@contrast/agent 4.32.0 → 5.0.0-alpha.2

package/lib/feature-set.js

@@ -1,297 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * @module lib/FeatureSet
- */
-
-const _ = require('lodash');
-
-const logger = require('./core/logger');
-const {
-  PROTECTION_MODES,
-  RULES,
-  PROTECT_RULE_SUPPORTED_MODES
-} = require('./constants');
-
-const OFF = 'OFF';
-
-/**
- * Provides an API for querying feature and policy data. Data sources are the
- * agent's configuration data and TS settings. Rules of precedence are accounted
- * for when returning feature/policy information.
- */
-class FeatureSet {
-  constructor(config = {}) {
-    this._subscribers = [];
-    this._logger = null;
-    this.config = config;
-    this.applicationSettings = {};
-    this.serverFeatures = {};
-  }
-
-  get logger() {
-    if (!this._logger) {
-      try {
-        this._logger = logger('contrast:feature-set');
-      } catch (err) {
-        // in case logger is not yet initialized, we can swallow this
-      }
-    }
-
-    return this._logger;
-  }
-
-  /**
-   * Update current application settings with new settings.
-   * @param {Object} applicationSettings
-   */
-  updateApplicationSettings(applicationSettings) {
-    if (applicationSettings) {
-      if (applicationSettings.sessionId === '') {
-        applicationSettings.sessionId = this.applicationSettings.sessionId;
-      }
-      _.merge(this.applicationSettings, applicationSettings);
-      this.publishApplicationSettings(applicationSettings);
-    }
-  }
-
-  /**
-   * Update current server features with new settings.
-   * @param {Object} serverFeatures
-   */
-  updateServerFeatures(serverFeatures) {
-    if (serverFeatures) {
-      _.merge(this.serverFeatures, serverFeatures);
-      this.publishServerFeatures(serverFeatures);
-    }
-  }
-
-  /**
-   * Publish events that provide ApplicationSettings updates.
-   */
-  publishApplicationSettings(applicationSettings) {
-    this._subscribers.forEach((subscriber) => {
-      subscriber.emit('application-settings', applicationSettings);
-    });
-  }
-
-  /**
-   * Publish events that provide ServerFeature updates.
-   */
-  publishServerFeatures(serverFeatures) {
-    const syslog = _.get(serverFeatures, 'defend.syslog');
-
-    this._subscribers.forEach((subscriber) => {
-      subscriber.emit('server-features', this.serverFeatures);
-
-      if (syslog) {
-        subscriber.emit('features.server.defend.syslog', syslog);
-      }
-    });
-  }
-
-  /**
-   * This will resolve the `mode` of the Protect rule by looking in the
-   * configuration and TS application settings. Config value will be used if
-   * present, otherwise the value from TS settings will be returned. `NO_ACTION`
-   * will be returned by default.
-   * @param {String} ruleId Rule ID for which to get mode
-   * @returns {common.PROTECTION_MODES}
-   */
-  getProtectRuleMode(ruleId) {
-    let mode = _.get(
-      this,
-      `config.protect.rules.${ruleId}.mode`,
-      ''
-    ).toUpperCase();
-    const supportedModes = _.get(PROTECT_RULE_SUPPORTED_MODES, ruleId, []);
-
-    mode = mode === OFF ? PROTECTION_MODES.NO_ACTION : PROTECTION_MODES[mode];
-    if (mode) {
-      if (supportedModes.includes(mode)) {
-        return mode;
-      } else {
-        if (this.logger) {
-          this.logger.info(`Invalid mode configuration for ${ruleId}: ${mode}`);
-        }
-        mode = '';
-      }
-    }
-    for (const ruleDef of _.get(
-      this,
-      'applicationSettings.protectionRulesList',
-      []
-    )) {
-      if (ruleDef.id === ruleId) {
-        ({ mode } = ruleDef);
-        break;
-      }
-    }
-
-    return mode || PROTECTION_MODES.NO_ACTION;
-  }
-
-  /**
-   * Returns whether the rule having the provided id has been disabled. The
-   * only way to explicitly disable a rule is via the configuration option:
-   * `protect.rules.disabled_rules: 'reflected-xss'`
-   * @param {String} ruleId Protect rule ID
-   * @returns {Boolean}
-   */
-  isProtectRuleDisabled(id) {
