@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/util/source-map.js

@@ -1,171 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { readFileSync, existsSync } = require('fs');
-const { transfer } = require('multi-stage-sourcemap');
-const { SourceMapConsumer } = require('@contrast/synchronous-source-maps');
-const path = require('path');
-const isAgentPath = require('./is-agent-path');
-
-/**
- * Utility for working with sourcemaps. This utility was built
- * because source map building happens inside of CleanStack which never has
- * any /real/ context for
- */
-class SourceMapUtility {
-  /**
-   * @param {Object} agent  reference to the global agent object
-   */
-  constructor(agent) {
-    this.agent = agent;
-    this.logger = require('../core/logger')('contrast:source-map');
-    this.retrieveSourceMap = require('../hooks/module/helpers').retrieveSourceMap;
-    this.consumerCache = {};
-  }
-
-  /**
-   * If the customer's source tree has source maps present, use them to
-   * tie our traces back to the original code.
-   * This function will read the original map.
-   *
-   * @param   {string}          filename    the original filename
-   * @param   {Babel.sourceMap} contrastMap the source map generated by the agent
-   * @returns {Babel.sourceMap}             the chained source map.
-   */
-  chain(filename, contrastMap) {
-    // is there an existing map file that we want to point back to?
-    // this is the case if we want to reference back into typescript etc. code
-    if (existsSync(`${filename}.map`)) {
-      try {
-        const existingMap = JSON.parse(readFileSync(`${filename}.map`, 'utf8'));
-        contrastMap = transfer({
-          fromSourceMap: contrastMap,
-          toSourceMap: existingMap
-        });
-        this.logger.trace(`Merged sourcemap from ${filename}.map`);
-      } catch (e) {
-        this.logger.debug(`Unable to read ${filename}.map.js`);
-        this.logger.debug(`${e}`);
-      }
-    }
-
-    return contrastMap;
-  }
-
-  /**
-   * Generate a source map consumer and cache it for later application
-   * @param {string}          filename the full path to the file
-   * @param {Babel.sourceMap} map      the parsed map to generate the consumer
-   */
-  cacheMap(filename, map) {
-    // path guaranteed to exist due to lib/core/config/util.js
-    if (!this.agent.config.agent.node.enable_source_maps) return;
-    const consumer = new SourceMapConsumer(map);
-    this.consumerCache[filename] = consumer;
-  }
-
-  /**
-   * Get the consumer if it is cached or create a new one if not
-   * @param {string} file full path to file
-   */
-  getConsumer(file) {
-    let consumer = null;
-    if (this.consumerCache[file]) {
-      consumer = this.consumerCache[file];
-    } else {
-      const mapFile = this.retrieveSourceMap(this.agent, file);
-      if (mapFile) {
-        consumer = new SourceMapConsumer(mapFile);
-        this.consumerCache[file] = consumer;
-      }
-    }
-
-    return consumer;
-  }
-
-  /**
-   * Filter out cases when sourcemaps aren't applicable.
-   * If source maps are disabled, it is agent code, or it is
-   * node internal file, we don't want to apply a source map.
-   * @param {string} file full path to file.
-   */
-  needsSourceMap(file) {
-    const applicable =
-      file &&
-      this.agent.config.agent.node.enable_source_maps &&
-      !isAgentPath(file) &&
-      !file.startsWith('internal/');
-
-    return applicable;
-  }
-
-  /**
-   * Apply a source map to a filename and source line.
-   * Will return original filename and number if it can't use
-   * a sourcemap
-   *
-   * @param   {string} file       filename the agent is using
-   * @param   {number} lineNumber original line number from error
-   * @param   {number} column     original column number from error
-   * @returns {{ lineNumber: number, file: string }} { new line number, new filename }
-   */
-  applyMap(file, lineNumber, column) {
-    if (!this.needsSourceMap(file)) return { lineNumber, file };
-
-    const consumer = this.getConsumer(file);
-
-    if (!column) column = 0; // this is a required property
-
-    if (consumer) {
-      const { line, source } = consumer.originalPositionFor({
-        line: lineNumber,
-        column
-      }) || { line: undefined, source: undefined };
-
-      if (line) lineNumber = line;
-      if (source) file = this.replaceSource(file, source);
-    }
-
-    return { lineNumber, file };
-  }
-
-  /**
-   * Replace the original filename in the stacktrace
-   * ex: original source file we're reading from the map
-   *     comes from source.ts, we want to direct there.
-   * Worth noting that this is something of a hack because if the user's source
-   * just corresponds to the /map/ and the original source is elsewhere
-   * then these paths are gonna be wrong. That said, it is gonna point
-   * to the right file, so I'm pretty confident users can figure this out.
-   *
-   * @param   {string} original full filepath of source the agent is using
-   * @param   {string} source   filename (without path) coming from source-map.
-   * @returns {string}          fixed filename with full path
-   */
-  replaceSource(original, source) {
-    return original === source
-      ? original
-      : original.replace(path.basename(original), source);
-  }
-}
-
-module.exports.util = null;
-
-module.exports.init = (agent) => {
-  module.exports.util = new SourceMapUtility(agent);
-};
-
-module.exports.SourceMapUtility = SourceMapUtility;

