@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/core/rewrite/rewrite-log.js

@@ -1,74 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * Helper class that provides some means of optimizing the rewrite process.
- * Before we build and traverse an AST, we can use this to scan for any
- * tokens we're configured to rewrite and bail early if they aren't in the code.
- * This is especially useful for Protect mode - where we only need to rewrite
- * instances of "eval", which is not likely to occur in most files anyway.
- * As we traverse the AST and make our rewrites, we log which ones occurred.
- * If we end up not rewriting anything (even though we scanned and found tokens),
- * we can still just return the original code unaltered.
- */
-module.exports = class RewriteLog {
-  constructor(specs, callees, codeString) {
-    this.aborted = false;
-    this._tokensRewritten = {};
-    this._tokenMatches = specs.reduce(
-      (matches, spec) =>
-        callees[spec.name]
-          ? Object.assign(matches, {
-              [spec.name]: !spec.token || 0 <= codeString.indexOf(spec.token)
-            })
-          : matches,
-      {}
-    );
-  }
-
-  /**
-   * Documents that there was a rewrite that occurred for
-   * the callee of the given name.
-   * @param {String} name
-   */
-  logRewrite(name) {
-    /* Please, no pollution. */
-    if (!this._tokenMatches[name]) return;
-    this._tokensRewritten[name] = true;
-  }
-
-  /**
-   * Returns, based on the callees provided, whether any of
-   * their associated symbols were found in the code string.
-   * This gives a quick way to determine, base on our config,
-   * if we need to even rewrite the code at all.
-   */
-  foundTokens() {
-    return Object.values(this._tokenMatches).some(Boolean);
-  }
-
-  /**
-   * During the rewriting process we log which rewrites took
-   * place. This returns whether we made any modifications.
-   * In reality we might scan the code for tokens and find
-   * them, but they might be in comments or do not warrent
-   * rewriting e.g. '<a>' + 'Title' + '<a>'. If we did not
-   * make changes, we can just return original code.
-   */
-  rewritesOccurred() {
-    return !this.aborted && Object.values(this._tokensRewritten).some(Boolean);
-  }
-};

package/lib/core/rewrite/switch-statement.js

@@ -1,71 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const t = require('@babel/types');
-
-/**
- * Wraps non-literal discriminants and case tests in `ContrastMethods.__cast`.
- * ```
- * switch(key) {
- *  case obj[dynamic]:
- *    // do stuff
- *  case dynamic:
- *    // do stuff
- *  case 'literal':
- *    // do stuff
- * }
- * // becomes:
- * switch(ContrastMethods.__cast(key)) {
- *  case ContrastMethods.__cast(obj[dynamic]):
- *    // do stuff
- *  case ContrastMethods.__cast(dynamic):
- *    // do stuff
- *  case 'literal':
- *   // do stuff
- * }
- * ```
- * @param {import('@babel/traverse').NodePath<import('@babel/types').SwitchStatement>} path
- * @param {import('.').State} state
- */
-module.exports = function SwitchStatement(path, state) {
-  if (!state.callees.__cast) return;
-  let rewritten = false;
-
-  if (!t.isLiteral(path.node.discriminant)) {
-    rewritten = true;
-    path.node.discriminant = t.callExpression(state.callees.__cast, [
-      path.node.discriminant
-    ]);
-  }
-
-  path.node.cases = path.node.cases.map((c) => {
-    if (!c.test || t.isLiteral(c.test)) return c;
-
-    rewritten = true;
-    c.test = t.callExpression(state.callees.__cast, [c.test]);
-    return c;
-  });
-
-  if (!rewritten) return;
-  state.rewriteLog.logRewrite('__cast');
-};
-
-/**
- * @param {import('@babel/traverse').NodePath<import('@babel/types').CallExpression>} path
- */
-module.exports.unwrite = function unwriteSwitchStatement(path) {
-  path.replaceWith(path.node.arguments[0]);
-};

