+    return false;
+  }
+
   static getDisplayRange(arg, orgArg = arg, iteration = 0) {
     if (tracker.getData(arg)) {
       return new TagRange(0, arg.length - 1, 'untrusted');
@@ -144,6 +163,7 @@ module.exports = class CallContext {
   set args(args) {
     this.__args = args.map(CallContext.valueString);
     this.argsTracked = args.map((arg) => CallContext.isTracked(arg));
+    this.hasArgsTracked = args.map((arg) => CallContext.hasTrackedArg(arg));
     this.argsDisplayRanges = args.map((arg) => CallContext.getDisplayRange(arg));
   }
 

package/lib/assess/propagators/JSON/stringify.js

@@ -331,7 +331,9 @@ module.exports.handle = function() {
       // always exist, even if an empty array, for production code.
       if (metadata.sourceEvents && !metadata.sourceEvents.length) {
         const { sourceEvents, braned } = data.metadata;
-        if (braned) {
+        // If it is a source membrane (could be deserialization membrane), then
+        // we need to get a source event.
+        if (braned && braned.membrane && braned.membrane.makeReqSourceEvent) {
           sourceEvents.push(
             braned.membrane.makeReqSourceEvent(data.result.length)
           );

package/lib/assess/sinks/dynamo.js

@@ -37,6 +37,7 @@ const requiredTags = ['untrusted'];
 const trackSchemaCommands = {
   'scan': {
     attributes: [
+      'FilterExpression',
       'ExclusiveStartKey',
       'ScanFilter'
     ]

package/lib/core/async-storage/index.js

@@ -44,7 +44,7 @@ const KEYS = {
   REQUEST: 'request',
   REQ: 'req',
   RES: 'res',
-  RESPONSE_CONTENT_TYPE: 'res.contentType',
+  RESPONSE_CONTENT_TYPE: 'response.contentType',
   ROUTE: 'route',
   RULES: 'defend.rules',
   SAMPLES: 'defend.samples',

package/lib/core/express/index.js

@@ -59,6 +59,7 @@ class ExpressFramework {
     // Express middleware error handler.
     this.errorHandler = ExpressFramework.ContrastErrorHandler.bind(this);
     moduleHook.resolve({ name: 'express' }, this.hookExpress.bind(this));
+    moduleHook.resolve({ name: 'body-parser' }, this.hookBodyParser.bind(this));
   }
 
   /**
@@ -227,6 +228,80 @@ class ExpressFramework {
     agentEmitter.on(HTTP_EVENTS.SERVER_LISTEN, this.onServerListen.bind(this));
   }
 
+  hookBodyParser(bodyParser) {
+    const instrumentation = this;
+    const origBodyParser = bodyParser;
+
+    const { json: origJson, raw: origRaw, text: origText, urlencoded: origUrlencoded } = bodyParser;
+    const fnArr = [
+      {
+        key: 'json',
+        original: origJson,
+      },
+      {
+        key: 'raw',
+        original: origRaw,
+      },
+      {
+        key: 'text',
+        original: origText,
+      },
+      {
+        key: 'urlencoded',
+        original: origUrlencoded,
+      }
+    ];
+
+    bodyParser = function bodyParser(...args) {
+      const parser = origBodyParser(...args);
+      const hookedParser = function(req, res, next) {
+        parser(req, res, instrumentation.contrastNext(req, res, next, 'bodyParser'));
+      };
+
+      Object.defineProperty(hookedParser, 'name', {
+        value: 'bodyParser'
+      });
+
+      return hookedParser;
+    };
+
+    fnArr.forEach((fn) => {
+      const fnName = `bodyParser.${fn.key}`;
+      function contrastHooked(...args) {
+        const parser = fn.original(...args);
+        const hookedParser = function (req, res, next) {
+          parser(req, res, instrumentation.contrastNext(req, res, next, fnName));
+        };
+
+        Object.defineProperty(hookedParser, 'name', {
+          value: `${fn.key}Parser`
+        });
+
+        return hookedParser;
+      }
+
+      Object.defineProperty(bodyParser, fn.key, {
+        configurable: true,
+        enumerable: true,
+        get: () => contrastHooked,
+      });
+    });
+
+    return bodyParser;
+  }
+
+  contrastNext(req, res, origNext, fnName) {
+    return function next() {
+      if (fnName == 'bodyParser.json') {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
+      } else {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
+      }
+
+      origNext();
+    };
+  }
+
   onServerListen(args, server) {
     if (!this.serversSeen.has(server)) {
       logger.debug('ignore server.listen: non-express handler');
@@ -316,35 +391,6 @@ class ExpressFramework {
       next();
     }, 'multerMiddleware');
 
