@contrast/agent 4.31.2 → 5.0.0-alpha.1

package/lib/instrumentation.js

@@ -1,190 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * Responsible for initializing all the agent instrumentation.
- * It also collects the application's library information.
- *
- * @module lib/instrumentation
- */
-'use strict';
-const agentEmitter = require('./agent-emitter');
-const LoggerKit = require('./core/logger');
-const libraries = require('./libraries');
-const logger = LoggerKit('contrast:instrumentation');
-const libUsage = require('./library-usage');
-
-/**
- * Starts the application script with instrumentation. After collecting library
- * information and policies
- *
- * @param {Agent} agent The agent
- * @param {TSReporter} reporter TSReporter instance
- */
-module.exports = function instrument(agent, reporter) {
-  if (!agent.isInAssessMode() && !agent.isInDefendMode()) {
-    logger.warn(
-      'Assess nor Protect mode are enabled. Continuing without instrumentation'
-    );
-    return;
-  }
-
-  // The order of these matters, do not re-order
-  collectLibInfo(agent);
-  // (CONTRAST-31526) this must be required first to load global.ContrastMethods
-  require('./core/rewrite/injections');
-  assessModeFeatures(agent);
-  protectModeFeatures({ agent, reporter });
-  nonPolicyHooks(agent);
-  anyModeFeatures(agent);
-  // this should go before we call user code to avoid rewriting our own code
-  instrumentCore({ agent, logger });
-
-  /**
-   * CAN'T GO ASYNC AFTER CALLING THIS - STARTING MAIN HAS TO HAPPEN
-   * IN THE SAME EVENT LOOP TICK AS SENDING THE ONLINE EVENT B/C THE
-   * PRIMARY MIGHT IMMEDIATELY SEND MESSAGES ONCE THE WORKER IS ONLINE
-   * IF THE WORKER USER CODE DOESN'T REGISTER A LISTENER IN THIS TICK
-   * THE MESSAGE WILL BE LOST
-   */
-  if (agent.cluster.isWorker) {
-    logger.debug("cluster fork online; emitting 'online' event to primary");
-    process.send({
-      cmd: 'NODE_CLUSTER',
-      act: 'online'
-    });
-  }
-
-  return;
-};
-
-/**
- * Retrieves a list of installed dependencies and
- * then emits the list as appInfo to TS
- */
-function collectLibInfo(agent) {
-  if (
-    agent.cluster.isPrimary &&
-    agent.config.inventory.enable &&
-    agent.config.inventory.analyze_libraries
-  ) {
-    // only do libraries in the master process (they should be the same for the forks)
-    logger.info('collecting library information');
-
-    const eluEnabled = agent.config.agent.node.library_usage.reporting.enable;
-    const evalFrequency =
-      agent.config.agent.node.library_usage.reporting.interval;
-    if (eluEnabled) {
-      require('./hooks/module/extensions')();
-      libUsage.listen(evalFrequency);
-    }
-    libraries.getLibInfo(agent, eluEnabled).then((libs) => {
-      agentEmitter.emit('appinfo', { libs });
-    });
-  }
-}
-
-/**
- * Initializes the asses mode features
- */
-function assessModeFeatures(agent) {
-  if (agent.isInAssessMode()) {
-    logger.debug('initializing assess mode features');
-    require('./assess/policy/init').init(agent);
-    require('./assess/static/read-findings-from-cache')(agent);
-    require('./hooks/encoding')();
-    require('./hooks/object-to-primitive')();
-    require('./hooks/array')();
-    require('./hooks/object-is')();
-    require('./hooks/dataflow-monitor')(agent);
-    require('./assess')(agent);
-    require('./coverage')();
-  }
-}
-
-/**
- * Initializes the protect mode features
- *
- */
-function protectModeFeatures({ agent, reporter }) {
-  if (agent.isInDefendMode()) {
-    logger.debug('initializing protect mode features');
-
-    require('./protect')();
-
-    // if it's native_input_analysis then use agent-lib
-    if (agent.config.agent.node.native_input_analysis) {
-      const lib = require('@contrast/agent-lib');
-      // needs the || '.' for testing...
-      const logDir = agent.config.agent.node.analysis_log_dir || '.';
-      const agentLib = new lib.Agent(
-        { enableLogging: true, logDir, logLevel: 'INFO' }
-      );
-      // attach the constants so lib.Agent() isn't exposed.
-      for (const c in lib.constants) {
-        agentLib[c] = lib.constants[c];
-      }
-      agent.agentLib = agentLib;
-    }
-
-    const protectService = require('./protect/listeners')(agent, reporter);
-    const InputAnalysisSensor = require('./protect/input-analysis');
-    require('./protect/sources')(agent);
-    require('./protect/sinks')(agent);
-
-    new InputAnalysisSensor({
-      agent,
-      reporter,
-      logger: LoggerKit,
-      protectService
-    }).install();
-  }
-}
-
-/**
- * Instruments non policy related hooks
- *
- */
-function nonPolicyHooks(agent) {
-  require('./core/async-storage/hooks/bluebird')();
-  require('./core/async-storage/hooks/redis')();
-  require('./core/async-storage/hooks/mongodb')();
-  require('./core/async-storage/hooks/mysql')();
-  require('./hooks/require');
-  require('./hooks/cluster')(agent);
-  require('./hooks/http')(agent);
-  require('./hooks/newrelic')();
-  require('./hooks/express-session')();
-  require('./hooks/express-fileupload')();
-}
-
-/**
- * Initializes the listeners for route-discovery and route-observation on sensors.
- * Installs the source hooks and transplies native modules
- */
-function anyModeFeatures(agent) {
-  require('./core')(agent);
-  require('./hooks/frameworks')(agent);
-}
-
-/**
- * Hooks Function.toString to unwrite our rewritten code
- * Monkey patches module._compile to rewrite user code
- * proxy magic for stealthy-require to not break
- */
-function instrumentCore({ agent, logger }) {
-  require('./hooks/fn-to-string')(agent);
-  require('./hooks/stealthy-require')();
-  require('./hooks/module')(agent);
-}

