@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/core/logger/umbrella-logger.js

@@ -1,163 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { writeFileSync } = require('fs');
-const logger = require('../logger')('contrast:tsReporter:umbrella');
-
-/**
- *
- * It would be really painful to produce these tests by hand, so we want to spit out
- * at least the basics automatically and then go through and verify by hand to make sure
- * that stuff like line numbers is correct.
- *
- * The test spec is defined at https://bitbucket.org/contrastsecurity/umbrella-acceptance-tests/src/master/DESIGN.md
- *
- */
-
-// not all rules will be captured in SAST, so missing IAST rules arent worth recording
-const ruleExclusions = [
-  'csp-header-missing',
-  'hsts-header-missing',
-  'clickjacking-control-missing',
-  'xxssprotection-header-disabled',
-  'xcontenttype-header-missing',
-  'autocomplete-missing'
-];
-
-class UmbrellaLogger {
-  constructor(agent) {
-    this.model = {
-      name: `${agent.config.application.name}`,
-      language: 'node',
-      version: `${process.version}`,
-      findings: []
-    };
-  }
-
-  static formatEvent(event) {
-    const formatted = {
-      // the stack is being left completely intact in this case because
-      // the java model is insufficient
-      stack: event.stack,
-      signature: event.signature
-    };
-
-    // for static rules
-    if (event.action === 'CREATION') formatted.type = 'source';
-    else if (event.action === 'TRIGGER') formatted.type = 'sink';
-    else formatted.type = event.action.toLowerCase();
-
-    return formatted;
-  }
-
-  /**
-   * format a finding as per the shared test spec
-   * https://bitbucket.org/contrastsecurity/umbrella-acceptance-tests/src/master/DESIGN.md
-   * @param   {Finding} finding rule finding
-   * @returns {Object}          formatted finding as per the spec
-   */
-  static formatFinding(finding) {
-    /*
-      spec:
-      "route": {
-        "url": "/header-multipart"
-      },
-      "ruleId": "path-traversal",
-      "events": {
-        "type": "source",
-        "signature": {
-          "class": "org.apache.catalina.core.ApplicationPart",
-          "method": "getHeader",
-          "arguments": ["java.lang.String"],
-          "constructor": false
-        },
-        "stack": [
-          {
-            "file": "SomeSourceFile.java",
-            "lineNumber": 54
-          },
-          {
-            "file": "SomeOtherSourceFile.java",
-            "lineNumber": 140
-          }
-        ]
-      },+*/
-    const formatted = {
-      hash: finding.hash,
-      ruleId: finding.ruleId,
-      events: finding.events.map((e) => UmbrellaLogger.formatEvent(e))
-    };
-
-    if (finding.routes[0]) {
-      // get the actual path to the route
-      formatted.route = finding.routes[0].signature.split('"')[1];
-    }
-
-    // handle static rules
-    // static rules are not really described in the spec, so this is just
-    // getting them into the best possible case for fitting
-    if (formatted.events.length === 0) {
-      formatted.events = [
-        {
-          type: 'source',
-          stack: [
-            {
-              file: finding.properties.source,
-              lineNumber: finding.properties.lineNumber
-            }
-          ],
-          signature: finding.signature
-        }
-      ];
-    }
-
-    return formatted;
-  }
-
-  /**
-   * write the umbrella structure to disk
-   */
-  static write(model) {
-    writeFileSync(
-      `${process.cwd()}/umbrella_log.json`,
-      JSON.stringify(model, null, 2)
-    );
-  }
-
-  /**
-   * record a given node finding into the interanal structure
-   * @param {Finding} finding the generated finding
-   */
-  log(finding) {
-    try {
-      // don't record rules SAST doesn't use
-      if (!ruleExclusions.includes(finding.ruleId)) {
-        // de-dupe findings
-        if (!this.model.findings.some((f) => f.hash === finding.hash)) {
-          this.model.findings.push(UmbrellaLogger.formatFinding(finding));
-
-          // overwrites the file every time a finding is found
-          UmbrellaLogger.write(this.model);
-        }
-      }
-    } catch (e) {
-      logger.error(`${e}`);
-    }
-  }
-}
-
-module.exports = UmbrellaLogger;
-module.exports.ruleExclusions = ruleExclusions;

