@contrast/agent 4.3.1-0 → 4.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (621) hide show
  1. package/LICENSE +10 -10
  2. package/README.md +86 -57
  3. package/agent-loader.js +14 -0
  4. package/bin/VERSION +1 -0
  5. package/bin/linux/contrast-service +0 -0
  6. package/bin/mac/contrast-service +0 -0
  7. package/bin/windows/contrast-service.exe +0 -0
  8. package/bootstrap.js +14 -0
  9. package/cli-rewriter.js +14 -0
  10. package/cli.js +14 -0
  11. package/esm.mjs +14 -0
  12. package/lib/agent-emitter.js +14 -0
  13. package/lib/agent.js +14 -0
  14. package/lib/app-info.js +14 -0
  15. package/lib/assess/deadzones/index.js +14 -0
  16. package/lib/assess/deadzones/rewrite.js +14 -0
  17. package/lib/assess/express/index.js +14 -0
  18. package/lib/assess/express/route-coverage.js +14 -0
  19. package/lib/assess/express/sinks/index.js +14 -0
  20. package/lib/assess/express/sinks/xss.js +14 -0
  21. package/lib/assess/express/sources.js +14 -0
  22. package/lib/assess/fastify/index.js +14 -0
  23. package/lib/assess/fastify/route-coverage.js +14 -0
  24. package/lib/assess/fastify/sinks/index.js +14 -0
  25. package/lib/assess/fastify/sinks/response-scanning.js +14 -0
  26. package/lib/assess/fastify/sinks/unvalidated-redirect.js +14 -0
  27. package/lib/assess/fastify/sinks/xss.js +14 -0
  28. package/lib/assess/fastify/sources.js +14 -0
  29. package/lib/assess/hapi/index.js +14 -0
  30. package/lib/assess/hapi/route-coverage.js +17 -3
  31. package/lib/assess/hapi/sinks/index.js +14 -0
  32. package/lib/assess/hapi/sinks/response-scanning.js +14 -0
  33. package/lib/assess/hapi/sinks/session.js +14 -0
  34. package/lib/assess/hapi/sinks/unvalidated-redirect.js +14 -0
  35. package/lib/assess/hapi/sinks/xss.js +14 -0
  36. package/lib/assess/hapi/sources.js +14 -0
  37. package/lib/assess/index.js +14 -0
  38. package/lib/assess/koa/index.js +14 -0
  39. package/lib/assess/koa/route-coverage.js +14 -0
  40. package/lib/assess/koa/sinks/index.js +14 -0
  41. package/lib/assess/koa/sinks/response-scanning.js +14 -0
  42. package/lib/assess/koa/sinks/unvalidated-redirect.js +14 -0
  43. package/lib/assess/koa/sinks/xss.js +14 -0
  44. package/lib/assess/koa/sources.js +14 -0
  45. package/lib/assess/loopback4/index.js +14 -0
  46. package/lib/assess/loopback4/route-coverage.js +14 -0
  47. package/lib/assess/loopback4/sinks/index.js +14 -0
  48. package/lib/assess/loopback4/sinks/response-scanning.js +14 -0
  49. package/lib/assess/loopback4/sinks/xss.js +14 -0
  50. package/lib/assess/loopback4/sources.js +14 -0
  51. package/lib/assess/membrane/debraner.js +14 -0
  52. package/lib/assess/membrane/deserialization-membrane.js +14 -0
  53. package/lib/assess/membrane/index.js +16 -8
  54. package/lib/assess/membrane/source-membrane.js +17 -4
  55. package/lib/assess/models/base-event.js +16 -2
  56. package/lib/assess/models/call-context.js +14 -3
  57. package/lib/assess/models/index.js +14 -0
  58. package/lib/assess/models/propagation-event.js +14 -0
  59. package/lib/assess/models/signature.js +14 -0
  60. package/lib/assess/models/sink-event.js +14 -0
  61. package/lib/assess/models/source-event.js +14 -0
  62. package/lib/assess/models/tag-range/index.js +20 -16
  63. package/lib/assess/models/tag-range/relationships.js +14 -0
  64. package/lib/assess/models/tag-range/util.js +14 -0
  65. package/lib/assess/policy/index.js +14 -0
  66. package/lib/assess/policy/init.js +14 -0
  67. package/lib/assess/policy/signatures.json +95 -0
  68. package/lib/assess/policy/util.js +23 -2
  69. package/lib/assess/propagators/JSON/parse.js +14 -0
  70. package/lib/assess/propagators/JSON/stringify.js +14 -0
  71. package/lib/assess/propagators/ajv/conditionals.js +14 -0
  72. package/lib/assess/propagators/ajv/evaluator-shim.js +14 -0
  73. package/lib/assess/propagators/ajv/index.js +14 -0
  74. package/lib/assess/propagators/ajv/json-schema-type-evaluators.js +14 -0
  75. package/lib/assess/propagators/ajv/object-walk.js +14 -0
  76. package/lib/assess/propagators/ajv/refs.js +14 -0
  77. package/lib/assess/propagators/ajv/schema-context.js +14 -0
  78. package/lib/assess/propagators/array-prototype-join.js +14 -0
  79. package/lib/assess/propagators/common.js +14 -0
  80. package/lib/assess/propagators/ejs-template-generate-source.js +14 -0
  81. package/lib/assess/propagators/handlebars-compile.js +14 -0
  82. package/lib/assess/propagators/handlebars-escape-expresssion.js +14 -0
  83. package/lib/assess/propagators/index.js +14 -0
  84. package/lib/assess/propagators/joi/boolean.js +14 -0
  85. package/lib/assess/propagators/joi/expression.js +14 -0
  86. package/lib/assess/propagators/joi/index.js +14 -0
  87. package/lib/assess/propagators/joi/number.js +14 -0
  88. package/lib/assess/propagators/joi/string-base.js +14 -0
  89. package/lib/assess/propagators/joi/string-schema.js +14 -0
  90. package/lib/assess/propagators/joi/values.js +14 -0
  91. package/lib/assess/propagators/manager.js +31 -3
  92. package/lib/assess/propagators/object.js +14 -0
  93. package/lib/assess/propagators/path/basename.js +14 -0
  94. package/lib/assess/propagators/path/common.js +47 -13
  95. package/lib/assess/propagators/path/dirname.js +14 -0
  96. package/lib/assess/propagators/path/extname.js +14 -0
  97. package/lib/assess/propagators/path/format.js +14 -0
  98. package/lib/assess/propagators/path/join.js +14 -0
  99. package/lib/assess/propagators/path/normalize.js +20 -1
  100. package/lib/assess/propagators/path/parse.js +14 -0
  101. package/lib/assess/propagators/path/relative.js +14 -0
