@contrast/agent 4.32.19 → 5.0.0-alpha.10

package/lib/reporter/models/request.js

@@ -1,288 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { get } = require('lodash');
-const { PROXY_TARGET } = require('../../constants');
-const querystring = require('querystring');
-const cookie = require('cookie');
-const { IncomingMessage } = require('http');
-
-/**
- * When certain source events are emitted for a given
- * framework, the IncomingMessage is either req
- * or some lower level path.
- *
- * @param {Object} req IncomingMessage or Framework req/ctx
- * @param {string} altPath alternative path for IncomingMessage (e.g - 'raw.req')
- * @return {import('http').IncomingMessage}
- */
-function findIncomingMessage(req, altPath) {
-  // FIXME: Replace lodash get function with a native one
-  return req instanceof IncomingMessage ? req : get(req, altPath);
-}
-
-/**
- * Model of request objects sent to TeamServer
- */
-class Request {
-  /**
-   * @param {Object} req the raw request object
-   * @param {string} rawLocations
-   */
-  constructor(req, rawLocations) {
-    const raw = findIncomingMessage(req, rawLocations);
-
-    if (raw) {
-      /** @type {import('http').IncomingMessage} */
-      this._raw = raw;
-
-      /**
-       * express overrides IncomingMessage.url, boo them
-       * @type {string}
-       */
-      const url = raw.originalUrl || raw.url;
-
-      const [uri, queryString] = Request.splitUrl(url);
-      this.uri = uri;
-
-      /** @type {string} */
-      this.queryString = queryString;
-
-      /**
-       * http version
-       * @type {string}
-       */
-      this.version = raw.httpVersion;
-
-      /** @type {string} */
-      this.method = raw.method;
-
-      /** @type {Object<string, string>} */
-      this.headers = raw.headers;
-
-      if (raw.headers) {
-        /** @type {string} */
-        this.content_type = raw.headers['content-type'];
-
-        /** @type {string} */
-        this.user_agent = raw.headers['user-agent'];
-
-        /** @type {Object<string, string>} */
-        this.cookies = cookie.parse(raw.headers.cookie || '');
-      }
-
-      /** @type {string} */
-      this.protocol = raw.socket && raw.socket.encrypted ? 'https' : 'http';
-
-      /** @type {string} */
-      this.ip = this.resolveIp();
-
-      /** @type {string} */
-      this.port = this.resolvePort();
-
-      // START OF UNKNOWN VARS
-      /** @type {any} */
-      this.serverVersionInfo = null;
-      // END OF UNKNOWN VARS
-
-      // ---- these are added by framework specific implementations ----
-
-      /** @type {string} */
-      this.body = undefined;
-
-      /** @type {Object} */
-      this.parameters = undefined;
-
-      /** @type {string} */
-      this.normalizedUri = undefined;
-    }
-  }
-
-  set parameters(params) {
-    this._params = params || {};
-  }
-
-  get parameters() {
-    return this._params;
-  }
-
-  get body() {
-    return this._body;
-  }
-
-  set body(body) {
-    this._body = !body || !Object.keys(body).length ? null : body;
-  }
-
-  get queryParams() {
-    return querystring.parse(this.queryString);
-  }
-
-  serializeBody() {
-    if (!this.body) {
-      return null;
-    }
-    let { body } = this;
-    const proxied = this.body[PROXY_TARGET];
-    if (proxied) {
-      body = proxied.target;
-    }
-    /*
-     * request body serialization
-     *
-     * If the request is x-www-form-urlencoded url encode it so SR
-     * can perform sensitive data masking (need to re-encode b/c body parsing
-     * does decoding).  TODO - should this only be done if SR is enabled?
-     *
-     * Otherwise just JSON.stringify it so it can be sent over the wire.  Note
