@contrast/agent 4.3.1-0 → 4.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (621) hide show
  1. package/LICENSE +10 -10
  2. package/README.md +86 -57
  3. package/agent-loader.js +14 -0
  4. package/bin/VERSION +1 -0
  5. package/bin/linux/contrast-service +0 -0
  6. package/bin/mac/contrast-service +0 -0
  7. package/bin/windows/contrast-service.exe +0 -0
  8. package/bootstrap.js +14 -0
  9. package/cli-rewriter.js +14 -0
  10. package/cli.js +14 -0
  11. package/esm.mjs +14 -0
  12. package/lib/agent-emitter.js +14 -0
  13. package/lib/agent.js +14 -0
  14. package/lib/app-info.js +14 -0
  15. package/lib/assess/deadzones/index.js +14 -0
  16. package/lib/assess/deadzones/rewrite.js +14 -0
  17. package/lib/assess/express/index.js +14 -0
  18. package/lib/assess/express/route-coverage.js +14 -0
  19. package/lib/assess/express/sinks/index.js +14 -0
  20. package/lib/assess/express/sinks/xss.js +14 -0
  21. package/lib/assess/express/sources.js +14 -0
  22. package/lib/assess/fastify/index.js +14 -0
  23. package/lib/assess/fastify/route-coverage.js +14 -0
  24. package/lib/assess/fastify/sinks/index.js +14 -0
  25. package/lib/assess/fastify/sinks/response-scanning.js +14 -0
  26. package/lib/assess/fastify/sinks/unvalidated-redirect.js +14 -0
  27. package/lib/assess/fastify/sinks/xss.js +14 -0
  28. package/lib/assess/fastify/sources.js +14 -0
  29. package/lib/assess/hapi/index.js +14 -0
  30. package/lib/assess/hapi/route-coverage.js +17 -3
  31. package/lib/assess/hapi/sinks/index.js +14 -0
  32. package/lib/assess/hapi/sinks/response-scanning.js +14 -0
  33. package/lib/assess/hapi/sinks/session.js +14 -0
  34. package/lib/assess/hapi/sinks/unvalidated-redirect.js +14 -0
  35. package/lib/assess/hapi/sinks/xss.js +14 -0
  36. package/lib/assess/hapi/sources.js +14 -0
  37. package/lib/assess/index.js +14 -0
  38. package/lib/assess/koa/index.js +14 -0
  39. package/lib/assess/koa/route-coverage.js +14 -0
  40. package/lib/assess/koa/sinks/index.js +14 -0
  41. package/lib/assess/koa/sinks/response-scanning.js +14 -0
  42. package/lib/assess/koa/sinks/unvalidated-redirect.js +14 -0
  43. package/lib/assess/koa/sinks/xss.js +14 -0
  44. package/lib/assess/koa/sources.js +14 -0
  45. package/lib/assess/loopback4/index.js +14 -0
  46. package/lib/assess/loopback4/route-coverage.js +14 -0
  47. package/lib/assess/loopback4/sinks/index.js +14 -0
  48. package/lib/assess/loopback4/sinks/response-scanning.js +14 -0
  49. package/lib/assess/loopback4/sinks/xss.js +14 -0
  50. package/lib/assess/loopback4/sources.js +14 -0
  51. package/lib/assess/membrane/debraner.js +14 -0
  52. package/lib/assess/membrane/deserialization-membrane.js +14 -0
  53. package/lib/assess/membrane/index.js +16 -8
  54. package/lib/assess/membrane/source-membrane.js +17 -4
  55. package/lib/assess/models/base-event.js +16 -2
  56. package/lib/assess/models/call-context.js +14 -3
  57. package/lib/assess/models/index.js +14 -0
  58. package/lib/assess/models/propagation-event.js +14 -0
  59. package/lib/assess/models/signature.js +14 -0
  60. package/lib/assess/models/sink-event.js +14 -0
  61. package/lib/assess/models/source-event.js +14 -0
  62. package/lib/assess/models/tag-range/index.js +20 -16
  63. package/lib/assess/models/tag-range/relationships.js +14 -0
  64. package/lib/assess/models/tag-range/util.js +14 -0
  65. package/lib/assess/policy/index.js +14 -0
  66. package/lib/assess/policy/init.js +14 -0
  67. package/lib/assess/policy/signatures.json +95 -0
  68. package/lib/assess/policy/util.js +23 -2
  69. package/lib/assess/propagators/JSON/parse.js +14 -0
  70. package/lib/assess/propagators/JSON/stringify.js +14 -0
  71. package/lib/assess/propagators/ajv/conditionals.js +14 -0
  72. package/lib/assess/propagators/ajv/evaluator-shim.js +14 -0
  73. package/lib/assess/propagators/ajv/index.js +14 -0
  74. package/lib/assess/propagators/ajv/json-schema-type-evaluators.js +14 -0
  75. package/lib/assess/propagators/ajv/object-walk.js +14 -0
  76. package/lib/assess/propagators/ajv/refs.js +14 -0
  77. package/lib/assess/propagators/ajv/schema-context.js +14 -0
  78. package/lib/assess/propagators/array-prototype-join.js +14 -0
  79. package/lib/assess/propagators/common.js +14 -0
  80. package/lib/assess/propagators/ejs-template-generate-source.js +14 -0
  81. package/lib/assess/propagators/handlebars-compile.js +14 -0
  82. package/lib/assess/propagators/handlebars-escape-expresssion.js +14 -0
  83. package/lib/assess/propagators/index.js +14 -0
  84. package/lib/assess/propagators/joi/boolean.js +14 -0
  85. package/lib/assess/propagators/joi/expression.js +14 -0
  86. package/lib/assess/propagators/joi/index.js +14 -0
  87. package/lib/assess/propagators/joi/number.js +14 -0
  88. package/lib/assess/propagators/joi/string-base.js +14 -0
  89. package/lib/assess/propagators/joi/string-schema.js +14 -0
  90. package/lib/assess/propagators/joi/values.js +14 -0
  91. package/lib/assess/propagators/manager.js +31 -3
  92. package/lib/assess/propagators/object.js +14 -0
  93. package/lib/assess/propagators/path/basename.js +14 -0
  94. package/lib/assess/propagators/path/common.js +47 -13
  95. package/lib/assess/propagators/path/dirname.js +14 -0
  96. package/lib/assess/propagators/path/extname.js +14 -0