  102. package/lib/assess/propagators/path/resolve.js +14 -0
  103. package/lib/assess/propagators/path/to-namespaced-path.js +14 -0
  104. package/lib/assess/propagators/pug-compile.js +14 -0
  105. package/lib/assess/propagators/querystring/escape.js +14 -0
  106. package/lib/assess/propagators/querystring/parse.js +14 -0
  107. package/lib/assess/propagators/querystring/stringify.js +14 -0
  108. package/lib/assess/propagators/querystring/unescape.js +14 -0
  109. package/lib/assess/propagators/querystring/utils.js +14 -0
  110. package/lib/assess/propagators/sequelize/sql-string-escape.js +14 -0
  111. package/lib/assess/propagators/sequelize/sql-string-format-named-parameters.js +14 -0
  112. package/lib/assess/propagators/sequelize/sql-string-format.js +14 -0
  113. package/lib/assess/propagators/sequelize/utils.js +14 -0
  114. package/lib/assess/propagators/string-prototype-replace.js +14 -0
  115. package/lib/assess/propagators/string-prototype-split.js +14 -0
  116. package/lib/assess/propagators/string-prototype-trim.js +14 -0
  117. package/lib/assess/propagators/string.js +14 -0
  118. package/lib/assess/propagators/templates.js +14 -0
  119. package/lib/assess/propagators/url/url-prototype-parse.js +14 -0
  120. package/lib/assess/propagators/url/url-url.js +14 -0
  121. package/lib/assess/propagators/url/utils.js +14 -0
  122. package/lib/assess/propagators/util/format.js +14 -0
  123. package/lib/assess/propagators/utils.js +14 -0
  124. package/lib/assess/propagators/v8/init-hooks.js +14 -0
  125. package/lib/assess/propagators/validator/init-hooks.js +14 -0
  126. package/lib/assess/propagators/validator/validator-methods.js +14 -0
  127. package/lib/assess/response-scanning/app-activity.js +14 -0
  128. package/lib/assess/response-scanning/autocomplete-missing.js +14 -2
  129. package/lib/assess/response-scanning/cache-controls-missing.js +14 -0
  130. package/lib/assess/response-scanning/clickjacking-control-missing.js +14 -0
  131. package/lib/assess/response-scanning/common.js +14 -0
  132. package/lib/assess/response-scanning/cookies/common.js +14 -0
  133. package/lib/assess/response-scanning/cookies/events.js +14 -0
  134. package/lib/assess/response-scanning/cookies/httponly.js +14 -0
  135. package/lib/assess/response-scanning/cookies/secure-flag-missing.js +14 -0
  136. package/lib/assess/response-scanning/headers/csp-header-insecure.js +14 -0
  137. package/lib/assess/response-scanning/headers/csp-header-missing.js +14 -0
  138. package/lib/assess/response-scanning/headers/csp-utils.js +14 -0
  139. package/lib/assess/response-scanning/headers/hsts-header-missing.js +14 -0
  140. package/lib/assess/response-scanning/headers/powered-by.js +14 -0
  141. package/lib/assess/response-scanning/headers/xcontenttype-header-missing.js +14 -0
  142. package/lib/assess/response-scanning/headers/xxssprotection-header-disabled.js +14 -0
  143. package/lib/assess/response-scanning/parameter-pollution.js +14 -2
  144. package/lib/assess/response-scanning/parseable-response-emitter.js +14 -0
  145. package/lib/assess/restify/index.js +14 -0
  146. package/lib/assess/restify/route-coverage.js +14 -0
  147. package/lib/assess/restify/session.js +14 -0
  148. package/lib/assess/restify/sinks/index.js +14 -0
  149. package/lib/assess/restify/sinks/response-scanning.js +14 -0
  150. package/lib/assess/restify/sinks/unvalidated-redirect.js +14 -0
  151. package/lib/assess/restify/sinks/xss.js +14 -0
  152. package/lib/assess/restify/sources.js +14 -0
  153. package/lib/assess/sinks/common.js +14 -0
  154. package/lib/assess/sinks/dynamo.js +14 -0
  155. package/lib/assess/sinks/hapi-16-xss.js +14 -0
  156. package/lib/assess/sinks/index.js +14 -0
  157. package/lib/assess/sinks/libxmljs-xxe.js +14 -0
  158. package/lib/assess/sinks/mongodb.js +25 -7
  159. package/lib/assess/sinks/ssrf-url.js +14 -0
  160. package/lib/assess/sources/formidable.js +14 -0
  161. package/lib/assess/sources/index.js +14 -0
  162. package/lib/assess/static/hardcoded.js +14 -0
  163. package/lib/assess/technologies/index.js +14 -0
  164. package/lib/assess/utils.js +14 -0
  165. package/lib/cli-rewriter/index.js +14 -0
  166. package/lib/constants.js +14 -0
  167. package/lib/contrast.js +18 -5
  168. package/lib/core/arch-components/dynamodb.js +14 -0
  169. package/lib/core/arch-components/index.js +14 -0
  170. package/lib/core/arch-components/mongodb.js +14 -0
  171. package/lib/core/arch-components/mysql.js +14 -0
  172. package/lib/core/arch-components/postgres.js +14 -0
  173. package/lib/core/arch-components/sqlite3.js +14 -0
  174. package/lib/core/async-storage/context.js +14 -0
  175. package/lib/core/async-storage/hooks/bluebird.js +34 -0
  176. package/lib/core/async-storage/hooks/mongodb-core.js +14 -0
  177. package/lib/core/async-storage/hooks/mysql.js +14 -0
  178. package/lib/core/async-storage/hooks/redis.js +14 -0
  179. package/lib/core/async-storage/hooks/utils.js +14 -0
  180. package/lib/core/async-storage/index.js +14 -0
  181. package/lib/core/async-storage/scopes/index.js +14 -0
  182. package/lib/core/common/formidable.js +14 -0
  183. package/lib/core/common/index.js +14 -0
  184. package/lib/core/config/options.js +14 -0
  185. package/lib/core/config/util.js +14 -0
  186. package/lib/core/exclusions/exclusion-factory.js +14 -0
  187. package/lib/core/exclusions/exclusion.js +14 -0
  188. package/lib/core/exclusions/input.js +14 -0
  189. package/lib/core/exclusions/url.js +14 -0
  190. package/lib/core/express/index.js +14 -0
  191. package/lib/core/express/utils.js +15 -1
