@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/assess/hapi/route-coverage.js

@@ -1,163 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const logger = require('../../core/logger')('hooks:hapi');
-const patcher = require('../../hooks/patcher');
-const { uniqueId } = require('../../util/route-info');
-const agentEmitter = require('../../agent-emitter');
-const { PATCH_TYPES } = require('../../constants');
-const {
-  constants: {
-    EVENTS: { HAPI_ROUTES, HAPI_ADD_ROUTE }
-  }
-} = require('../../core/hapi');
-
-class RouteCoverage {
-  constructor() {
-    this.routeInfos = {};
-    this.registeredRoutes = new Map();
-    this.registerRouteHandler();
-  }
-
-  /**
-   * Registers handlers on handling a route to properly
-   * emit coverage and patches the handler to emit observation
-   */
-  registerRouteHandler() {
-    agentEmitter.on(HAPI_ROUTES, this.emitRouteCoverage.bind(this));
-    agentEmitter.on(HAPI_ADD_ROUTE, this.registerAddRouteHandler.bind(this));
-  }
-
-  /**
-   * Adds a uniqueId for a given route.path in a local map
-   * patches `route.settings.handler` to emit route observation
-   *
-   * @param {Hapi.Route} route
-   */
-  registerAddRouteHandler(route) {
-    const self = this;
-
-    if (!this.registeredRoutes.has(route.path)) {
-      this.registeredRoutes.set(route.path, uniqueId());
-    }
-
-    patcher.patch(route.settings, 'handler', {
-      name: 'hapi.route.handler',
-      patchType: PATCH_TYPES.ROUTE_COVERAGE,
-      alwaysRun: true,
-      pre(data) {
-        const [request = {}] = data.args;
-        self.emitRouteObservation(request._route);
-      }
-    });
-  }
-
-  /**
-   * Generates all defined routes from either route Map(hapi 19+)
-   * or route objects and emits a `route-discovery` event
-   *
-   * @param {Object} routes
-   */
-  emitRouteCoverage(routes) {
-    /*
-     * Hapi19 switched route storage Object->Map
-     */
-    if (routes instanceof Map) {
-      routes.forEach((val, method) => {
-        val.routes.forEach(({ route }) => {
-          this.generateRouteInfo(route);
-        });
-      });
-    } else {
-      const methods = Object.keys(routes);
-      methods.forEach((method) => {
-        routes[method].routes.forEach(({ route }) => {
-          this.generateRouteInfo(route);
-        });
-      });
-    }
-
-    agentEmitter.emit('route-discovery', this.routeInfos);
-  }
-
-  /**
-   * emits a route-observation event with the proper
-   * keys: verb, id. If id and verb are falsey
-   * it will log a warning and not report a route-observation
-   *
-   * @param {Hapi.Route} route hapi route instance
-   *
-   */
-  emitRouteObservation(route = {}) {
-    const { method: verb, path: url } = route;
-    const id = this.registeredRoutes.get(route.path);
-    if (id && verb) {
-      agentEmitter.emit('route-observation', { verb, id, url });
-    } else {
-      logger.warn(
-        `Unable to report route observation. id ${id || '?'}, verb: ${verb ||
-          '?'}`
-      );
-    }
-  }
-
-  /**
-   * Formats each route. If the id for a given
-   * uri path exists, it will add the method to
-   * methods and change the
-   * "signature" to be an array of methods
-   *
-   * @param {Hapi.Route} route a hapi route object
-   *
-   */
-  generateRouteInfo(route) {
-    const { path, method } = route;
-    const id = this.registeredRoutes.get(path);
-
-    if (this.routeInfos[id]) {
-      this.routeInfos[id].methods.push(method);
-      this.routeInfos[id].signature = this.createSignature({
-        method: this.routeInfos[id].methods,
-        path
-      });
-    } else {
-      this.routeInfos[id] = {
-        methods: [method],
-        id,
-        signature: this.createSignature({ method, path })
-      };
-    }
-  }
-
-  /**
-   * Creates the signature with proper method and path
-   * @param {Hapi.Route} route
-   * @param {String|Array} route.method if array it will join by ", "
-   * @param {String} route.path path of route
-   * @return {String} a signature line server.route({ method....
-   */
-  createSignature({ method, path }) {
-    let signature = 'server.route({ method: ';
-    signature += Array.isArray(method)
-      ? `["${method.join('", "')}"]`
-      : `"${method}"`;
-
-    signature += `, path: "${path}" })`;
-    return signature;
-  }
-}
-
-module.exports = RouteCoverage;