  97. package/lib/assess/propagators/path/format.js +14 -0
  98. package/lib/assess/propagators/path/join.js +14 -0
  99. package/lib/assess/propagators/path/normalize.js +20 -1
  100. package/lib/assess/propagators/path/parse.js +14 -0
  101. package/lib/assess/propagators/path/relative.js +14 -0
  102. package/lib/assess/propagators/path/resolve.js +14 -0
  103. package/lib/assess/propagators/path/to-namespaced-path.js +14 -0
  104. package/lib/assess/propagators/pug-compile.js +14 -0
  105. package/lib/assess/propagators/querystring/escape.js +14 -0
  106. package/lib/assess/propagators/querystring/parse.js +14 -0
  107. package/lib/assess/propagators/querystring/stringify.js +14 -0
  108. package/lib/assess/propagators/querystring/unescape.js +14 -0
  109. package/lib/assess/propagators/querystring/utils.js +14 -0
  110. package/lib/assess/propagators/sequelize/sql-string-escape.js +14 -0
  111. package/lib/assess/propagators/sequelize/sql-string-format-named-parameters.js +14 -0
  112. package/lib/assess/propagators/sequelize/sql-string-format.js +14 -0
  113. package/lib/assess/propagators/sequelize/utils.js +14 -0
  114. package/lib/assess/propagators/string-prototype-replace.js +14 -0
  115. package/lib/assess/propagators/string-prototype-split.js +14 -0
  116. package/lib/assess/propagators/string-prototype-trim.js +14 -0
  117. package/lib/assess/propagators/string.js +14 -0
  118. package/lib/assess/propagators/templates.js +14 -0
  119. package/lib/assess/propagators/url/url-prototype-parse.js +14 -0
  120. package/lib/assess/propagators/url/url-url.js +14 -0
  121. package/lib/assess/propagators/url/utils.js +14 -0
  122. package/lib/assess/propagators/util/format.js +14 -0
  123. package/lib/assess/propagators/utils.js +14 -0
  124. package/lib/assess/propagators/v8/init-hooks.js +14 -0
  125. package/lib/assess/propagators/validator/init-hooks.js +14 -0
  126. package/lib/assess/propagators/validator/validator-methods.js +14 -0
  127. package/lib/assess/response-scanning/app-activity.js +14 -0
  128. package/lib/assess/response-scanning/autocomplete-missing.js +14 -2
  129. package/lib/assess/response-scanning/cache-controls-missing.js +14 -0
  130. package/lib/assess/response-scanning/clickjacking-control-missing.js +14 -0
  131. package/lib/assess/response-scanning/common.js +14 -0
  132. package/lib/assess/response-scanning/cookies/common.js +14 -0
  133. package/lib/assess/response-scanning/cookies/events.js +14 -0
  134. package/lib/assess/response-scanning/cookies/httponly.js +14 -0
  135. package/lib/assess/response-scanning/cookies/secure-flag-missing.js +14 -0
  136. package/lib/assess/response-scanning/headers/csp-header-insecure.js +14 -0
  137. package/lib/assess/response-scanning/headers/csp-header-missing.js +14 -0
  138. package/lib/assess/response-scanning/headers/csp-utils.js +14 -0
  139. package/lib/assess/response-scanning/headers/hsts-header-missing.js +14 -0
  140. package/lib/assess/response-scanning/headers/powered-by.js +14 -0
  141. package/lib/assess/response-scanning/headers/xcontenttype-header-missing.js +14 -0
  142. package/lib/assess/response-scanning/headers/xxssprotection-header-disabled.js +14 -0
  143. package/lib/assess/response-scanning/parameter-pollution.js +14 -2
  144. package/lib/assess/response-scanning/parseable-response-emitter.js +14 -0
  145. package/lib/assess/restify/index.js +14 -0
  146. package/lib/assess/restify/route-coverage.js +14 -0
  147. package/lib/assess/restify/session.js +14 -0
  148. package/lib/assess/restify/sinks/index.js +14 -0
  149. package/lib/assess/restify/sinks/response-scanning.js +14 -0
  150. package/lib/assess/restify/sinks/unvalidated-redirect.js +14 -0
  151. package/lib/assess/restify/sinks/xss.js +14 -0
  152. package/lib/assess/restify/sources.js +14 -0
  153. package/lib/assess/sinks/common.js +14 -0
  154. package/lib/assess/sinks/dynamo.js +14 -0
  155. package/lib/assess/sinks/hapi-16-xss.js +14 -0
  156. package/lib/assess/sinks/index.js +14 -0
  157. package/lib/assess/sinks/libxmljs-xxe.js +14 -0
  158. package/lib/assess/sinks/mongodb.js +25 -7
  159. package/lib/assess/sinks/ssrf-url.js +14 -0
  160. package/lib/assess/sources/formidable.js +14 -0
  161. package/lib/assess/sources/index.js +14 -0
  162. package/lib/assess/static/hardcoded.js +14 -0
  163. package/lib/assess/technologies/index.js +14 -0
  164. package/lib/assess/utils.js +14 -0
  165. package/lib/cli-rewriter/index.js +14 -0
  166. package/lib/constants.js +14 -0
  167. package/lib/contrast.js +18 -5
  168. package/lib/core/arch-components/dynamodb.js +14 -0
  169. package/lib/core/arch-components/index.js +14 -0
  170. package/lib/core/arch-components/mongodb.js +14 -0
  171. package/lib/core/arch-components/mysql.js +14 -0
  172. package/lib/core/arch-components/postgres.js +14 -0
  173. package/lib/core/arch-components/sqlite3.js +14 -0
  174. package/lib/core/async-storage/context.js +14 -0
  175. package/lib/core/async-storage/hooks/bluebird.js +34 -0
  176. package/lib/core/async-storage/hooks/mongodb-core.js +14 -0
  177. package/lib/core/async-storage/hooks/mysql.js +14 -0
  178. package/lib/core/async-storage/hooks/redis.js +14 -0
  179. package/lib/core/async-storage/hooks/utils.js +14 -0
  180. package/lib/core/async-storage/index.js +14 -0