  192. package/lib/core/fastify/index.js +14 -0
  193. package/lib/core/fastify/utils.js +14 -0
  194. package/lib/core/hapi/index.js +14 -0
  195. package/lib/core/hapi/utils.js +14 -0
  196. package/lib/core/index.js +14 -0
  197. package/lib/core/koa/index.js +14 -0
  198. package/lib/core/koa/utils.js +14 -0
  199. package/lib/core/logger/daily-rotate-file.js +14 -0
  200. package/lib/core/logger/dataflow-monitor.js +14 -0
  201. package/lib/core/logger/debug-logger.js +29 -17
  202. package/lib/core/logger/index.js +14 -0
  203. package/lib/core/logger/perf-logger.js +14 -0
  204. package/lib/core/logger/umbrella-logger.js +14 -0
  205. package/lib/core/loopback4/index.js +14 -0
  206. package/lib/core/metrics/index.js +14 -0
  207. package/lib/core/restify/index.js +14 -0
  208. package/lib/core/restify/utils.js +14 -0
  209. package/lib/core/rewrite/assignment-expression.js +14 -0
  210. package/lib/core/rewrite/binary-expression.js +14 -0
  211. package/lib/core/rewrite/call-expression.js +14 -0
  212. package/lib/core/rewrite/callees.js +14 -0
  213. package/lib/core/rewrite/catch-clause.js +14 -0
  214. package/lib/core/rewrite/function-wrap.js +14 -0
  215. package/lib/core/rewrite/index.js +14 -0
  216. package/lib/core/rewrite/injections.js +14 -0
  217. package/lib/core/rewrite/is-contrast-method.js +14 -0
  218. package/lib/core/rewrite/log.js +14 -0
  219. package/lib/core/rewrite/member-expression.js +14 -0
  220. package/lib/core/rewrite/object-property.js +14 -0
  221. package/lib/core/rewrite/prepend-globals.js +14 -0
  222. package/lib/core/rewrite/rewrite-log.js +14 -0
  223. package/lib/core/rewrite/switch-statement.js +14 -0
  224. package/lib/core/rewrite/template-literal.js +14 -0
  225. package/lib/core/stacktrace.js +15 -3
  226. package/lib/coverage.js +14 -0
  227. package/lib/feature-set.js +16 -1
  228. package/lib/generator-function.js +14 -0
  229. package/lib/hooks/array.js +14 -0
  230. package/lib/hooks/cluster.js +14 -0
  231. package/lib/hooks/dataflow-monitor.js +14 -0
  232. package/lib/hooks/encoding.js +15 -1
  233. package/lib/hooks/express-fileupload.js +14 -0
  234. package/lib/hooks/express-session.js +14 -0
  235. package/lib/hooks/fn-to-string.js +14 -0
  236. package/lib/hooks/frameworks/base.js +14 -0
  237. package/lib/hooks/frameworks/common.js +14 -0
  238. package/lib/hooks/frameworks/hapi16.js +14 -0
  239. package/lib/hooks/frameworks/http.js +14 -0
  240. package/lib/hooks/frameworks/https.js +14 -0
  241. package/lib/hooks/frameworks/index.js +14 -0
  242. package/lib/hooks/hapi-16-reply.js +14 -0
  243. package/lib/hooks/hapi-16-session.js +14 -0
  244. package/lib/hooks/http.js +14 -0
  245. package/lib/hooks/module/extensions.js +14 -0
  246. package/lib/hooks/module/helpers.js +14 -0
  247. package/lib/hooks/module/index.js +14 -0
  248. package/lib/hooks/newrelic.js +14 -0
  249. package/lib/hooks/object-is.js +14 -0
  250. package/lib/hooks/object-to-primitive.js +14 -0
  251. package/lib/hooks/patcher.js +28 -24
  252. package/lib/hooks/require.js +14 -0
  253. package/lib/hooks/stealthy-require.js +14 -0
  254. package/lib/instrumentation.js +14 -0
  255. package/lib/libraries.js +21 -3
  256. package/lib/library-usage.js +14 -0
  257. package/lib/list-installed.js +14 -0
  258. package/lib/protect/analysis/aho-corasick.js +27 -30
  259. package/lib/protect/analysis/dfsa-analyzer.js +14 -0
  260. package/lib/protect/errors/handler.js +14 -0
  261. package/lib/protect/errors/security-exception.js +14 -0
  262. package/lib/protect/express/index.js +14 -0
  263. package/lib/protect/express/sinks.js +14 -0
  264. package/lib/protect/express/sources.js +14 -0
  265. package/lib/protect/fastify/index.js +14 -0
  266. package/lib/protect/fastify/sinks.js +14 -0
  267. package/lib/protect/fastify/sources.js +14 -0
  268. package/lib/protect/hapi/error-handler.js +14 -0
  269. package/lib/protect/hapi/index.js +14 -0
  270. package/lib/protect/hapi/sinks.js +14 -0
  271. package/lib/protect/hapi/sources.js +14 -0
  272. package/lib/protect/index.js +14 -0
  273. package/lib/protect/input-analysis.js +14 -0
  274. package/lib/protect/koa/index.js +14 -0
  275. package/lib/protect/koa/sinks.js +14 -0
  276. package/lib/protect/koa/sources.js +14 -0
  277. package/lib/protect/listeners.js +14 -0
  278. package/lib/protect/loopback4/index.js +14 -0
  279. package/lib/protect/loopback4/sources.js +14 -0
  280. package/lib/protect/models/application-context.js +14 -0
  281. package/lib/protect/models/sink-event.js +14 -0
  282. package/lib/protect/models/source-event.js +14 -0
  283. package/lib/protect/restify/index.js +14 -0
  284. package/lib/protect/restify/sinks.js +14 -0
  285. package/lib/protect/restify/sources.js +14 -0
  286. package/lib/protect/rules/assessment.js +14 -0
  287. package/lib/protect/rules/attack-patterns.js +14 -0
  288. package/lib/protect/rules/base-scanner/index.js +14 -0
  289. package/lib/protect/rules/base-scanner/java-script-scanner.js +14 -0
  290. package/lib/protect/rules/base-scanner/postgresqlscanner.js +14 -0
  291. package/lib/protect/rules/base-scanner/scan-state.js +14 -0
  292. package/lib/protect/rules/base-scanner/substring-finder.js +14 -0
  293. package/lib/protect/rules/base-scanner/token-sequence.js +14 -0
  294. package/lib/protect/rules/bot-blocker/bot-blocker-rule.js +14 -0
  295. package/lib/protect/rules/bot-blocker/index.js +14 -0
  296. package/lib/protect/rules/cmd-injection/cmdinjection-rule.js +14 -0
  297. package/lib/protect/rules/cmd-injection-command-backdoors/backdoor-detector.js +17 -3
