@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/core/rewrite/index.js

@@ -1,316 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { default: generate } = require('@babel/generator');
-const { parse } = require('@babel/parser');
-const { default: traverse } = require('@babel/traverse');
-
-const RewriteDeadzones = require('../../assess/deadzones/rewrite');
-const { util: sourceMapUtility } = require('../../util/source-map');
-const Scopes = require('../async-storage/scopes');
-const logger = require('../logger')('contrast:rewrite');
-const AssignmentExpression = require('./assignment-expression');
-const BinaryExpression = require('./binary-expression');
-const CallExpression = require('./call-expression');
-const CatchClause = require('./catch-clause');
-const functionWrap = require('./function-wrap');
-// const ImportDeclaration = require('./import-declaration');
-const isContrastMethod = require('./is-contrast-method');
-const logRewrite = require('./log');
-const MemberExpression = require('./member-expression');
-const ObjectProperty = require('./object-property');
-const prependGlobals = require('./prepend-globals');
-const RewriteLog = require('./rewrite-log');
-const SwitchStatement = require('./switch-statement');
-const TemplateLiteral = require('./template-literal');
-
-/**
- * @typedef {Object} State
- * @property {import('../../agent')} agent
- * @property {RewriteLog} rewriteLog
- * @property {import('./callees').Spec} specs
- * @property {{ [name: string]: import('@babel/types').MemberExpression }} callees
- * @property {boolean} inject
- * @property {boolean} wrap
- */
-
-const DEADZONE_NAME = 'agent: rewrite';
-
-/** @type {Rewriter} memoized rewriter return value. */
-let rewriter;
-
-class Rewriter {
-  constructor(agent) {
-    this.agent = agent;
-    const { specs, callees } = require('./callees')(agent);
-    this.specs = specs;
-    this.callees = callees;
-    this.deadzones = new RewriteDeadzones(agent);
-  }
-
-  /**
-   * @param {string} code
-   * @param {string} filename
-   * @returns {import('@babel/types').File} AST
-   */
-  parse(code, filename, sourceType) {
-    return parse(code, {
-      // TODO: check if necessary
-      plugins: [
-        'classPrivateMethods',
-        'classPrivateProperties',
-        'classProperties'
-      ],
-      ranges: true,
-      sourceType,
-      sourceFilename: filename,
-      tokens: true
-    });
-  }
-
-  /**
-   *
-   * @param {import('@babel/types').File} ast
-   * @param {string} filename
-   * @param {State} initialState
-   */
-  traverse(ast, filename, initialState) {
-    traverse(
-      ast,
-      {
-        /** Runs before other visitor functions. */
-        enter(path, state) {
-          for (let i = 0; i < state.agent.staticVisitors.length; i++) {
-            state.rewriteLog.logRewrite('staticVisitors');
-            state.agent.staticVisitors[i](path.node, filename, state);
-          }
-        },
-        Program(path, state) {
-          if (state.wrap) functionWrap(path, state);
-          if (state.inject) prependGlobals(path, state);
-        },
-        AssignmentExpression,
-        BinaryExpression,
-        CallExpression,
-        CatchClause,
-        // ImportDeclaration, disabled since we're not yet utilizing this.
-        MemberExpression,
-        ObjectProperty,
-        SwitchStatement,
-        TaggedTemplateExpression: TemplateLiteral.skip,
-        TemplateLiteral
-      },
-      null,
-      initialState
-    );
-    traverse.cache.clear();
-  }
-
-  /**
-   * Transform original javascript into contrast rewritten form.
-   * Should be run in no instrumentation scope
-   *
-   * @param {string} code
-   * @param {string} filename
-   * @param {State} initialState
-   * @param {string} sourceType 'script' for cjs, 'module' for esm
-   * @returns {import('@babel/generator').GeneratorResult}
-   */
-  rewrite(code, filename, initialState, sourceType = 'script') {
-    // I don't think this changes but use the native module wrap to
-    // code = require('module').wrap(code);
-    // XXX this was causing an error by wrapping es6 features in a function
-    if (!this.agent.config.agent.node.enable_rewrite) {
-      return { code };
-    }
-
-    try {
-      // Comment out shebang if present, won't affect any code locations.
-      code = code.charAt(0) === '#' ? `//${code}` : code;
-
-      const ast = this.parse(code, filename, sourceType);
-      this.traverse(ast, filename, initialState);
-      return generate(
-        ast,
-        {
-          jsonCompatibleStrings: true,
-          // source maps are generated regardless of whether they're
-          // configured to be used in reporting. This has no slowdown
-          // overhead except during startup, which already sucks.
-          // use rewrite cache!
-          sourceMaps: true,
-          sourceFileName: filename