package/lib/core/loopback4/index.js

@@ -1,173 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const agentEmitter = require('../../agent-emitter');
-const { isString } = require('../../util/is-string');
-const moduleHook = require('../../hooks/require');
-const patcher = require('../../hooks/patcher');
-const Scopes = require('../async-storage/scopes');
-const { PATCH_TYPES } = require('../../constants');
-
-// https://github.com/strongloop/loopback-next/blob/master/packages/openapi-v3/src/decorators/request-body.decorator.ts#L14
-const REQUEST_BODY_INDEX = 'x-parameter-index';
-
-const constants = {
-  EVENTS: {
-    SEND: {
-      POST: 'loopback4 response send post'
-    },
-    SOURCES: {
-      BODY: 'loopback4 body source',
-      PARAMS: 'loopback4 param source'
-    }
-  }
-};
-
-class Loopback4Core {
-  constructor() {
-    this.instrumentLoopback4();
-  }
-
-  instrumentLoopback4() {
-    moduleHook.resolve(
-      { name: '@loopback/rest', file: 'dist/rest.server.js' },
-      this.patchRestServer.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@loopback/rest', file: 'dist/parser.js' },
-      this.patchRestParser.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@loopback/metadata', file: 'dist/decorator-factory.js' },
-      this.patchDecoratorFactory.bind(this)
-    );
-    moduleHook.resolve({ name: 'http' }, this.patchServerResponse.bind(this));
-  }
-
-  patchRestServer(xport) {
-    // the updateSpecFromRequest function mixes-in some data from the request
-    // (namely the hostname) in to the in-memory openapi spec document
-    // this then gets stringified and JSON.parse'ed again.  The resulting
-    // JSON.parse causes the object to get wrapped in a deserialization membrane
-    // b/c it contains tracked data.  This causes *every* property access
-    // to generate a CallContext etc, which causes the loading of the explorer
-    // page with our test app to take > 30 seconds.
-    //
-    // Since this is just a JSON file getting returned it can't cause an XSS
-    // anyways, so just run this method in no-instrumentation scope so the
-    // updated spec object does not become tainted.
-    patcher.patch(xport.RestServer.prototype, 'updateSpecFromRequest', {
-      scope: Scopes.SCOPE_NAMES.NO_PROPAGATION,
-      patchType: PATCH_TYPES.FRAMEWORK,
-      name: '@loopback/rest/rest.server.updateSpecFromRequest'
-    });
-  }
-
-  patchDecoratorFactory(xport) {
-    // loopback uses the following decorator pattern for declaring
-    // route handlers: @operation(method, '/safe', spec)
-    //
-    // where spec is an object that contains data about how to handle
-    // the request.  The implementation of this decorator does a
-    // deep clone of the object by default, however the check
-    // for whether the object can be cloned breaks with our Object
-    // injection.  See NODE-1211 for more details.  Not performing
-    // this deep-copy causes data to bleed between routes, causing
-    // strange and difficult to debug behavior.
-    //
-    // This adds the *original* Object to the array of deep-cloneable
-    // types (in this context we have the original Object b/c we
-    // don't rewrite our own agent code).
-    xport.DecoratorFactory._cloneableTypes.push(Object);
-  }
-
-  patchServerResponse(xport) {
-    patcher.patch(xport.ServerResponse.prototype, 'end', {
-      scope: Scopes.SCOPE_NAMES.ALWAYS_RUN,
-      patchType: PATCH_TYPES.FRAMEWORK,
-      name: 'http.ServerResponse.end - loopback',
-      post(data) {
-        if (data.args.length < 1) {
-          return;
-        }
-        const body = data.args[0];
-        if (isString(body)) {
-          agentEmitter.emit(constants.EVENTS.SEND.POST, body);
-        }
-      }
-    });
-  }
-
-  patchRestParser(xport) {
-    patcher.patch(xport, 'parseOperationArgs', {
-      patchType: PATCH_TYPES.ASSESS_SOURCE,
-      name: 'loopback4 parseOperationArgs',
-      post(data) {
-        // wrap input arguments in an object to
-        // simulate them being keys on a request object.
-        // accessing inputs as properties on a request are fundamental
-        // to how both assess and protect work - so this just fakes it.
-        const fakeReq = {};
-        fakeReq.params = {};
-        data.result.then((result) => {
-          const route = data.args[1];
-          const { spec } = route;
-          if (!spec || !spec.parameters) {
-            return;
-          }
-          let requestBodyIndex = 0;
-          if (spec.requestBody) {
-            if (spec.requestBody[REQUEST_BODY_INDEX]) {
-              requestBodyIndex = Math.min(
-                spec.requestBody[REQUEST_BODY_INDEX],
-                result.length - 1
-              );
-            }
-            fakeReq.body = result[requestBodyIndex];
-            agentEmitter.emit(constants.EVENTS.SOURCES.BODY, fakeReq);
-            result[requestBodyIndex] = Loopback4Core.getTracked(
-              fakeReq,
-              'body'
-            );
-          }
-          spec.parameters.forEach((paramSpec, index) => {
-            switch (paramSpec.in) {
-              case 'path': {
-                if (spec.requestBody && index >= requestBodyIndex) {
-                  index += 1;
-                }
-                fakeReq.params[paramSpec.name] = result[index];
-                agentEmitter.emit(constants.EVENTS.SOURCES.PARAMS, fakeReq);
-                result[index] = Loopback4Core.getTracked(
-                  fakeReq.params,
-                  paramSpec.name
-                );
-                break;
-              }
-            }
-          });
-        });
-      }
-    });
-  }
-
-  static getTracked(obj, prop) {
-    return Scopes.runInAllowAllScope(() => obj[prop]);
-  }
-}
-
-module.exports = Loopback4Core;
-module.exports.constants = constants;