package/lib/util/static-rules.js

@@ -1,33 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * Gets all the rules of type static from nonDataflowRule.json
- */
-function getStaticRulePolicy() {
-  const { rules } = require('../assess/policy/non-dataflow-rules.json');
-  const staticRules = {};
-  for (const rule in rules) {
-    if (rules[rule].type === 'static') {
-      staticRules[rule] = rules[rule];
-    }
-  }
-  return staticRules;
-}
-
-module.exports.getStaticRulePolicy = getStaticRulePolicy;
-
-module.exports.STATIC_RULES = Object.keys(getStaticRulePolicy());

package/lib/util/trace-util.js

@@ -1,74 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * Helper methods for creating and reporting traces
- */
-
-'use strict';
-
-const crc32 = require('crc-32');
-
-const {
-  AsyncStorage,
-  KEYS: { REQUEST }
-} = require('../core/async-storage');
-
-/**
- * Looks in AsyncStorage context for the request.
- * If it can, checks if the same rule has been reported in request
- * more than 5 times; if it has, returns nothing as it if could not find
- * the request.
- * Improvements: decouple request lookup with throttling rule reports per request
- */
-function getRequest(agent, ruleId) {
-  const context = AsyncStorage.getContext();
-  if (!context || !context[REQUEST]) {
-    return;
-  }
-
-  const request = context[REQUEST];
-
-  // first time rule is triggered, adding to rules object
-  if (!context.rules[ruleId]) {
-    context.rules[ruleId] = 0;
-  }
-
-  const ruleCount = context.rules[ruleId];
-  const { sampling } = agent.config.assess;
-  if (sampling && sampling.enable && ruleCount >= sampling.baseline) {
-    return;
-  }
-
-  context.rules[ruleId]++;
-  return request;
-}
-
-/**
- * used by rules/sinks to create hashes used for preflight
- *
- * @param {*} digestComponents Array of rule specific things to digest, such as ruleId
- * @return {crc32} Hash of digest
- */
-function createHash(digestComponents) {
-  let hash = '';
-  for (const digest of digestComponents) {
-    if (digest) hash = crc32.str(digest, hash);
-  }
-
-  return hash;
-}
-
-module.exports.getRequest = getRequest;
-module.exports.createHash = createHash;