  181. package/lib/core/async-storage/scopes/index.js +14 -0
  182. package/lib/core/common/formidable.js +14 -0
  183. package/lib/core/common/index.js +14 -0
  184. package/lib/core/config/options.js +14 -0
  185. package/lib/core/config/util.js +14 -0
  186. package/lib/core/exclusions/exclusion-factory.js +14 -0
  187. package/lib/core/exclusions/exclusion.js +14 -0
  188. package/lib/core/exclusions/input.js +14 -0
  189. package/lib/core/exclusions/url.js +14 -0
  190. package/lib/core/express/index.js +14 -0
  191. package/lib/core/express/utils.js +15 -1
  192. package/lib/core/fastify/index.js +14 -0
  193. package/lib/core/fastify/utils.js +14 -0
  194. package/lib/core/hapi/index.js +14 -0
  195. package/lib/core/hapi/utils.js +14 -0
  196. package/lib/core/index.js +14 -0
  197. package/lib/core/koa/index.js +14 -0
  198. package/lib/core/koa/utils.js +14 -0
  199. package/lib/core/logger/daily-rotate-file.js +14 -0
  200. package/lib/core/logger/dataflow-monitor.js +14 -0
  201. package/lib/core/logger/debug-logger.js +29 -17
  202. package/lib/core/logger/index.js +14 -0
  203. package/lib/core/logger/perf-logger.js +14 -0
  204. package/lib/core/logger/umbrella-logger.js +14 -0
  205. package/lib/core/loopback4/index.js +14 -0
  206. package/lib/core/metrics/index.js +14 -0
  207. package/lib/core/restify/index.js +14 -0
  208. package/lib/core/restify/utils.js +14 -0
  209. package/lib/core/rewrite/assignment-expression.js +14 -0
  210. package/lib/core/rewrite/binary-expression.js +14 -0
  211. package/lib/core/rewrite/call-expression.js +14 -0
  212. package/lib/core/rewrite/callees.js +14 -0
  213. package/lib/core/rewrite/catch-clause.js +14 -0
  214. package/lib/core/rewrite/function-wrap.js +14 -0
  215. package/lib/core/rewrite/index.js +14 -0
  216. package/lib/core/rewrite/injections.js +14 -0
  217. package/lib/core/rewrite/is-contrast-method.js +14 -0
  218. package/lib/core/rewrite/log.js +14 -0
  219. package/lib/core/rewrite/member-expression.js +14 -0
  220. package/lib/core/rewrite/object-property.js +14 -0
  221. package/lib/core/rewrite/prepend-globals.js +14 -0
  222. package/lib/core/rewrite/rewrite-log.js +14 -0
  223. package/lib/core/rewrite/switch-statement.js +14 -0
  224. package/lib/core/rewrite/template-literal.js +14 -0
  225. package/lib/core/stacktrace.js +15 -3
  226. package/lib/coverage.js +14 -0
  227. package/lib/feature-set.js +16 -1
  228. package/lib/generator-function.js +14 -0
  229. package/lib/hooks/array.js +14 -0
  230. package/lib/hooks/cluster.js +14 -0
  231. package/lib/hooks/dataflow-monitor.js +14 -0
  232. package/lib/hooks/encoding.js +15 -1
  233. package/lib/hooks/express-fileupload.js +14 -0
  234. package/lib/hooks/express-session.js +14 -0
  235. package/lib/hooks/fn-to-string.js +14 -0
  236. package/lib/hooks/frameworks/base.js +14 -0
  237. package/lib/hooks/frameworks/common.js +14 -0
  238. package/lib/hooks/frameworks/hapi16.js +14 -0
  239. package/lib/hooks/frameworks/http.js +14 -0
  240. package/lib/hooks/frameworks/https.js +14 -0
  241. package/lib/hooks/frameworks/index.js +14 -0
  242. package/lib/hooks/hapi-16-reply.js +14 -0
  243. package/lib/hooks/hapi-16-session.js +14 -0
  244. package/lib/hooks/http.js +14 -0
  245. package/lib/hooks/module/extensions.js +14 -0
  246. package/lib/hooks/module/helpers.js +14 -0
  247. package/lib/hooks/module/index.js +14 -0
  248. package/lib/hooks/newrelic.js +14 -0
  249. package/lib/hooks/object-is.js +14 -0
  250. package/lib/hooks/object-to-primitive.js +14 -0
  251. package/lib/hooks/patcher.js +28 -24
  252. package/lib/hooks/require.js +14 -0
  253. package/lib/hooks/stealthy-require.js +14 -0
  254. package/lib/instrumentation.js +14 -0
  255. package/lib/libraries.js +21 -3
  256. package/lib/library-usage.js +14 -0
  257. package/lib/list-installed.js +14 -0
  258. package/lib/protect/analysis/aho-corasick.js +27 -30
  259. package/lib/protect/analysis/dfsa-analyzer.js +14 -0
  260. package/lib/protect/errors/handler.js +14 -0
  261. package/lib/protect/errors/security-exception.js +14 -0
  262. package/lib/protect/express/index.js +14 -0
  263. package/lib/protect/express/sinks.js +14 -0
  264. package/lib/protect/express/sources.js +14 -0
  265. package/lib/protect/fastify/index.js +14 -0
  266. package/lib/protect/fastify/sinks.js +14 -0
  267. package/lib/protect/fastify/sources.js +14 -0
  268. package/lib/protect/hapi/error-handler.js +14 -0
  269. package/lib/protect/hapi/index.js +14 -0
  270. package/lib/protect/hapi/sinks.js +14 -0
  271. package/lib/protect/hapi/sources.js +14 -0
  272. package/lib/protect/index.js +14 -0
  273. package/lib/protect/input-analysis.js +14 -0
  274. package/lib/protect/koa/index.js +14 -0
  275. package/lib/protect/koa/sinks.js +14 -0
  276. package/lib/protect/koa/sources.js +14 -0
  277. package/lib/protect/listeners.js +14 -0
  278. package/lib/protect/loopback4/index.js +14 -0
  279. package/lib/protect/loopback4/sources.js +14 -0
  280. package/lib/protect/models/application-context.js +14 -0
  281. package/lib/protect/models/sink-event.js +14 -0
  282. package/lib/protect/models/source-event.js +14 -0
  283. package/lib/protect/restify/index.js +14 -0
  284. package/lib/protect/restify/sinks.js +14 -0