  298. package/lib/protect/rules/cmd-injection-command-backdoors/cmd-injection-command-backdoors-rule.js +14 -0
  299. package/lib/protect/rules/cmd-injection-semantic-chained-commands/chained-command-scanner.js +14 -0
  300. package/lib/protect/rules/cmd-injection-semantic-chained-commands/cmd-injection-semantic-chained-commands-rule.js +14 -0
  301. package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/cmd-injection-semantic-dangerous-paths-rule.js +14 -0
  302. package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/dangerous-paths-scanner.js +14 -0
  303. package/lib/protect/rules/common.js +14 -0
  304. package/lib/protect/rules/index.js +14 -0
  305. package/lib/protect/rules/ip-denylist/ip-denylist-rule.js +14 -0
  306. package/lib/protect/rules/method-tampering/evaluator.js +14 -0
  307. package/lib/protect/rules/method-tampering/method-tampering-rule.js +14 -0
  308. package/lib/protect/rules/nosqli/no-sql-injection-rule.js +14 -0
  309. package/lib/protect/rules/nosqli/nosql-scanner/index.js +14 -0
  310. package/lib/protect/rules/nosqli/nosql-scanner/mongodbscanner.js +14 -0
  311. package/lib/protect/rules/path-traversal/path-traversal-rule.js +14 -0
  312. package/lib/protect/rules/rule-factory.js +14 -0
  313. package/lib/protect/rules/signatures/cmd-injection/custom-searchers/chained-command-searcher.js +14 -0
  314. package/lib/protect/rules/signatures/cmd-injection/custom-searchers/index.js +14 -0
  315. package/lib/protect/rules/signatures/cmd-injection/index.js +14 -0
  316. package/lib/protect/rules/signatures/evaluator.js +14 -0
  317. package/lib/protect/rules/signatures/index.js +14 -0
  318. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/index.js +14 -0
  319. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/nosql-comment-searcher.js +14 -0
  320. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/simple-or-searcher.js +14 -0
  321. package/lib/protect/rules/signatures/nosql-injection/index.js +14 -0
  322. package/lib/protect/rules/signatures/path-traversal/index.js +14 -0
  323. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/behavior-url-searcher.js +14 -0
  324. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/function-definition-searcher.js +14 -0
  325. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/immediate-function-searcher.js +14 -0
  326. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/index.js +14 -0
  327. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/link-and-src-target-searcher.js +14 -0
  328. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/location-set-searcher.js +14 -0
  329. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/map-access-searcher.js +14 -0
  330. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/native-function-execution-searcher.js +14 -0
  331. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/no-alnum-searcher.js +14 -0
  332. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/redefined-function-searcher.js +14 -0
  333. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/style-url-injection-searcher.js +14 -0
  334. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/variable-assignment-searcher.js +14 -0
  335. package/lib/protect/rules/signatures/reflected-xss/helpers/function-call.js +15 -1
  336. package/lib/protect/rules/signatures/reflected-xss/index.js +14 -0
  337. package/lib/protect/rules/signatures/signature.js +14 -0
  338. package/lib/protect/rules/signatures/sql-injection/custom-searchers/if-else-drop-searcher.js +14 -0
  339. package/lib/protect/rules/signatures/sql-injection/custom-searchers/index.js +14 -0
  340. package/lib/protect/rules/signatures/sql-injection/custom-searchers/simple-or-searcher.js +14 -0
  341. package/lib/protect/rules/signatures/sql-injection/custom-searchers/sql-comment-searcher.js +14 -0
  342. package/lib/protect/rules/signatures/sql-injection/custom-searchers/time-function-searcher.js +14 -0
  343. package/lib/protect/rules/signatures/sql-injection/custom-searchers/tsql-exec-searcher.js +14 -0
  344. package/lib/protect/rules/signatures/sql-injection/index.js +14 -0
  345. package/lib/protect/rules/signatures/ssjs-injection/index.js +14 -0
  346. package/lib/protect/rules/signatures/unsafe-file-upload/index.js +14 -0
  347. package/lib/protect/rules/signatures/untrusted-deserialization/index.js +14 -0
  348. package/lib/protect/rules/sqli/generic-complicated.js +14 -0
  349. package/lib/protect/rules/sqli/sql-injection-rule.js +14 -0
  350. package/lib/protect/rules/sqli/sql-scanner/index.js +14 -0
  351. package/lib/protect/rules/sqli/sql-scanner/mysql-scanner.js +14 -0
  352. package/lib/protect/rules/ssjs-injection/evaluator.js +14 -0
  353. package/lib/protect/rules/ssjs-injection/ssjsinjection-rule.js +14 -0
  354. package/lib/protect/rules/unsafe-file-upload/unsafe-file-upload-rule.js +14 -0
  355. package/lib/protect/rules/untrusted-deserialization/untrusted-deserialization-rule.js +14 -0
  356. package/lib/protect/rules/virtual-patch/index.js +14 -0
  357. package/lib/protect/rules/virtual-patch/utils.js +14 -0
  358. package/lib/protect/rules/virtual-patch/virtual-patch-rule.js +14 -0
  359. package/lib/protect/rules/xss/helpers/function-call.js +15 -1
  360. package/lib/protect/rules/xss/reflected-xss-rule.js +14 -0
  361. package/lib/protect/rules/xxe/xxerule.js +14 -0
  362. package/lib/protect/sample-aggregator.js +14 -0
  363. package/lib/protect/samples.js +14 -0
  364. package/lib/protect/service.js +14 -0
  365. package/lib/protect/sinks/child-process.js +14 -0