package/lib/libraries.js

@@ -1,172 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { stat } = require('fs').promises;
-const stringify = require('json-stable-stringify');
-const Module = require('module');
-const { AGENT_INFO } = require('./constants');
-const { runInNoInstrumentationScope } = require('./core/async-storage/scopes');
-const logger = require('./core/logger')('contrast:libraries');
-const listInstalled = require('./list-installed');
-const AppUpdate = require('./reporter/models/app-update');
-
-const DEADZONE_NAME = 'agent: libraries';
-
-/**
- * @typedef {import('./list-installed').Result} Result
- */
-
-/**
- * Searches a list of paths and returns the first valid path found.
- * @param {string[]} paths
- * @returns {Promise<string | undefined>}
- */
-const findNodeModsPath = async (paths) =>
-  // this functions similarly to `Bluebird.map() with concurrency: 1
-  paths.reduce(async (prev, path) => {
-    if (await prev) return prev;
-
-    try {
-      await stat(path);
-      return path;
-    } catch (err) {
-      return undefined;
-    }
-  }, Promise.resolve());
-
-/**
- * Filters out the agent as a dependency, formats libraries, and keeps track of
- * nested modules.
- *
- * @param {{ [key: string]: Result | string }} deps collection of dependencies from app root
- * @param {Map<string, Set<string>} requiredBy
- * @param {string} parent the name of the module requiring the current when nested
- * @return {{ [key: string]: Result }} formatted object
- */
-const formatDependencies = (deps, requiredBy, parent) =>
-  Object.entries(deps || {}).reduce((result, [key, val]) => {
-    if (key === AGENT_INFO.NAME) {
-      return result;
-    }
-
-    if (parent) {
-      const set = requiredBy.has(key) ? requiredBy.get(key) : new Set();
-
-      set.add(parent);
-      requiredBy.set(key, set);
-    }
-
-    if (typeof val === 'string') {
-      result[key] = {
-        name: key,
-        version: val,
-        dependencies: {}
-      };
-      return result;
-    }
-
-    if (!val.name) val.name = key;
-
-    val.dependencies = formatDependencies(val.dependencies, requiredBy, key);
-    result[key] = val;
-
-    return result;
-  }, {});
-
-/**
- * Recursively adds each dependency as a library which is used later
- * for reporting inventory and class usage
- *
- * @param {{ [key: string]: Result }} deps the formatted object from formatDependencies
- * @param {Map<string, Set<string>} requiredBy map containing data regarding dependents
- * @param {import('./agent')} agent agent instance
- */
-const processDependencies = (deps, requiredBy, agent) => {
-  Object.values(deps).forEach((dep) => {
-    dep._requiredBy = requiredBy.has(dep.name)
-      ? Array.from(requiredBy.get(dep.name))
-      : [];
-
-    const newLib = AppUpdate.addLib(dep, agent);
-    // If this is the first time we've checked this dep, check its deps as well.
-    if (newLib) {
-      processDependencies(dep.dependencies, requiredBy, agent);
-    }
-  });
-};
-
-/**
- * Traverses entire dependency tree to report library inventory
- *
- * @param {import('./agent')} agent agent instance
- * @param {boolean} eluEnabled flag to get composition for each module
- * @returns {AppUpdate.libraries}
- */
