@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/reporter/messaging-router.js

@@ -1,116 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const messages = require('./messages/speedracer');
-
-/**
- * While directly connecting to teamserver is no longer supported, the design
- * allows the reporter to connect to different services while maintaining
- * a consistent API through use of sendMessage().
- *
- * Using the agent's configuration, this class will build out a collection of
- * messages. Each message will be knowledgable enough to be able to connect
- * to the underlying service - now Speedracer only. A messages contract is
- * simple - it has a send() method that returns a promise. The promise resolves
- * to AgentSettings:
- *  {
- *    applicationSettings,
- *    serverFeatures
- *  }
- */
-class MessagingRouter {
-  constructor({ agent, reporter, logger }) {
-    this.logger = logger('contrast:reporter:messaging-router');
-    this.reporter = reporter;
-    this.agent = agent;
-    this.messages = Object.assign({}, messages);
-    this.messageArgs = { agent, reporter, logger };
-    this.messageFinder = messageFinder(this);
-  }
-
-  /**
-   * Resolves the appropriate message by type and sends the message. It will
-   * return the promise returned by <code>message.send</code>.
-   * @param {String} type The message type
-   * @param {Object} data The agent domain model
-   * @returns {Promise}
-   */
-  route(type, data) {
-    const Message = this.getMessageByType(type);
-
-    // new Message(...).send(data) returns a promise which can reject. this is being
-    // called (at least sometimes) by ts-reporter#sendMessage() which is called by
-    // ts-reporter#sendActivityMessage(), called by ts-reporter:493 (emitter.on('activity'))
-    // with no checks for reject anywhere in that call sequence.
-    return !Message
-      ? Promise.resolve({})
-      : new Message(this.messageArgs).send(data);
-  }
-
-  /**
-   * Given message type, will return the appropriate message constructor.
-   * @param {String} type The type of message
-   * @returns {Function}
-   */
-  getMessageByType(type) {
-    return this.messageFinder(type);
-  }
-
-  /**
-   * Factory function that will build out the router's collection of messages
-   * based on the agent's configuration. For example, if the configuration
-   * contains a service configuration section, supported Speedracer messsages
-   * will be used instead of the default Teamserver web service messages that
-   * communicate to TS directly via HTTP.
-   * @param {Agent} agent An agent instance
-   * @param {Logger} logger A logger instance
-   * @param {TSReporter} reporter A reporter instance
-   * @Returns {MessagingRouter}
-   */
-  static create({ agent, logger, reporter }) {
-    const router = new MessagingRouter({ agent, logger, reporter });
-
-    if (reporter.speedracer) {
-      Object.keys(messages).forEach((messageType) => {
-        router.messages[messageType] = messages[messageType];
-      });
-    }
-
-    return router;
-  }
-}
-
-/**
- * Returns a function that will return the message constructor matching the
- * given type.
- * @param {MessagingRouter} router The router from which to obtain messages
- * @returns {Function}
- */
-const messageFinder = (router) => {
-  const lookups = {
-    appupdate: 'ApplicationUpdateMessage',
-    startup: 'StartupMessage',
-    appcreate: 'ApplicationCreateMessage',
-    activity: 'ActivityMessage',
-    poll: 'PollMessage',
-    observedRoute: 'ObservedRouteMessage',
-    request: 'RequestMessage'
-  };
-
-  return (type) => (type in lookups ? router.messages[lookups[type]] : null);
-};
-
-module.exports = MessagingRouter;

package/lib/reporter/models/app-activity/app-activity.js

@@ -1,43 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-const Defend = require('./defend.js');
-const Inventory = require('./inventory.js');
-
-/**
- * Model for AppActivity messages sent to TeamServer
- */
-class AppActivity {
-  constructor() {
-    this.defend = new Defend();
-    this.inventory = new Inventory();
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      inventory: this.inventory.toSerializable(),
-      defend: this.defend.toSerializable()
-    };
-  }
-}
-
-module.exports = AppActivity;

package/lib/reporter/models/app-activity/attacker-activity.js

@@ -1,77 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-const ProtectionRuleActivity = require('./protection-rule-activity.js');
-const RuleEvents = require('./rule-events.js');
-
-/**
- * Activity reported for a specific attacker
- */
-class AttackerActivity {
-  constructor(source) {
-    /**
-     * @type {Source}
-     */
-    this.source = source;
-    /**
-     * @type {Object.<string,ProtectionRuleActivity>}
-     */
-    this.protectionRules = {};
-    /**
-     */
-    this.virtualPatches = {};
-  }
-
-  /**
-   * Add sample to the correct rule, with the correct status
-   * @param {Object} data .ruleId, .status, .sample
-   */
-  addData(data) {
-    // FIXME
-    let activity;
-    this.protectionRules[data.ruleId] = activity =
-      this.protectionRules[data.ruleId] || new ProtectionRuleActivity();
-
-    activity[data.status] = activity[data.status] || new RuleEvents();
-
-    this.protectionRules[data.ruleId][data.status].addAttack(data.sample);
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      source: this.source.toSerializable(),
-      protectionRules: makeEachSerializable(this.protectionRules),
-      virtualPatches: this.virtualPatches // TODO serialize
-    };
-  }
-}
-
-function makeEachSerializable(map) {
-  const serializable = {};
-  Object.entries(map).forEach(([key, value]) => {
-    serializable[key] = value.toSerializable(); // from ProtectionRuleActivity
-  });
-
-  return serializable;
-}
-
-module.exports = AttackerActivity;

