@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/util/html-util.js

@@ -1,83 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @param {string} tag
- * @param {string} content
- * @param {number} offset
- * @returns {[number, number]} tag range start index, tag range length
- */
-const getTagRange = (tag, content, offset) => {
-  const tagStart = content.indexOf(`<${tag}`, offset);
-  if (tagStart < 0) return [-1, 0];
-
-  const tagEnd = content.indexOf('>', tagStart);
-  return [tagStart, tagEnd - tagStart + 1];
-};
-
-module.exports = {
-  /**
-   * Retrieves the value of the provided attribute within the given tag.
-   * @param {string} attribute
-   * @param {string} tag
-   * @return {string | void}
-   */
-  getAttribute(attribute, tag = '') {
-    let attrStart = tag.indexOf(`${attribute}=`);
-    if (attrStart === -1) return undefined;
-
-    attrStart += attribute.length + 1;
-    const quoteChar = tag[attrStart];
-    if (quoteChar === ' ') return undefined;
-
-    let attrEnd = -1;
-    if (quoteChar === '"' || quoteChar === "'") {
-      attrStart += 1;
-      attrEnd = tag.indexOf(quoteChar, attrStart);
-    } else {
-      // handle unquoted <form method=post >
-      attrEnd = tag.indexOf(' ', attrStart);
-
-      // handle unquoted and last attribute <form method=post>
-      if (attrEnd === -1) {
-        attrEnd = tag[tag.length - 2] === '/' ? tag.length - 2 : tag.length - 1;
-      }
-    }
-
-    return tag.substr(attrStart, attrEnd - attrStart);
-  },
-
-  /**
-   * Find and return all of the requested opening tags within a section of HTML.
-   * @param {string} tag
-   * @param {string} content
-   * @returns {string[]}
-   */
-  getElements(tag, content = '') {
-    const elements = [];
-    let offset = 0;
-    let tagRangeStart = -1;
-    let tagRangeLength = 0;
-
-    do {
-      [tagRangeStart, tagRangeLength] = getTagRange(tag, content, offset);
-      if (tagRangeStart >= 0) {
-        offset = tagRangeStart + tagRangeLength;
-        elements.push(content.substr(tagRangeStart, tagRangeLength));
-      }
-    } while (tagRangeStart >= 0);
-
-    return elements;
-  }
-};

