@contrast/agent 4.30.0 → 4.31.0

package/lib/assess/policy/propagators.json

@@ -536,6 +536,10 @@
     "fastify-plugin": {
       "enabled": true,
       "override": "./propagators/fastify-static/allowed-path.js"
+    },
+    "serve-static": {
+      "enabled": true,
+      "override": "./propagators/serve-static.js"
     }
   }
 }

package/lib/assess/policy/rules.json

@@ -612,7 +612,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -626,7 +626,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -640,12 +640,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -659,12 +659,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -678,7 +678,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -693,7 +693,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -707,7 +707,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -722,7 +722,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -736,7 +736,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -750,7 +750,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -764,7 +764,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -779,7 +779,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -793,7 +793,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -808,7 +808,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -822,7 +822,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -837,7 +837,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -851,12 +851,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -871,12 +871,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -890,7 +890,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -905,7 +905,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -919,7 +919,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -934,7 +934,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -948,7 +948,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -963,7 +963,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -977,7 +977,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -992,7 +992,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1006,7 +1006,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1021,7 +1021,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1035,12 +1035,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1055,12 +1055,12 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1074,7 +1074,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1089,7 +1089,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1103,7 +1103,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1118,7 +1118,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1132,7 +1132,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1147,7 +1147,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1161,7 +1161,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1176,7 +1176,7 @@
             "args": [
               {
                 "index": 0,
-                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen", "safe-path"],
                 "requiredTags": ["untrusted"]
               }
             ]

package/lib/assess/policy/signatures.json

@@ -1402,6 +1402,11 @@
       "moduleName": "fastify-static",
       "methodName": "allowedPath",
       "isModule": false
+    },
+    "serve-static": {
+      "moduleName": "serve-static",
+      "methodName": "",
+      "isModule": true
     }
   }
 }

package/lib/assess/propagators/fastify-static/allowed-path.js

@@ -55,7 +55,7 @@ module.exports.handle = function handle() {
                         logger.trace('hooking fastify-static/index');
                         tagRangeUtil.addInPlace(
                           trackingData.tagRanges,
-                          new TagRange(0, data.args[0].length - 1, 'exclusion:path-traversal')
+                          new TagRange(0, data.args[0].length - 1, 'safe-path')
                         );
                         tagRangeUtil.removeInPlace(trackingData.tagRanges, ['untrusted']);
 

package/lib/assess/propagators/serve-static.js

@@ -0,0 +1,109 @@
+/**
+Copyright: 2023 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const parseUrl = require('parseurl');
+const requireHook = require('../../hooks/require');
+const patcher = require('../../hooks/patcher');
+const tracker = require('../../tracker');
+const { PATCH_TYPES } = require('../../constants');
+const TagRange = require('../models/tag-range');
+const tagRangeUtil = require('../models/tag-range/util');
+const { CallContext, Signature, PropagationEvent } = require('../models');
+const { AsyncStorage, KEYS } = require('../../core/async-storage');
+const agent = require('../../agent');
+
+module.exports.handle = handle;
+module.exports.patchServerStatic = patchServeStatic;
+module.exports.patchSendModule = patchSendModule;
+
+/**
+ * Called to install require hook.
+ */
+function handle() {
+  if (agent.config.assess.enable_sanitizer_serve_static) {
+    requireHook.resolve(
+      { name: 'serve-static' },
+      (serveStatic) =>
+        patchServeStatic(serveStatic));
+    requireHook.resolve(
+      { name: 'send' },
+      (sendModule) =>
+        patchSendModule(sendModule));
+  }
+}
+
+/**
+ * Patch the function to apply html-encoded tag to tracked return values.
+ * @param {object} serveStaticExport The exported value of the serve-static module
+ */
+function patchServeStatic(serveStaticExport) {
+  return patcher.patch(serveStaticExport, {
+    name: 'serve-static',
+    patchType: PATCH_TYPES.ASSESS_PROPAGATOR,
+    alwaysRun: true,
+    post(data) {
+      const resultFn = data.result;
+      data.result = patcher.patch(resultFn, {
+        name: 'serve-static',
+        patchType: PATCH_TYPES.ASSESS_PROPAGATOR,
+        alwaysRun: true,
+        pre(data) {
+          const req = data.args[0];
+          const path = parseUrl(req).pathname;
+
+          AsyncStorage.set(KEYS.SERVE_STATIC_PATH, path);
+        }
+      });
+    }
+  });
+}
+
+function patchSendModule(sendModuleExport) {
+  return patcher.patch(sendModuleExport, {
+    name: 'send',
+    patchType: PATCH_TYPES.ASSESS_PROPAGATOR,
+    alwaysRun: true,
+    pre(data) {
+      const [req, path] = data.args;
+      const serveStaticPath = AsyncStorage.get(KEYS.SERVE_STATIC_PATH);
+      const reqPath = parseUrl(req).pathname;
+
+      if (path !== serveStaticPath || path !== reqPath) return;
+
+      const trackData = tracker.getData(path);
+      if (trackData) {
+        trackData.tagRanges = tagRangeUtil.add(
+          trackData.tagRanges,
+          new TagRange(0, path.length - 1, 'safe-path')
+        );
+
+        const event = new PropagationEvent({
+          context: CallContext.create(data),
+          parents: [trackData.event],
+          signature: new Signature(
+            'serve-static'
+          ),
+          source: 'P',
+          target: 'R',
+          tags: 'safe-path',
+          tagRanges: trackData.tagRanges
+        });
+        trackData.event = event;
+      }
+    }
+  });
+}
+

