@contrast/agent 4.23.0 → 4.23.1

package/lib/core/express/index.js

@@ -59,6 +59,7 @@ class ExpressFramework {
     // Express middleware error handler.
     this.errorHandler = ExpressFramework.ContrastErrorHandler.bind(this);
     moduleHook.resolve({ name: 'express' }, this.hookExpress.bind(this));
+    moduleHook.resolve({ name: 'body-parser' }, this.hookBodyParser.bind(this));
   }
 
   /**
@@ -227,6 +228,80 @@ class ExpressFramework {
     agentEmitter.on(HTTP_EVENTS.SERVER_LISTEN, this.onServerListen.bind(this));
   }
 
+  hookBodyParser(bodyParser) {
+    const instrumentation = this;
+    const origBodyParser = bodyParser;
+
+    const { json: origJson, raw: origRaw, text: origText, urlencoded: origUrlencoded } = bodyParser;
+    const fnArr = [
+      {
+        key: 'json',
+        original: origJson,
+      },
+      {
+        key: 'raw',
+        original: origRaw,
+      },
+      {
+        key: 'text',
+        original: origText,
+      },
+      {
+        key: 'urlencoded',
+        original: origUrlencoded,
+      }
+    ];
+
+    bodyParser = function bodyParser(...args) {
+      const parser = origBodyParser(...args);
+      const hookedParser = function(req, res, next) {
+        parser(req, res, instrumentation.contrastNext(req, res, next, 'bodyParser'));
+      };
+
+      Object.defineProperty(hookedParser, 'name', {
+        value: 'bodyParser'
+      });
+
+      return hookedParser;
+    };
+
+    fnArr.forEach((fn) => {
+      const fnName = `bodyParser.${fn.key}`;
+      function contrastHooked(...args) {
+        const parser = fn.original(...args);
+        const hookedParser = function (req, res, next) {
+          parser(req, res, instrumentation.contrastNext(req, res, next, fnName));
+        };
+
+        Object.defineProperty(hookedParser, 'name', {
+          value: `${fn.key}Parser`
+        });
+
+        return hookedParser;
+      }
+
+      Object.defineProperty(bodyParser, fn.key, {
+        configurable: true,
+        enumerable: true,
+        get: () => contrastHooked,
+      });
+    });
+
+    return bodyParser;
+  }
+
+  contrastNext(req, res, origNext, fnName) {
+    return function next() {
+      if (fnName == 'bodyParser.json') {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
+      } else {
+        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
+      }
+
+      origNext();
+    };
+  }
+
   onServerListen(args, server) {
     if (!this.serversSeen.has(server)) {
       logger.debug('ignore server.listen: non-express handler');
@@ -316,35 +391,6 @@ class ExpressFramework {
       next();
     }, 'multerMiddleware');
 
-    // ... body-parser ...............................................
-    this.useAfter(function ContrastRawBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'rawParser');
-
-    // ... bodyParser in Sails Framework ............................
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      if (req._sails && req.body) {
-        agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      }
-      next();
-    }, '_parseHTTPBody');
-
-    this.useAfter(function ContrastTextBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'textParser');
-
-    this.useAfter(function ContrastBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
-      next();
-    }, 'urlencodedParser');
-
-    this.useAfter(function ContrastJSONParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.JSON_VALUE);
-      next();
-    }, 'jsonParser');
-
     // ... cookie-parser .............................................
     this.useAfter(function ContrastCookiesParsed(req, res, next) {
       agentEmitter.emit(

package/lib/protect/sinks/mongodb.js

@@ -16,13 +16,11 @@ Copyright: 2022 Contrast Security, Inc
 
 const _ = require('lodash');
 const semver = require('semver');
-const constants = require('../../constants');
-const BaseSensor = require('../../hooks/frameworks/base');
 const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
+const BaseSensor = require('../../hooks/frameworks/base');
+const { PATCH_TYPES, SINK_TYPES } = require('../../constants');
 const { emitSinkEvent } = require('../../hooks/frameworks/common');
 