-    const disabledConfig = _.get(
-      this,
-      'config.protect.rules.disabled_rules',
-      ''
-    );
-
-    return disabledConfig
-      .split(',')
-      .map((c) => c.trim())
-      .some((disabledId) => id === disabledId);
-  }
-
-  /**
-   * Reads agent configuration and TS settings and returns the Protect policy
-   * for the Protect rule having the provided ID.
-   * @param {String} ruleId The rule id for which to get policy information
-   * @returns {Object}
-   */
-  /**
-   * @returns {Object}
-   */
-  getProtectRulePolicy(ruleId) {
-    if (ruleId === RULES.VIRTUAL_PATCH) {
-      return this.getVirtualPatchPolicy();
-    }
-    if (ruleId === RULES.BOT_BLOCKER) {
-      return this.getBotBlockerPolicy();
-    }
-    if (ruleId === RULES.IP_DENYLIST) {
-      return this.getIpDenylistPolicy();
-    }
-
-    const ruleConfig = _.get(this.config, `protect.rules.${ruleId}`, {});
-    const ruleSettings = _.get(
-      this,
-      'applicationSettings.protectionRulesList',
-      []
-    ).find(({ id }) => id === ruleId);
-    const mode = this.getProtectRuleMode(ruleId);
-    const enable = !!(
-      !this.isProtectRuleDisabled(ruleId) && mode !== PROTECTION_MODES.NO_ACTION
-    );
-
-    return {
-      ...(ruleSettings || {}),
-      ...ruleConfig,
-      id: ruleId,
-      mode,
-      enable
-    };
-  }
-
-  /**
-   * Reads agent configuration and TS settings and returns the Protect policy
-   * for the IP Denylist rule.
-   * @returns {Object}
-   */
-  getIpDenylistPolicy() {
-    const config = this.getProtectRuleConfig(RULES.IP_DENYLIST);
-    const settings = _.get(this, 'serverFeatures.defend.ipDenylistsList', []);
-
-    return {
-      id: RULES.IP_DENYLIST,
-      enable: !config.disable && config.mode !== OFF && settings.length > 0,
-      mode: PROTECTION_MODES.BLOCK_AT_PERIMETER,
-      data: settings
-    };
-  }
-
-  /**
-   * Reads agent configuration and TS settings and returns the Protect policy
-   * for the Virtual-Patch rules.
-   * @returns {Object}
-   */
-  getVirtualPatchPolicy() {
-    const config = this.getProtectRuleConfig(RULES.VIRTUAL_PATCH);
-    const settings = _.get(this, 'applicationSettings.virtualPatchesList', []);
-
-    return settings.map((setting) => ({
-      id: RULES.VIRTUAL_PATCH,
-      enable: !config.disable && settings.length > 0 && config.mode !== OFF,
-      mode: PROTECTION_MODES.BLOCK_AT_PERIMETER,
-      ...setting
-    }));
-  }
-
-  /**
-   * Reads agent configuration and TS settings and returns the Protect policy
-   * for the Bot-Blocker rule.
-   * @returns {Object}
-   */
-  getBotBlockerPolicy() {
-    const config = this.getProtectRuleConfig(RULES.BOT_BLOCKER);
-    const settings = {
-      enable: _.get(this, 'serverFeatures.defend.botBlocker', false),
-      data: _.get(this, 'serverFeatures.defend.botBlockersList', [])
-    };
-
-    return {
-      id: RULES.BOT_BLOCKER,
-      enable: !config.disable && config.mode !== OFF && settings.enable,
-      mode: PROTECTION_MODES.BLOCK_AT_PERIMETER,
-      data: settings.data
-    };
-  }
-
-  /**
-   * Returns the protect rules policy data from the agent's configuration.
-   * @param {String} ruleId The rule id for which to return config
-   * @returns {Object}
-   */
-  getProtectRuleConfig(ruleId) {
-    const modeConfig = String(
-      _.get(this, `config.protect.rules.${ruleId}`, '')
-    ).toUpperCase();
-
-    return {
-      mode: modeConfig,
-      disable: this.isProtectRuleDisabled(ruleId)
-    };
-  }
-
-  /**
-   * Convienience method for setting a mode for all Protect rules or for a
-   * particular Protect rule.
-   * @param {String} mode Set the rule(s) to this mode
-   * @param {String} [ruleId] Set mode only for this rule ID.
-   */
-  setProtectMode(mode, ruleId) {
-    for (const rule of _.get(
-      this,
-      'applicationSettings.protectionRulesList',
-      []
-    )) {
-      if (!ruleId || (ruleId && rule.id === ruleId)) {
-        rule.mode = mode;
-      }
-    }
-  }
-}
-
-module.exports = FeatureSet;