package/lib/util/traverse.js

@@ -1,188 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const isTraversable = (value) => {
-  if (Array.isArray(value) && value.length) {
-    return true;
-  }
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-  if (Object.keys(value).length === 0) {
-    return false;
-  }
-  return ![Function, String, Boolean, Number].some((c) => value instanceof c);
-};
-
-class Stack {
-  constructor() {
-    this.stack = [];
-  }
-
-  length() {
-    return this.stack.length;
-  }
-
-  pop() {
-    const { stack } = this;
-    const { length } = stack;
-    const last = stack[length - 1];
-
-    0 < stack.length && (stack.length = stack.length - 1);
-    return last;
-  }
-
-  push(item) {
-    this.stack.push(item);
-  }
-}
-
-class Path extends Stack {
-  push(key, array) {
-    if (this.array) {
-      key = `[${key}]`;
-    }
-    this.array = array;
-
-    super.push({
-      key,
-      array,
-    });
-  }
-}
-
-class Visitor {
-  constructor(callback, maxDepth = Infinity) {
-    this.callback = callback;
-    this.maxDepth = maxDepth;
-    this.paths = [];
-    this.counter = new Stack();
-    this.path = new Path();
-    this.cache = new WeakSet();
-  }
-
-  visit(key, value, isMaxDepthReached) {
-    if (isMaxDepthReached) {
-      this.updateStacks(
-        { counter: this.counter, path: this.path },
-        null,
-        null,
-        isMaxDepthReached,
-      );
-      return;
-    }
-    // skip circular objects
-    if (typeof value === 'object' && value !== null) {
-      if (this.cache.has(value)) {
-        // Circular reference found, discard key
-        return;
-      }
-      // Store value in our collection
-      this.cache.add(value);
-    }
-
-    let newVal;
-    const depth = this.path.length();
-    if (depth <= this.maxDepth) {
-      newVal = this.callback(key, value, depth, this.path);
-    }
-
-    this.updateStacks({ counter: this.counter, path: this.path }, key, value);
-
-    return newVal || value;
-  }
-
-  updateStacks(stacks, key, value, isMaxDepthReached) {
-    if (isMaxDepthReached) {
-      stacks.counter.pop();
-      stacks.path.pop();
-    }
-    // We're decending into the object, so here we're
-    // just building up the stacks.
-
-    if (value && isTraversable(value)) {
-      stacks.counter.push(Object.keys(value).length);
-      stacks.path.push(key, Array.isArray(value));
-      return;
-    }
-
-    // Otherwise we're decrementing / removing from stacks
-    // when we process leaf nodes.
-    // Look at the top value of stack
-    const dec = stacks.counter.pop() - 1;
-    // If non-zero we're still processessing at same level
-    //  of depth, so leave the path stack alone.
-    if (dec !== 0) {
-      stacks.counter.push(dec);
-      return;
-    } else {
-      // If it *is* zero, we need to remove the top item
-      // from the stack, and maybe more (recursively).
-      if (stacks.counter.length()) {
-        stacks.path.pop();
-        return this.updateStacks(
-          { counter: this.counter, path: this.path },
-          key,
-          value,
-        );
-      }
-      return;
-    }
-  }
-}
-
-function traverse(obj, fn, visitor, maxDepth) {
-  if (typeof visitor === 'number') {
-    maxDepth = visitor;
-    visitor = undefined;
-  }
-  visitor =
-    visitor ||
-    new Visitor(function (key, value, depth, paths) {
-      fn(key, value, depth, paths);
-    }, maxDepth);
-
-  traverseObject(obj, visitor, maxDepth);
-}
-
-function traverseObject(obj, visitor, remainingDepth = 250, visited = new Set()) {
-  if (!obj || visited.has(obj)) {
-    return;
-  }
-
-  if (visitor.path.length() < 1) {
-    visitor.visit('', obj);
-    visited.add(obj);
-  }
-
-  // This is done just to reset the stack, without changing the current impletion
-  if (remainingDepth == 0) {
-    visitor.visit(null, null, true);
-    visited.add(obj);
-    return;
-  }
-
-  Object.entries(obj).forEach(([key, value]) => {
-    visitor.visit(key, value);
-    visited.add(obj);
-    if (value && typeof value === 'object') {
-      traverseObject(value, visitor, remainingDepth - 1, visited);
-    }
-  });
-}
-
-module.exports.Visitor = Visitor;
-module.exports.traverse = traverse;

package/lib/util/user-input-evaluator.js

@@ -1,64 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * @typedef {Object} Condition
- * @property {string=} name
- * @property {string=} value
- * @property {string} evaluation
- */
-
-/**
- * @typedef {Object} Input
- * @property {string=} name
- * @property {string} value
- */
-
-/**
- * Evaluator factories take a "value" and return an Evaluator function.
- * @type {{ [strategy: string]: (value: string) => (input: string) => boolean}}
- */
-const EVALUATORS = {
-  contains: (value) => (input) => input.indexOf(value) >= 0,
-  doesnt_contain: (value) => (input) => input.indexOf(value) < 0,
-  equals: (value) => (input) => value.toString() === input.toString(),
-  doesnt_equal: (value) => (input) => value.toString() !== input.toString(),
-  matches: (value) => (input) => new RegExp(value, 'i').test(input),
-  doesnt_match: (value) => (input) => !new RegExp(value, 'i').test(input)
-};
-
-/**
- * Given a condition, will return a function that will evaluate an
- * input string as described by the condition. The returned function
- * will return the condition itself if the evaluation is met, otherwise it will
- * return `null`.
- * @param {Condition} condition The condition to use to do evaluation
- * @returns {(input: Input) => Condition | null}
- */
-module.exports.create = function createUserInputEvaluator(condition) {
-  const name = (condition.name || '').toLowerCase();
-  const value = (condition.value || '').toLowerCase();
-  const strategy = condition.evaluation.toLowerCase();
-
-  if (!EVALUATORS[strategy]) return () => null;
-
-  const evaluator = EVALUATORS[strategy](value);
-
-  return (input) => {
-    if (!input || (input.name || '').toLowerCase() !== name) return null;
-    return evaluator(input.value) ? condition : null;
-  };
-};