-const getLibInfo = async (agent, eluEnabled) =>
-  runInNoInstrumentationScope(async () => {
-    try {
-      const boundRequire = Module.createRequire(agent.appInfo.path);
-      const paths = boundRequire.resolve.paths(agent.appInfo.path);
-      const nodeModsPath = await findNodeModsPath(paths);
-
-      if (!nodeModsPath) {
-        logger.error(
-          'unable to read installed dependencies because a node_modules directory could not be detected given a package.json located at %s - use the agent.node.app_root configuration variable if installed in non-standard location',
-          agent.appInfo.path
-        );
-        return AppUpdate.libraries;
-      }
-
-      logger.debug('detected node_modules at %s', nodeModsPath);
-      const data = await listInstalled(nodeModsPath, logger);
-
-      logger.debug(
-        'package.json dependencies: %s',
-        // _dependencies contains { name: version } info
-        stringify(data._dependencies, { space: 2 })
-      );
-      logger.debug(
-        'package.json devDependencies: %s',
-        stringify(data.devDependencies, { space: 2 })
-      );
-
-      const requiredBy = new Map();
-      const dependencies = formatDependencies(data.dependencies, requiredBy);
-      processDependencies(dependencies, requiredBy, agent);
-
-      const libs = AppUpdate.libraries;
-      if (eluEnabled) {
-        logger.info('recursively scanning dependencies');
-        // this functions similarly to `Bluebird.map()` with concurrency: 1
-        await Object.values(libs).reduce(async (prev, lib) => {
-          await prev;
-          return lib.getComposition();
-        }, Promise.resolve());
-      }
-
-      logger.info(
-        'finished library inventory for %s dependencies',
-        Object.keys(libs).length
-      );
-
-      return libs;
-    } catch (err) {
-      logger.error('unable to read installed dependencies: %o', err);
-      return AppUpdate.libraries;
-    }
-  }, DEADZONE_NAME);
-
-module.exports.getLibInfo = getLibInfo;

package/lib/library-usage.js

@@ -1,51 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const path = require('path');
-const { setCodeEventListener } = require('@contrast/fn-inspect');
-const agentEmitter = require('./agent-emitter');
-const logger = require('./core/logger')('contrast:library-usage');
-const LibraryUsage = require('./reporter/models/app-update/library-usage');
-
-const reportedFiles = new Set();
-
-/**
- * start listening for v8 code events
- * @param {number} evalInterval how often to get code events
- */
-module.exports.listen = function(evalInterval = 1) {
-  const handler = (codeEvent) => {
-    try {
-      if (
-        codeEvent.type !== 'LazyCompile' ||
-        codeEvent.script.indexOf(`node_modules${path.sep}`) === -1 ||
-        reportedFiles.has(codeEvent.script)
-      ) {
-        return;
-      }
-
-      reportedFiles.add(codeEvent.script);
-      logger.trace(`new usage: ${codeEvent.script}`);
-
-      const libUsage = new LibraryUsage(codeEvent.script);
-      agentEmitter.emit('libraryUsage', libUsage);
-    } catch (err) {
-      logger.error('error occurred during code event handling: %o', err);
-    }
-  };
-
-  setCodeEventListener(handler, evalInterval);
-};