package/lib/core/rewrite/template-literal.js

@@ -1,64 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const t = require('@babel/types');
-const isContrastMethod = require('./is-contrast-method');
-
-const SKIP = Symbol('SKIP');
-module.exports.SKIP = SKIP;
-
-/**
- * Rewrites template literals to `ContrastMethods.__contrastTag` tagged template
- * expressions.
- * ```
- * const str = `hello ${name}`;
- * // becomes
- * const str = ContrastMethods.__contrastTag`hello ${name}`;
- * ```
- * @param {import('@babel/traverse').NodePath<import('@babel/types').TemplateLiteral>} path
- * @param {import('.').State} state
- */
-module.exports = function TemplateLiteral(path, state) {
-  if (!state.callees.__contrastTag || path.node[SKIP]) return;
-
-  state.rewriteLog.logRewrite('__contrastTag');
-  const taggedTemplateExpression = t.taggedTemplateExpression(
-    state.callees.__contrastTag,
-    path.node
-  );
-  // Prevents an error where the new taggedTemplateExpression quasi is traversed again.
-  taggedTemplateExpression.quasi[SKIP] = true;
-  path.replaceWith(taggedTemplateExpression);
-};
-
-/**
- * We want to avoid rewriting the template literals in the quasi of a template expression because, in theory,
- * all propagation we need will be handled inside the function, which we're already rewriting.
- * So, we add a SKIP property to the quasi. When the leave pass of traversal runs, TemplateLiterals will
- * check for SKIP to know that they are the children of a TaggedTemplateExpression.
- * @param {import('@babel/traverse').NodePath<import('@babel/types').TaggedTemplateExpression>} path
- */
-module.exports.skip = function skipTemplateLiteral(path) {
-  path.node.quasi[SKIP] = true;
-};
-
-/**
- * @param {import('@babel/traverse').NodePath<import('@babel/types').TaggedTemplateExpression>} path
- */
-module.exports.unwrite = function unwriteTemplateLiteral(path) {
-  if (!isContrastMethod(path.node.tag)) return;
-  path.replaceWith(path.node.quasi);
-};

