@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/core/fastify/index.js

@@ -1,199 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const moduleHook = require('../../hooks/require');
-const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
-const agentEmitter = require('../../agent-emitter');
-const logger = require('../../core/logger')('hooks:fastify');
-const utils = require('./utils');
-const {
-  prototype: { decorateRequest },
-  setFrameworkRequest
-} = require('../../hooks/frameworks/base');
-const FastifyRequest = require('../../reporter/models/frameworks/fastify-request');
-const Stream = require('stream');
-
-const constants = {
-  CONTRAST_HOOKS: ['onRequest', 'preValidation', 'onSend'],
-  EVENTS: {
-    FASTIFY_EXPORT: 'fastify-export', // used to patch methods on the fastify framework
-    PRE_VALIDATION: 'fastify-prevalidation-hook', // used to implement fastify `preValidation` hook
-    ON_SEND: 'fastify-onsend-hook', // used to implement fastify `onSend` hook
-    ON_ROUTE: 'fastify-onroute-hook', // used to implement fastify `onRoute` hook
-  }
-};
-
-class FastifyCore {
-  constructor() {
-    this.instrumentFastify();
-  }
-
-  /**
-   * Sets up handler to patch createServer when fastify is required
-   */
-  instrumentFastify() {
-    moduleHook.resolve(
-      { name: 'fastify' },
-      this.registerFastifyHandler.bind(this)
-    );
-  }
-
-  /**
-   * Patches `createServer` for other instrumentation to patch methods
-   * on a fastify instance, and emits `FASTIFY_EXPORT` so other instrumentation
-   * can patch methods on the fastify export
-   *
-   * @param {Object} xport fastify export
-   */
-  registerFastifyHandler(xport) {
-    const self = this;
-    logger.info('Hooking fastify build');
-    return patcher.patch(xport, {
-      name: 'fastify.build',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      post(data) {
-        const fastify = data.result;
-        // install fastify lifecycle hooks. Order:
-        // 1. onRequest
-        // 2. preParsing
-        // 3. preValidation
-        // 4. preHandler
-        // 5. onSend
-        // 6. onResponse (does not offer a payload to inspect and modify. Is fired _after_ sending)
-        // if for some reason a new hook needs to be added, add it to the list of importantHooks
-        // below.
-        fastify.addHook('onRequest', FastifyCore.onRequest.bind(self));
-        fastify.addHook(
-          'preValidation',
-          FastifyCore.onPreValidation.bind(self)
-        );
-        fastify.addHook('onSend', FastifyCore.onSend.bind(self));
-        self.registerContrastHooksHandler(
-          utils.getHidden(fastify, 'fastify.hooks')
-        );
-        agentEmitter.emit(constants.EVENTS.FASTIFY_EXPORT, fastify);
-        fastify.addHook('onRoute', FastifyCore.onRoute.bind(self));
-      }
-    });
-  }
-
-  /**
-   * make sure that our hooks are the last that run in the fastify hook lifecycle.
-   * This assumes that we are already in the hook stack.
-   * also makes the assumption that the hook did not throw.
-   * @param {fastify.Hooks} hooks instance of hooks stored on fastify
-   */
-  registerContrastHooksHandler(hooks) {
-    patcher.patch(hooks, 'add', {
-      name: 'fastify.Hooks',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      post(data) {
-        // we only care about the following hooks as these are what we use
-        const {
-          args: [hook],
-          obj: self
-        } = data;
-
-        if (constants.CONTRAST_HOOKS.includes(hook) && self[hook].length > 1) {
-          const len = self[hook].length;
-          const top = self[hook][len - 1];
-          self[hook][len - 1] = self[hook][len - 2];
-          self[hook][len - 2] = top;
-        }
-      }
-    });
-  }
-
-  /**
-   * Fastify lifecycle hook as defined in official docs.
-   * @param {Fastify.routeOptions} routeOptions properties of a given route
-   */
-  static onRoute(routeOptions) {
-    agentEmitter.emit(constants.EVENTS.ON_ROUTE, routeOptions);
-  }
-
-  /**
-   * Fastify lifecycle hook as defined in official docs.
-   * @external https://github.com/fastify/fastify/blob/master/docs/Hooks.md#onrequest
-   * @external https://github.com/fastify/fastify/blob/master/docs/Request.md
-   * @param {Fastify.Request} request incoming request
-   * @param {Fastify.Reply}   reply   unbuilt outgoing response
-   * @param {Function}        done    callback to signal the hook is finished.
-   */
-  static onRequest(request, reply, done) {
-    // Set the framework-specific request model in our first hook point
-    setFrameworkRequest(request, FastifyRequest);
-    done();
-  }
-
-  /**
-   * Fastify lifecycle hook as defined in official docs.
-   * @external https://github.com/fastify/fastify/blob/master/docs/Hooks.md#prevalidation
-   * @external https://github.com/fastify/fastify/blob/master/docs/Request.md
-   * @param {Fastify.Request} request incoming request
-   * @param {Fastify.Reply}   reply   unbuilt outgoing response
-   * @param {Function}        done    callback to signal the hook is finished.
-   */
-  static onPreValidation(...data /*request, reply, done*/) {
-    const [request, , done] = data;
-    agentEmitter.emit(constants.EVENTS.PRE_VALIDATION, ...data);
-    decorateRequest({
-      body: request.body,
-      parameters: request.params,
-      query: request.query
-    });
-    done();
-  }
-
-  /**
-   * Fastify lifecycle hook as defined in:
-   * @external https://github.com/fastify/fastify/blob/master/docs/Hooks.md#onsend
-   * @external https://github.com/fastify/fastify/blob/master/docs/Reply.md
-   * @param {Fastify.Request} request incoming request
-   * @param {Fastify.Reply}   reply   built outgoing response
-   * @param {*}               payload the response body
-   * @param {Function}        done    callback to signal the hook is finished.
-   */
-  static onSend(...data /* request, reply, payload, done */) {
-    const [, , payload, done] = data;
-    // because these hooks run in customer code, we want to be sure that even if
-    // we can't emit source events, we still hit that `done()` call.
-    // payload can be of type:
-    // - String
-    // - Stream
-    // - Buffer
-    // - Error
-    // - undefined
-    // - null
-    if (
-      !(
-        payload instanceof Stream ||
-        payload instanceof Buffer ||
-        payload instanceof Error
-      )
-    ) {
-      agentEmitter.emit(constants.EVENTS.ON_SEND, ...data);
-    }
-
-    done(null, payload);
-  }
-}
-
-module.exports = FastifyCore;
-module.exports.constants = constants;
-module.exports.utils = utils;