  285. package/lib/protect/restify/sources.js +14 -0
  286. package/lib/protect/rules/assessment.js +14 -0
  287. package/lib/protect/rules/attack-patterns.js +14 -0
  288. package/lib/protect/rules/base-scanner/index.js +14 -0
  289. package/lib/protect/rules/base-scanner/java-script-scanner.js +14 -0
  290. package/lib/protect/rules/base-scanner/postgresqlscanner.js +14 -0
  291. package/lib/protect/rules/base-scanner/scan-state.js +14 -0
  292. package/lib/protect/rules/base-scanner/substring-finder.js +14 -0
  293. package/lib/protect/rules/base-scanner/token-sequence.js +14 -0
  294. package/lib/protect/rules/bot-blocker/bot-blocker-rule.js +14 -0
  295. package/lib/protect/rules/bot-blocker/index.js +14 -0
  296. package/lib/protect/rules/cmd-injection/cmdinjection-rule.js +14 -0
  297. package/lib/protect/rules/cmd-injection-command-backdoors/backdoor-detector.js +17 -3
  298. package/lib/protect/rules/cmd-injection-command-backdoors/cmd-injection-command-backdoors-rule.js +14 -0
  299. package/lib/protect/rules/cmd-injection-semantic-chained-commands/chained-command-scanner.js +14 -0
  300. package/lib/protect/rules/cmd-injection-semantic-chained-commands/cmd-injection-semantic-chained-commands-rule.js +14 -0
  301. package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/cmd-injection-semantic-dangerous-paths-rule.js +14 -0
  302. package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/dangerous-paths-scanner.js +14 -0
  303. package/lib/protect/rules/common.js +14 -0
  304. package/lib/protect/rules/index.js +14 -0
  305. package/lib/protect/rules/ip-denylist/ip-denylist-rule.js +14 -0
  306. package/lib/protect/rules/method-tampering/evaluator.js +14 -0
  307. package/lib/protect/rules/method-tampering/method-tampering-rule.js +14 -0
  308. package/lib/protect/rules/nosqli/no-sql-injection-rule.js +14 -0
  309. package/lib/protect/rules/nosqli/nosql-scanner/index.js +14 -0
  310. package/lib/protect/rules/nosqli/nosql-scanner/mongodbscanner.js +14 -0
  311. package/lib/protect/rules/path-traversal/path-traversal-rule.js +14 -0
  312. package/lib/protect/rules/rule-factory.js +14 -0
  313. package/lib/protect/rules/signatures/cmd-injection/custom-searchers/chained-command-searcher.js +14 -0
  314. package/lib/protect/rules/signatures/cmd-injection/custom-searchers/index.js +14 -0
  315. package/lib/protect/rules/signatures/cmd-injection/index.js +14 -0
  316. package/lib/protect/rules/signatures/evaluator.js +14 -0
  317. package/lib/protect/rules/signatures/index.js +14 -0
  318. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/index.js +14 -0
  319. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/nosql-comment-searcher.js +14 -0
  320. package/lib/protect/rules/signatures/nosql-injection/custom-searchers/simple-or-searcher.js +14 -0
  321. package/lib/protect/rules/signatures/nosql-injection/index.js +14 -0
  322. package/lib/protect/rules/signatures/path-traversal/index.js +14 -0
  323. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/behavior-url-searcher.js +14 -0
  324. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/function-definition-searcher.js +14 -0
  325. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/immediate-function-searcher.js +14 -0
  326. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/index.js +14 -0
  327. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/link-and-src-target-searcher.js +14 -0
  328. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/location-set-searcher.js +14 -0
  329. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/map-access-searcher.js +14 -0
  330. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/native-function-execution-searcher.js +14 -0
  331. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/no-alnum-searcher.js +14 -0
  332. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/redefined-function-searcher.js +14 -0
  333. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/style-url-injection-searcher.js +14 -0
  334. package/lib/protect/rules/signatures/reflected-xss/custom-searchers/variable-assignment-searcher.js +14 -0
  335. package/lib/protect/rules/signatures/reflected-xss/helpers/function-call.js +15 -1
  336. package/lib/protect/rules/signatures/reflected-xss/index.js +14 -0
  337. package/lib/protect/rules/signatures/signature.js +14 -0
  338. package/lib/protect/rules/signatures/sql-injection/custom-searchers/if-else-drop-searcher.js +14 -0
  339. package/lib/protect/rules/signatures/sql-injection/custom-searchers/index.js +14 -0
  340. package/lib/protect/rules/signatures/sql-injection/custom-searchers/simple-or-searcher.js +14 -0
  341. package/lib/protect/rules/signatures/sql-injection/custom-searchers/sql-comment-searcher.js +14 -0
  342. package/lib/protect/rules/signatures/sql-injection/custom-searchers/time-function-searcher.js +14 -0
  343. package/lib/protect/rules/signatures/sql-injection/custom-searchers/tsql-exec-searcher.js +14 -0
  344. package/lib/protect/rules/signatures/sql-injection/index.js +14 -0
  345. package/lib/protect/rules/signatures/ssjs-injection/index.js +14 -0
  346. package/lib/protect/rules/signatures/unsafe-file-upload/index.js +14 -0
  347. package/lib/protect/rules/signatures/untrusted-deserialization/index.js +14 -0