package/lib/core/stacktrace.js

@@ -1,221 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const semver = require('semver');
-const agent = require('../agent');
-const process = require('process');
-const sourceMap = require('../util/source-map');
-const _isAgentPath = require('../util/is-agent-path');
-
-const STACK_TRACE_LIMIT = agent.config.agent.stack_trace_limit;
-const EVAL_ORIGIN_REGEX = /\((.*?):(\d+):\d+\)/;
-const EVENTS_FILE = semver.gte(process.version, '16.0.0')
-  ? 'node:events'
-  : 'events.js';
-
-/**
- * The factory will set stacktrace limit for stackframe lists created by it.
- * @param {number} stackTraceLimit set the stack trace limit
- * @param {function} isAgentPath function indicating if path is agent code
- */
-class Factory {
-  constructor({
-    stackTraceLimit = STACK_TRACE_LIMIT,
-    isAgentPath = _isAgentPath
-  } = {}) {
-    this.stackTraceLimit = stackTraceLimit;
-    this.isAgentPath = isAgentPath;
-  }
-
-  /**
-   * Creates a function that will build a stacktrace when invoked. It will keep
-   * an error in a closure whose stack will be generated and processed when the
-   * returned function executes. The result will be cached.
-   * @param {object} params
-   * @param {function} params.limitFn The constructorOpt param used when creating stack
-   * @returns {function}
-   */
-  createSnapshot({ constructorOpt, prependFrames } = {}) {
-    const { isAgentPath } = this;
-    const target = {};
-
-    this.appendStackGetter(target, constructorOpt);
-
-    let ret;
-
-    /**
-     * Generates array of frames from `target`'s `stack` getter
-     * @returns {array}
-     */
-    return function snapshot() {
-      if (!ret) {
-        const eventFrames = [];
-        const clsFrames = [];
-        const callsites = Factory.generateCallsites(target);
-
-        // eslint-disable-next-line complexity
-        ret = (callsites || []).reduce((acc, callsite) => {
-          if (Factory.isCallsiteValid(callsite)) {
-            const frame = Factory.makeFrame(callsite);
-
-            if (
-              frame.file &&
-              !`${frame.type}${frame.method}`.includes('ContrastMethods')
-            ) {
-              const isAgentFrame = isAgentPath(frame.file);
-              const isAgentEmitter = frame.type === 'AgentEmitter';
-
-              // Filter out cls-hooked code called by the agent
-              if (frame.file.indexOf('cls-hooked') !== -1) {
-                clsFrames.push(frame);
-                return acc;
-              } else {
-                if (isAgentFrame) {
-                  clsFrames.length = 0;
-                } else {
-                  clsFrames.length && acc.push(...clsFrames);
-                }
-              }
-
-              // Filter out AgentEmitter and any event.js code for it
-              if (frame.file === EVENTS_FILE) {
-                eventFrames.push(frame);
-                return acc;
-              } else {
-                if (isAgentEmitter) {
-                  eventFrames.length = 0;
-                } else {
-                  eventFrames.length && acc.push(...eventFrames);
-                }
-              }
-
-              // Finally add any non-agent frames
-              if (!isAgentFrame && !isAgentEmitter) {
-                acc.push(frame);
-              }
-            }
-          }
-
-          return acc;
-        }, []);
-      }
-
-      return prependFrames ? [...prependFrames, ...ret] : ret;
-    };
-  }
-
-  /**
-   * Based on stacktrace limit and constructor opt, will append a stack getter
-   * @param {} error
-   * @param {} limitFn
-   */
-  appendStackGetter(error, constructorOpt) {
-    const { stackTraceLimit } = Error;
-    Error.stackTraceLimit = this.stackTraceLimit;
-    Error.captureStackTrace(error, constructorOpt);
-    Error.stackTraceLimit = stackTraceLimit;
-  }
-
-  static isCallsiteValid(callsite) {
-    return callsite instanceof Callsite;
-  }
-
-  /**
-   * Creates an array frame objects from an array of Callsite instances
-   * @param {} callsite
-   * @returns {}
-   */
-  static makeFrame(callsite) {
-    let evalOrigin;
-    let file;
-    let lineNumber;
-    let columnNumber;
-
-    if (callsite.isEval()) {
-      evalOrigin = Factory.formatFileName(callsite.getEvalOrigin());
-
-      const match = evalOrigin.match(EVAL_ORIGIN_REGEX);
-      if (match) {
-        [, file, lineNumber, columnNumber] = match;
-      }
-    }
-
-    file = file || callsite.getFileName();
-    lineNumber = lineNumber || callsite.getLineNumber();
-    columnNumber = columnNumber || callsite.getColumnNumber();
-
-    let mappedData;
-    if (sourceMap.util) {
-      mappedData = sourceMap.util.applyMap(file, lineNumber, columnNumber);
-    }
-
-    if (mappedData) {
-      ({ lineNumber, file } = mappedData);
-    }
-
-    return {
-      eval: evalOrigin,
-      file,
-      lineNumber,
-      method: callsite.getFunctionName(),
-      type: callsite.getTypeName()
-    };
-  }
-
-  static formatFileName(fileName = '') {
-    const cwd = `${process.cwd()}/`;
-    const idx = fileName.indexOf(cwd);
-
-    if (idx > -1) {
-      return fileName.replace(cwd, ''); // + 1 to remove /
-    }
-    return fileName;
-  }
-
-  /**
-   * Will access `stack` getter propery on the provided error to generate
-   * a stacktrace. We capture the callsite instances passed to `prepareStacktrace`
-   * using an ephemeral monkey patch.
-   * @param {object} error object with a `stack` getter property
-   * @returns {}
-   */
-  static generateCallsites(error) {
-    let callsites;
-
-    const { prepareStackTrace } = Error;
-
-    Error.prepareStackTrace = function(_, _callsites) {
-      callsites = _callsites;
-      return _callsites;
-    };
-
-    // accessing the getter will call `Error.prepareStacktrace`
-    error.stack;
-
-    // restore original method
-    Error.prepareStackTrace = prepareStackTrace;
-
-    return callsites;
-  }
-}
-
-module.exports.Factory = Factory;
-module.exports.generateCallsites = Factory.generateCallsites;
-module.exports.singleton = new Factory();
-
-const Callsite = (module.exports.Callsite = Factory.generateCallsites(
-  new Error()
-)[0].constructor);

