@contrast/agent 4.25.5 → 4.26.0

package/lib/assess/models/call-context.js

@@ -21,6 +21,7 @@ const stackFactory = require('../../core/stacktrace').singleton;
 const { PROXY_TARGET } = require('../../../lib/constants');
 const TagRange = require('../models/tag-range');
 const distringuish = require('@contrast/distringuish');
+const agent = require('../../agent');
 
 /**
  * Holds information about the call context of a function
@@ -153,29 +154,36 @@ function valueString(value) {
   return type;
 }
 
-function create(params) {
+const appendStack = agent.config.assess.enable_lazy_stacktraces ?
+    (instance, snapshot) => {
+      let stack;
+      // This enables the lazy generation of a stacktrace which is a performance
+      // improvement, but the snapshot method call is in a closure which creates
+      // a memory leak in longer running tests
+      Object.defineProperty(instance, 'stack', {
+        enumerable: true,
+        configurable: true,
+        get() {
+          if (!stack) {
+            stack = snapshot();
+          }
+          return stack;
+        },
+        set(value) {
+          stack = value;
+        }
+      });
+    } : (instance, snapshot) => {
+      instance.stack = snapshot();
+    };
+
+function create (params) {
   const instance = new CallContext(params);
   const snapshot = params.stacktrace || stackFactory.createSnapshot({
     constructorOpt: params.hooked
   });
 
-  let stack;
-
-  // If this occurs within the constructor it will leak all references within
-  // the snapshot's closure.
-  Object.defineProperty(instance, 'stack', {
-    enumerable: true,
-    configurable: true,
-    get() {
-      if (!stack) {
-        stack = snapshot();
-      }
-      return stack;
-    },
-    set(value) {
-      stack = value;
-    }
-  });
+  appendStack(instance, snapshot);
 
   return instance;
 }

package/lib/assess/models/index.js

@@ -12,6 +12,8 @@ Copyright: 2022 Contrast Security, Inc
   engineered, modified, repackaged, sold, redistributed or otherwise used in a
   way not consistent with the End User License Agreement.
 */
+'use strict';
+
 const CallContext = require('./call-context');
 const Signature = require('./signature');
 const BaseEvent = require('./base-event');

package/lib/core/config/options.js

@@ -761,6 +761,13 @@ const assess = [
     fn: castBoolean,
     desc: 'When set to `false` won\'t track the source events lazily but will track the first up to 250 source events',
   },
+  {
+    name: 'assess.enable_lazy_stacktraces',
+    arg: '[false]',
+    default: false,
+    fn: castBoolean,
+    desc: 'When set to `true` it will evaluate stacktraces lazily, this improves performance, but causes a memory leak if used in a longer running application',
+  },
 ];
 
 const protect = [

package/lib/core/config/util.js

@@ -37,7 +37,7 @@ const util = module.exports;
  * @param {*} value
  * @param {boolean} def set from default or not
  */
-function set(conf, name, value, def) {
+function set(conf, name, value, def, origin) {
   // use _.set so we can nest properties for names like 'application.vulnerability.tags'
   // and ensure 'var t = config.application.vulnerability.tags' is not going
   // to throw anything like 'can't read property tagRanges of undefined'
@@ -47,6 +47,7 @@ function set(conf, name, value, def) {
   if (!name.startsWith('api.')) {
     conf._flat[name] = value;
   }
+  conf._sources[name] = origin;
 }
 
 class ConfigurationError extends Error {
@@ -59,6 +60,7 @@ class Config {
   constructor() {
     this._default = {};
     this._flat = {};
+    this._sources = {};
 
     // all properties on node.agent should always exist, so that
     // no code needs to check whether they exist or not. this rule
@@ -87,6 +89,10 @@ class Config {
     return this._default[name];
   }
 
+  getOrigin(name) {
+    return this._sources[name];
+  }
+
   query(name) {
     const isDefault = this.isDefault(name);
     const value = this.get(name);
@@ -188,9 +194,8 @@ function readConfig(cliOptions, logger) {
   let fileContents;
 
   if (configPath) {
-    cliOptions.configFile = path.resolve(configPath);
     try {
-      fileContents = fs.readFileSync(cliOptions.configFile, 'utf-8');
+      fileContents = fs.readFileSync(path.resolve(configPath), 'utf-8');
     } catch (e) {
       logger.error(`Unable to read config file. ${e.message}`);
     }
@@ -211,7 +216,7 @@ function readConfig(cliOptions, logger) {
     }
   }
 