package/lib/constants.js

@@ -515,6 +515,7 @@ const TAGS = {
     'CUSTOM_VALIDATED_UNVALIDATED_REDIRECT',
   'custom-validated-xpath-injection': 'CUSTOM_VALIDATED_XPATH_INJECTION',
   'custom-validated-xxe': 'CUSTOM_VALIDATED_XXE',
+  'safe-path': 'SAFE_PATH',
 
   // tracked-string range tags
   'no-newlines': 'NO_NEWLINES',

package/lib/contrast.js

@@ -330,6 +330,7 @@ contrastAgent.bootstrap = function(args) {
         const args = {
           quiet: (process.env['CONTRAST__AGENT__DIAGNOSTICS__QUIET'] === 'false') ? false : true,
           output: destination,
+          skip: false,
         };
 
         try {
@@ -339,8 +340,9 @@ contrastAgent.bootstrap = function(args) {
         }
 
         if (!(process.env['CONTRAST__AGENT__SYSTEM_DIAGNOSTICS__ENABLE'] === 'false')) {
+          args.output = path.join(args.output, '../contrast_system_info.json');
           const info = fetchSystemInfo();
-          outputSystemInfo({ skip: false, quiet: true, output: 'contrast_system_info.json' }, info);
+          outputSystemInfo(args, info);
         }
       }
     });

package/lib/core/async-storage/index.js

@@ -38,6 +38,7 @@ const KEYS = {
   FASTIFY_HANDLER_RESOLVED: 'fastify.xss.handler.resolved',
   FASTIFY_REPLY_SEND_STATE: 'fastify.xss.reply.send.state',
   FINALHANDLER_CB_INDEX: 'finalHandlerCbIndex',
+  SERVE_STATIC_PATH: 'serveStaticPath',
   HAPI_CALLER: 'hapi.caller',
   INPUT_EXCLUSIONS: 'defend.exclusions',
   KOA_CTX: 'koa.ctx',

package/lib/core/config/options.js

@@ -721,6 +721,14 @@ const assess = [
     default: false,
     desc: 'trust incoming strings when they pass custom validators (Mongoose, Joi)',
   },
+  {
+    name: 'assess.enable_sanitizer_serve_static',
+    arg: '<enable-sanitizer-serve-static>',
+    default: false,
+    desc: 'Enables the serve-static module as a path-traversal sanitizer. Express uses serve-static in a safe way' +
+    'but manual setup of serve-static can be vulnerable. Even with Express there is a possibility for "traversing-down"' +
+    'the served folder or user misconfiguration if not configured with an absolute path',
+  },
   {
     name: 'assess.enable_preflight',
     arg: '[false]',

package/lib/util/config-diagnostics-utils.js

@@ -114,7 +114,10 @@ function getProtectValues(option, config, tsData) {
       Source: 'ContrastUI',
     };
   } else if (option.name.includes('protect.rules') && option.name.includes('mode')) {
-    const apiRule = tsData.protectionRulesList.find(r => r.id == option.name.split('.')[2]);
+    let apiRule;
+    if (tsData.protectionRulesList) {
+      apiRule = tsData.protectionRulesList.find(r => r.id == option.name.split('.')[2]);
+    }
 
     const apiMode = apiRule ? apiRule.mode : undefined;
     const ymlMode = config._flat[option.name];
@@ -199,6 +202,14 @@ function outputAgentConfigFile(agent, options, args, err) {
     effectiveConfig.Config.Status = 'Success';
   }
 
+  try {
+    fs.accessSync(path.join(args.output, '..'), fs.constants.RDWD_OK);
+    fs.writeFileSync(args.output, JSON.stringify(effectiveConfig, null, 2), 'utf-8');
+  } catch (err) {
+    // try to write the file at pwd instead
+    args.output = path.join(process.cwd(), 'contrast_effective_config.json');
+  }
+
   try {
     fs.accessSync(path.join(args.output, '..'), fs.constants.RDWD_OK);
     fs.writeFileSync(args.output, JSON.stringify(effectiveConfig, null, 2), 'utf-8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.30.0",
+  "version": "4.31.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -182,6 +182,7 @@
     "qs": "^6.9.4",
     "rethinkdb": "file:test/mock/rethinkdb",
     "sequelize": "^6.11.0",
+    "serve-static": "^1.15.0",
     "shellcheck": "^1.0.0",
     "sinon": "^9.2.4",
     "sinon-chai": "^3.3.0",