package/lib/core/metrics/index.js

@@ -1,150 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const logger = require('../logger');
-
-/**
- * Report debugging and instrumentation metrics
- */
-class Metrics {
-  constructor() {
-    this.config = null;
-    this.enabled = false;
-  }
-
-  /**
-   * Configure and enable metrics configuration
-   *
-   * @param config agent configuration
-   */
-  configure(config) {
-    if (!config || !config.agent.node.dev.metrics) {
-      return;
-    }
-    this.enabled = true;
-    this.client = require('prom-client');
-    this.client.collectDefaultMetrics({
-      eventLoopMonitoringPrecision: 1
-    });
-    const fs = require('fs');
-    this.hist = {};
-    this.logger = logger('contrast:metrics');
-    setInterval(() => {
-      fs.writeFile(
-        './metrics.txt',
-        this.client.register.metrics(),
-        { flag: 'w' },
-        (err) => {
-          if (err) {
-            this.logger.debug(`failed to write to ./metrics.txt: ${err}`);
-          }
-        }
-      );
-    }, 5000).unref();
-  }
-
-  /**
-   * Record a value in a histogram (creates it if it doesn't exist)
-   *
-   * @param key the name of the histogram
-   * @param help the help text for the histogram
-   * @param value the value to record
-   */
-  histogramRecord(key, help, value) {
-    if (!this.enabled) {
-      return;
-    }
-    if (!this.hist[key]) {
-      this.hist[key] = new this.client.Histogram({
-        name: key,
-        help,
-        buckets: [2, 5, 10, 20, 40]
-      });
-    }
-    this.hist[key].observe(value);
-  }
-
-  /**
-   * Add the time it took to send a speedracer message to the corresponding histogram
-   *
-   * @param msgType the type of speedracer message
-   * @param time the time it took in milliseconds
-   */
-  recordMessageTime(msgType, time) {
-    this.histogramRecord(
-      `speedracer_${msgType}_latency`,
-      `end to end time spent handling a speedracer ${msgType} message`,
-      time
-    );
-  }
-
-  /**
-   * Add the time it took to serialize a speedracer message to the corresponding histogram
-   *
-   * @param msgType the type of speedracer message
-   * @param time the time it took in milliseconds
-   */
-  recordSerializeTime(msgType, time) {
-    this.histogramRecord(
-      `speedracer_${msgType}_serialize_latency`,
-      `time spent serializing a speedracer ${msgType} message`,
-      time
-    );
-  }
-
-  /**
-   * Add the time it took to deserialize a speedracer message to the corresponding histogram
-   *
-   * @param msgType the type of speedracer message
-   * @param time the time it took in milliseconds
-   */
-  recordDeserializeTime(msgType, time) {
-    this.histogramRecord(
-      `speedracer_${msgType}_deserialize_latency`,
-      `time spent deserializing a speedracer ${msgType} message`,
-      time
-    );
-  }
-
-  /**
-   * Add the time it took to connect to speedracer to the histogram
-   *
-   * @param time the time it took in milliseconds
-   */
-  recordConnectTime(time) {
-    this.histogramRecord(
-      'speedracer_connect',
-      'time from calling connect to callback',
-      time
-    );
-  }
-
-  /**
-   * Add the time it took from calling write to the write being successful to the histogram
-   *
-   * @param time the time it took in milliseconds
-   */
-  recordWriteTime(time) {
-    this.histogramRecord(
-      'speedracer_write',
-      'time from calling write to callback',
-      time
-    );
-  }
-}
-
-const metrics = new Metrics();
-module.exports = metrics;