package/lib/reporter/models/app-activity/defend.js

@@ -1,94 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-const Source = require('./source.js');
-const AttackerActivity = require('./attacker-activity.js');
-
-/** Holds defend data for AppActivity messages */
-class Defend {
-  constructor(settings) {
-    settings = settings || {};
-
-    /**
-     * @type {Object}
-     * Holds counts of attack events by status.
-     */
-    this.attackCounts = {
-      blocked: 0,
-      blockedAtPerimeter: 0,
-      exploited: 0,
-      ineffective: 0
-    };
-
-    /**
-     * @type {Array.AttackerActivity}
-     * XXX maybe could this be a Map to prevent logic in addAttack?
-     */
-    this.attackers = [];
-  }
-
-  /**
-   * Adds an attack finding to the collection. If an attacker is found
-   * Who's source info matches the finding, the finding will be appended
-   * to that attacker's data set.
-   * @param   {Object} data
-   * @param   {String} data.ruleId
-   * @param   {Sample} data.sample
-   * @param   {String} data.status
-   * @returns {}
-   */
-  addAttack(finding) {
-    this.attackCounts[finding.status] += 1;
-    const source = new Source(finding.sample.request);
-    const knownAttacker = this.attackers.some((attackerActivity) => {
-      if (source.equals(attackerActivity.source)) {
-        attackerActivity.addData(finding);
-        return true;
-      }
-      return false;
-    });
-
-    if (!knownAttacker) {
-      const attackerActivity = new AttackerActivity(source);
-      attackerActivity.addData(finding);
-      this.attackers.push(attackerActivity);
-    }
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      attackers: this.attackers.map((attacker) => attacker.toSerializable())
-    };
-  }
-
-  /**
-   * Look in the list of attackers and return the source of the attacker
-   * if it matches the provided source. Otherwise return ~null~.
-   * @param {AttackerActivity[]} attackers Attackers to search
-   * @param {Source}             source    Source to use for comparison
-   */
-  static findSource(attackers, source) {
-    return attackers.find((a) => a.source.equals(source)) || null;
-  }
-}
-
-module.exports = Defend;

package/lib/reporter/models/app-activity/inventory.js

@@ -1,73 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module lib/reporter/models/AppActivity/Inventory
- */
-
-'use strict';
-
-/**
- * Holds inventory data for AppActivity messages
- * @prop browsers
- * @prop techs
- * @prop queries
- */
-class Inventory {
-  constructor() {
-    this.browsers = new Set();
-    this.techs = new Set();
-    this.queries = 0;
-  }
-
-  /**
-   * Adds data to internal collections. Dispatches to the appropriate
-   * method based on data attributes.
-   */
-  addData(data = {}) {
-    if (data.techs) {
-      this.addTech(data.techs);
-    }
-    if (data.browsers) {
-      this.addBrowser(data.browsers);
-    }
-  }
-
-  /**
-   * Adds tech to internal collection.
-   */
-  addTech(tech) {
-    this.techs.add(tech);
-  }
-
-  /**
-   * Adds browsers to internal collection.
-   */
-  addBrowser(browser) {
-    this.browsers.add(browser);
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      browsers: Array.from(this.browsers),
-      technologies: Array.from(this.techs),
-      queriesMonitored: this.queries
-    };
-  }
-}
-
-module.exports = Inventory;

package/lib/reporter/models/app-activity/protection-rule-activity.js

@@ -1,68 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-/**
- * ProtectionRuleActivity
- */
-class ProtectionRuleActivity {
-  constructor() {
-    /**
-     * @type {number}
-     */
-    this.startTime = Date.now();
-    /**
-     * @type {RuleEvents}
-     */
-    this.ineffective = undefined;
-    /**
-     * @type {RuleEvents}
-     */
-    this.blocked = undefined;
-    /**
-     * @type {RuleEvents}
-     */
-    this.exploited = undefined;
-    /**
-     * @type {RuleEvents}
-     */
-    this.blockedAtPerimeter = undefined;
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      startTime: this.startTime,
-      ineffective: undefinedOrToSerializable(this.ineffective),
-      blocked: undefinedOrToSerializable(this.blocked),
-      exploited: undefinedOrToSerializable(this.exploited),
-      blockedAtPerimeter: undefinedOrToSerializable(this.blockedAtPerimeter)
-    };
-  }
-}
-
-function undefinedOrToSerializable(ruleEvents) {
-  if (ruleEvents) {
-    return ruleEvents.toSerializable();
-  }
-  return undefined;
-}
-
-module.exports = ProtectionRuleActivity;