package/lib/util/ip-analyzer.js

@@ -1,246 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const address = require('ipaddr.js');
-const EventEmitter = require('events');
-
-const constants = require('../constants');
-const logger = require('../core/logger')('contrast:ip-analyzer');
-
-const { INPUT_TYPES } = constants;
-
-/**
- * Extracts a list of IP address values from a UserInput instance
- * of any type.
- * @param {UserInput} input
- * @returns {null|String[]}
- */
-function extractFromInput(input) {
-  return input.type === INPUT_TYPES.IP
-    ? input.value
-    : input.type === INPUT_TYPES.HEADER
-    ? extractFromHeaderInput(input)
-    : null;
-}
-
-/**
- * Extracts a list of IP address values from a UserInput instance
- * of type HEADER.
- * @param {UserInput} input
- * @returns {null|String[]}
- */
-function extractFromHeaderInput(input) {
-  return input.name === 'x-forwarded-for' ? input.value.split(',') : null;
-}
-
-/**
- * Gets a list of IP address from the requests object. The
- * first is from the <code>connection.remoteAddress</code>
- * value, and remaining ones from the x-forwarded-for header.
- * These are appended in reverse order.
- * @param {} req
- */
-const getReqAddresses = (req = {}) => {
-  const forwardedFor = getForwardedFor(req);
-  const ip = req.socket && req.socket.remoteAddress;
-  return ip ? [ip].concat(forwardedFor) : forwardedFor;
-};
-
-/**
- * Extracts the x-forwarded-for header values from the req.
- * @param   {IncomingMessage} req The request from which to get values
- * @returns {String[]}            Gathered IP values
- */
-const getForwardedFor = (req = {}) => {
-  const header = req.headers && req.headers['x-forwarded-for'];
-  return header ? header.split(',').map((x) => x.trim()) : [];
-};
-
-/**
- * Compares two epoch time values to see if the second has "expired", compared to the first.
- * Compares now with the expiresAt unit time to see if expiresAt has passed.
- * If expires is false, it should never expire
- * @param {Object} params
- * @param {Number} params.time      Time to compare
- * @param {Number} params.expiresAt The time of expiry
- * @param {Boolean} params.expires If the ip is supposed to expire
- * @returns {Boolean}
- */
-const expired = ({ now, expiresAt, expires }) =>
-  expires ? expiresAt - now <= 0 : false;
-
-/**
- * If the string represents a CIDR range, will return its value parsed into
- * an object by ipaddr.js. Otherwise <code>null</code> will return.
- * @param   {String} cidr CIDR formatted IP range
- * @returns {Object}      Value of (ipaddr.js).parseCIDR
- */
-const decorateDenylistEntry = (ip, rule) => {
-  const slashIdx = ip.indexOf('/');
-  const isCIDR = slashIdx >= 0;
-  const ipInstance = isCIDR
-    ? address.process(ip.substr(0, slashIdx))
-    : address.process(ip);
-
-  Object.assign(rule, {
-    normalizedValue: ipInstance.toNormalizedString(),
-    cidr: null
-  });
-
-  if (isCIDR) {
-    rule.cidr = { range: address.parseCIDR(ip), kind: ipInstance.kind() };
-  }
-};
-
-/**
- * Used to build the setting into an object that can be analyzed in an easier
- * and more effifient way. It does some upfront calculations and parsing.
- * @param   {Object}   setting The IpFilter setting
- * @returns {Object}
- */
-const build = (setting) => {
-  const denylistedIpDetails = {
-    ...setting,
-    expiresAt: new Date().getTime() + setting.expiresAtMs
-  };
-
-  decorateDenylistEntry(setting.ip, denylistedIpDetails);
-
-  return denylistedIpDetails;
-};
-
-class IpAnalyzer extends EventEmitter {
-  constructor(ipFilterSettings) {
-    super();
-    this.updateSettings(ipFilterSettings);
-  }
-
-  updateSettings(ipFilterSettings = []) {
-    this.settings = ipFilterSettings;
-    this.entries = ipFilterSettings.map(build);
-  }
-
-  /**
-   * Returns the first IP allowlist/denylist rule that satisfies
-   * for a given request. If none satisfy, or IPs provided are invalid
-   * will return null.
-   * @param   {IncomingMessage} req
-   * @returns {Object}
-   */
-  match(req) {
-    return this.matchFromList(getReqAddresses(req));
-  }
-
-  /**
-   * Evaluator API Interface
-   * @param   {UserInput} userInput UserInput to evaluate
-   * @returns {Object} Evaluation details
-   */
-  evaluate(userInput) {
-    return this.matchFromList(IpAnalyzer.getInputAddresses(userInput));
-  }
-
-  /**
-   * Iterates over the provided set of addresses and returns information for the
-   * first denylist entry that satisfies a match.
-   * @param {String[]} addresses Set of addresses to check for match
-   * @returns {Object}
-   */
-  matchFromList(addresses) {
-    const now = new Date().getTime();
-    const result = null;
-
-    if (!addresses.length) {
-      return false;
-    }
-
-    for (const denylistEntry of this.entries) {
-      const { expires, expiresAt } = denylistEntry;
-      for (let i = 0; i < addresses.length; i++) {
-        const currentIp = addresses[i];
-
-        // Ignore bad IP values.
-        if (!address.isValid(currentIp)) {
-          logger.warn(`Unable to parse ${currentIp}.`);
-          continue;
-        }
-
-        // Publish expired denylistEntrys.
-        if (expired({ now, expiresAt, expires })) {
-          logger.info(`IP expired: ${denylistEntry.name}, ${denylistEntry.ip}`);
-          // TODO: CONTRAST-34184
-          this.emit('expired', denylistEntry);
-          continue;
-        }
-
-        const match = IpAnalyzer.applyDenylistMatch(denylistEntry, currentIp);
-        if (match) {
-          return match;
-        }
-      }
-    }
-
-    return result;
-  }
-
-  /**
-   * Provided with an IP denylist details entry and an IP address, will check
-   * whether the IP satisfies a match against the entry. This could be an exact
-   * match atainst the IP, or that the IP falls within a CIDR range if specified
-   * by the entry.
-   * @param {Object} denylistEntry IP denylist details
-   * @param {String} ip IP address
-   * @returns {null|Object}
-   */
-  static applyDenylistMatch(denylistEntry, ip) {
-    const parsed = address.process(ip);
-
-    // Check if IP is in CIDR range,
-    if (denylistEntry.cidr) {
-      if (parsed.kind() !== denylistEntry.cidr.kind) {
-        return null;
-      }
-
-      if (parsed.match(denylistEntry.cidr.range)) {
-        return { ...denylistEntry, match: ip };
-      } else {
-        return null;
-      }
-    }
-
-    // or do a direct comparison
-    if (parsed.toNormalizedString() === denylistEntry.normalizedValue) {
-      return { ...denylistEntry, match: ip };
-    }
-
-    return null;
-  }
-
-  /**
-   * Will return an array of addresses extracted from a <code>UserInput</code>
-   * instance.
-   * @param {UserInput} userInput Value from which to extract addresses
-   * @returns {String[]}
-   */
-  static getInputAddresses(userInput) {
-    const addresses = extractFromInput(userInput);
-    if (!addresses) return [];
-    if (typeof addresses === 'string') return [addresses];
-    return addresses.filter(Boolean);
-  }
-}
-
-exports.IpAnalyzer = IpAnalyzer;

package/lib/util/is-agent-path.js

@@ -1,25 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const path = require('path');
-const agentPath = path.resolve(__dirname, '..', '..');
-/**
- * This utility function checks if the path is a substring of the agent codebase
- *
- * @param {string} path a path to a file
- */
-module.exports = function isAgentPath(filePath) {
-  return filePath.indexOf(agentPath) >= 0;
-};