  348. package/lib/protect/rules/sqli/generic-complicated.js +14 -0
  349. package/lib/protect/rules/sqli/sql-injection-rule.js +14 -0
  350. package/lib/protect/rules/sqli/sql-scanner/index.js +14 -0
  351. package/lib/protect/rules/sqli/sql-scanner/mysql-scanner.js +14 -0
  352. package/lib/protect/rules/ssjs-injection/evaluator.js +14 -0
  353. package/lib/protect/rules/ssjs-injection/ssjsinjection-rule.js +14 -0
  354. package/lib/protect/rules/unsafe-file-upload/unsafe-file-upload-rule.js +14 -0
  355. package/lib/protect/rules/untrusted-deserialization/untrusted-deserialization-rule.js +14 -0
  356. package/lib/protect/rules/virtual-patch/index.js +14 -0
  357. package/lib/protect/rules/virtual-patch/utils.js +14 -0
  358. package/lib/protect/rules/virtual-patch/virtual-patch-rule.js +14 -0
  359. package/lib/protect/rules/xss/helpers/function-call.js +15 -1
  360. package/lib/protect/rules/xss/reflected-xss-rule.js +14 -0
  361. package/lib/protect/rules/xxe/xxerule.js +14 -0
  362. package/lib/protect/sample-aggregator.js +14 -0
  363. package/lib/protect/samples.js +14 -0
  364. package/lib/protect/service.js +14 -0
  365. package/lib/protect/sinks/child-process.js +14 -0
  366. package/lib/protect/sinks/eval.js +14 -0
  367. package/lib/protect/sinks/fs.js +14 -0
  368. package/lib/protect/sinks/function.js +14 -0
  369. package/lib/protect/sinks/index.js +14 -0
  370. package/lib/protect/sinks/libxmljs.js +14 -0
  371. package/lib/protect/sinks/mongodb.js +14 -0
  372. package/lib/protect/sinks/mysql.js +14 -0
  373. package/lib/protect/sinks/node-serialize.js +14 -0
  374. package/lib/protect/sinks/postgres.js +14 -0
  375. package/lib/protect/sinks/sequelize.js +14 -0
  376. package/lib/protect/sinks/sqlite3.js +14 -0
  377. package/lib/protect/sinks/vm.js +14 -0
  378. package/lib/protect/sources/busboy.js +14 -0
  379. package/lib/protect/sources/formidable.js +14 -0
  380. package/lib/protect/sources/index.js +14 -0
  381. package/lib/protect/validators/authorization.js +14 -0
  382. package/lib/protect/validators/common.js +14 -0
  383. package/lib/protect/validators/connection.js +14 -0
  384. package/lib/protect/validators/content-length.js +14 -0
  385. package/lib/protect/validators/host.js +14 -0
  386. package/lib/protect/validators/if-none-match.js +14 -0
  387. package/lib/protect/validators/index.js +14 -0
  388. package/lib/protect/validators/origin.js +14 -0
  389. package/lib/reporter/app-activity-queue.js +14 -0
  390. package/lib/reporter/grpc-client.js +14 -0
  391. package/lib/reporter/messages/speedracer/activity.js +14 -0
  392. package/lib/reporter/messages/speedracer/application-create.js +14 -0
  393. package/lib/reporter/messages/speedracer/application-update.js +14 -0
  394. package/lib/reporter/messages/speedracer/base.js +14 -0
  395. package/lib/reporter/messages/speedracer/index.js +14 -0
  396. package/lib/reporter/messages/speedracer/observed-route.js +14 -0
  397. package/lib/reporter/messages/speedracer/poll.js +14 -0
  398. package/lib/reporter/messages/speedracer/request.js +14 -0
  399. package/lib/reporter/messages/speedracer/startup.js +14 -0
  400. package/lib/reporter/messaging-router.js +14 -0
  401. package/lib/reporter/models/app-activity/app-activity.js +14 -0
  402. package/lib/reporter/models/app-activity/attacker-activity.js +14 -0
  403. package/lib/reporter/models/app-activity/defend.js +14 -0
  404. package/lib/reporter/models/app-activity/inventory.js +14 -0
  405. package/lib/reporter/models/app-activity/protection-rule-activity.js +14 -0
  406. package/lib/reporter/models/app-activity/rule-events.js +14 -0
  407. package/lib/reporter/models/app-activity/sample.js +14 -0
  408. package/lib/reporter/models/app-activity/source.js +14 -0
  409. package/lib/reporter/models/app-activity/user-input.js +14 -0
  410. package/lib/reporter/models/app-create.js +14 -0
  411. package/lib/reporter/models/app-update/index.js +16 -4
  412. package/lib/reporter/models/app-update/library-manifest.js +14 -0
  413. package/lib/reporter/models/app-update/library-usage.js +14 -0
  414. package/lib/reporter/models/app-update/library.js +14 -0
  415. package/lib/reporter/models/event-tag.js +14 -0
  416. package/lib/reporter/models/finding/event.js +14 -0
  417. package/lib/reporter/models/finding/finding.js +14 -0
  418. package/lib/reporter/models/frameworks/express-request.js +14 -0
  419. package/lib/reporter/models/frameworks/fastify-request.js +14 -0
  420. package/lib/reporter/models/frameworks/hapi-request.js +14 -0
  421. package/lib/reporter/models/frameworks/index.js +14 -0
  422. package/lib/reporter/models/frameworks/koa-request.js +14 -0
  423. package/lib/reporter/models/frameworks/restify-request.js +14 -0
  424. package/lib/reporter/models/observed-route.js +14 -0
  425. package/lib/reporter/models/request.js +14 -0
  426. package/lib/reporter/models/route-coverage.js +14 -0
  427. package/lib/reporter/models/startup.js +14 -0
  428. package/lib/reporter/models/trace-event-source.js +14 -0
  429. package/lib/reporter/models/utils/request-factory.js +14 -0
  430. package/lib/reporter/models/utils/user-input-factory.js +14 -0
  431. package/lib/reporter/models/utils/user-input-kit.js +14 -0
  432. package/lib/reporter/mq-client.js +14 -0