package/lib/assess/hapi/sinks/index.js

@@ -1,27 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-const XssSink = require('./xss');
-const RedirectSink = require('./unvalidated-redirect');
-const ResponseScanning = require('./response-scanning');
-const SessionHandler = require('./session');
-
-module.exports = class HapiSinks {
-  constructor(agent) {
-    new XssSink(agent);
-    new RedirectSink(agent);
-    new ResponseScanning();
-    new SessionHandler();
-  }
-};

package/lib/assess/hapi/sinks/response-scanning.js

@@ -1,49 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const agentEmitter = require('../../../agent-emitter');
-const {
-  constants: { EVENTS },
-  utils: { isValidEncoding }
-} = require('../../../core/hapi');
-const { get } = require('lodash');
-const { emitSendEvent } = require('../../../hooks/frameworks/common');
-
-class HapiResponseScanning {
-  constructor() {
-    this.registerResponseScanningHandler();
-  }
-
-  /**
-   * registers an event when hapi response is `finished`
-   * for response scanning assess rules
-   */
-  registerResponseScanningHandler() {
-    agentEmitter.on(EVENTS.HAPI_FINISHED, (request) => {
-      const { response } = request;
-      const { _data: body, _encoding: encoding } = get(
-        response,
-        '_payload',
-        {}
-      );
-
-      if (isValidEncoding(encoding)) {
-        emitSendEvent(body);
-      }
-    });
-  }
-}
-
-module.exports = HapiResponseScanning;

package/lib/assess/hapi/sinks/session.js

@@ -1,125 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const agentEmitter = require('../../../agent-emitter');
-const {
-  AsyncStorage,
-  KEYS: { REQUEST }
-} = require('../../../core/async-storage');
-const {
-  constants: { EVENTS },
-  utils: {
-    createSessionEvent,
-    createSessionContext,
-    secureFlagMissing,
-    httpOnly
-  }
-} = require('../../../core/hapi');
-const { emitSessionEvent } = require('../../../hooks/frameworks/common');
-const patcher = require('../../../hooks/patcher');
-const { PATCH_TYPES } = require('../../../constants');
-
-class HapiResponseScanning {
-  constructor() {
-    this.instrumentSessionMethods();
-  }
-
-  instrumentSessionMethods() {
-    const self = this;
-    agentEmitter.on(EVENTS.HAPI_PRE_HANDLER, ({ server, h }) => {
-      patcher.patch(server.constructor.prototype, 'state', {
-        alwaysRun: true,
-        name: 'hapi.server.state',
-        patchType: PATCH_TYPES.ASSESS_SINK,
-        pre(data) {
-          const [, , options] = data.args;
-          self.registerSessionHandler({
-            moduleName: 'server',
-            module: server,
-            options
-          });
-        }
-      });
-
-      patcher.patch(h.constructor.prototype, 'state', {
-        alwaysRun: true,
-        name: 'hapi.state',
-        patchType: PATCH_TYPES.ASSESS_SINK,
-        pre(data) {
-          const [, , options] = data.args;
-          self.registerSessionHandler({
-            moduleName: 'h',
-            module: h,
-            options
-          });
-        }
-      });
-    });
-  }
-
-  /**
-   * registers an event when hapi response is `finished`
-   * for response scanning assess rules
-   */
-  registerSessionHandler({ moduleName, module, options }) {
-    agentEmitter.on(EVENTS.HAPI_FINISHED, () => {
-      if (secureFlagMissing(options)) {
-        this.handleSessionEvent({
-          moduleName,
-          module,
-          ruleId: 'secure-flag-missing',
-          options
-        });
-      }
-
-      if (httpOnly(options)) {
-        this.handleSessionEvent({
-          moduleName,
-          module,
-          ruleId: 'httponly',
-          options
-        });
-      }
-    });
-  }
-
-  /**
-   * Emit session events so they can
-   * be checked and then reported to TeamServer.
-   * @param {Object} params
-   * @param {string} params.moduleName - name of the module (h|server)
-   * @param {Object} params.module     - the module (h|server)
-   * @param {string} params.ruleId     - the ruleid - 'httponly' | 'secure-flag-missing'
-   * @param {Object} params.options    - the options passed to *.state
-   */
-  handleSessionEvent({ moduleName, module, ruleId, options }) {
-    const { [REQUEST]: hapiRequest } = AsyncStorage.getContext();
-    const ctxt = createSessionContext(module, [options], hapiRequest, 'P1', {
-      constructorOpt: agentEmitter.emit
-    });
-    const events = {};
-    events[ruleId] = createSessionEvent(
-      moduleName,
-      'state',
-      ctxt,
-      'P1',
-      options
-    );
-
-    emitSessionEvent(events);
-  }
-}
-
-module.exports = HapiResponseScanning;