package/lib/util/is-contrast-error.js

@@ -1,15 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-module.exports = (err = {}) => !!err && err.type === 'contrast';

package/lib/util/is-piped-to-dev.js

@@ -1,16 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-module.exports = (string) => string.match(/^\/dev\//);

package/lib/util/is-string.js

@@ -1,24 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-/**
- * Checks if value is an instance of a String
- * or typeof `string`
- *
- * @param {*} str arg to check if string
- * @return {Boolean}
- */
-module.exports.isString = (str) =>
-  str instanceof String || typeof str === 'string';

package/lib/util/partial.js

@@ -1,29 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-/**
- * simulates what lodash partial would do but
- * avoids all the .toString
- * See: NODE-948
- *
- * @param {Function} func to call
- * @param {*} arg arg to put first
- * @return {Function}
- */
-module.exports = function partial(func, ...firstArgs) {
-  return function contrastPartial(...args) {
-    return func(...firstArgs, ...args);
-  };
-};

package/lib/util/pkg-name.js

@@ -1,23 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const pkg = module.exports;
-let pkgName;
-
-pkg.set = (name) => {
-  pkgName = name;
-};
-
-pkg.get = () => pkgName;

package/lib/util/request-util.js

@@ -1,74 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const ACCEPT_TYPES = ['image/', 'text/css', 'text/javascript'];
-const CONTENT_TYPES = [...ACCEPT_TYPES, 'application/javascript'];
-const util = module.exports;
-
-/**
- * Returns true if the request URL appears to point to a static file.
- *
- * @param {String} url
- * @return {Boolean}
- */
-util.isStaticFile = (url) => {
-  try {
-    return /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.test(
-      url
-    );
-  } catch (e) {
-    return false;
-  }
-};
-
-/**
- * Checks both accept headers and content-type headers
- * to see if they match expected
- *
- * @param {Object} headers headers from an IncomingRequest
- * @return {Boolean}
- */
-util.isMediaType = (headers = {}) => {
-  const { accept } = headers;
-  const contentType = headers['content-type'];
-
-  if (!accept || accept === '*/*') {
-    return false;
-  }
-
-  if (!isContentType(contentType)) {
-    return ACCEPT_TYPES.filter((type) => accept.startsWith(type)).length > 0;
-  }
-
-  return true;
-};
-
-/**
- * Checks content-type header to see if it starts with a list of expected
- * values.  Also checks to see if header contains the string "font"
- *
- * @param {String} contentType value of content-type header
- * @return {Boolean}
- */
-const isContentType = (contentType) => {
-  if (!contentType) {
-    return false;
-  }
-
-  return (
-    CONTENT_TYPES.filter((type) => contentType.startsWith(type)).length > 0 ||
-    /font/.test(contentType)
-  );
-};

package/lib/util/resolve-obj.js

@@ -1,39 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/* (Foo, 'bar.baz') --> Foo.bar.baz  */
-function resolveLastObj(obj, str) {
-  return str.split('.').reduce(function(o, x) {
-    return o[x];
-  }, obj);
-}
-
-/* (Foo, 'bar.baz') --> Foo.bar  */
-function resolveInitObj(obj, str) {
-  const dotIndex = str.lastIndexOf('.');
-  if (dotIndex > 1) {
-    str = str.slice(0, dotIndex);
-    return resolveLastObj(obj, str);
-  }
-  return obj;
-}
-
-/* ('bar.baz') --> 'baz' */
-function resolveMethod(str) {
-  return str.split('.').pop() || str;
-}
-
-module.exports.resolveLastObj = resolveLastObj;
-module.exports.resolveInitObj = resolveInitObj;
-module.exports.resolveMethod = resolveMethod;

package/lib/util/route-info.js

@@ -1,50 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * Creates a formatted "signature" for a route
- * @param {string} path
- * @param {Array} [methods=['get']]
- * @return {string} formatted signature
- */
-function createSignature(path = '/', methods = ['get']) {
-  const method = methods.length > 6 ? 'all' : methods[0];
-  const sig = `Router.${method}('${path}', [Function])`;
-  return sig;
-}
-
-/**
- * Creates an atomic counter to create a unique
- * ID for route discovery.
- *
- * @param {Number} counter=0
- */
-const uniqueId = (function(counter) {
-  return function newId() {
-    return String(counter++);
-  };
-})(0);
-
-/**
- * Gets the name of handler or just defaults to [Function]
- * @param {Function} handler
- * @return {string}
- */
-function getHandlerName(handler) {
-  return handler.name || '[Function]';
-}
-
-module.exports = { createSignature, uniqueId, getHandlerName };

package/lib/util/some.js

@@ -1,27 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-function some(array, predicate) {
-  let index = -1;
-  const length = array == null ? 0 : array.length;
-
-  while (++index < length) {
-    if (predicate(array[index], index, array)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-module.exports = some;