package/lib/core/fastify/utils.js

@@ -1,28 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const utils = module.exports;
-
-/**
- * Get a hidden parameter using a symbol on the fastify object
- * @param   {Object} target built outgoing response
- * @param   {String} symbol full symbol stringified
- * @returns {Object}              key/val headers on response
- */
-utils.getHidden = function(target, symbol) {
-  let symbols = Object.getOwnPropertySymbols(target);
-  symbols = symbols.filter((sym) => sym.toString() === `Symbol(${symbol})`);
-  return target[symbols[0]] || {};
-};

package/lib/core/hapi/index.js

@@ -1,215 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const moduleHook = require('../../hooks/require');
-const patcher = require('../../hooks/patcher');
-const agentEmitter = require('../../agent-emitter');
-const {
-  prototype: { decorateRequest },
-  setFrameworkRequest
-} = require('../../hooks/frameworks/base');
-const HapiRequest = require('../../reporter/models/frameworks/hapi-request');
-const { get } = require('lodash');
-const { PATCH_TYPES } = require('../../constants');
-const logger = require('../logger')('hooks:hapi');
-const utils = require('./utils');
-
-const constants = {
-  LIFECYLE_METHODS: [
-    'onRequest',
-    'onPreAuth',
-    'onPostAuth',
-    'onPreHandler',
-    'onPostHandler',
-    'onPreResponse'
-  ],
-  FINISHED: 'Hapi.requestFinished',
-  ORIG_FUNC: Symbol('originalFunction'),
-  EVENTS: {
-    HAPI_EXPORT: 'hapi-export', // used to patch methods on the hapi framework
-    HAPI_ROUTES: 'hapi-routes', // used to instrument registered routes
-    HAPI_ADD_ROUTE: 'hapi-add-route', // used to instrument adding a route
-    HAPI_PRE_AUTH: 'hapi-pre-auth', // used to implement hapi onPreAuth hooks
-    HAPI_POST_AUTH: 'hapi-post-auth', // uses to implement hapi onPostAuth hooks
-    HAPI_PRE_HANDLER: 'hapi-pre-handler', // used to implement hapi onPreHandler hooks
-    HAPI_FINISHED: 'hapi-response-finished', // used to implement when hapi response is finished
-    HAPI_PRE_RES: 'hapi-pre-response', // used to implement hapi onPreResponse hooks
-    HAPI_MULTI_PART: 'hapi-multi-part' // used to add instrumentation for multipart form parsing
-  }
-};
-
-class HapiCore {
-  constructor() {
-    this.version = '>=17';
-    this.instrumentHapi();
-  }
-
-  /**
-   * Sets up handlers when `hapi` and `hapi-multer` and `hapi-cookie` is required
-   */
-  instrumentHapi() {
-    const { version } = this;
-    moduleHook.resolve(
-      { name: 'hapi', version },
-      this.registerXportHandlers.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@hapi/hapi', version },
-      this.registerXportHandlers.bind(this)
-    );
-    moduleHook.resolve(
-      { name: 'pez' },
-      this.registerMultipartHandler.bind(this)
-    );
-    moduleHook.resolve(
-      { name: '@hapi/pez' },
-      this.registerMultipartHandler.bind(this)
-    );
-  }
-
-  /**
-   * Patches `Pez.Dispenser.prototype.emit` to emit when multipart events have been emmited
-   * @param {Pez}
-   */
-  registerMultipartHandler(Pez) {
-    patcher.patch(Pez.Dispenser.prototype, 'emit', {
-      name: 'Pez.Dispenser.emit',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      pre: (wrapCtx) => {
-        const { args } = wrapCtx;
-        agentEmitter.emit(constants.EVENTS.HAPI_MULTI_PART, args);
-      }
-    });
-  }
-
-  /**
-   * Sets up handlers when hapi is required
-   *
-   * @param {Hapi} hapi export prototype
-   */
-  registerXportHandlers(hapi) {