-const { SINK_TYPES } = constants;
 const ID = 'mongodb';
 
 function getCursorQueryData(args, version) {
@@ -61,84 +59,98 @@ class MongoDBSensor extends BaseSensor {
   }
 
   install({ ModuleHook }) {
-    ModuleHook.resolve({ name: 'mongodb' }, (mongodb, { version }) => {
-      // command(ns, cmd, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'command', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          emitSinkEvent(
-            getCursorQueryData(wrapCtx.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
-      });
-
-      // cursor(ns, cmd, options)
-      patcher.patch(mongodb.CoreServer.prototype, 'cursor', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(
-            getCursorQueryData(data.args, version),
-            SINK_TYPES.NOSQL_QUERY,
-            ID
-          );
-        }
+    const v4MethodsWithFilter = [
+      'updateOne',
+      'replaceOne',
+      'updateMany',
+      'deleteOne',
+      'deleteMany',
+      'findOneAndDelete',
+      'findOneAndReplace',
+      'findOneAndUpdate',
+      'countDocuments',
+      'count',
+      'distinct',
+    ];
+
+    ModuleHook.resolve({ name: ID, version: '<4.0.0' }, (mongodb, { version }) => {
+      ['command', 'cursor'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.CoreServer.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            emitSinkEvent(
+              getCursorQueryData(wrapCtx.args, version),
+              SINK_TYPES.NOSQL_QUERY,
+              ID
+            );
+          }
+        });
       });
 
-      // remove(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'remove', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+      ['remove', 'update'].forEach(method => {
+        patcher.patch(mongodb.CoreServer.prototype, method, {
+          alwaysRun: true,
+          name: 'mongodb.CoreServer.prototype.remove',
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const ops = Array.isArray(wrapCtx.args[1]) ? wrapCtx.args[1] : [wrapCtx.args[1]];
+
+            for (const op of ops) {
+              const eData = getOpQueryData(op);
+              if (eData) {
+                emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+              }
             }
           }
-        }
+        });
       });
 
-      // update(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'update', {
+      patcher.patch(mongodb.Db.prototype, 'eval', {
         alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
+        name: 'mongodb.Db.prototype.eval',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          const ops = Array.isArray(data.args[1])
-            ? data.args[1]
-            : [data.args[1]];
-
-          for (const op of ops) {
-            const eData = getOpQueryData(op);
-            if (eData) {
-              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
-            }
-          }
+        pre: (wrapCtx) => {
+          emitSinkEvent(wrapCtx.args[0], SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
+    });
 
-      // eval(code, parameters, options, cb)
-      patcher.patch(mongodb.Db.prototype, 'eval', {
+    ModuleHook.resolve({ name: ID, version: '>=4.0.0' }, (mongodb) => {
+      v4MethodsWithFilter.forEach((method) => {
+        patcher.patch(mongodb.Collection.prototype, method, {
+          alwaysRun: true,
+          name: `mongodb.Collection.prototype.${method}`,
+          patchType: PATCH_TYPES.PROTECT_SINK,
+          pre: (wrapCtx) => {
+            const value = typeof wrapCtx.args[0] == 'function' ? null : wrapCtx.args[0];
+            emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+          },
+        });
+      });
+
+      patcher.patch(mongodb.Db.prototype, 'command', {
         alwaysRun: true,
-        name: 'mongodb.Db.prototype',
+        name: 'mongodb.Db.prototype.command',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (data) => {
-          emitSinkEvent(data.args[0], SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (wrapCtx) => {
+          const value = wrapCtx.args[0] && wrapCtx.args[0].filter;
+          emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
     });
 
+    ModuleHook.resolve({ name: ID, file: 'lib/cursor/find_cursor', version: '>=4.0.0' }, (cursor) => patcher.patch(cursor, 'FindCursor', {
+      alwaysRun: true,
+      name: 'mongodb.FindCursor',
+      patchType: PATCH_TYPES.PROTECT_SINK,
+      pre: (wrapCtx) => {
+        const value = wrapCtx.args[2];
+        emitSinkEvent(value, SINK_TYPES.NOSQL_QUERY, ID);
+      }
+    }));
+
     return this;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.23.0",
+  "version": "4.23.1",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",