package/lib/list-installed.js

@@ -1,97 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const semver = require('semver');
-const util = require('util');
-
-const {
-  AGENT_INFO: { SUPPORTED_NPM_VERSIONS },
-} = require('./constants');
-
-const VERSION_REGEX = /^npm@(\S+)\s+(\S+[\s\S]*)$/m;
-const isWin32 = process.platform === 'win32';
-
-const execFile = util.promisify(require('child_process').execFile);
-
-/**
- * @typedef {Object} Result
- * @property {string} name
- * @property {string} version
- * @property {{ [key: string]: Result | string }} dependencies
- * @property {{ [key: string]: Result | string }} devDependencies
- */
-
-/**
- * @param {string} cwd directory in which we want to execute `npm ls`
- * @param {*} logger
- * @returns {Promise<Result>}
- */
-// eslint-disable-next-line complexity
-module.exports = async function listInstalled(cwd, logger) {
-  const execFileOpts = {
-    cwd,
-    env: { ...process.env, NODE_OPTIONS: undefined },
-    maxBuffer: 1024 * 1024 * 128,
-    shell: isWin32
-  };
-  let stdout;
-
-  try {
-    const result = await execFile('npm', ['help'], execFileOpts);
-    stdout = result.stdout;
-  } catch (err) {
-    logger.trace('`npm help` returned an error: %o', err);
-    // If npm encounters any errors whatsoever it will return with a non-zero
-    // exit code but still output the relevant information to stdout.
-    // If an even worse error occurs, we may not be able to parse stdout.
-    stdout = err.stdout || '';
-  }
-
-  const [, version, location] = stdout.match(VERSION_REGEX) || [];
-  if (!version)
-    throw new Error(
-      "Unable to locate `npm`. `npm` is required for your application's libraries to be reported to Contrast for analysis. Please enable debug level logs for more information."
-    );
-
-  logger.debug('using npm version %s at %s', version, location);
-
-  const lsArgs = ['ls', '--json', '--long'];
-  if (semver.gte(version, '7.0.0')) lsArgs.push('--all');
-  if (!semver.satisfies(version, SUPPORTED_NPM_VERSIONS))
-    logger.warn(
-      'The installed version of npm (%s at %s) can cause unexpected behavior. Please install a version that satisfies %s',
-      version,
-      location,
-      SUPPORTED_NPM_VERSIONS
-    );
-
-  try {
-    const result = await execFile('npm', lsArgs, execFileOpts);
-    stdout = result.stdout;
-  } catch (err) {
-    logger.trace('`npm ls` returned an error: %o', err);
-    stdout = err.stdout || '';
-  }
-
-  try {
-    return JSON.parse(stdout);
-  } catch (err) {
-    logger.trace('parsing the output of `npm ls` failed: %o', err);
-    throw new Error(
-      '`npm ls` failed to provide a list of installed dependencies. Please enable trace level logs for more information.'
-    );
-  }
-};