-  return config;
+  return { config, configPath };
 }
 
 /**
@@ -221,10 +226,9 @@ function readConfig(cliOptions, logger) {
  * @param {Object} cliOptions
  * @return {Object} "un-flattened" file options
  */
-function getFileOptions(cliOptions, logger) {
-  const config = readConfig(cliOptions, logger);
-  return _.reduce(
-    config,
+util.getFileOptions = function(cliOptions, logger) {
+  const { config, configPath } = readConfig(cliOptions, logger);
+  return _.reduce({ ...config, configPath },
     (memo, value, key) => {
       // Merge if necessary,
       if (memo[key]) {
@@ -233,12 +237,11 @@ function getFileOptions(cliOptions, logger) {
         // but otherwise set the config path.
         _.set(memo, key, value);
       }
-
       return memo;
     },
     {}
   );
-}
+};
 
 /**
  * only set autoEnv if it's a common config option
@@ -256,8 +259,9 @@ function getAutoEnv(name) {
  * @return {Config} merged options
  */
 function mergeCliOptions(cliOptions, logger) {
-  const fileOptions = getFileOptions(cliOptions, logger);
+  const fileOptions = util.getFileOptions(cliOptions, logger);
 
+  // eslint-disable-next-line complexity
   return configOptions.reduce((options, option) => {
     const {
       default: optDefault,
@@ -273,12 +277,26 @@ function mergeCliOptions(cliOptions, logger) {
     const fileFlag = _.get(fileOptions, name);
 
     // For some values, we want to know if we assigned by falling back to default
-    let isFromDefault;
-
     // cli > env > file > default
+    let isFromDefault, origin;
+
+    if (cliFlag != null) {
+      origin = 'CLI';
+    } else if (env != null || autoEnv != null) {
+      origin = 'ENV';
+    } else if (fileFlag != null) {
+      origin = 'YAML';
+    }
+
     let value = [cliFlag, env, autoEnv, fileFlag]
-      .map((v) => fn(v, logger))
-      .find((flag) => flag !== undefined);
+      .map((v) => fn(v, logger)).find((flag) => flag !== undefined);
+
+    // This is kind of a special case. We never set a default value for it so
+    // if we want to see it in the config, it needs to be set explicitly
+    if (name == 'configFile' && value == null) {
+      value = fileOptions.configPath;
+      origin = 'DEFAULT';
+    }
 
     // if it's an enum, find it in the enum or set the value to default
     // ineffective if optDefault wasn't in the enum;
@@ -288,6 +306,7 @@ function mergeCliOptions(cliOptions, logger) {
     if (optEnum && optEnum.indexOf(value) === -1) {
       value = fn(optDefault, logger);
       isFromDefault = true;
+      origin = 'DEFAULT';
     }
 
     // set default last and separately, so that we can mark that the option was
@@ -297,12 +316,12 @@ function mergeCliOptions(cliOptions, logger) {
         logger.error("Missing required option '%s'", name);
         return options;
       }
-
       value = fn(optDefault, logger);
       isFromDefault = true;
+      origin = 'DEFAULT';
     }
+    set(options, name, value, isFromDefault, origin);
 
-    set(options, name, value, isFromDefault);
     return options;
   }, new Config());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.25.5",
+  "version": "4.26.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -138,7 +138,7 @@
     "dustjs-linkedin": "^3.0.1",
     "ejs": "^3.1.7",
     "escape-html": "^1.0.3",
-    "eslint": "^8.9.0",
+    "eslint": "^8.26.0",
     "eslint-plugin-mocha": "^10.0.3",
     "eslint-plugin-node": "^11.1.0",
     "express": "file:test/mock/express",
@@ -158,7 +158,7 @@
     "lint-staged": "^12.0.2",
     "madge": "^4.0.1",
     "marsdb": "file:test/mock/marsdb",
-    "mocha": "^9.2.0",
+    "mocha": "^9.2.2",
     "mochawesome": "^7.0.1",
     "mock-fs": "^5.1.2",
     "mongodb": "file:test/mock/mongodb",