  433. package/lib/reporter/server-activity-queue.js +14 -0
  434. package/lib/reporter/socket-client.js +14 -0
  435. package/lib/reporter/speedracer/base-connection-state.js +14 -0
  436. package/lib/reporter/speedracer/constants.js +14 -0
  437. package/lib/reporter/speedracer/failure-connection-state.js +14 -0
  438. package/lib/reporter/speedracer/index.js +14 -0
  439. package/lib/reporter/speedracer/success-connection-state.js +14 -0
  440. package/lib/reporter/speedracer/unknown-connection-state.js +14 -0
  441. package/lib/reporter/translations/enums.js +14 -0
  442. package/lib/reporter/translations/helpers.js +14 -0
  443. package/lib/reporter/translations/to-protobuf/dtm/activity.js +14 -0
  444. package/lib/reporter/translations/to-protobuf/dtm/address.js +14 -0
  445. package/lib/reporter/translations/to-protobuf/dtm/agent-startup.js +14 -0
  446. package/lib/reporter/translations/to-protobuf/dtm/application-create.js +14 -0
  447. package/lib/reporter/translations/to-protobuf/dtm/application-update.js +14 -0
  448. package/lib/reporter/translations/to-protobuf/dtm/architecture-component.js +14 -0
  449. package/lib/reporter/translations/to-protobuf/dtm/attack-result.js +14 -0
  450. package/lib/reporter/translations/to-protobuf/dtm/bot-blocker-details.js +14 -0
  451. package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-details.js +14 -0
  452. package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-semantic-analysis-details.js +14 -0
  453. package/lib/reporter/translations/to-protobuf/dtm/finding.js +14 -0
  454. package/lib/reporter/translations/to-protobuf/dtm/http-method-tampering-details.js +14 -0
  455. package/lib/reporter/translations/to-protobuf/dtm/http-request.js +14 -0
  456. package/lib/reporter/translations/to-protobuf/dtm/index.js +14 -0
  457. package/lib/reporter/translations/to-protobuf/dtm/ip-denylist-details.js +14 -0
  458. package/lib/reporter/translations/to-protobuf/dtm/library-usage-update.js +14 -0
  459. package/lib/reporter/translations/to-protobuf/dtm/no-sql-injection-details.js +14 -0
  460. package/lib/reporter/translations/to-protobuf/dtm/observed-route.js +14 -0
  461. package/lib/reporter/translations/to-protobuf/dtm/pair.js +14 -0
  462. package/lib/reporter/translations/to-protobuf/dtm/path-traversal-details.js +14 -0
  463. package/lib/reporter/translations/to-protobuf/dtm/poll.js +14 -0
  464. package/lib/reporter/translations/to-protobuf/dtm/rasp-rule-sample.js +14 -0
  465. package/lib/reporter/translations/to-protobuf/dtm/raw-request.js +14 -0
  466. package/lib/reporter/translations/to-protobuf/dtm/route-coverage.js +14 -0
  467. package/lib/reporter/translations/to-protobuf/dtm/simple-pair.js +14 -0
  468. package/lib/reporter/translations/to-protobuf/dtm/sql-injection-details.js +14 -0
  469. package/lib/reporter/translations/to-protobuf/dtm/ssjs-injection-details.js +14 -0
  470. package/lib/reporter/translations/to-protobuf/dtm/stack-trace-element.js +14 -0
  471. package/lib/reporter/translations/to-protobuf/dtm/trace-event/action.js +14 -0
  472. package/lib/reporter/translations/to-protobuf/dtm/trace-event/index.js +14 -0
  473. package/lib/reporter/translations/to-protobuf/dtm/trace-event/parent-object-id.js +14 -0
  474. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-object.js +14 -0
  475. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-signature.js +14 -0
  476. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-event-source.js +14 -0
  477. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-stack.js +14 -0
  478. package/lib/reporter/translations/to-protobuf/dtm/trace-event/trace-taint-range.js +14 -0
  479. package/lib/reporter/translations/to-protobuf/dtm/trace-event/type.js +14 -0
  480. package/lib/reporter/translations/to-protobuf/dtm/untrusted-deserialization-details.js +14 -0
  481. package/lib/reporter/translations/to-protobuf/dtm/user-input.js +14 -0
  482. package/lib/reporter/translations/to-protobuf/dtm/virtual-patch-details.js +14 -0
  483. package/lib/reporter/translations/to-protobuf/dtm/xss-details.js +14 -0
  484. package/lib/reporter/translations/to-protobuf/dtm/xxe-details.js +14 -0
  485. package/lib/reporter/translations/to-protobuf/index.js +14 -0
  486. package/lib/reporter/translations/to-protobuf/settings/application-settings.js +14 -0
  487. package/lib/reporter/translations/to-protobuf/settings/assess-features.js +14 -0
  488. package/lib/reporter/translations/to-protobuf/settings/auth.js +14 -0
  489. package/lib/reporter/translations/to-protobuf/settings/bot-blocker.js +14 -0
  490. package/lib/reporter/translations/to-protobuf/settings/custom-rule-feature.js +14 -0
  491. package/lib/reporter/translations/to-protobuf/settings/defend-features.js +14 -0
  492. package/lib/reporter/translations/to-protobuf/settings/exclusions.js +14 -0
  493. package/lib/reporter/translations/to-protobuf/settings/index.js +14 -0
  494. package/lib/reporter/translations/to-protobuf/settings/input-analysis-result.js +14 -0
  495. package/lib/reporter/translations/to-protobuf/settings/inventory-features.js +14 -0
  496. package/lib/reporter/translations/to-protobuf/settings/ip-filter.js +14 -0
  497. package/lib/reporter/translations/to-protobuf/settings/log-enhancer.js +14 -0
