@contrast/agent 4.31.2 → 4.32.1

package/bin/VERSION

@@ -1 +1 @@
-2.28.24
+2.28.25

package/lib/contrast.js

@@ -191,6 +191,18 @@ function getAgentArgs(options) {
   return agentArgs;
 }
 
+function parseArgv(argv) {
+  const parsed = [];
+  const cwd = process.cwd();
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i].includes(cwd)) {
+      parsed.push(path.relative(cwd, argv[i]).toLowerCase());
+    } else {
+      parsed.push(path.basename(argv[i]).toLowerCase());
+    }
+  }
+  return parsed;
+}
 /**
  * Initializes config, logger and other non-instrumentation code.
  *
@@ -210,6 +222,26 @@ contrastAgent.prepare = function(...args) {
     const configUtil = require('./core/config/util');
     const config = configUtil.setup(options, logger);
 
+    if (config.agent.node.exclusive_entrypoint) {
+      const parsed = parseArgv(process.argv);
+      if (!parsed.includes(config.agent.node.exclusive_entrypoint)) {
+        return false;
+      }
+    }
+
+    if (config.agent.node.cmd_ignore_list) {
+      const parsed = parseArgv(process.argv);
+      const cmdIgnoreList = config.agent.node.cmd_ignore_list.split(',');
+      if (parsed.includes('npm')) {
+        if (cmdIgnoreList.includes('npm*')) return false;
+        parsed.shift();
+      }
+      const cmd = parsed.join(' ');
+      if (cmdIgnoreList.includes(cmd)) {
+        return false;
+      }
+    }
+
     loggerFactory.init(config);
 
     contrastAgent.doImports();

package/lib/core/config/options.js

@@ -454,6 +454,18 @@ const agent = [
     default: 16,
     desc: 'set the maximum body size that will be sent to speedracer for input analysis',
   },
+  {
+    // SEE NODE-2886
+    name: 'agent.node.cmd_ignore_list',
+    arg: '<commands>',
+    desc: 'comma-separated list of commands that will not startup the agent if agent is required; npm* will ignore all npm executables but not your application\'s scripts'
+  },
+  {
+    // SEE NODE-2886
+    name: 'agent.node.exclusive_entrypoint',
+    arg: '<entrypoint.js>',
+    desc: 'an entrypoint for an application that, when specified, will prevent the agent instrumenting on anything else'
+  },
   {
     name: 'agent.heap_dump.enable',
     arg: '[true]',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.31.2",
+  "version": "4.32.1",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",