package/lib/core/restify/index.js

@@ -1,147 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const moduleHook = require('../../hooks/require');
-const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
-const agentEmitter = require('../../agent-emitter');
-const utils = require('./utils');
-
-const constants = {
-  LIFECYCLE_METHODS: [
-    'onRequest',
-    'onPreAuth',
-    'onPostAuth',
-    'onPreHandler',
-    'onPostHandler',
-    'onPreResponse'
-  ],
-  RESTIFY_SEMVER_RANGE: '>=8.0.0 <9.0.0',
-  EVENTS: {
-    RESTIFY_EXPORT: 'restify-export', // used to patch methods on the restify framework
-    RESPONSE: 'restify-response-export', // used to patch methods on the restify/lib/response.js export
-    CREATE_SERVER: 'restify-create-server', // use to patch methods on a given restify instance
-    SEND: {
-      PRE: 'restify-response-send-pre', // used to handle response.__send before the actual method gets called
-      POST: 'restify-response-send-post' // used to handle response.__send after the actual method gets called
-    }
-  }
-};
-
-class RestifyCore {
-  /**
-   * @param {Boolean} [instrument=true] used for testing only
-   */
-  constructor(instrument = true) {
-    if (instrument) {
-      this.instrumentRestify();
-      this.instrumentRestifyResponse();
-    }
-  }
-
-  /**
-   * Sets up handler to patch createServer when restify is required
-   */
-  instrumentRestify() {
-    moduleHook.resolve(
-      { name: 'restify', version: constants.RESTIFY_SEMVER_RANGE },
-      this.registerServerHandler.bind(this)
-    );
-  }
-
-  /**
-   * Patches `createServer` for other instrumentation to patch methods
-   * on a restify instance, and emits `RESTIFY_EXPORT` so other instrumentation
-   * can patch methods no the restify export
-   *
-   * @param {Object} restify restify export
-   */
-  registerServerHandler(restify) {
-    agentEmitter.emit(constants.EVENTS.RESTIFY_EXPORT, restify);
-    patcher.patch(restify, 'createServer', {
-      name: 'restify',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      post(data) {
-        const server = data.result;
-        agentEmitter.emit(constants.EVENTS.CREATE_SERVER, server);
-      }
-    });
-  }
-
-  /**
-   * Sets up handler to patch Response in restify
-   */
-  instrumentRestifyResponse() {
-    moduleHook.resolve(
-      {
-        name: 'restify',
-        file: 'lib/response.js',
-        version: constants.RESTIFY_SEMVER_RANGE
-      },
-      this.registerResponseHandler.bind(this)
-    );
-  }
-
-  /**
-   * Wraps the patch method in `restify/lib/response`
-   * to properly patch `Response`
-   *
-   * @param {Function} xport patch method in lib/response
-   * @return {Function} returns a wrapped function so we can properly
-   * get access to the `Response`
-   */
-  registerResponseHandler(xport) {
-    const self = this;
-
-    /**
-     * This is done because restify decorates the response with
-     * some of its own methods
-     * @param {ServerResponse}
-     * @return {Function}
-     */
-    return function contrastPatch(...patchArgs) {
-      const [Response] = patchArgs;
-      const result = Reflect.apply(xport, null, patchArgs);
-      self.registerSendHandler(Response);
-      agentEmitter.emit(constants.EVENTS.RESPONSE, Response);
-      return result;
-    };
-  }
-
-  /**
-   * Patches __send to emit pre/post events for assess and protect
-   * instrumentation
-   *
-   * @param {ServerResponse} Response restify's patched `Response`
-   */
-  registerSendHandler(Response) {
-    patcher.patch(Response.prototype, '__send', {
-      name: 'Response.prototype',
-      patchType: PATCH_TYPES.SINK,
-      alwaysRun: true,
-      pre(data) {
-        agentEmitter.emit(constants.EVENTS.SEND.PRE, data);
-      },
-      post(data) {
-        agentEmitter.emit(constants.EVENTS.SEND.POST, data);
-      }
-    });
-  }
-}
-
-module.exports = RestifyCore;
-module.exports.constants = constants;
-module.exports.utils = utils;