  366. package/lib/protect/sinks/eval.js +14 -0
  367. package/lib/protect/sinks/fs.js +14 -0
  368. package/lib/protect/sinks/function.js +14 -0
  369. package/lib/protect/sinks/index.js +14 -0
  370. package/lib/protect/sinks/libxmljs.js +14 -0
  371. package/lib/protect/sinks/mongodb.js +14 -0
  372. package/lib/protect/sinks/mysql.js +14 -0
  373. package/lib/protect/sinks/node-serialize.js +14 -0
  374. package/lib/protect/sinks/postgres.js +14 -0
  375. package/lib/protect/sinks/sequelize.js +14 -0
  376. package/lib/protect/sinks/sqlite3.js +14 -0
  377. package/lib/protect/sinks/vm.js +14 -0
  378. package/lib/protect/sources/busboy.js +14 -0
  379. package/lib/protect/sources/formidable.js +14 -0
  380. package/lib/protect/sources/index.js +14 -0
  381. package/lib/protect/validators/authorization.js +14 -0
  382. package/lib/protect/validators/common.js +14 -0
  383. package/lib/protect/validators/connection.js +14 -0
  384. package/lib/protect/validators/content-length.js +14 -0
  385. package/lib/protect/validators/host.js +14 -0
  386. package/lib/protect/validators/if-none-match.js +14 -0
  387. package/lib/protect/validators/index.js +14 -0
  388. package/lib/protect/validators/origin.js +14 -0
  389. package/lib/reporter/app-activity-queue.js +14 -0
  390. package/lib/reporter/grpc-client.js +14 -0
  391. package/lib/reporter/messages/speedracer/activity.js +14 -0
  392. package/lib/reporter/messages/speedracer/application-create.js +14 -0
  393. package/lib/reporter/messages/speedracer/application-update.js +14 -0
  394. package/lib/reporter/messages/speedracer/base.js +14 -0
  395. package/lib/reporter/messages/speedracer/index.js +14 -0
  396. package/lib/reporter/messages/speedracer/observed-route.js +14 -0
  397. package/lib/reporter/messages/speedracer/poll.js +14 -0
  398. package/lib/reporter/messages/speedracer/request.js +14 -0
  399. package/lib/reporter/messages/speedracer/startup.js +14 -0
  400. package/lib/reporter/messaging-router.js +14 -0
  401. package/lib/reporter/models/app-activity/app-activity.js +14 -0
  402. package/lib/reporter/models/app-activity/attacker-activity.js +14 -0
  403. package/lib/reporter/models/app-activity/defend.js +14 -0
  404. package/lib/reporter/models/app-activity/inventory.js +14 -0
  405. package/lib/reporter/models/app-activity/protection-rule-activity.js +14 -0
  406. package/lib/reporter/models/app-activity/rule-events.js +14 -0
  407. package/lib/reporter/models/app-activity/sample.js +14 -0
  408. package/lib/reporter/models/app-activity/source.js +14 -0
  409. package/lib/reporter/models/app-activity/user-input.js +14 -0
  410. package/lib/reporter/models/app-create.js +14 -0
  411. package/lib/reporter/models/app-update/index.js +16 -4
  412. package/lib/reporter/models/app-update/library-manifest.js +14 -0
  413. package/lib/reporter/models/app-update/library-usage.js +14 -0
  414. package/lib/reporter/models/app-update/library.js +14 -0
  415. package/lib/reporter/models/event-tag.js +14 -0
  416. package/lib/reporter/models/finding/event.js +14 -0
  417. package/lib/reporter/models/finding/finding.js +14 -0
  418. package/lib/reporter/models/frameworks/express-request.js +14 -0
  419. package/lib/reporter/models/frameworks/fastify-request.js +14 -0
  420. package/lib/reporter/models/frameworks/hapi-request.js +14 -0
  421. package/lib/reporter/models/frameworks/index.js +14 -0
  422. package/lib/reporter/models/frameworks/koa-request.js +14 -0
  423. package/lib/reporter/models/frameworks/restify-request.js +14 -0
  424. package/lib/reporter/models/observed-route.js +14 -0
  425. package/lib/reporter/models/request.js +14 -0
  426. package/lib/reporter/models/route-coverage.js +14 -0
  427. package/lib/reporter/models/startup.js +14 -0
  428. package/lib/reporter/models/trace-event-source.js +14 -0
  429. package/lib/reporter/models/utils/request-factory.js +14 -0
  430. package/lib/reporter/models/utils/user-input-factory.js +14 -0
  431. package/lib/reporter/models/utils/user-input-kit.js +14 -0
  432. package/lib/reporter/mq-client.js +14 -0
  433. package/lib/reporter/server-activity-queue.js +14 -0
  434. package/lib/reporter/socket-client.js +14 -0
  435. package/lib/reporter/speedracer/base-connection-state.js +14 -0
  436. package/lib/reporter/speedracer/constants.js +14 -0
  437. package/lib/reporter/speedracer/failure-connection-state.js +14 -0
  438. package/lib/reporter/speedracer/index.js +14 -0
  439. package/lib/reporter/speedracer/success-connection-state.js +14 -0
  440. package/lib/reporter/speedracer/unknown-connection-state.js +14 -0
  441. package/lib/reporter/translations/enums.js +14 -0
  442. package/lib/reporter/translations/helpers.js +14 -0
  443. package/lib/reporter/translations/to-protobuf/dtm/activity.js +14 -0
  444. package/lib/reporter/translations/to-protobuf/dtm/address.js +14 -0
  445. package/lib/reporter/translations/to-protobuf/dtm/agent-startup.js +14 -0
  446. package/lib/reporter/translations/to-protobuf/dtm/application-create.js +14 -0
  447. package/lib/reporter/translations/to-protobuf/dtm/application-update.js +14 -0
  448. package/lib/reporter/translations/to-protobuf/dtm/architecture-component.js +14 -0
  449. package/lib/reporter/translations/to-protobuf/dtm/attack-result.js +14 -0
  450. package/lib/reporter/translations/to-protobuf/dtm/bot-blocker-details.js +14 -0
  451. package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-details.js +14 -0
  452. package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-semantic-analysis-details.js +14 -0