package/lib/assess/hapi/sinks/unvalidated-redirect.js

@@ -1,100 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const moduleHook = require('../../../hooks/require');
-const patcher = require('../../../hooks/patcher');
-const logger = require('../../../core/logger')('hooks:hapi');
-const { Signature, CallContext } = require('../../models');
-const policy = require('../../policy');
-const { get } = require('lodash');
-const { PATCH_TYPES } = require('../../../constants');
-
-class HapiRedirectSink {
-  constructor(agent) {
-    this.common = require('../../sinks/common')(agent);
-    this.rules = get(policy, 'rules');
-    this.ruleId = 'unvalidated-redirect';
-    this.disallowedTags = ['url-encoded'];
-    const methodName = 'redirect';
-    this.methodName = methodName;
-    this.signature = new Signature({
-      moduleName: 'h',
-      methodName,
-      isModule: true
-    });
-
-    this.instrumentResponse();
-  }
-
-  /**
-   * checks if an assess rule is enabled in policy
-   * @param {string} ruleId assess rule id
-   */
-  get enabled() {
-    return get(this.rules, `${this.ruleId}.enabled`);
-  }
-
-  /**
-   * Adds a hook for when hapi/lib/response is required
-   */
-  instrumentResponse() {
-    moduleHook.resolve(
-      { name: 'hapi', file: 'lib/response' },
-      this.registerUnvalidatedRedirectHandler.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@hapi/hapi', file: 'lib/response' },
-      this.registerUnvalidatedRedirectHandler.bind(this)
-    );
-  }
-
-  /**
-   * Patches `Response.prototype.redirect` for
-   * `unvalidated-redirect` checking
-   *
-   * @param {Hapi.Response} Response outgoing response
-   */
-  registerUnvalidatedRedirectHandler(Response) {
-    const self = this;
-    const { isVulnerable, requiredTags, report } = this.common;
-    const { disallowedTags, ruleId, methodName, signature } = this;
-
-    logger.info('loading hapi response hooks.');
-    patcher.patch(Response.prototype, methodName, {
-      name: 'hapi.Response.prototype',
-      patchType: PATCH_TYPES.ASSESS_SINK,
-      alwaysRun: true,
-      post(data) {
-        if (!self.enabled) {
-          return;
-        }
-        const [url] = data.args;
-        if (isVulnerable({ input: url, disallowedTags, requiredTags })) {
-          const ctxt = CallContext.create({
-            obj: data.obj,
-            args: [url],
-            result: url,
-            stackOpts: {
-              constructorOpt: data.hooked
-            }
-          });
-          report({ ruleId, signature, input: url, ctxt });
-        }
-      }
-    });
-  }
-}
-
-module.exports = HapiRedirectSink;

