@contrast/agent 4.28.1 → 4.29.0

package/lib/app-info.js

@@ -18,22 +18,35 @@ const fs = require('fs');
 const path = require('path');
 const parentPackageJson = require('parent-package-json');
 const semver = require('semver');
+const { v4: uuid } = require('uuid');
 const { AGENT_INFO } = require('./constants');
 const logger = require('./core/logger')('contrast:appInfo');
 
-const isContainer = () => {
+const MOUNTINFO_REGEX = /\/docker\/containers\/(.*?)\//;
+const CGROUP_REGEX = /:\/docker\/([^/]+)$/;
+
+const getContainerId = () => {
   try {
-    fs.statSync('/.dockerenv');
-    return true;
+    const results = fs.readFileSync('/proc/self/mountinfo', 'utf8').match(MOUNTINFO_REGEX);
+
+    if (results) return results[1];
   } catch (err) {
-    // if no docker env, check /proc/self/cgroup
+    //
   }
 
   try {
-    return fs.readFileSync('/proc/self/cgroup', 'utf8').includes('docker');
+    const results = fs.readFileSync('/proc/self/cgroup', 'utf8').match(CGROUP_REGEX);
+
+    if (results) return results[1];
+  } catch (err) {
+    //
+  }
+
+  try {
+    fs.statSync('/.dockerenv');
+    return `_${uuid()}`;
   } catch (err) {
-    // if file not present,
-    return false;
+    return null;
   }
 };
 
@@ -69,7 +82,7 @@ class AppInfo {
       type: os.type()
     };
     this.hostname = os.hostname();
-    this.isContainer = isContainer();
+    this.containerId = getContainerId();
 
     logger.info('finding package.json for %s', this.indexFile);
 

package/lib/assess/policy/rules.json

@@ -555,6 +555,48 @@
               }
             ]
           }
+        },
+        "mssql/lib/base/prepared-statement.prototype.prepare": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "mssql/lib/base/request.prototype.batch": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "mssql/lib/base/request.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
         }
       }
     },

package/lib/assess/policy/signatures.json

@@ -626,6 +626,24 @@
       "methodName": "Database.prototype.prepare",
       "isModule": true
     },
+    "mssql/lib/base/prepared-statement.prototype.prepare": {
+      "moduleName": "mssql",
+      "version": ">=6.4.0",
+      "methodName": "PreparedStatement.prototype.prepare",
+      "isModule": true
+    },
+    "mssql/lib/base/request.prototype.batch": {
+      "moduleName": "mssql",
+      "version": ">=6.4.0",
+      "methodName": "Request.prototype.batch",
+      "isModule": true
+    },
+    "mssql/lib/base/request.prototype.query": {
+      "moduleName": "mssql",
+      "version": ">=6.4.0",
+      "methodName": "Request.prototype.query",
+      "isModule": true
+    },
     "path.format": {
       "moduleName": "path",
       "methodName": "format",

package/lib/telemetry.js

@@ -74,12 +74,18 @@ module.exports = class Telemetry {
       const mac = getMac();
 
       const hash = createHash('sha256').update(mac);
+      if (appInfo.containerId) {
+        hash.update(appInfo.containerId);
+      }
       this.instanceId = hash.copy().digest('hex');
       this.applicationId = hash.update(appInfo.name).digest('hex');
     } catch (err) {
       // If getMac fails we fall back to generating a UUID. "Unstable"
       // identifiers such as these are prefixed with an underscore.
-      const id = uuid();
+      let id = uuid();
+      if (appInfo.containerId) {
+        id += `_${appInfo.containerId}`;
+      }
 
       this.instanceId = `_${id}`;
       this.applicationId = this.instanceId;
@@ -92,7 +98,7 @@ module.exports = class Telemetry {
       osArch: appInfo.os.architecture,
       osPlatform: appInfo.os.platform,
       osRelease: appInfo.os.release,
-      isContainer: appInfo.isContainer,
+      isContainer: !!appInfo.containerId,
       agent: AGENT_INFO.NAME,
       agentVersion: AGENT_INFO.VERSION,
       isAssess: agent.isInAssessMode(),

package/lib/util/heap-dump.js

@@ -59,14 +59,12 @@ const init = function init(config) {
     let count = 0;
 
     const interval = setInterval(() => {
-      if (count >= config.count) {
-        clearInterval(interval);
-        return;
-      }
-
       writeHeapSnapshot(config.path);
-
       count++;
+
+      if (count === config.count) {
+        clearInterval(interval);
+      }
     }, config.window_ms);
   }, config.delay_ms).unref();
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.28.1",
+  "version": "4.29.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",

package/system-diagnostics.js

@@ -40,14 +40,22 @@ function isContainer() {
     fs.statSync('/.dockerenv');
     return true;
   } catch (err) {
-    // if no docker env, check /proc/self/cgroup
+    // if no docker env, check /proc/self/mountinfo
+  }
+
+  try {
+    return fs.readFileSync('proc/self/mountinfo', 'utf8').includes('docker/containers/');
+  } catch (err) {
+    // else check /proc/self/cgroup
   }
 
   try {
     return fs.readFileSync('/proc/self/cgroup', 'utf8').includes('docker');
   } catch (err) {
-    return false;
+    // if there's not such file we can conclude it's not docker env
   }
+
+  return false;
 }
 
 function isUsingPM2() {
@@ -55,11 +63,11 @@ function isUsingPM2() {
   let version = null;
 
   for (const pathVar of ['npm_package_json', 'PWD']) {
-    let packagePath;
-    if (packagePath = process.env[pathVar]) {
+    const packagePath = process.env[pathVar];
+    if (packagePath) {
       try {
-        version = require(path.join(packagePath, 'package.json'));
-      } catch(err) {
+        version = require(path.join(packagePath, 'package.json')).dependencies['pm2'];
+      } catch (err) {
         //
       }
     }
@@ -142,7 +150,6 @@ const diagnostics = {
       Node: {
         Version: process.version
       },
-      PM2: isUsingPM2(),
       OperatingSystem: {
         Architecture: os.arch(),
         Name: os.type(),
@@ -155,12 +162,14 @@ const diagnostics = {
       },
       Host: {
         isDocker: isContainer(),
+        PM2: isUsingPM2(),
         Memory: {
           Total: (os.totalmem() / 1e6).toFixed(0).concat(' MB'),
           Free: (os.freemem() / 1e6).toFixed(0).concat(' MB'),
           Used: ((os.totalmem() - os.freemem()) / 1e6).toFixed(0).concat(' MB'),
         }
       },
+      Application: require(path.join(process.env['PWD'], 'package.json')),
     };
 
     return info;