package/lib/protect/analysis/aho-corasick.js

@@ -1,175 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-// https://www.geeksforgeeks.org/aho-corasick-algorithm-pattern-searching/
-
-const a = 'a'.charCodeAt(0);
-const A = 'A'.charCodeAt(0);
-const Z = 'Z'.charCodeAt(0);
-const l2u = a - A;
-
-// initialize the lower -> upper and upper -> lower translation array.
-const TRANSLATION = [];
-for (let byte = A; byte <= Z; byte++) {
-  // translate the uppercase character to lowercase
-  TRANSLATION[byte] = byte + l2u;
-}
-
-class AhoCorasick {
-  constructor(words) {
-    // the maximum number of states is equal to the sum of the length of
-    // the strings to be matched.
-    this.maxStates = 0;
-    for (const word of words) {
-      this.maxStates += word.length;
-    }
-
-    // can optimize this by trading off computation for space.
-    this.maxChars = 128;
-
-    // if this state matches words each match will be in an array at
-    // the state.
-    this.out = Array(this.maxStates + 1);
-    for (let i = 0; i <= this.maxStates; i++) {
-      this.out[i] = [];
-    }
-
-    // state to transition to on failure
-    this.fail = Array(this.maxStates + 1);
-
-    // maxStates + 1 rows
-    // maxChars columns
-    this.goto = Array(this.maxStates + 1);
-    for (let i = 0; i <= this.maxStates; i++) {
-      this.goto[i] = Array();
-    }
-
-    this.words = words;
-
-    this.stateCount = this.buildAutomata();
-
-    // keep state so this can be called in a streaming fashion
-    this.state = 0;
-  }
-
-  reset() {
-    this.state = 0;
-  }
-
-  // eslint-disable-next-line complexity
-  buildAutomata() {
-    // only the root state (state 0) to start with
-    let stateCount = 1;
-
-    // fill in the goto matrix.
-    for (let i = 0; i < this.words.length; i++) {
-      const word = Buffer.from(this.words[i]);
-      let state = 0;
-
-      // create transitions for all character of the current word
-      for (let byte of word) {
-        if (byte & 0x80) {
-          throw new Error('pattern character codes cannot exceed 127');
-        } else if (TRANSLATION[byte]) {
-          byte = TRANSLATION[byte];
-        }
-        if (this.goto[state][byte] === undefined) {
-          this.goto[state][byte] = stateCount;
-          stateCount += 1;
-        }
-        state = this.goto[state][byte];
-      }
-
-      // add current word to terminal list
-      this.out[state].push(this.words[i]);
-    }
-
-    // for all byte values that don't have a transition from the root, add
-    // a transition to the root.
-    for (let byte = 0; byte < this.maxChars; byte++) {
-      if (this.goto[0][byte] === undefined) {
-        this.goto[0][byte] = 0;
-      }
-    }
-
-    // failure function is computer using breadth first order.
-    const queue = [];
-
-    // iterate over all possible inputs
-    for (let i = 0; i < this.maxChars; i++) {
-      // all nodes of depth 1 have failure function value 0.
-      if (this.goto[0][i] !== 0) {
-        this.fail[this.goto[0][i]] = 0;
-        queue.push(this.goto[0][i]);
-      }
-    }
-
-    while (queue.length) {
-      // get the first state in the queue
-      const state = queue.shift();
-
-      // for the removed state, find the failure function for all
-      // characters for which a goto is not defined.
-      for (let i = 0; i < this.maxChars; i++) {
-        if (this.goto[state][i] === undefined) {
-          continue;
-        }
-
-        // get failure transition
-        let failure = this.fail[state];
-
-        // find the deepest node ..
-
-        while (this.goto[failure][i] === undefined) {
-          failure = this.fail[failure];
-        }
-
-        failure = this.goto[failure][i];
-        this.fail[this.goto[state][i]] = failure;
-
-        // merge outputs
-        this.out[this.goto[state][i]].push(...this.out[failure]);
-
-        // insert the next level node (of trie) into queue
-        queue.push(this.goto[state][i]);
-      }
-    }
-
-    return stateCount;
-  }
-
-  check(byte) {
-    // if it's > maxChars set it to a non-matching value to force failure.
-    // this could allow some memory-reduction optimizations if worth it. i.e.,
-    // maxChars only needs to be the highest charcode in the words the user
-    // passes in. and they can be offset by the lowest charcode as well.
-    if (byte >= this.maxChars) {
-      byte = 0;
-    } else if (TRANSLATION[byte]) {
-      byte = TRANSLATION[byte];
-    }
-    let next = this.state;
-    while (this.goto[next][byte] === undefined) {
-      next = this.fail[next];
-    }
-
-    this.state = this.goto[next][byte];
-
-    return this.out[this.state].length ? this.out[this.state] : null;
-  }
-}
-
-module.exports = AhoCorasick;