-        },
-        code
-      );
-    } catch (err) {
-      initialState.rewriteLog.aborted = true;
-
-      logger.warn('could not rewrite %s', filename);
-      logger.warn(err);
-    }
-  }
-
-  /**
-   * Takes code string, creates an AST, traverses the AST to preform transformations we need.
-   * @param {string} content
-   * @param {string} filename
-   * @param {Object} opts
-   * @param {boolean} opts.inject whether or not to inject globals
-   * @param {string} opts.sourceType 'script' for cjs, 'module' for esm
-   * @param {boolean} opts.wrap whether or not to function wrap
-   * @returns {import('@babel/generator').GeneratorResult}
-   */
-  rewriteCode(
-    content,
-    filename,
-    { inject = true, sourceType = 'script', wrap = false } = {}
-  ) {
-    const code = String(content);
-
-    /** @type {import('@babel/generator').GeneratorResult} */
-    const result = { code };
-
-    // Determine if we even need to rewrite: if there are no callees, no.
-    if (this.callees && Object.keys(this.callees).length === 0) {
-      logger.debug('no custom callees, skipping rewrite for %s', filename);
-      return result;
-    }
-
-    const rewriteLog = new RewriteLog(this.specs, this.callees, code);
-
-    // ...if there's no tokens to rewrite or static visitors to run, no.
-    if (!rewriteLog.foundTokens()) {
-      logger.debug('no rewritable tokens, skipping rewrite for %s', filename);
-      return result;
-    }
-
-    /** @type {State} */
-    const initialState = {
-      agent: this.agent,
-      rewriteLog,
-      specs: this.specs,
-      callees: this.callees,
-      inject,
-      wrap: wrap && sourceType === 'script',
-      deps: []
-    };
-
-    const rewriteResult = Scopes.runInNoInstrumentationScope(
-      () => this.rewrite(code, filename, initialState, sourceType),
-      DEADZONE_NAME
-    );
-
-    if (rewriteLog.aborted) {
-      logger.debug('rewrite aborted, returning original code for %s', filename);
-      return result;
-    }
-
-    logger.trace('successfully rewrote code for %s', filename);
-    rewriteResult.deps = initialState.deps;
-
-    return rewriteResult;
-  }
-
-  /**
-   * @param {string} content file content
-   * @param {string} filename source filename
-   * @param {Object} opts
-   * @param {boolean} opts.inject whether or not to inject globals
-   * @param {string} opts.sourceType 'script' for cjs, 'module' for esm
-   * @param {boolean} opts.wrap whether or not to function wrap
-   * @returns {import('@babel/generator').GeneratorResult}
-   */
-  rewriteFile(
-    content,
-    filename,
-    { inject = true, sourceType = 'script', wrap = true } = {}
-  ) {
-    if (this.deadzones.isDeadzoned(filename)) {
-      logger.debug('skipping rewrite for deadzoned file %s', filename);
-      return content;
-    }
-
-    const result = this.rewriteCode(content, filename, {
-      inject,
-      sourceType,
-      wrap
-    });
-    if (this.agent.config.agent.node.enable_rewrite_log) {
-      logRewrite(result.code, filename);
-    }
-
-    // if sourceMapUtility is not configured, this will throw a null
-    // exception. As such, this will almost always fail in tests.
-    try {
-      result.map = sourceMapUtility.chain(filename, result.map);
-    } catch (err) {
-      logger.debug(`Unable to chain source map for ${filename} %o`, err);
-    }
-    return result;
-  }
-
-  /**
-   * Unwrites the global.contrastMethods references when a user calls
-   * `Function.prototype.toString`.
-   * @param {string} code
-   * @returns {string} sanitized code
-   */
-  unwrite(code) {
-    const ast = this.parse(code);
-
-    const self = this;
-    traverse(ast, {
-      // All rewritten code to remove has been converted to a Call Expression...
-      CallExpression(path) {
-        if (!isContrastMethod(path.node.callee)) return;
-
-        const spec = self.specs.find(
-          (spec) => spec.name === path.node.callee.property.name
-        );
-        if (!spec) return;
-
-        switch (spec.type) {
-          case 'BinaryExpression': {
-            return BinaryExpression.unwrite(path, spec);
-          }
-          case 'CallExpression': {
-            return CallExpression.unwrite(path);
-          }
-          case 'MemberExpression': {
-            return MemberExpression.unwrite(path);
-          }
-          case 'SwitchStatement': {
-            return SwitchStatement.unwrite(path);
-          }
-        }
-      },
-      // ...or a Tagged Template Expression
-      TaggedTemplateExpression: TemplateLiteral.unwrite
-    });
-
-    return generate(ast, { jsonCompatibleStrings: true }).code;
-  }
-}
-
-/**
- * Returns a memoized result, since a rewriter is included in multiple locations.
- * @returns {Rewriter}
- */
-module.exports = function createBabelRewriter(agent) {
-  if (!rewriter) rewriter = new Rewriter(agent);
-  return rewriter;
-};