-    agentEmitter.emit(constants.EVENTS.HAPI_EXPORT, hapi);
-    this.registerServerHandler(hapi);
-  }
-
-  registerServerHandler(hapi) {
-    const self = this;
-    // These are the session hooks which depend on hapi itself being loaded;
-    // because this only executes after all of hapi's sub-dependencies are required,
-    // we cannot wait to hook those until we have access to the hapi module.
-    patcher.patch(hapi, ['Server', 'server'], {
-      name: 'hapi.server',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      alwaysRun: true,
-      post(data) {
-        const server = data.result;
-        if (server) {
-          self.instrumentServer(server);
-          self.hookRoute(server);
-        }
-      }
-    });
-  }
-
-  hookRoute(server) {
-    patcher.patch(server._core.router, 'add', {
-      alwaysRun: true,
-      name: 'hapi.server.route',
-      patchType: PATCH_TYPES.FRAMEWORK,
-      post(data) {
-        const route = get(data, 'args[1]');
-        agentEmitter.emit(constants.EVENTS.HAPI_ADD_ROUTE, route);
-      }
-    });
-  }
-
-  instrumentServer(server) {
-    const self = this;
-    // mark that this server instance has not been hooked yet.
-    server.toolkitHooked = false;
-    server.ext('onPreStart', function onPreStart(core) {
-      logger.info('hapi version %s', core.version);
-      self.instrumentHapiHooks(core);
-    });
-
-    server.ext('onPostStart', function onPostStart(core) {
-      const routes = get(core, '_core.router.routes');
-      agentEmitter.emit(constants.EVENTS.HAPI_ROUTES, routes);
-    });
-  }
-
-  instrumentHapiHooks(server) {
-    server.ext('onRequest', function onRequest(request, h) {
-      // Set the framework-specific request model in our first hook point
-      setFrameworkRequest(request, HapiRequest);
-      return h.continue;
-    });
-
-    server.ext('onPreAuth', function onPreAuth(request, h) {
-      agentEmitter.emit(constants.EVENTS.HAPI_PRE_AUTH, request, h);
-      return h.continue;
-    });
-
-    server.ext('onPostAuth', function onPostAuth(request, h) {
-      agentEmitter.emit(constants.EVENTS.HAPI_POST_AUTH, {
-        request,
-        h,
-        server
-      });
-
-      // Update the domain's model of the request with body and params since it has been
-      // fully parsed and validated
-      decorateRequest({
-        normalizedUri: get(request, 'route.path'),
-        body: request.payload,
-        parameters: request.params,
-        query: request.query
-      });
-
-      return h.continue;
-    });
-
-    server.ext('onPreHandler', function onPreHandler(request, h) {
-      agentEmitter.emit(constants.EVENTS.HAPI_PRE_HANDLER, {
-        request,
-        h,
-        server
-      });
-
-      return h.continue;
-    });
-
-    server.ext('onPostHandler', function onPostHandler(request, h) {
-      const { response } = request;
-      // if the response was ended before we got here, we may not get a response that looks like
-      // what we expect it to
-      if (response && !response.isBoom) {
-        response.events.on('finish', function() {
-          agentEmitter.emit(constants.EVENTS.HAPI_FINISHED, request);
-        });
-      }
-      return h.continue;
-    });
-    server.ext('onPreResponse', function onPreResponse(request, h) {
-      agentEmitter.emit(constants.EVENTS.HAPI_PRE_RES, request);
-      return h.continue;
-    });
-  }
-}
-
-module.exports = HapiCore;
-module.exports.constants = constants;
-module.exports.utils = utils;