  498. package/lib/reporter/translations/to-protobuf/settings/protection-rule.js +14 -0
  499. package/lib/reporter/translations/to-protobuf/settings/reaction.js +14 -0
  500. package/lib/reporter/translations/to-protobuf/settings/rule-definition.js +14 -0
  501. package/lib/reporter/translations/to-protobuf/settings/sampling.js +14 -0
  502. package/lib/reporter/translations/to-protobuf/settings/server-features.js +14 -0
  503. package/lib/reporter/translations/to-protobuf/settings/syslog.js +14 -0
  504. package/lib/reporter/translations/to-protobuf/settings/virtual-patch.js +14 -0
  505. package/lib/reporter/ts-reporter.js +14 -0
  506. package/lib/tracker.js +14 -0
  507. package/lib/util/base64.js +14 -0
  508. package/lib/util/bitset.js +14 -0
  509. package/lib/util/block-request.js +14 -0
  510. package/lib/util/callback-resolver.js +14 -0
  511. package/lib/util/clean-stack.js +15 -1
  512. package/lib/util/clean-string/brackets.js +17 -3
  513. package/lib/util/clean-string/clean-string-base.js +14 -0
  514. package/lib/util/clean-string/comments.js +14 -0
  515. package/lib/util/clean-string/concatenations.js +15 -1
  516. package/lib/util/clean-string/jsclean-string.js +14 -0
  517. package/lib/util/clean-string/placeholders.js +14 -0
  518. package/lib/util/clean-string/util.js +15 -2
  519. package/lib/util/colors.js +14 -0
  520. package/lib/util/file-finder.js +14 -0
  521. package/lib/util/heap-dump.js +14 -0
  522. package/lib/util/html-util.js +14 -0
  523. package/lib/util/ip-analyzer.js +15 -1
  524. package/lib/util/is-agent-path.js +14 -0
  525. package/lib/util/is-contrast-error.js +14 -0
  526. package/lib/util/is-piped-to-dev.js +14 -0
  527. package/lib/util/is-string.js +14 -0
  528. package/lib/util/partial.js +14 -0
  529. package/lib/util/pkg-name.js +14 -0
  530. package/lib/util/request-util.js +14 -0
  531. package/lib/util/resolve-obj.js +14 -0
  532. package/lib/util/route-info.js +14 -0
  533. package/lib/util/source-map.js +14 -0
  534. package/lib/util/static-rules.js +14 -0
  535. package/lib/util/trace-util.js +14 -0
  536. package/lib/util/traverse.js +14 -0
  537. package/lib/util/user-input-evaluator.js +14 -0
  538. package/lib/util/xml-analyzer/external-entity-finder.js +15 -1
  539. package/node_modules/bindings/LICENSE.md +22 -0
  540. package/node_modules/bindings/README.md +98 -0
  541. package/node_modules/bindings/bindings.js +221 -0
  542. package/node_modules/bindings/package.json +32 -0
  543. package/node_modules/file-uri-to-path/.npmignore +1 -0
  544. package/node_modules/file-uri-to-path/.travis.yml +30 -0
  545. package/node_modules/file-uri-to-path/History.md +21 -0
  546. package/node_modules/file-uri-to-path/LICENSE +20 -0
  547. package/node_modules/file-uri-to-path/README.md +74 -0
  548. package/node_modules/file-uri-to-path/index.d.ts +2 -0
  549. package/node_modules/file-uri-to-path/index.js +66 -0
  550. package/node_modules/file-uri-to-path/package.json +36 -0
  551. package/node_modules/file-uri-to-path/test/test.js +24 -0
  552. package/node_modules/file-uri-to-path/test/tests.json +13 -0
  553. package/node_modules/nan/CHANGELOG.md +537 -0
  554. package/node_modules/nan/LICENSE.md +13 -0
  555. package/node_modules/nan/README.md +455 -0
  556. package/node_modules/nan/doc/asyncworker.md +146 -0
  557. package/node_modules/nan/doc/buffers.md +54 -0
  558. package/node_modules/nan/doc/callback.md +76 -0
  559. package/node_modules/nan/doc/converters.md +41 -0
  560. package/node_modules/nan/doc/errors.md +226 -0
  561. package/node_modules/nan/doc/json.md +62 -0
  562. package/node_modules/nan/doc/maybe_types.md +583 -0
  563. package/node_modules/nan/doc/methods.md +664 -0
  564. package/node_modules/nan/doc/new.md +147 -0
  565. package/node_modules/nan/doc/node_misc.md +123 -0
  566. package/node_modules/nan/doc/object_wrappers.md +263 -0
  567. package/node_modules/nan/doc/persistent.md +296 -0
  568. package/node_modules/nan/doc/scopes.md +73 -0
  569. package/node_modules/nan/doc/script.md +38 -0
  570. package/node_modules/nan/doc/string_bytes.md +62 -0
  571. package/node_modules/nan/doc/v8_internals.md +199 -0
  572. package/node_modules/nan/doc/v8_misc.md +85 -0
  573. package/node_modules/nan/include_dirs.js +1 -0
  574. package/node_modules/nan/nan.h +2898 -0
  575. package/node_modules/nan/nan_callbacks.h +88 -0
  576. package/node_modules/nan/nan_callbacks_12_inl.h +514 -0
  577. package/node_modules/nan/nan_callbacks_pre_12_inl.h +520 -0
  578. package/node_modules/nan/nan_converters.h +72 -0
  579. package/node_modules/nan/nan_converters_43_inl.h +68 -0
  580. package/node_modules/nan/nan_converters_pre_43_inl.h +42 -0
  581. package/node_modules/nan/nan_define_own_property_helper.h +29 -0
  582. package/node_modules/nan/nan_implementation_12_inl.h +430 -0
  583. package/node_modules/nan/nan_implementation_pre_12_inl.h +263 -0
  584. package/node_modules/nan/nan_json.h +166 -0
  585. package/node_modules/nan/nan_maybe_43_inl.h +356 -0
  586. package/node_modules/nan/nan_maybe_pre_43_inl.h +268 -0
  587. package/node_modules/nan/nan_new.h +340 -0
  588. package/node_modules/nan/nan_object_wrap.h +156 -0
  589. package/node_modules/nan/nan_persistent_12_inl.h +132 -0
  590. package/node_modules/nan/nan_persistent_pre_12_inl.h +242 -0