-     * this isn't actually the raw body but is what we've done historically.
-     */
-    if (
-      this.content_type &&
-      this.content_type === 'application/x-www-form-urlencoded'
-    ) {
-      return querystring.stringify(body);
-    } else if (
-      !this.content_type &&
-      this.headers['content-type'] === 'application/x-www-form-urlencoded'
-    ) {
-      return querystring.stringify(body);
-    } else {
-      // if the body isn't an object just stringify it as it is
-      if (typeof body !== 'object') {
-        return JSON.stringify(body);
-      }
-
-      // body is an array or an object; it doesn't really matter which,
-      const keys = Object.keys(body);
-      const nominalMaxKeys = 200; // maximum number of keys to display, but
-      const minimumToRemove = 20; // if this many can't be removed don't remove any
-
-      // the point of nominalMaxKeys and minimumToRemove is to avoid removing an
-      // inconsequential number resulting in something like:
-      // {100 kv pairs} (1 removed) {100 kv pairs}
-      // the 10% minimum to remove is arbitrary but does avoid the situation above.
-      let s;
-      if (keys.length > nominalMaxKeys + minimumToRemove) {
-        s = this.stringifyWithOmissions(keys, body, nominalMaxKeys);
-      } else {
-        s = JSON.stringify(body);
-      }
-
-      return s;
-    }
-  }
-
-  stringifyWithOmissions(keys, body, max) {
-    // get the pieces
-    const partSize = Math.trunc(max / 2);
-    const p1 = keys.slice(0, partSize);
-    const p2 = keys.slice(-partSize);
-
-    // get the head part
-    let part = {};
-    for (let i = 0; i < partSize; i++) {
-      part[p1[i]] = body[p1[i]];
-    }
-    const head = JSON.stringify(part);
-
-    // now the tail part
-    part = {};
-    for (let i = 0; i < partSize; i++) {
-      part[p2[i]] = body[p2[i]];
-    }
-    return `${head}...(${keys.length - max} removed)...${JSON.stringify(part)}`;
-  }
-
-  /**
-   * Render the object so that it can be stringified and consumed by TeamServer
-   */
-  toSerializable() {
-    return {
-      body: this.serializeBody(),
-      content_type: this.content_type,
-      cookies: this.cookies,
-      headers: formatMap(this.headers),
-      ip: this.ip,
-      method: this.method,
-      parameters: formatMap(this.parameters),
-      port: this.port,
-      protocol: this.protocol,
-      queryString: this.queryString,
-      serverVersionInfo: this.serverVersionInfo,
-      uri: this.normalizedUri || this.uri,
-      user_agent: this.user_agent,
-      version: this.version
-    };
-  }
-
-  /**
-   * Splits url by ?
-   * @param {string} url
-   * @returns {string[]}
-   */
-  static splitUrl(url = '') {
-    return url.split('?');
-  }
-
-  /** @returns {string} */
-  resolveIp() {
-    let ip;
-
-    ip = this._raw.headers && this._raw.headers['x-forwarded-for'];
-    if (ip) {
-      ip = ip.split(',')[0];
-    } else {
-      ip = (this._raw.socket && this._raw.socket.remoteAddress) || '';
-    }
-
-    return ip.trim();
-  }
-
-  /** @returns {string} */
-  resolvePort() {
-    const port = (this._raw.socket && this._raw.socket.localPort) || 0;
-
-    return port.toString();
-  }
-
-  /**
-   * Only returns the path of the uri, strips query params
-   * @returns {string}
-   */
-  static normalizeURI(url) {
-    return Request.splitUrl(url)[0];
-  }
-}
-
-/**
- * Takes a map of key --> value and changes it to key --> [value]
- * @param {Object<string, string>} obj
- * @returns {Object<string, string[]>}
- */
-function formatMap(obj) {
-  const map = {};
-  for (const key in obj) {
-    if (!(key in map)) {
-      map[key] = [];
-    }
-    map[key].push(obj[key]);
-  }
-
-  return map;
-}
-
-module.exports = Request;