package/lib/core/rewrite/injections.js

@@ -1,169 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const logger = require('../logger')('contrast:rewrite:injections');
-const patcher = require('../../hooks/patcher');
-const { PATCH_TYPES } = require('../../constants');
-const Membrane = require('../../assess/membrane');
-const { toUntrackedString } = require('../../assess/utils');
-
-class Injection {
-  /**
-   * @param {string|void} name
-   * @param {string} id
-   * @param {any} value
-   */
-  constructor(name, id, value) {
-    this.name = name;
-    this.id = id;
-    this.value = value;
-
-    this._enabled = false;
-
-    Object.defineProperty(global, id, {
-      value,
-      enumerable: false
-    });
-  }
-
-  enabled() {
-    return this._enabled;
-  }
-
-  enable() {
-    logger.trace(`enabling ${this.id} injection`);
-    this._enabled = true;
-  }
-}
-
-const getOrig = (v) => patcher.unwrap(Membrane.unwrap(v));
-
-const ContrastMethods = new Injection(null, 'ContrastMethods', {
-  __add: function __add(left, right) {
-    const ret = getOrig(left) + getOrig(right);
-    return ret;
-  },
-  __forceCopy: function __forceCopy(handle) {
-    // Used to force a copy of handle:
-    // https://stackoverflow.com/a/31733628
-    // This is a workaround for CONTRAST-30333, in which something we
-    // suspect is a v8 bug means that handle will otherwise be clobbered
-    // and if it was externalized, we will lose the data associated with it
-    if (typeof handle === 'string') {
-      handle = toUntrackedString(handle);
-    }
-    return handle;
-  },
-  __cast: function __cast(val) {
-    return getOrig(val);
-  },
-  __doubleEqual: function __doubleEqual(left, right) {
-    left = getOrig(left);
-    right = getOrig(right);
-
-    return left == right;
-  },
-  __notDoubleEqual: function __notDoubleEqual(left, right) {
-    left = getOrig(left);
-    right = getOrig(right);
-
-    return left != right;
-  },
-  __tripleEqual: function __tripleEqual(left, right) {
-    left = getOrig(left);
-    right = getOrig(right);
-
-    return left === right;
-  },
-  __notTripleEqual: function __notDoubleEqual(left, right) {
-    left = getOrig(left);
-    right = getOrig(right);
-
-    return left !== right;
-  },
-  __contrastTag: function __contrastTag(strings) {
-    // XXX implemented in lib/assess/propagators/templates.js
-  },
-  __contrastEval: function __contrastEval(str) {
-    return str;
-  },
-  // TODO: NODE-2020
-  __importDefault(mod, source, url) {},
-  __importNamespace(mod, source, url) {},
-  __import(mod, spec, source, url) {}
-});
-
-ContrastMethods.enable();
-
-const injections = {
-  ContrastMethods,
-  JSON: new Injection('JSON', 'ContrastJSON', Object.create(JSON)),
-  Function: new Injection(
-    'Function',
-    'ContrastFunction',
-    patcher.patch(global.Function, {
-      name: 'Function.value',
-      patchType: PATCH_TYPES.INJECTION
-    })
-  ),
-  Object: new Injection(
-    'Object',
-    'ContrastObject',
-    patcher.patch(global.Object, {
-      name: 'Object',
-      patchType: PATCH_TYPES.INJECTION
-    })
-  ),
-  String: new Injection(
-    'String',
-    'ContrastString',
-    patcher.patch(global.String, {
-      name: 'String',
-      patchType: PATCH_TYPES.INJECTION
-    })
-  ),
-  Number: new Injection(
-    'Number',
-    'ContrastNumber',
-    patcher.patch(global.Number, {
-      name: 'Number',
-      patchType: PATCH_TYPES.INJECTION
-    })
-  )
-};
-
-module.exports = {
-  /**
-   * Allows access to injections by name.
-   * @param {string} name
-   * @returns {Injection}
-   */
-  get(name) {
-    return injections[name];
-  },
-
-  /**
-   * Returns enabled injections.
-   * @returns {Injection[]}
-   */
-  getEnabled() {
-    return Object.values(injections).reduce(
-      (enabled, injection) =>
-        injection.enabled() ? [...enabled, injection] : enabled,
-      []
-    );
-  }
-};