  591. package/node_modules/nan/nan_private.h +73 -0
  592. package/node_modules/nan/nan_string_bytes.h +305 -0
  593. package/node_modules/nan/nan_typedarray_contents.h +96 -0
  594. package/node_modules/nan/nan_weak.h +437 -0
  595. package/node_modules/nan/package.json +41 -0
  596. package/node_modules/nan/tools/1to2.js +412 -0
  597. package/node_modules/nan/tools/README.md +14 -0
  598. package/node_modules/nan/tools/package.json +19 -0
  599. package/node_modules/unix-dgram/LICENSE +13 -0
  600. package/node_modules/unix-dgram/README.md +107 -0
  601. package/node_modules/unix-dgram/binding.gyp +20 -0
  602. package/node_modules/unix-dgram/build/Makefile +324 -0
  603. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram/src/unix_dgram.o.d +58 -0
  604. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram.node.d +1 -0
  605. package/node_modules/unix-dgram/build/Release/.deps/Release/unix_dgram.node.d +1 -0
  606. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram/src/unix_dgram.o +0 -0
  607. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram.node +0 -0
  608. package/node_modules/unix-dgram/build/Release/unix_dgram.node +0 -0
  609. package/node_modules/unix-dgram/build/binding.Makefile +6 -0
  610. package/node_modules/unix-dgram/build/config.gypi +213 -0
  611. package/node_modules/unix-dgram/build/unix_dgram.target.mk +159 -0
  612. package/node_modules/unix-dgram/lib/unix_dgram.js +168 -0
  613. package/node_modules/unix-dgram/package.json +36 -0
  614. package/node_modules/unix-dgram/src/unix_dgram.cc +404 -0
  615. package/node_modules/unix-dgram/src/win_dummy.cc +7 -0
  616. package/node_modules/unix-dgram/test/test-connect-callback.js +68 -0
  617. package/node_modules/unix-dgram/test/test-connect.js +53 -0
  618. package/node_modules/unix-dgram/test/test-dgram-unix.js +58 -0
  619. package/node_modules/unix-dgram/test/test-send-error.js +26 -0
  620. package/package.json +3 -2
  621. package/perf-logs.js +14 -0
@@ -0,0 +1,85 @@
1
+ ## Miscellaneous V8 Helpers
2
+
3
+ - <a href="#api_nan_utf8_string"><b><code>Nan::Utf8String</code></b></a>
4
+ - <a href="#api_nan_get_current_context"><b><code>Nan::GetCurrentContext()</code></b></a>
5
+ - <a href="#api_nan_set_isolate_data"><b><code>Nan::SetIsolateData()</code></b></a>
6
+ - <a href="#api_nan_get_isolate_data"><b><code>Nan::GetIsolateData()</code></b></a>
7
+ - <a href="#api_nan_typedarray_contents"><b><code>Nan::TypedArrayContents</code></b></a>
8
+
9
+
10
+ <a name="api_nan_utf8_string"></a>
11
+ ### Nan::Utf8String
12
+
13
+ Converts an object to a UTF-8-encoded character array. If conversion to a string fails (e.g. due to an exception in the toString() method of the object) then the length() method returns 0 and the * operator returns NULL. The underlying memory used for this object is managed by the object.
14
+
15
+ An implementation of [`v8::String::Utf8Value`](https://v8docs.nodesource.com/node-8.16/d4/d1b/classv8_1_1_string_1_1_utf8_value.html) that is consistent across all supported versions of V8.
16
+
17
+ Definition:
18
+
19
+ ```c++
20
+ class Nan::Utf8String {
21
+ public:
22
+ Nan::Utf8String(v8::Local<v8::Value> from);
23
+
24
+ int length() const;
25
+
26
+ char* operator*();
27
+ const char* operator*() const;
28
+ };
29
+ ```
30
+
31
+ <a name="api_nan_get_current_context"></a>
32
+ ### Nan::GetCurrentContext()
33
+
34
+ A call to [`v8::Isolate::GetCurrent()->GetCurrentContext()`](https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a81c7a1ed7001ae2a65e89107f75fd053) that works across all supported versions of V8.
35
+
36
+ Signature:
37
+
38
+ ```c++
39
+ v8::Local<v8::Context> Nan::GetCurrentContext()
40
+ ```
41
+
42
+ <a name="api_nan_set_isolate_data"></a>
43
+ ### Nan::SetIsolateData()
44
+
45
+ A helper to provide a consistent API to [`v8::Isolate#SetData()`](https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#a7acadfe7965997e9c386a05f098fbe36).
46
+
47
+ Signature:
48
+
49
+ ```c++
50
+ void Nan::SetIsolateData(v8::Isolate *isolate, T *data)
51
+ ```
52
+
53
+
54
+ <a name="api_nan_get_isolate_data"></a>
55
+ ### Nan::GetIsolateData()
56
+
57
+ A helper to provide a consistent API to [`v8::Isolate#GetData()`](https://v8docs.nodesource.com/node-8.16/d5/dda/classv8_1_1_isolate.html#aabd223436bc1100a787dadaa024c6257).
58
+
59
+ Signature:
60
+
61
+ ```c++
62
+ T *Nan::GetIsolateData(v8::Isolate *isolate)
63
+ ```
64
+
65
+ <a name="api_nan_typedarray_contents"></a>
66
+ ### Nan::TypedArrayContents<T>
67
+
68
+ A helper class for accessing the contents of an ArrayBufferView (aka a typedarray) from C++. If the input array is not a valid typedarray, then the data pointer of TypedArrayContents will default to `NULL` and the length will be 0. If the data pointer is not compatible with the alignment requirements of type, an assertion error will fail.
69
+
70
+ Note that you must store a reference to the `array` object while you are accessing its contents.
71
+
72
+ Definition:
73
+
74
+ ```c++
75
+ template<typename T>
76
+ class Nan::TypedArrayContents {
77
+ public:
78
+ TypedArrayContents(v8::Local<Value> array);
79
+
80
+ size_t length() const;
81
+
82
+ T* const operator*();
83
+ const T* const operator*() const;
84
+ };
85
+ ```
@@ -0,0 +1 @@
1
+ console.log(require('path').relative('.', __dirname));