package/lib/core/hapi/utils.js

@@ -1,126 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const utils = module.exports;
-const { startsWith, cloneDeep } = require('lodash');
-const { CallContext, Signature } = require('../../assess/models');
-const SessionEvent = require('../../assess/response-scanning/cookies/events');
-const VALID_ENCODINGS = ['utf8', 'ascii', 'utf16'];
-
-/**
- * Checks encoding and returns if it is one of the
- * `VALID_ENCODINGS`, why? no f'n idea
- *
- * @param {string} encoding
- * @return {Boolean}
- */
-utils.isValidEncoding = function(encoding) {
-  return VALID_ENCODINGS.includes(encoding);
-};
-
-/**
- * Checks the options when storing a cookie,
- * and checks if `isSecure` is `false`
- *
- * @param {Object} options passed from server.constructor.prototype.state
- * @return {Boolean}
- */
-utils.secureFlagMissing = function(options) {
-  return utils.vulnerableOption({ options, key: 'isSecure' });
-};
-
-/**
- * Checks the options when storing a cookie,
- * and checks if `isHttpOnly` is `false`
- *
- * @param {Object} options passed from h.constructor.prototype.state
- */
-utils.httpOnly = function(options) {
-  return utils.vulnerableOption({ options, key: 'isHttpOnly' });
-};
-
-/**
- * Generic function to check an option and if it is `false`
- * @param {Object} params
- * @param {Object} params.options options passed to a cookie method
- * @param {string} params.key value in options to check
- * @return {Boolean}
- */
-utils.vulnerableOption = function({ options, key }) {
-  // eslint-disable-next-line no-prototype-builtins
-  return options.hasOwnProperty(key) && options[key] !== true;
-};
-
-/**
- * Create a context for the session event.
- *
- * @param {*}      obj    - The object being applied.
- * @param {*[]}    args   - The arguments to the function.
- * @param {*}      result - The result of the function called.
- * @param {string} source - Source "type" of the event ('P', 'P0', etc).
- */
-utils.createSessionContext = function(obj, args, result, source, stackOpts) {
-  const mask = '[HIDDEN]';
-  let opts, idx;
-  // use source type to find the arg which has options and attempt to sanitize its password field
-  // lodash lets me skip the if (sourceType) check since it'll return false if passed trash
-  if (startsWith(source, 'P') && source.length === 2) {
-    idx = parseInt(source[1]);
-    opts = cloneDeep(args[idx]);
-  }
-
-  if (!opts) {
-    return CallContext.create({
-      obj,
-      args,
-      result,
-      stackOpts
-    });
-  }
-
-  if (opts.password) {
-    opts.password = mask;
-  }
-
-  args[idx] = opts;
-
-  return CallContext.create({ obj, args, result });
-};
-
-/**
- * Create an event given the session's state being set.
- *
- * @param  {string}      module  - Name of the module (h|server)
- * @param  {string}      method  - Method name for what triggered the event.
- * @param  {CallContext} ctxt    - Context for the call
- * @param  {string}      source  - Source "type" of the event ('P', 'P0', etc)
- * @param  {options}     options - The options which set the flag we're going off of.
- * @return {SessionEvent}
- */
-utils.createSessionEvent = function(module, method, ctxt, source, options) {
-  const signature = new Signature({
-    moduleName: module,
-    methodName: method,
-    isModule: true
-  });
-
-  return new SessionEvent({
-    context: ctxt,
-    signature,
-    source,
-    options,
-    framework: 'hapi'
-  });
-};

package/lib/core/index.js

@@ -1,34 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const ExpressCore = require('./express');
-const RestifyCore = require('./restify');
-const FastifyCore = require('./fastify');
-const KoaCore = require('./koa');
-const Loopback4Core = require('./loopback4');
-const HapiCore = require('./hapi');
-const commonCore = require('./common');
-require('./arch-components');
-
-module.exports = function(agent) {
-  new ExpressCore();
-  new RestifyCore();
-  new FastifyCore();
-  new KoaCore();
-  new Loopback4Core();
-  new HapiCore();
-  commonCore(agent);
-};