package/lib/generator-function.js

@@ -1,20 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * Expose the GeneratorFunction constructor.
- * For whatever reason, this isn't a global in node. If ever it is,
- * expose or else just reflect it out of a generator function manually
- */
-module.exports = global.GeneratorFunction || function*() {}.constructor;

package/lib/hooks/array.js

@@ -1,75 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const logger = require('../core/logger')('contrast:hooks:array-prototype');
-const {
-  PATCH_TYPES: { MISC }
-} = require('../constants');
-const patcher = require('./patcher');
-
-const getOrig = (v) => patcher.unwrap(v);
-
-/**
- * Apply a heuristic to gauge whether we need to unwrap arguments so results
- * of SameValueZero algorithm are preserved.
- * @param {*[]} args The arguments passed to prototype method
- * @returns {boolean}
- */
-function shouldUnwrap(args) {
-  const [valueToFind] = args;
-  return (
-    typeof valueToFind === 'function' &&
-    (valueToFind.name === 'Object' ||
-      valueToFind.name === 'String' ||
-      valueToFind.name === 'Function')
-  );
-}
-
-/**
- * Checks whether we should unwrap argument and array elements before the
- * original is called.
- * @param {object} data
- */
-function maybeUnwrapContext(data) {
-  if (shouldUnwrap(data.args)) {
-    data.args[0] = getOrig(data.args[0]);
-    let i = typeof data.args[1] === 'number' ? data.args[1] : 0;
-    for (i; i < data.obj.length; i++) {
-      data.obj[i] = getOrig(data.obj[i]);
-    }
-  }
-}
-
-module.exports = function init() {
-  logger.debug('patching Array includes and indexOf methods');
-
-  patcher.patch(Array.prototype, 'includes', {
-    name: 'Array',
-    patchType: MISC,
-    alwaysRun: true,
-    pre(data) {
-      maybeUnwrapContext(data);
-    }
-  });
-
-  patcher.patch(Array.prototype, 'indexOf', {
-    name: 'Array',
-    patchType: MISC,
-    alwaysRun: true,
-    pre(data) {
-      maybeUnwrapContext(data);
-    }
-  });
-};

