@contrast/agent 4.32.18 → 4.32.20

package/lib/assess/response-scanning/parseable-response-emitter.js

@@ -16,6 +16,8 @@ Copyright: 2023 Contrast Security, Inc
 
 const agentEmitter = require('../../agent-emitter');
 const httpCommon = require('./common');
+const logger = require('../../core/logger')('contrast:response-scanning');
+
 let setup = false;
 
 module.exports = {
@@ -25,16 +27,20 @@ module.exports = {
     }
     // TODO add generic res.end hook
     agentEmitter.on('send', function({ request, responseHeaders, body }) {
-      // not setting default value in arg because null does not evaluate to false
-      body = body || '';
+      if (typeof body !== 'object' || body === null) {
+        // not setting default value in arg because null does not evaluate to false
+        body = body || '';
 
-      if (httpCommon.isParseableResponse(responseHeaders)) {
-        agentEmitter.emit('parseableResponse', {
-          request,
-          responseHeaders,
-          body,
-          bodyLC: body.toLowerCase()
-        });
+        if (httpCommon.isParseableResponse(responseHeaders)) {
+          agentEmitter.emit('parseableResponse', {
+            request,
+            responseHeaders,
+            body,
+            bodyLC: body.toLowerCase()
+          });
+        }
+      } else {
+        logger.warn('The contrast agent expects the response body to be a string or null.');
       }
     });
 

package/lib/assess/sinks/ssrf-url.js

@@ -20,6 +20,7 @@ Copyright: 2023 Contrast Security, Inc
  * We will parse the url and only check the protocol, host, path
  */
 
+const logger = require('../../core/logger')('contrast:hooks:ssrf-url');
 const { isString } = require('../../util/is-string');
 const tracker = require('../../tracker');
 const { URL } = require('url');
@@ -42,7 +43,7 @@ module.exports = ({ common: { isVulnerable } }) => {
    * @param {string} params.name name of tag to add
    * @return {TagRange[]} params.list of TagRanges including the new tag
    */
-  ssrfUrl.addTag = function({ tags, start, stop, name }) {
+  ssrfUrl.addTag = function ({ tags, start, stop, name }) {
     const tagRange = new TagRange(start, stop, name);
 
     return tagRangeUtil.add(tags, tagRange);
@@ -57,7 +58,7 @@ module.exports = ({ common: { isVulnerable } }) => {
    * @param {Object} disallowedTags for sink
    * @return {Boolean} if input is vulnerable or not
    */
-  ssrfUrl.handle = function({ input, requiredTags, disallowedTags }) {
+  ssrfUrl.handle = function ({ input, requiredTags, disallowedTags }) {
     if (!isString(input)) {
       return false;
     }
@@ -68,27 +69,36 @@ module.exports = ({ common: { isVulnerable } }) => {
       return false;
     }
 
-    const url = new URL(input);
-    const qpIndex = url.search ? input.indexOf(url.search) : -1;
-    // start search after protocol + // so it doesn't match `/` as first in the http://
-    const pathIndex = input.indexOf(url.pathname, url.protocol.length + 2);
+    try {
+      // we define a default base here so that `input` can be a relative path
+      const url = new URL(input, 'abc://xyz');
+      const qpIndex = url.search ? input.indexOf(url.search) : -1;
+      const pathIndex = url.pathname ? input.indexOf(
+        url.pathname,
+        // start search after protocol + // so it doesn't match `/` as first in the http://
+        // if our generated base is used, protocol will be `abc` and won't be present in the input
+        url.protocol === 'abc:' ? 0 : url.protocol.length + 2
+      ) : -1;
 
-    if (pathIndex >= 0) {
-      contrastProps.tagRanges = ssrfUrl.addTag({
-        tags: contrastProps.tagRanges,
-        start: pathIndex,
-        stop: pathIndex + url.pathname.length - 1,
-        name: PATH_TAG
-      });
-    }
+      if (pathIndex >= 0) {
+        contrastProps.tagRanges = ssrfUrl.addTag({
+          tags: contrastProps.tagRanges,
+          start: pathIndex,
+          stop: pathIndex + url.pathname.length - 1,
+          name: PATH_TAG
+        });
+      }
 
-    if (qpIndex >= 0) {
-      contrastProps.tagRanges = ssrfUrl.addTag({
-        tags: contrastProps.tagRanges,
-        start: qpIndex,
-        stop: qpIndex + url.search.length - 1,
-        name: QUERY_TAG
-      });
+      if (qpIndex >= 0) {
+        contrastProps.tagRanges = ssrfUrl.addTag({
+          tags: contrastProps.tagRanges,
+          start: qpIndex,
+          stop: qpIndex + url.search.length - 1,
+          name: QUERY_TAG
+        });
+      }
+    } catch (err) {
+      logger.warn('Unable to parse url %s, err: %o', err);
     }
 
     return isVulnerable({ input, requiredTags, disallowedTags });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.32.18",
+  "version": "4.32.20",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",