package/lib/reporter/models/route-coverage.js

@@ -1,53 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module lib/reporter/models/AppActivity/RouteCoverage
- */
-
-'use strict';
-const Request = require('./request');
-
-module.exports = class RouteCoverage {
-  /**
-   * @param {Object} info Route discovery data
-   * @param {String} info.id Identifier
-   * @param {String} info.signature Signature-like description
-   */
-  constructor(info = {}) {
-    this.observations = [];
-
-    this.id = info.id;
-    this.signature = info.signature;
-  }
-
-  /**
-   * Adds a route observation DTM to observations
-   * @param {Object} observation The item to add to the collection
-   * @returns {Object[]} The collection
-   */
-  addObservation({ url, verb } = {}) {
-    this.observations.push({
-      url: Request.normalizeURI(url),
-      verb: verb.toUpperCase()
-    });
-  }
-
-  toSerializable() {
-    return {
-      signature: this.signature,
-      observations: this.observations
-    };
-  }
-};

package/lib/reporter/models/startup.js

@@ -1,56 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const {
-  AGENT_INFO: { VERSION }
-} = require('../../constants');
-
-class Startup {
-  constructor(agent) {
-    const { config, appInfo } = agent;
-    const tags = config.server && config.server.tags;
-
-    this.config = agent.config;
-    this.appInfo = agent.appInfo;
-
-    this.version = VERSION;
-
-    if (appInfo.serverEnvironment) {
-      this.environment = appInfo.serverEnvironment;
-    }
-
-    if (tags) {
-      this.tags = tags;
-    }
-  }
-
-  /**
-   * When we send this to TS via HTTP client we assemble it based on what
-   * fields are set from the config.
-   * @returns {Object}
-   */
-  toSerializable() {
-    return Object.assign(
-      {
-        version: this.version,
-        environment: this.environment
-      },
-      this.tags ? { tags: this.tags } : {}
-    );
-  }
-}
-
-module.exports = Startup;

package/lib/reporter/models/trace-event-source.js

@@ -1,38 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * TraceEventSource used for route coverage trace sources.
- */
-class TraceEventSource {
-  /**
-   * @param {String} type type of source (ie header, body, etc.)
-   * @param {String} name key on request object (ie req.query.input is vulnerable `input').
-   */
-  constructor(event) {
-    this.type = event.type.toUpperCase();
-    this.name = event.name;
-  }
-
-  toSerializable() {
-    return {
-      type: this.type,
-      name: this.name
-    };
-  }
-}
-
-module.exports = TraceEventSource;

package/lib/reporter/models/utils/request-factory.js

@@ -1,32 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module
- */
-'use strict';
-
-const Request = require('../request');
-const Scopes = require('../../../core/async-storage/scopes');
-const DEADZONE_NAME = 'request model creation';
-
-/**
- * Builds framework-specific request models in a scope that prevents agent code
- * from running.
- * @param {IncomingMessage} req
- * @param {Function} Ctor Provide framework-specific object constructor
- */
-module.exports.make = function(req, Ctor = Request) {
-  return Scopes.runInNoInstrumentationScope(() => new Ctor(req), DEADZONE_NAME);
-};

