@contrast/agent 4.31.2 → 5.0.0-alpha.1

package/lib/assess/loopback4/route-coverage.js

@@ -1,129 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { uniqueId } = require('../../util/route-info');
-const agentEmitter = require('../../agent-emitter');
-const patcher = require('../../hooks/patcher');
-const moduleHook = require('../../hooks/require');
-const { PATCH_TYPES } = require('../../constants');
-const { funcInfo } = require('@contrast/fn-inspect');
-
-class RouteCoverage {
-  constructor(agent) {
-    this.routes = new Map();
-    this.appDir = agent.appInfo.appDir;
-    moduleHook.resolve(
-      { name: '@loopback/rest', file: 'dist/router/routing-table.js' },
-      this.patchRoutingTable.bind(this)
-    );
-  }
-
-  /**
-   * Get the argument names for a route
-   *
-   * @param {Object} route
-   *
-   * @returns {string} string representation of params
-   */
-  getSignatureArgs(route) {
-    if (!route.spec.parameters) {
-      return '';
-    }
-    return route.spec.parameters.map((p) => p.name).join(', ');
-  }
-
-  /**
-   * Get the file:funcname prefix for a signature
-   *
-   * @param {Object} route
-   *
-   * @returns {string} string representation of the sgnature prefix
-   */
-  getSignatureFunc(route) {
-    const func = route._controllerName ? route._controllerCtor : route._handler;
-    const finfo = funcInfo(func);
-    const path = finfo.file.replace(`${this.appDir}/`, '');
-    const suffix = route._controllerName
-      ? `${route._controllerName}.${route._methodName}`
-      : finfo.method;
-    return `${path}:${suffix}`;
-  }
-
-  /**
-   * create a signature from a route
-   *
-   * @param {Object} route
-   *
-   * @returns {string} the signature for the route
-   */
-  createSignature(route) {
-    return `${this.getSignatureFunc(route)}(${this.getSignatureArgs(route)})`;
-  }
-
-  /**
-   * Apply patches to loopback/rest routing-table.js
-   *
-   * @param {Object} xport the export object to patch
-   */
-  patchRoutingTable(xport) {
-    const self = this;
-    patcher.patch(xport.RoutingTable.prototype, 'registerRoute', {
-      alwaysRun: true,
-      patchType: PATCH_TYPES.ROUTE_COVERAGE,
-      name: '@loopback/rest/RoutingTable.registerRoute',
-      post(data) {
-        const route = data.args[0];
-        const signature = self.createSignature(route);
-        if (!self.routes.has(signature)) {
-          const id = uniqueId();
-          self.routes.set(signature, id);
-          agentEmitter.emit('route-discovery', { [id]: { signature, id } });
-        }
-      }
-    });
-
-    patcher.patch(xport.RoutingTable.prototype, 'find', {
-      alwaysRun: true,
-      patchType: PATCH_TYPES.ROUTE_COVERAGE,
-      name: '@loopback/rest/RoutingTable.find',
-      post(data) {
-        const req = data.args[0];
-        const route = data.result;
-        // ExternalRoutes are express routes
-        // they're still reported via the express hooks
-        if (!route || route.constructor.name === 'ExternalRoute') {
-          return;
-        }
-        const signature = self.createSignature(route);
-        let id;
-        if (!self.routes.has(signature)) {
-          id = uniqueId();
-          self.routes.set(signature, id);
-          agentEmitter.emit('route-discovery', { [id]: { signature, id } });
-        } else {
-          id = self.routes.get(signature);
-        }
-        agentEmitter.emit('route-observation', {
-          verb: route.verb,
-          id,
-          url: req.url
-        });
-      }
-    });
-  }
-}
-
-module.exports = RouteCoverage;

package/lib/assess/loopback4/sinks/index.js

@@ -1,25 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const ResponseScanning = require('./response-scanning');
-const ReflectedXss = require('./xss');
-
-module.exports = class LoopbackSinks {
-  constructor(agent) {
-    new ResponseScanning();
-    new ReflectedXss(agent);
-  }
-};

package/lib/assess/loopback4/sinks/response-scanning.js

@@ -1,39 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const agentEmitter = require('../../../agent-emitter');
-const {
-  constants: { EVENTS }
-} = require('../../../core/loopback4');
-const { emitSendEvent } = require('../../../hooks/frameworks/common');
-
-class Loopback4ResponseScanning {
-  constructor() {
-    this.registerResponseScanningHandler();
-  }
-
-  /**
-   * Registers a listener for loopback sending a body in order
-   * to call response scanning rules
-   */
-  registerResponseScanningHandler() {
-    agentEmitter.on(EVENTS.SEND.POST, (payload) => {
-      emitSendEvent(payload);
-    });
-  }
-}
-
-module.exports = Loopback4ResponseScanning;