package/lib/assess/hapi/sinks/xss.js

@@ -1,178 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const moduleHook = require('../../../hooks/require');
-const patcher = require('../../../hooks/patcher');
-const { Signature, CallContext } = require('../../models');
-const policy = require('../../policy');
-const { get } = require('lodash');
-const agentEmitter = require('../../../agent-emitter');
-const {
-  constants: { EVENTS, ORIG_FUNC, LIFECYLE_METHODS }
-} = require('../../../core/hapi');
-const stackFactory = require('../../../core/stacktrace').singleton;
-const { AsyncStorage, KEYS } = require('../../../core/async-storage');
-const semver = require('semver');
-const { funcInfo } = require('@contrast/fn-inspect');
-const { PATCH_TYPES } = require('../../../constants');
-
-class HapiXssSink {
-  constructor(agent) {
-    this.common = require('../../sinks/common')(agent);
-    this.rules = get(policy, 'rules');
-    this.ruleId = 'reflected-xss';
-    this.signature = new Signature({
-      moduleName: 'h',
-      methodName: 'response',
-      isModule: true
-    });
-
-    this.instrumentToolkit();
-    this.registerRouteHandler();
-    this.registerXssHandler();
-  }
-
-  /**
-   * checks if an assess rule is enabled in policy
-   */
-  get enabled() {
-    return get(this.rules, `${this.ruleId}.enabled`);
-  }
-
-  /**
-   * Adds a listeners for when `router.add` is called to get access to the
-   * route handler, to save that function reference to report a more accurate
-   * stack trace for xss
-   */
-  registerRouteHandler() {
-    /**
-     * @param {Route} route hapi route
-     */
-    agentEmitter.on(EVENTS.HAPI_ADD_ROUTE, (route) => {
-      const { handler } = route.settings;
-      Object.defineProperty(route.settings.handler, ORIG_FUNC, {
-        value: handler
-      });
-    });
-  }
-
-  /**
-   * Implements a koa `onRoute` hook to wrap the handler
-   * if it is a promise
-   */
-  instrumentToolkit() {
-    moduleHook.resolve(
-      { name: 'hapi', file: 'lib/toolkit' },
-      this.registerExecuteHandler.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@hapi/hapi', file: 'lib/toolkit' },
-      this.registerExecuteHandler.bind(this)
-    );
-  }
-
-  /**
-   * Sets both the route handler and stack
-   * in AsyncStorage
-   *
-   * @param {Toolkit} Toolkit module
-   * @param {Object} pkg meta for hapi
-   */
-  registerExecuteHandler(Toolkit, meta) {
-    // Hapi 19 exports this on Manager now
-    if (semver.gte(meta.version, '19.0.0')) {
-      Toolkit = Toolkit.Manager;
-    }
-
-    patcher.patch(Toolkit.prototype, 'execute', {
-      name: 'hapi.toolkit.execute',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      pre(data) {
-        let handler = data.args[0];
-
-        if (!LIFECYLE_METHODS.includes(handler.name)) {
-          // if route coverage is enabled we put the original function
-          // on the wrap in a Symbol, use that if it exists
-          handler = handler[ORIG_FUNC] || handler;
-          const topFrame = funcInfo(handler);
-          const stacktrace = stackFactory.createSnapshot({
-            constructorOpt: data.hooked,
-            prependFrames: [topFrame]
-          });
-          AsyncStorage.set(KEYS.HAPI_CALLER, { handler, stack: stacktrace });
-        }
-      }
-    });
-  }
-
-  hasViewEngineSource(source) {
-    if (typeof source === 'object' && source.manager && source.context) {
-      return true;
-    }
-
-    return false;
-  }
-
-  /**
-   * Checks the response in a `onPreResponse` hook for xss vulns
-   */
-  registerXssHandler() {
-    /**
-     * @param {Request} request Hapi request object
-     */
-    agentEmitter.on(EVENTS.HAPI_PRE_RES, (request) => {
-      if (!this.enabled) {
-        return;
-      }
-      const { ruleId, signature } = this;
-      const {
-        response: { source }
-      } = request;
-      const {
-        report,
-        isVulnerable,
-        xss: { disallowedTags },
-        requiredTags
-      } = this.common;
-
-      const input = this.hasViewEngineSource(source) ? source.context : source;
-
-      if (
-        isVulnerable({
-          input,
-          disallowedTags,
-          requiredTags,
-          searchDepth: typeof input === 'string' ? 0 : Infinity,
-          ruleId
-        })
-      ) {
-        const { handler, stack: stacktrace } = AsyncStorage.get(
-          KEYS.HAPI_CALLER
-        );
-        const ctxt = CallContext.create({
-          obj: handler,
-          args: [source],
-          result: source,
-          stacktrace
-        });
-
-        report({ ruleId, signature, input: source, ctxt });
-      }
-    });
-  }
-}
-
-module.exports = HapiXssSink;

package/lib/assess/hapi/sources.js

@@ -1,37 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const agentEmitter = require('../../agent-emitter');
-const {
-  constants: { EVENTS }
-} = require('../../core/hapi');
-const { emitWatchableObjects } = require('../../hooks/frameworks/common');
-
-class HapiAssessSources {
-  constructor() {
-    this.registerSourcesHandler();
-  }
-
-  /**
-   * Handles emitting of all assess source events
-   */
-  registerSourcesHandler() {
-    agentEmitter.on(EVENTS.HAPI_POST_AUTH, ({ request }) => {
-      emitWatchableObjects(request);
-    });
-  }
-}
-
-module.exports = HapiAssessSources;