-    // ... body-parser ...............................................
-    this.useAfter(function ContrastRawBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'rawParser');
-
-    // ... bodyParser in Sails Framework ............................
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      if (req._sails && req.body) {
-        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      }
-      next();
-    }, '_parseHTTPBody');
-
-    this.useAfter(function ContrastTextBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'textParser');
-
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'urlencodedParser');
-
-    this.useAfter(function ContrastJSONParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
-      next();
-    }, 'jsonParser');
-
     // ... cookie-parser .............................................
     this.useAfter(function ContrastCookiesParsed(req, res, next) {
       agentEmitter.emit(

package/lib/protect/sinks/mongodb.js

@@ -16,13 +16,11 @@ Copyright: 2022 Contrast Security, Inc
 
 const _ = require('lodash');
 const semver = require('semver');
-const constants = require('../../constants');
-const BaseSensor = require('../../hooks/frameworks/base');
 const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
+const BaseSensor = require('../../hooks/frameworks/base');
+const { PATCH_TYPES, SINK_TYPES } = require('../../constants');
 const { emitSinkEvent } = require('../../hooks/frameworks/common');
 
-const { SINK_TYPES } = constants;
 const ID = 'mongodb';
 
 function getCursorQueryData(args, version) {
@@ -61,84 +59,98 @@ class MongoDBSensor extends BaseSensor {
   }
 
   install({ ModuleHook }) {
-    ModuleHook.resolve({ name: 'mongodb' }, (mongodb, { version }) => {
-      // command(ns, cmd, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'command', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          emitSinkEvent(
-            getCursorQueryData(wrapCtx.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
-      });
-
-      // cursor(ns, cmd, options)
-      patcher.patch(mongodb.CoreServer.prototype, 'cursor', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(
-            getCursorQueryData(data.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
+    const v4MethodsWithFilter = [
+      'updateOne',
+      'replaceOne',
+      'updateMany',
+      'deleteOne',
+      'deleteMany',
+      'findOneAndDelete',
+      'findOneAndReplace',
+      'findOneAndUpdate',
+      'countDocuments',
+      'count',
+      'distinct',
+    ];
+
+    ModuleHook.resolve({ name: ID, version: '<4.0.0' }, (mongodb, { version }) => {
+      ['command', 'cursor'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.CoreServer.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            emitSinkEvent(
+              getCursorQueryData(wrapCtx.args, version),
+              SINK_TYPES.NOSQL_QUERY,
+              ID
+            );
+          }
+        });
       });
 
-      // remove(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'remove', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+      ['remove', 'update'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: 'mongodb.CoreServer.prototype.remove',
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const ops = Array.isArray(wrapCtx.args[1]) ? wrapCtx.args[1] : [wrapCtx.args[1]];
+
+            for (const op of ops) {
+              const eData = getOpQueryData(op);
+              if (eData) {
+                emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+              }
             }
           }
-        }
+        });
       });
 
-      // update(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'update', {
+      patcher.patch(mongodb.Db.prototype, 'eval', {
         alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
+        name: 'mongodb.Db.prototype.eval',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
-            }
-          }
+        pre: (wrapCtx) => {
+          emitSinkEvent(wrapCtx.args[0], SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
+    });
 