package/lib/assess/loopback4/sinks/xss.js

@@ -1,77 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const agentEmitter = require('../../../agent-emitter');
-const { constants } = require('../../../core/loopback4');
-const { Signature, CallContext } = require('../../models');
-const policy = require('../../policy');
-const { get } = require('lodash');
-
-class LoopbackXss {
-  constructor(agent) {
-    this.common = require('../../sinks/common')(agent);
-    this.rules = get(policy, 'rules');
-    this.ruleId = 'reflected-xss';
-    this.signature = new Signature({
-      moduleName: 'res',
-      methodName: 'end',
-      isModule: false
-    });
-    agentEmitter.on(constants.EVENTS.SEND.POST, this.checkResult.bind(this));
-  }
-
-  /**
-   * checks if an assess rule is enabled in policy
-   */
-  get enabled() {
-    return get(this.rules, `${this.ruleId}.enabled`);
-  }
-
-  checkResult(body) {
-    if (!this.enabled) {
-      return;
-    }
-
-    const { ruleId, signature } = this;
-
-    const {
-      isVulnerable,
-      xss: { disallowedTags },
-      requiredTags,
-      report
-    } = this.common;
-
-    if (
-      isVulnerable({
-        input: body,
-        disallowedTags,
-        requiredTags,
-        ruleId
-      })
-    ) {
-      const ctxt = CallContext.create({
-        obj: body,
-        args: [body],
-        result: body,
-        stackOpts: {
-          constructorOpt: agentEmitter.emit
-        }
-      });
-      report({ ruleId, signature, input: body, ctxt });
-    }
-  }
-}
-
-module.exports = LoopbackXss;

package/lib/assess/loopback4/sources.js

@@ -1,33 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const agentEmitter = require('../../agent-emitter');
-const {
-  constants: { EVENTS }
-} = require('../../core/loopback4');
-
-class Loopback4AssessSources {
-  constructor() {
-    agentEmitter.on(EVENTS.SOURCES.BODY, function(req) {
-      agentEmitter.emit('assess.body', req, 'body');
-    });
-
-    agentEmitter.on(EVENTS.SOURCES.PARAMS, function(req) {
-      agentEmitter.emit('assess.params', req, 'params');
-    });
-  }
-}
-
-module.exports = Loopback4AssessSources;