package/lib/core/rewrite/is-contrast-method.js

@@ -1,28 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-const t = require('@babel/types');
-
-/**
- * Helper method to determine if a leaf node was wrapped by a ContrastMethods callee
- * @param {import('@babel/types').Expression} node leaf node
- * @return {boolean}
- */
-module.exports = function isContrastMethod(node) {
-  return (
-    t.isMemberExpression(node) &&
-    t.isIdentifier(node.object) &&
-    node.object.name === 'ContrastMethods'
-  );
-};

package/lib/core/rewrite/log.js

@@ -1,24 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-const zlib = require('zlib');
-const logger = require('../logger')('contrast:rewrite');
-
-module.exports = function log(newContent, filename) {
-  logger.debug(
-    '_rw_',
-    filename,
-    zlib.deflateSync(newContent).toString('base64')
-  );
-};

package/lib/core/rewrite/member-expression.js

@@ -1,52 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const t = require('@babel/types');
-
-/**
- * Wraps computed member expressions with `ContrastMethods.__forceCopy`.
- * ```
- * obj[key] = 'new-key'
- * // becomes:
- * obj[ContrastMethods.__forceCopy(key)] = 'new-key';
- * ```
- * @param {import('@babel/traverse').NodePath<import('@babel/types').MemberExpression>} path
- * @param {import('.').State} state
- */
-module.exports = function MemberExpression(path, state) {
-  if (
-    !state.callees.__forceCopy ||
-    !path.node.computed ||
-    !t.isIdentifier(path.node.property)
-  )
-    return;
-
-  state.rewriteLog.logRewrite('__forceCopy');
-  path.replaceWith(
-    t.memberExpression(
-      path.node.object,
-      t.callExpression(state.callees.__forceCopy, [path.node.property]),
-      true
-    )
-  );
-};
-
-/**
- * @param {import('@babel/traverse').NodePath<import('@babel/types').CallExpression>} path
- */
-module.exports.unwrite = function unwriteMemberExpression(path) {
-  path.replaceWith(path.node.arguments[0]);
-};

package/lib/core/rewrite/object-property.js

@@ -1,46 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const t = require('@babel/types');
-
-/**
- * Wraps computed object properties in `ContrastMethods.__forceCopy`.
- * ```
- * const obj = { [key]: 'value' };
- * // becomes:
- * const obj = { [ContrastMethods.__forceCopy(key)]: 'value' };
- * ```
- * @param {import('@babel/traverse').NodePath<import('@babel/types').Property>} path
- * @param {import('.').State} state
- */
-module.exports = function ObjectProperty(path, state) {
-  if (
-    !state.callees.__forceCopy ||
-    !path.node.computed ||
-    !t.isIdentifier(path.node.key) ||
-    !path.node.value
-  )
-    return;
-
-  state.rewriteLog.logRewrite('__forceCopy');
-  path.replaceWith(
-    t.objectProperty(
-      t.callExpression(state.callees.__forceCopy, [path.node.key]),
-      path.node.value,
-      true
-    )
-  );
-};

package/lib/core/rewrite/prepend-globals.js

@@ -1,48 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { statement } = require('@babel/template');
-const t = require('@babel/types');
-const injections = require('../rewrite/injections');
-
-const safeInjectionBuilder = statement(
-  `const %%name%% = global.%%id%% || %%name%%;`
-);
-const unsafeInjectionBuilder = statement(
-  `const %%id%% = global.%%id%% || (() => { throw new SyntaxError(%%errMessage%%); })();`
-);
-
-/**
- * @param {import('@babel/traverse').NodePath<import('@babel/types').Program} path
- * @param {import('.').State} state
- */
-module.exports = function prependGlobals(path, state) {
-  const injectionStatements = injections.getEnabled().map((injection) =>
-    injection.name
-      ? safeInjectionBuilder({
-          id: injection.id,
-          name: injection.name
-        })
-      : unsafeInjectionBuilder({
-          id: injection.id,
-          errMessage: t.stringLiteral(
-            `${injection.id} undefined during compilation`
-          )
-        })
-  );
-  state.rewriteLog.logRewrite('inject');
-  path.unshiftContainer('body', injectionStatements);
-};