package/lib/hooks/cluster.js

@@ -1,232 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const patcher = require('./patcher.js');
-const { PATCH_TYPES } = require('../constants');
-const logger = require('../core/logger')('contrast:hooks:cluster');
-const path = require('path');
-const _ = require('lodash');
-
-let workerId = 0;
-
-/**
- * Converts a map of agentArg:val entries to an argv array
- *
- * @param args map of agent args ({ arg1: val1, arg2: val2 })
- * @return array of agent args ([--arg1, val1, --arg2, val2])
- */
-function formatAgentArgs(args) {
-  const formatted = [];
-  for (const arg in args) {
-    formatted.push(`--${arg}`);
-    formatted.push(args[arg]);
-  }
-  return formatted;
-}
-
-/**
- * Initialize default cluster settings for the agent.
- *   Prepends agent arguments in the argv array
- *   Prepends the entry point script if in CLI mode
- *
- * @param agent
- */
-function initClusterSettings(agent) {
-  agent.cluster.settings = {
-    exec: agent.argv[1],
-    args: [...formatAgentArgs(agent.agentArgs), '--', ...agent.appArgs]
-  };
-  if (agent.isCli) {
-    agent.cluster.settings.args = [
-      process.argv[1],
-      ...agent.cluster.settings.args
-    ];
-  }
-}
-
-/**
- * Modify cluster settings for CLI mode
- *   If caller is setting exec preserve original exec and set new exec to args[0]
- *   If caller is setting args set args to ...agentArgs -- ...newArgs
- *
- * @param agent
- * @param settings the settings to modify
- */
-function updateSettingsCli(agent, settings) {
-  if (settings.exec && settings.args) {
-    // exec = current exec (cli.js)
-    // args = <new script>, <agent args>, --, <new app args>
-    settings.args = [
-      settings.exec,
-      ...formatAgentArgs(agent.agentArgs),
-      '--',
-      ...settings.args
-    ];
-    delete settings.exec;
-  } else if (settings.exec) {
-    // exec = current exec (cli.js)
-    // args = <new script>, <agent args>, --, <current app args>
-    settings.args = [settings.exec, ...agent.cluster.settings.args.slice(1)];
-    delete settings.exec;
-  } else if (settings.args) {
-    // exec = current exec (cli.js)
-    // args = <current script>, <agent args>, --, <new app args>
-    settings.args = [
-      agent.cluster.settings.args[0],
-      ...formatAgentArgs(agent.agentArgs),
-      '--',
-      ...settings.args
-    ];
-  }
-}
-
-/**
- * Modify cluster settings for preload mode
- *   If caller is setting execArgv prepend the preload args to new execArgv
- *   If caller is setting args set args to ...agentArgs -- ...newArgs
- *
- * @param agent
- * @param settings the settings to modify
- */
-function updateSettingsPreload(agent, settings) {
-  if (settings.args) {
-    //args = <agent args>, --, <new app args>
-    settings.args = [
-      ...formatAgentArgs(agent.agentArgs),
-      '--',
-      ...settings.args
-    ];
-  }
-
-  if (settings.execArgv) {
-    //prepend -r path to preload
-    settings.execArgv = [
-      '-r',
-      path.resolve(__dirname, '../../bootstrap.js'),
-      ...settings.execArgv
-    ];
-  }
-}
-
-function init(agent) {
-  logger.debug('applying non-policy hook: cluster');
-  patcher.patch(agent.cluster, 'setupMaster', {
-    alwaysRun: true,
-    name: 'agent.cluster',
-    patchType: PATCH_TYPES.MISC,
-    pre(data) {
-      /*
-       * initialize with the original argv
-       */
-      if (_.isEmpty(agent.cluster.settings)) {
-        initClusterSettings(agent);
-      }
-
-      const settings = data.args[0] ? data.args[0] : {};
-
-      /*
-       * manipulate args and exec as appropriate for the configuration
-       */
-      if (agent.isCli) {
-        updateSettingsCli(agent, settings);
-      } else {
-        updateSettingsPreload(agent, settings);
-      }
-
-      logger.info(
-        'setupMaster called with settings %s',
-        JSON.stringify(settings)
-      );
-      data.args[0] = settings;
-    }
-  });
-
-  // We need to block the "online" emit for clusters until we are ready to actually ready to send messages.
-  patcher.patch(agent.cluster, 'emit', {
-    name: 'agent.cluster',
-    patchType: PATCH_TYPES.MISC,
-    alwaysRun: true,
-    pre(data) {
-      const [msg, obj] = data.args;
-      if (msg === 'online') {
-        if (!agent.clusterEmitPids.has(obj.process.pid)) {
-          // first cluster online event for this worker
-          logger.debug(
-            `swallowing cluster online event for pid ${obj.process.pid}`
-          );
-          agent.clusterEmitPids.add(obj.process.pid);
-          data.result = patcher.preempt();
-          return;
-        }
-      }
-    }
-  });
-
-  patcher.patch(agent.cluster, 'fork', {
-    name: 'agent.cluster',
-    patchType: PATCH_TYPES.MISC,
-    alwaysRun: true,
-    post(data) {
-      const worker = data.result;
-      // incrementing ID to make sure events are unique
-      // otherwise you get erroneous workers emitting online
-      // events.  could use pid, but since they can be re-used
-      // we'd have to clean these up
-      patcher.patch(worker, `emit`, {
-        name: `worker.${workerId++}.emit`,
-        patchType: PATCH_TYPES.MISC,
-        alwaysRun: true,
-        pre(data) {
-          const [msg] = data.args;
-
-          if (msg === 'online') {
-            if (!agent.workerEmitPids.has(worker.process.pid)) {
-              // first online event from the proc
-              logger.debug(
-                `swallowing worker online event for pid ${worker.process.pid}`
-              );
-              agent.workerEmitPids.add(worker.process.pid);
-              data.result = patcher.preempt();
-              return;
-            }
-          }
-        }
-      });
-
-      // stop tracking the pids on exit in case that get re-used
-      // we want to re-swallow
-      worker.on('exit', function() {
-        agent.workerEmitPids.delete(worker.process.pid);
-        agent.clusterEmitPids.delete(worker.process.pid);
-      });
-    }
-  });
-}
-
-module.exports = function(agent) {
-  init(agent);
-};
-
-/*
- * for testing only
- */
-module.exports.unhook = function(xport) {
-  patcher.unpatch(
-    xport.setupMaster,
-    'agent.cluster.setupMaster',
-    PATCH_TYPES.MISC
-  );
-};

package/lib/hooks/dataflow-monitor.js

@@ -1,38 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * Tracks dataflow for a given request
- * if config flag is true.
- */
-module.exports = (agent) => {
-  if (agent.config.agent.node.dataflow_monitor) {
-    const agentEmitter = require('../agent-emitter');
-    const dataflowMonitor = require('../core/logger/dataflow-monitor');
-
-    agentEmitter.on('http.incomingRequest', (req) => {
-      dataflowMonitor.requestStart(req);
-    });
-
-    agentEmitter.on('dataflowEvent', (event) => {
-      dataflowMonitor.event(event);
-    });
-
-    agentEmitter.on('http.responseFinished', (req, res) => {
-      dataflowMonitor.requestEnd(req, res);
-    });
-  }
-};