  453. package/lib/reporter/translations/to-protobuf/dtm/finding.js +14 -0
  454. package/lib/reporter/translations/to-protobuf/dtm/http-method-tampering-details.js +14 -0
  455. package/lib/reporter/translations/to-protobuf/dtm/http-request.js +14 -0
  456. package/lib/reporter/translations/to-protobuf/dtm/index.js +14 -0
  457. package/lib/reporter/translations/to-protobuf/dtm/ip-denylist-details.js +14 -0
  458. package/lib/reporter/translations/to-protobuf/dtm/library-usage-update.js +14 -0
  459. package/lib/reporter/translations/to-protobuf/dtm/no-sql-injection-details.js +14 -0
  460. package/lib/reporter/translations/to-protobuf/dtm/observed-route.js +14 -0
  461. package/lib/reporter/translations/to-protobuf/dtm/pair.js +14 -0
  462. package/lib/reporter/translations/to-protobuf/dtm/path-traversal-details.js +14 -0
  463. package/lib/reporter/translations/to-protobuf/dtm/poll.js +14 -0
  464. package/lib/reporter/translations/to-protobuf/dtm/rasp-rule-sample.js +14 -0
  465. package/lib/reporter/translations/to-protobuf/dtm/raw-request.js +14 -0
  466. package/lib/reporter/translations/to-protobuf/dtm/route-coverage.js +14 -0
  467. package/lib/reporter/translations/to-protobuf/dtm/simple-pair.js +14 -0
  468. package/lib/reporter/translations/to-protobuf/dtm/sql-injection-details.js +14 -0
  469. package/lib/reporter/translations/to-protobuf/dtm/ssjs-injection-details.js +14 -0
  470. package/lib/reporter/translations/to-protobuf/dtm/stack-trace-element.js +14 -0
  471. package/lib/reporter/translations/to-protobuf/dtm/trace-event/action.js +14 -0
  472. package/lib/reporter/translations/to-protobuf/dtm/trace-event/index.js +14 -0
  473. package/lib/reporter/translations/to-protobuf/dtm/trace-event/parent-object-id.js +14 -0
  474. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-object.js +14 -0
  475. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-signature.js +14 -0
  476. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-source.js +14 -0
  477. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-stack.js +14 -0
  478. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-taint-range.js +14 -0
  479. package/lib/reporter/translations/to-protobuf/dtm/trace-event/type.js +14 -0
  480. package/lib/reporter/translations/to-protobuf/dtm/untrusted-deserialization-details.js +14 -0
  481. package/lib/reporter/translations/to-protobuf/dtm/user-input.js +14 -0
  482. package/lib/reporter/translations/to-protobuf/dtm/virtual-patch-details.js +14 -0
  483. package/lib/reporter/translations/to-protobuf/dtm/xss-details.js +14 -0
  484. package/lib/reporter/translations/to-protobuf/dtm/xxe-details.js +14 -0
  485. package/lib/reporter/translations/to-protobuf/index.js +14 -0
  486. package/lib/reporter/translations/to-protobuf/settings/application-settings.js +14 -0
  487. package/lib/reporter/translations/to-protobuf/settings/assess-features.js +14 -0
  488. package/lib/reporter/translations/to-protobuf/settings/auth.js +14 -0
  489. package/lib/reporter/translations/to-protobuf/settings/bot-blocker.js +14 -0
  490. package/lib/reporter/translations/to-protobuf/settings/custom-rule-feature.js +14 -0
  491. package/lib/reporter/translations/to-protobuf/settings/defend-features.js +14 -0
  492. package/lib/reporter/translations/to-protobuf/settings/exclusions.js +14 -0
  493. package/lib/reporter/translations/to-protobuf/settings/index.js +14 -0
  494. package/lib/reporter/translations/to-protobuf/settings/input-analysis-result.js +14 -0
  495. package/lib/reporter/translations/to-protobuf/settings/inventory-features.js +14 -0
  496. package/lib/reporter/translations/to-protobuf/settings/ip-filter.js +14 -0
  497. package/lib/reporter/translations/to-protobuf/settings/log-enhancer.js +14 -0
  498. package/lib/reporter/translations/to-protobuf/settings/protection-rule.js +14 -0
  499. package/lib/reporter/translations/to-protobuf/settings/reaction.js +14 -0
  500. package/lib/reporter/translations/to-protobuf/settings/rule-definition.js +14 -0
  501. package/lib/reporter/translations/to-protobuf/settings/sampling.js +14 -0
  502. package/lib/reporter/translations/to-protobuf/settings/server-features.js +14 -0
  503. package/lib/reporter/translations/to-protobuf/settings/syslog.js +14 -0
  504. package/lib/reporter/translations/to-protobuf/settings/virtual-patch.js +14 -0
  505. package/lib/reporter/ts-reporter.js +14 -0
  506. package/lib/tracker.js +14 -0
  507. package/lib/util/base64.js +14 -0
  508. package/lib/util/bitset.js +14 -0
  509. package/lib/util/block-request.js +14 -0
  510. package/lib/util/callback-resolver.js +14 -0
  511. package/lib/util/clean-stack.js +15 -1
  512. package/lib/util/clean-string/brackets.js +17 -3
  513. package/lib/util/clean-string/clean-string-base.js +14 -0
  514. package/lib/util/clean-string/comments.js +14 -0
  515. package/lib/util/clean-string/concatenations.js +15 -1
  516. package/lib/util/clean-string/jsclean-string.js +14 -0
  517. package/lib/util/clean-string/placeholders.js +14 -0
  518. package/lib/util/clean-string/util.js +15 -2
  519. package/lib/util/colors.js +14 -0
  520. package/lib/util/file-finder.js +14 -0
  521. package/lib/util/heap-dump.js +14 -0
  522. package/lib/util/html-util.js +14 -0
  523. package/lib/util/ip-analyzer.js +15 -1
  524. package/lib/util/is-agent-path.js +14 -0
  525. package/lib/util/is-contrast-error.js +14 -0
  526. package/lib/util/is-piped-to-dev.js +14 -0
  527. package/lib/util/is-string.js +14 -0
  528. package/lib/util/partial.js +14 -0
  529. package/lib/util/pkg-name.js +14 -0