-      // eval(code, parameters, options, cb)
-      patcher.patch(mongodb.Db.prototype, 'eval', {
+    ModuleHook.resolve({ name: ID, version: '>=4.0.0' }, (mongodb) => {
+      v4MethodsWithFilter.forEach((method) => {
+        patcher.patch(mongodb.Collection.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.Collection.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const value = typeof wrapCtx.args[0] == 'function' ? null : wrapCtx.args[0];
+            emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+          },
+        });
+      });
+
+      patcher.patch(mongodb.Db.prototype, 'command', {
         alwaysRun: true,
-        name: 'mongodb.Db.prototype',
+        name: 'mongodb.Db.prototype.command',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(data.args[0], SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (wrapCtx) => {
+          const value = wrapCtx.args[0] && wrapCtx.args[0].filter;
+          emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
     });
 
+    ModuleHook.resolve({ name: ID, file: 'lib/cursor/find_cursor', version: '>=4.0.0' }, (cursor) => patcher.patch(cursor, 'FindCursor', {
+      alwaysRun: true,
+      name: 'mongodb.FindCursor',
+      patchType: PATCH_TYPES.PROTECT_SINK,
+      pre: (wrapCtx) => {
+        const value = wrapCtx.args[2];
+        emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+      }
+    }));
+
     return this;
   }
 }

package/lib/reporter/models/finding/event.js

@@ -102,12 +102,15 @@ class Event {
       this.args.push(
         new ObjectDTM(event.context.args[i], event.context.argsTracked[i])
       );
-      if (event.tagRanges[i] 
-        && event.context.argsDisplayRanges
-        && Object.keys(event.context.argsDisplayRanges[i]).length
-        ) {
-        event.tagRanges[i] = event.context.argsDisplayRanges[i];
-      }
+    }
+
+    
+    const displayRanges = event.context.argsDisplayRanges.filter((tagRange) => Object.keys(tagRange).length);;
+
+    if (displayRanges.length) {
+      // If displayRanges is non-empty (=/= [{}]), use that instead
+      // since it's more accurate when reporting
+      event.tagRanges = displayRanges;
     }
 
     if (event.code) {

package/lib/reporter/translations/to-protobuf/dtm/finding.js

@@ -29,15 +29,19 @@ module.exports = function Finding(details = {}) {
   }
 
   const routes = RoutesListWithObservations(details.routes);
+  const properties = objToMap(details.properties).map(
+    // ensure string values
+    ([key, value]) => [key, String(value)]
+  );
 
   return new dtm.Finding({
-    0: String(details.hash || ''), //                   1  hash_code
-    2: details.ruleId, //                               3    rule_id
-    5: objToMap(details.properties), //                 6 properties
-    6: mapToModelArray(TraceEvent, details.events), //  7     events
-    7: preflight, //                                    8  preflight
-    8: details.tags, //                                 9       tags
-    9: details.version, //                             10    version
+    0: String(details.hash || ''), //                  1  hash_code
+    2: details.ruleId, //                              3    rule_id
+    5: properties, //                                  6 properties
+    6: mapToModelArray(TraceEvent, details.events), // 7     events
+    7: preflight, //                                   8  preflight
+    8: details.tags, //                                9       tags
+    9: details.version, //                            10    version
     10: routes //                                     11     routes
   });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.22.1",
+  "version": "4.24.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -163,7 +163,7 @@
     "mock-fs": "^5.1.2",
     "mongodb": "file:test/mock/mongodb",
     "mongodb-npm": "npm:mongodb@^3.6.5",
-    "mongoose": "^6.1.1",
+    "mongoose": "^6.4.6",
     "mustache": "^3.0.1",
     "mysql": "file:test/mock/mysql",
     "mysql2": "file:test/mock/mysql2",