package/lib/reporter/models/app-activity/rule-events.js

@@ -1,55 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-/**
- * Holds samples for specific rules
- */
-class RuleEvents {
-  constructor() {
-    this.attackTimeMap = {};
-    this.startTime = Date.now();
-    this.total = 0;
-    this.samples = [];
-  }
-
-  addAttack(sample) {
-    this.total++;
-    const currentSecond = Math.floor((this.startTime - Date.now()) / 1000);
-    let attacksThisSecond = this.attackTimeMap[currentSecond] || 0;
-    this.attackTimeMap[currentSecond] = ++attacksThisSecond;
-
-    this.samples.push(sample);
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      attackTimeMap: this.attackTimeMap,
-      startTime: this.startTime,
-      total: this.total,
-      samples: this.samples.map(function(sample) {
-        return sample.toSerializable();
-      })
-    };
-  }
-}
-
-module.exports = RuleEvents;

package/lib/reporter/models/app-activity/sample.js

@@ -1,139 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const common = require('../../../protect/rules/common');
-const { ATTACK_STATUS } = common;
-
-/**
- * Sample
- */
-class Sample {
-  /**
-   * @param {UserInput} input
-   * @param {ApplicationContext} appContext
-   * @param {Object} [assessment] Result of rule evaluation
-   */
-  constructor(input, appContext, assessment) {
-    if (appContext && appContext.setStack) {
-      appContext.setStack();
-    }
-    this.appContexts = [appContext];
-    this.confirmedAttack = false;
-    this.effective = false;
-    this.blocked = false;
-    this.filters = [];
-    this.details = null;
-    this.input = input;
-    this.request = appContext.request;
-
-    // extra info for processing at sink time.
-    // NOT TO BE INCLUDED IN ACTUAL DTM AT REPORTING TIME.
-    // This is particularly useful when using the agent lib for processing
-    // mongo expansion and injection.
-    this._inputInfoForSink = {};
-
-    this.assessment = assessment;
-
-    if (assessment) {
-      if (assessment.results && assessment.results.importance === 'DEFINITE') {
-        this.confirmedAttack = true;
-      }
-
-      if (assessment.patterns) this.filters.push(...assessment.patterns.ids);
-      if (assessment.keywords) this.filters.push(...assessment.keywords.ids);
-      if (assessment.searchers) this.filters.push(...assessment.searchers.ids);
-    }
-
-    this.timestamp = {
-      start: Date.now(),
-      // FIX ********************
-      elapsed: 5000 // **********
-    };
-  }
-
-  /**
-   * Returns the status of the sample based on whether the input
-   * was effective ( attack vs probe ), and whether it was blocked.
-   * Values: ineffective, blocked_at_perimeter, blocked, exploited.
-   * @returns {String}
-   */
-  getStatus() {
-    if (this.blocked) {
-      return this.effective
-        ? ATTACK_STATUS.BLOCKED
-        : ATTACK_STATUS.BLOCKED_AT_PERIMETER;
-    } else {
-      return this.effective
-        ? ATTACK_STATUS.EXPLOITED
-        : ATTACK_STATUS.INEFFECTIVE;
-    }
-  }
-
-  /**
-   * Appends an ApplicationContext (or list of) to the sample's set.
-   * @param {AppplicationContext} appContext Context(s)
-   */
-  captureAppContext(appContext) {
-    if (appContext && appContext.setStack) {
-      appContext.setStack(); // NODE-550: sink events lacked stack
-    }
-    this.appContexts = [].concat(this.appContexts, appContext);
-  }
-
-  toSerializable() {
-    const appContext = extractAppContext(this);
-    const stack = (appContext.stack || []).map((item) => ({
-      declaringClass: item.type || '',
-      fileName: item.file,
-      lineNumber: item.lineNumber,
-      methodName: item.method || '<anonymous>'
-    }));
-
-    const data = {
-      timestamp: this.timestamp,
-      request: this.request ? this.request.toSerializable() : {},
-      details: this.details,
-      stack,
-      blocked: this.blocked,
-      input: this.input
-        ? {
-            ...this.input.toSerializable(),
-            applicable: this.applicable,
-            confirmedAttack: this.confirmedAttack,
-            effective: this.effective,
-            filters: this.filters
-          }
-        : null
-    };
-
-    return data;
-  }
-}
-
-/**
- * Extract the appropriate context from the sample to use for reporting.
- * Samples that are effective should have captured additional ApplicationContext
- * during sink evaluations - get the latter of these for effective attacks.
- * @param {Sample} sample
- * @returns {ApplicationContext}
- */
-function extractAppContext(sample) {
-  return !sample.effective || sample.appContexts.length === 1
-    ? sample.appContexts[0]
-    : sample.appContexts[1];
-}
-
-module.exports = Sample;