package/lib/coverage.js

@@ -1,158 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const _ = require('lodash');
-const { AsyncStorage, KEYS } = require('./core/async-storage');
-const agentEmitter = require('./agent-emitter');
-const logger = require('./core/logger')('contrast:coverage');
-const RouteCoverage = require('./reporter/models/route-coverage');
-
-class RouteCoverageInfo {
-  constructor() {
-    logger.debug('enabling coverage features');
-    this.emitter = agentEmitter;
-    this.routeInfo = new Map();
-    this.discovered = new Set();
-    this.registerListeners();
-  }
-
-  /**
-   * Registers route-discovery and route-observation
-   * events to format/emit other events for discovery
-   * and observations
-   */
-  registerListeners() {
-    this.emitter.on('route-discovery', (event) => {
-      this.discover(event);
-    });
-
-    this.emitter.on(
-      'route-observation',
-      ({ id, url, verb, stack, discoveryMethod }) => {
-        const info = { id, url, verb };
-        const observed = this.observe({
-          info,
-          stack,
-          sensor: this,
-          discoveryMethod
-        });
-
-        if (observed) {
-          // used to attach observation to a Finding
-          AsyncStorage.set(KEYS.ROUTE, observed);
-          this.clearObservations(id);
-        }
-      }
-    );
-  }
-
-  /**
-   * Add RouteCoverage to routeInfo map to be used to
-   * lookup signature in route observation.  Keep track of
-   * all the signatures discovered during this AppUpdate iteration
-   * @param {Object} infos Route discovery data
-   */
-  discover(infos) {
-    if (_.isEmpty(infos) || !_.isObject(infos)) {
-      return;
-    }
-
-    for (const id of Object.keys(infos)) {
-      const info = infos[id];
-
-      this.routeInfo.set(id, new RouteCoverage(info));
-
-      this.discovered.add(id);
-    }
-  }
-
-  /**
-   * Gets the signature from routeInfo, calls discoveryMethod
-   * if it was not discovered and a discoveryMethod exists(dynamic route
-   * registrations in Express/Kraken). Appends observations for Findings
-   * and returns the serialized RouteCoverage to be used for observation
-   * @param {Object} info   The route info being updated
-   * @returns {Object} The up-to-date DTM
-   */
-  observe({ info, stack, sensor, discoveryMethod }) {
-    if (_.isEmpty(info) || !_.isObject(info)) {
-      return null;
-    }
-
-    const { id } = info;
-    const discovered = this.routeInfo.has(id);
-
-    // this is for Express/Kraken where routes
-    // are defined after the initial startup
-    // rediscover what is in the stack
-    if (!discovered && discoveryMethod) {
-      discoveryMethod(sensor, stack);
-    }
-
-    const route = this.routeInfo.get(id);
-    if (!route) {
-      logger.debug('Unable to observe routes not discovered %j', info);
-      return null;
-    }
-
-    route.addObservation(info);
-
-    return route.toSerializable();
-  }
-
-  /**
-   * Removes the observations on a route
-   * after the observations are reported
-   */
-  clearObservations(id) {
-    const route = this.routeInfo.get(id);
-
-    if (route) {
-      route.observations = [];
-    }
-  }
-
-  /**
-   * Clear routes discovered after being reported
-   */
-  clearRoutes() {
-    this.discovered.clear();
-  }
-
-  /**
-   * Returns all route DTMs that have been reported since last reset.
-   * We store routes internally by an ID that we generate.
-   * @returns {RouteCoverageDTM[]}
-   */
-  getReport() {
-    const report = new Map();
-
-    for (const id of this.discovered) {
-      const { signature } = this.routeInfo.get(id);
-      const existing = report.get(signature);
-      if (!existing) {
-        report.set(signature, { signature });
-      }
-    }
-
-    return Array.from(report.values());
-  }
-}
-
-let coverage;
-module.exports = function memoizedRouteCoverage() {
-  if (!coverage) coverage = new RouteCoverageInfo();
-  return coverage;
-};