  530. package/lib/util/request-util.js +14 -0
  531. package/lib/util/resolve-obj.js +14 -0
  532. package/lib/util/route-info.js +14 -0
  533. package/lib/util/source-map.js +14 -0
  534. package/lib/util/static-rules.js +14 -0
  535. package/lib/util/trace-util.js +14 -0
  536. package/lib/util/traverse.js +14 -0
  537. package/lib/util/user-input-evaluator.js +14 -0
  538. package/lib/util/xml-analyzer/external-entity-finder.js +15 -1
  539. package/node_modules/bindings/LICENSE.md +22 -0
  540. package/node_modules/bindings/README.md +98 -0
  541. package/node_modules/bindings/bindings.js +221 -0
  542. package/node_modules/bindings/package.json +32 -0
  543. package/node_modules/file-uri-to-path/.npmignore +1 -0
  544. package/node_modules/file-uri-to-path/.travis.yml +30 -0
  545. package/node_modules/file-uri-to-path/History.md +21 -0
  546. package/node_modules/file-uri-to-path/LICENSE +20 -0
  547. package/node_modules/file-uri-to-path/README.md +74 -0
  548. package/node_modules/file-uri-to-path/index.d.ts +2 -0
  549. package/node_modules/file-uri-to-path/index.js +66 -0
  550. package/node_modules/file-uri-to-path/package.json +36 -0
  551. package/node_modules/file-uri-to-path/test/test.js +24 -0
  552. package/node_modules/file-uri-to-path/test/tests.json +13 -0
  553. package/node_modules/nan/CHANGELOG.md +537 -0
  554. package/node_modules/nan/LICENSE.md +13 -0
  555. package/node_modules/nan/README.md +455 -0
  556. package/node_modules/nan/doc/asyncworker.md +146 -0
  557. package/node_modules/nan/doc/buffers.md +54 -0
  558. package/node_modules/nan/doc/callback.md +76 -0
  559. package/node_modules/nan/doc/converters.md +41 -0
  560. package/node_modules/nan/doc/errors.md +226 -0
  561. package/node_modules/nan/doc/json.md +62 -0
  562. package/node_modules/nan/doc/maybe_types.md +583 -0
  563. package/node_modules/nan/doc/methods.md +664 -0
  564. package/node_modules/nan/doc/new.md +147 -0
  565. package/node_modules/nan/doc/node_misc.md +123 -0
  566. package/node_modules/nan/doc/object_wrappers.md +263 -0
  567. package/node_modules/nan/doc/persistent.md +296 -0
  568. package/node_modules/nan/doc/scopes.md +73 -0
  569. package/node_modules/nan/doc/script.md +38 -0
  570. package/node_modules/nan/doc/string_bytes.md +62 -0
  571. package/node_modules/nan/doc/v8_internals.md +199 -0
  572. package/node_modules/nan/doc/v8_misc.md +85 -0
  573. package/node_modules/nan/include_dirs.js +1 -0
  574. package/node_modules/nan/nan.h +2898 -0
  575. package/node_modules/nan/nan_callbacks.h +88 -0
  576. package/node_modules/nan/nan_callbacks_12_inl.h +514 -0
  577. package/node_modules/nan/nan_callbacks_pre_12_inl.h +520 -0
  578. package/node_modules/nan/nan_converters.h +72 -0
  579. package/node_modules/nan/nan_converters_43_inl.h +68 -0
  580. package/node_modules/nan/nan_converters_pre_43_inl.h +42 -0
  581. package/node_modules/nan/nan_define_own_property_helper.h +29 -0
  582. package/node_modules/nan/nan_implementation_12_inl.h +430 -0
  583. package/node_modules/nan/nan_implementation_pre_12_inl.h +263 -0
  584. package/node_modules/nan/nan_json.h +166 -0
  585. package/node_modules/nan/nan_maybe_43_inl.h +356 -0
  586. package/node_modules/nan/nan_maybe_pre_43_inl.h +268 -0
  587. package/node_modules/nan/nan_new.h +340 -0
  588. package/node_modules/nan/nan_object_wrap.h +156 -0
  589. package/node_modules/nan/nan_persistent_12_inl.h +132 -0
  590. package/node_modules/nan/nan_persistent_pre_12_inl.h +242 -0
  591. package/node_modules/nan/nan_private.h +73 -0
  592. package/node_modules/nan/nan_string_bytes.h +305 -0
  593. package/node_modules/nan/nan_typedarray_contents.h +96 -0
  594. package/node_modules/nan/nan_weak.h +437 -0
  595. package/node_modules/nan/package.json +41 -0
  596. package/node_modules/nan/tools/1to2.js +412 -0
  597. package/node_modules/nan/tools/README.md +14 -0
  598. package/node_modules/nan/tools/package.json +19 -0
  599. package/node_modules/unix-dgram/LICENSE +13 -0
  600. package/node_modules/unix-dgram/README.md +107 -0
  601. package/node_modules/unix-dgram/binding.gyp +20 -0
  602. package/node_modules/unix-dgram/build/Makefile +324 -0
  603. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram/src/unix_dgram.o.d +58 -0
  604. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram.node.d +1 -0
  605. package/node_modules/unix-dgram/build/Release/.deps/Release/unix_dgram.node.d +1 -0
  606. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram/src/unix_dgram.o +0 -0
  607. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram.node +0 -0
  608. package/node_modules/unix-dgram/build/Release/unix_dgram.node +0 -0
  609. package/node_modules/unix-dgram/build/binding.Makefile +6 -0
  610. package/node_modules/unix-dgram/build/config.gypi +213 -0
  611. package/node_modules/unix-dgram/build/unix_dgram.target.mk +159 -0
  612. package/node_modules/unix-dgram/lib/unix_dgram.js +168 -0
  613. package/node_modules/unix-dgram/package.json +36 -0
  614. package/node_modules/unix-dgram/src/unix_dgram.cc +404 -0
  615. package/node_modules/unix-dgram/src/win_dummy.cc +7 -0
  616. package/node_modules/unix-dgram/test/test-connect-callback.js +68 -0
  617. package/node_modules/unix-dgram/test/test-connect.js +53 -0
  618. package/node_modules/unix-dgram/test/test-dgram-unix.js +58 -0
  619. package/node_modules/unix-dgram/test/test-send-error.js +26 -0
  620. package/package.json +3 -2
  621. package/perf-logs.js +14 -0
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  /**
2
16
  * Responsible for initializing all the agent instrumentation.