package/lib/reporter/models/utils/user-input-factory.js

@@ -1,190 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const flatten = require('@contrast/flat');
-const UserInput = require('../app-activity/user-input');
-const UserInputFactory = module.exports;
-const { get } = require('lodash');
-
-/**
- * Creates a collection of UserInputs from a data object, a set
- * of options, and a depth indicating how far into the tree should
- * the object parser should read.
- * @param   {Object}   data    The user input object, .e.g. HEADER, BODY
- * @param   {Object}   options Specifying UserInput details
- * @returns {UserInput[]}
- */
-function makeWith(data, options) {
-  const { depth } = options;
-
-  const leaves = parseLeavesUpWith(data, depth);
-
-  // take leaves and make collection
-  const flattenedInputs = [leaves].flat(Infinity);
-
-  // filter by inputs that contain value
-  const filteredInputs = flattenedInputs.filter((input) => input.value);
-
-  // group by path
-  const uniqueInputs = [
-    ...new Map(filteredInputs.map((item) => [item.path, item])).values()
-  ];
-
-  // group inputs by their relevant depth in tree
-  // furthest leaf from root and then inward
-  const sortedInputs = uniqueInputs.sort((a, b) => a.depth - b.depth);
-
-  return createUserInputs(sortedInputs, options);
-}
-
-/**
- * Parses an object into UserInput-like objects starting at its leaves
- * and working inward to the specified level of depth.
- * @param   {Object}   data     The user input data to parse
- * @param   {Number}   times    The level of depth
- -- used for recursion only -------------------------------------------
- * @param   {String[]} [paths]  Used by recursion to traverse inward
- * @param   {Object[]} [coll]   Used by recursion to collect return val
- ----------------------------------------------------------------------
- * @returns {Object[]}
- */
-function parseLeavesUpWith(
-  data,
-  times = Infinity,
-  paths = Object.keys(flatten(data)),
-  coll = []
-) {
-  if (times === 0) {
-    return coll;
-  }
-
-  const depth = coll.length;
-
-  if (!paths.length) {
-    coll.push({ depth, value: valueToString(data) });
-    return coll;
-  }
-
-  const inputsAtDepth = getNestedValues({ data, paths, depth });
-  const shortenedPaths = getShortenedPaths(paths);
-
-  coll.push(inputsAtDepth);
-  return parseLeavesUpWith(data, times - 1, shortenedPaths, coll);
-}
-
-/**
- * Builds a collection of UserInput-like objects
- */
-function getNestedValues({ paths, depth, data }) {
-  return paths.reduce((memo, path) => {
-    // FIXME: Replace lodash get function with a native one
-    const value = valueToString(get(data, path));
-    const name = path;
-    if (value) {
-      memo.push({ depth, name, path, value });
-    }
-    return memo;
-  }, []);
-}
-
-/**
- * This is used when we're walking the tree
- * This will cut off the last layer of a path
- * and pass back unique/valid paths to parseLeavesUpWith
- *
- * so path a.b.c.d will now be a.b.c
- *
- * @param {Array} paths array of paths
- */
-function getShortenedPaths(paths) {
-  const shortPaths = paths.map((path) => path.substr(0, path.lastIndexOf('.')));
-
-  const validPaths = shortPaths.filter(Boolean);
-  return [...new Set(validPaths)];
-}
-
-/**
- * Returns the value as a string. If it is empty or a Number/Boolean,
- * then null is returned. If the value is not a string, then its
- * stringified representation is returned.
- * @param   {*}      value
- * @returns {string}
- */
-function valueToString(value) {
-  if (typeof value === 'string') {
-    return value.toString();
-  }
-
-  if (value && typeof value === 'object' && Object.keys(value).length) {
-    return safeStringify(value);
-  }
-
-  return null;
-}
-
-/**
- * JSON.stringify(data) in try-catch
- * @param {*} data to stringify or call toString
- * @returns {string}
- */
-function safeStringify(data) {
-  let string;
-
-  try {
-    string = JSON.stringify(data);
-  } catch (e) {
-    string = data.toString();
-  }
-
-  return string;
-}
-
-/**
- * Iterates over sorted collection of UserInput-like objects
- * merges its data with the passed in options
- *
- * @param {Array} inputs collection of UserInput-like objects
- * @param {Object} options shared options
- * @return {Array} collection of UserInputs
- */
-function createUserInputs(inputs, options) {
-  return inputs.map((input) => new UserInput({ ...options, ...input }));
-}
-
-/**
- * Convenience for only returning the only UserInput
- * as an object not a collection
- */
-UserInputFactory.makeOne = function(data) {
-  return UserInputFactory.make(data.value, data)[0];
-};
-
-/**
- * Creates a collection of UserInputs from a data object, a set
- * of options, and a depth indicating how far into the tree should
- * the object parser should read.
- * @param   {Object} data    The user input object, .e.g. HEADER, BODY
- * @param   {Object} options Specifying UserInput details
- * @returns {UserInput[]}
- */
-UserInputFactory.make = function(data, options) {
-  // no need to traverse a string to build inputs, only 1
-  if (typeof data === 'string') {
-    return createUserInputs([{ value: data }], options);
-  }
-
-  return makeWith(data, options);
-};

package/lib/reporter/models/utils/user-input-kit.js

@@ -1,48 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const UserInputFactory = require('./user-input-factory');
-
-module.exports = class UserInputKit {
-  /**
-   * Keeps an array of inputs per kit
-   * This is to group all relevant UserInput
-   * by depth in JSON
-   */
-  constructor() {
-    this.inputs = [];
-  }
-
-  /**
-   * Creates a collection of UserInput objects in an array by depth
-   *
-   * @param {Rule} rule protect rule
-   * @param {*} data from SourceEvent
-   * @param {string} type type from SourceEvent
-   */
-  create(rule, data, type) {
-    const depth = (rule.policy && rule.policy.inputParseDepth) || 1;
-
-    if (!this.inputs[depth]) {
-      this.inputs[depth] = UserInputFactory.make(data, {
-        depth,
-        type
-      });
-    }
-
-    return this.inputs[depth];
-  }
-};