package/lib/assess/membrane/debraner.js

@@ -1,170 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { PROXY_TARGET } = require('../../constants');
-
-class Debraner {
-  constructor(object) {
-    // assure that a top-level membrane can be removed
-    this.root = { root: object };
-    // the property-name path to the current object
-    this.path = [];
-
-    // restore is a noop if proxies have not been removed.
-    this.removed = false;
-
-    // used to avoid walking circular references. it's only used by
-    // remove() and debrane() but is exposed here for debugging.
-    this.circular = undefined;
-
-    // map of proxies found => PROXY_TARGET return value. not sure this
-    // is necessary other than to know whether to replace the object or
-    // not.
-    this.proxies = new Map();
-
-    // map of objects that were behind a membrane proxy => PROXY_TARGET
-    // return value. used to restore membrane proxies after stringifying.
-    this.unbranes = new Map();
-  }
-
-  remove() {
-    // used to avoid walking circular references. each remove() call
-    // requires that it is reset.
-    this.circular = new Set();
-
-    const debraned = this.debrane(this.root);
-    this.removed = true;
-    if (this.circular.size) {
-      // should this restore and return the original proxied object? stringify
-      // will throw on a circular reference and that would leave the object
-      // without the original membrane proxies. is there a better way to handle
-      // stringify throwing?
-    }
-    return debraned.root;
-  }
-
-  debrane(obj) {
-    if (typeof obj !== 'object' || !obj) {
-      return obj;
-    }
-
-    // check for a proxy before adding this object to the circular set. that
-    // prevents the proxy itself from being memorized; just the object behind
-    // the proxy.
-
-    const unbraned = obj[PROXY_TARGET];
-    if (unbraned) {
-      // save the proxied object so it can be restored after stringify. saving
-      // the path allows the proxies to be restored without walking the entire
-      // object.
-      unbraned.proxy = obj;
-      unbraned.path = this.path.slice();
-
-      // remember that this unwrapped object maps to this specific
-      // membrane and proxy. that allows the tracked property data to
-      // be accessed and applied to stringify's result.
-      this.unbranes.set(unbraned.target, unbraned);
-      this.proxies.set(obj, unbraned);
-
-      let container = this.root;
-      const lastIx = unbraned.path.length - 1;
-      for (let i = 0; i < lastIx; i++) {
-        container = container[unbraned.path[i]];
-      }
-      // replace the membrane proxy in its container with the non-proxied object
-      container[unbraned.path[lastIx]] = unbraned.target;
-
-      // then recurse with the unwrapped object.
-      return this.debrane(unbraned.target);
-    }
-
-    // has this already been walked?
-    if (this.circular.has(obj)) {
-      return obj;
-    }
-    this.circular.add(obj);
-
-    if (obj[Symbol.iterator]) {
-      // Array and Buffer are the only two iterable objects that can both
-      // contain tainted data and render it as text via 'toString()'. Buffer
-      // requires the deliberate intention of the program to both 1) encode
-      // a Buffer object as an object and 2) interpret that object as a buffer
-      // after JSON.parse. we cannot determine, from the data, that the user's
-      // application will take those steps, so only Array is left. If the user
-      // application uses Buffer.toString() then taint will be maintained if
-      // the buffer was tracked.
-      if (Array.isArray(obj)) {
-        for (const ix in obj) {
-          this.path.push(ix);
-          this.debrane(obj[ix]);
-          this.path.pop();
-        }
-        return obj;
-      } else {
-        // it doesn't matter if this is a String or a string or a typed array.
-        // a buffer, as well as typed arrays, could sneak data by that *can*
-        // be interpreted as a string. but, given that b = Buffer.from('xzxyy')
-        // then JSON.stringify({b}) => {"b": {"type": "Buffer", "data": [...]}}
-        // where data is [120, 122, 120, 121, 121] so it requires the program's
-        // deliberate intention to interpret the incoming data as a buffer. all
-        // typed arrays interpret their contents as numbers. and strings will
-        // not be behind a membrane. in theory a Map or a Set can contain user
-        // data but neither is rendered by JSON.stringify.
-        return obj;
-      }
-    }
-
-    //
-    // don't bother checking all the possible object types, e.g., RegExp, Date,
-    // Error, etc. instances. there are a few stray enumerable properties, like
-    // regex 'lastIndex', but in general there are so few, and the likelihood of
-    // these objects appearing in an object that is to be stringified is so low,
-    // that we're likely better off just ignoring them.
-    //
-    const keys = Object.getOwnPropertyNames(obj);
-    for (const key of keys) {
-      this.path.push(key);
-      this.debrane(obj[key]);
-      this.path.pop();
-    }
-    return obj;
-  }
-
-  restore() {
-    if (this.removed) {
-      this.rebrane(this.root);
-      this.removed = false;
-    }
-    return this.root.root;
-  }
-
-  // originally implemented using this.unbranes rather than this.proxies.
-  // but this.unbranes doesn't capture more than one proxy on the same
-  // object.
-  rebrane(obj) {
-    for (const [, proxies] of this.proxies) {
-      let container = this.root;
-      const lastIx = proxies.path.length - 1;
-      for (let i = 0; i < lastIx; i++) {
-        container = container[proxies.path[i]];
-      }
-      // replace object in its container with the membrane proxy
-      container[proxies.path[lastIx]] = proxies.proxy;
-    }
-  }
-}
-
-module.exports = Debraner;

package/lib/assess/membrane/deserialization-membrane.js

@@ -1,76 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const tagUtil = require('../models/tag-range/util');
-const TagRange = require('../models/tag-range');
-const tracker = require('../../tracker');
-const Membrane = require('./index');
-const { PropagationEvent, Signature, CallContext } = require('../models');
-
-const signature = new Signature('JSON.parse');
-
-class DeserializationMembrane extends Membrane {
-  /**
-   * @param {Object} data patcher data
-   * @param {ContrastProperties} props the metadata associated with the string which was deserialized to create the object in this membrane
-   */
-  constructor(data, props) {
-    super();
-    // use result for object and result because the object would just
-    // be stringified for display anyway. not exact, but close enough.
-    this.result = data.result;
-    this.arg = data.args[0];
-    this.obj = data.result;
-    this.event = props.event;
-    this.tagRanges = tagUtil.filterNonSupersetGroups(
-      'untrusted',
-      props.tagRanges
-    );
-  }
-
-  onString(str, metadata) {
-    const context = CallContext.create({
-      obj: this.obj,
-      args: [this.arg],
-      result: this.result,
-      stackOpts: {
-        constructorOpt: this.wrap
-      }
-    });
-    const event = new PropagationEvent({
-      context,
-      signature,
-      tagRanges: this.tagRanges,
-      source: 'A',
-      target: 'R'
-    });
-
-    const tracked = tracker.track(str);
-
-    if (!tracked) {
-      return str;
-    }
-
-    tracked.props.event = event;
-    event.parents.push(this.event);
-    tracked.props.tagRanges = this.tagRanges.map(
-      (t) => new TagRange(0, str.length - 1, t.tag)
-    );
-
-    return tracked.str;
-  }
-}
-
-module.exports = DeserializationMembrane;