3
17
  * It also collects the application's library information.
package/lib/libraries.js CHANGED
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const Promise = require('bluebird');
3
17
  const stringify = require('json-stable-stringify');
@@ -52,8 +66,12 @@ function setRequiredBy(deps, requiredBy = new Map()) {
52
66
  * @param {Object} agent agent instance
53
67
  */
54
68
  function processDependencies(deps, requiredBy, agent) {
55
- _.forEach(deps, (dep) => {
56
- // find which dependents a given library has from the `requiredBy` map
69
+ for (const key in deps) {
70
+ const dep = deps[key];
71
+ if (!dep.name) {
72
+ dep.name = key;
73
+ }
74
+
57
75
  dep._requiredBy = requiredBy.has(dep.name)
58
76
  ? Array.from(requiredBy.get(dep.name))
59
77
  : [];
@@ -63,7 +81,7 @@ function processDependencies(deps, requiredBy, agent) {
63
81
  if (newLib) {
64
82
  processDependencies(dep.dependencies, requiredBy, agent);
65
83
  }
66
- });
84
+ }
67
85
  }
68
86
 
69
87
  /**
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const path = require('path');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  const semver = require('semver');
2
16
  const util = require('util');
3
17
 
@@ -1,11 +1,32 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  // https://www.geeksforgeeks.org/aho-corasick-algorithm-pattern-searching/
4
18
 
5
19
  const a = 'a'.charCodeAt(0);
6
- const z = 'z'.charCodeAt(0);
7
20
  const A = 'A'.charCodeAt(0);
8
21
  const Z = 'Z'.charCodeAt(0);
22
+ const l2u = a - A;
23
+
24
+ // initialize the lower -> upper and upper -> lower translation array.
25
+ const TRANSLATION = [];
26
+ for (let byte = A; byte <= Z; byte++) {
27
+ // translate the uppercase character to lowercase
28
+ TRANSLATION[byte] = byte + l2u;
29
+ }
9
30
 
10
31
  class AhoCorasick {
11
32
  constructor(words) {
@@ -14,16 +35,6 @@ class AhoCorasick {
14
35
  this.maxStates = 0;
15
36
  for (const word of words) {
16
37
  this.maxStates += word.length;
17
- for (const char of word) {
18
- // allow for any character to be upper or lower case. this could be
19
- // restricted to certain words if desired, by changing the signature
20
- // to {caseInsensitive, caseSensitive}.
21
- if (char >= 'a' && char <= 'z') {
22
- this.maxStates += 1;
23
- } else if (char >= 'A' && char <= 'Z') {
24
- this.maxStates += 1;
25
- }
26
- }
27
38
  }
28
39
 
29
40
  // can optimize this by trading off computation for space.
@@ -69,33 +80,17 @@ class AhoCorasick {
69
80
  let state = 0;
70
81
 
71
82
  // create transitions for all character of the current word
72
- for (const byte of word) {
83
+ for (let byte of word) {
73
84
  if (byte & 0x80) {
74
85
  throw new Error('pattern character codes cannot exceed 127');
86
+ } else if (TRANSLATION[byte]) {
87
+ byte = TRANSLATION[byte];
75
88
  }
76
89
  if (this.goto[state][byte] === undefined) {
77
90
  this.goto[state][byte] = stateCount;
78
91
  stateCount += 1;
79
92
  }
80
- const previousState = state;
81
93
  state = this.goto[state][byte];
82
-
83
- // now make it case insensitive by mapping the alternate case to the
84
- // same state as the original case.
85
- let extra;
86
- if (byte >= a && byte <= z) {
87
- extra = byte - (a - A);
88
- } else if (byte >= A && byte <= Z) {
89
- extra = byte + (a - A);
90
- } else {
91
- continue;
92
- }
93
-
94
- if (this.goto[previousState][extra] === undefined) {
95
- // transition to the state that the other case character transitioned
96
- // to.
97
- this.goto[previousState][extra] = stateCount - 1;
98
- }
99
94
  }
100
95
 
101
96
  // add current word to terminal list
@@ -163,6 +158,8 @@ class AhoCorasick {
163
158
  // passes in. and they can be offset by the lowest charcode as well.
164
159
  if (byte >= this.maxChars) {
165
160
  byte = 0;
161
+ } else if (TRANSLATION[byte]) {
162
+ byte = TRANSLATION[byte];
166
163
  }
167
164
  let next = this.state;
168
165
  while (this.goto[next][byte] === undefined) {
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const AhoCorasick = require('./aho-corasick');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  /**
2
16
  * @module lib/protect/errors/handler
3
17
  */
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const util = require('util');
3
17
 
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  const ProtectSink = require('./sinks');
2
16
  const ProectSource = require('./sources');
3
17
 
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const agentEmitter = require('../../agent-emitter');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const agentEmitter = require('../../agent-emitter');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const ProtectSink = require('./sinks');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { SINK_TYPES } = require('../../constants');
3
17
  const { emitSinkEvent } = require('../../hooks/frameworks/common');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { INPUT_TYPES } = require('../../constants');
3
17
  const { emitSourceEvent } = require('../../hooks/frameworks/common');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const moduleHook = require('../../hooks/require');
3
17
  const _ = require('lodash');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const ProtectSink = require('./sinks');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { SINK_TYPES } = require('../../constants');
3
17
  const { emitSinkEvent } = require('../../hooks/frameworks/common');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { INPUT_TYPES } = require('../../constants');
3
17
  const {
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const RestifyFrameworkInstrumentation = require('./restify');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const requireHook = require('../hooks/require');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const ProtectSink = require('./sinks');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { SINK_TYPES } = require('../../constants');
3
17
  const { emitSinkEvent } = require('../../hooks/frameworks/common');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const { INPUT_TYPES, PATCH_TYPES } = require('../../constants');
3
17
  const { emitSourceEvent } = require('../../hooks/frameworks/common');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  /**
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const ProtectSources = require('./sources');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const {
3
17
  constants: { EVENTS }
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
 
3
17
  const CleanStack = require('../../util/clean-stack');
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  'use strict';
2
16
  const ApplicationContext = require('./application-context');
3
17
 
@@ -1,3 +1,17 @@
1
+ /**
2
+ Copyright: 2021 Contrast Security, Inc
3
+ Contact: support@contrastsecurity.com
4
+ License: Commercial
5
+
6
+ NOTICE: This Software and the patented inventions embodied within may only be
7
+ used as part of Contrast Security’s commercial offerings. Even though it is
8
+ made available through public repositories, use of this Software is subject to
9
+ the applicable End User Licensing Agreement found at
10
+ https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
11
+ between Contrast Security and the End User. The Software may not be reverse
12
+ engineered, modified, repackaged, sold, redistributed or otherwise used in a
13
+ way not consistent with the End User License Agreement.
14
+ */
1
15
  /**
2
16
  * @module lib/models/SourceEvent
3
17
  */