@contrast/agent 4.32.2 → 4.32.4

package/lib/assess/fastify/sinks/xss.js

@@ -197,7 +197,9 @@ class FastifyXssSink {
       pre(data) {
         // Final check after handler and all hooks have ran
         const replyState = AsyncStorage.get(KEYS.FASTIFY_REPLY_SEND_STATE);
-        const payload = data.args[0] || replyState.payload;
+        const payload = data.args[0] || replyState && replyState.payload;
+
+        if (!payload) return;
 
         if (
           isVulnerable({

package/lib/assess/response-scanning/headers/csp-header-insecure.js

@@ -117,7 +117,12 @@ function formatSource({
   evaluator = isSrcSecure
 }) {
   key = _.camelCase(key);
-  data[`${key}Secure`] = evaluator(sources, defaultSources);
+  const evaluation = evaluator(sources, defaultSources);
+  if (!evaluation && !data.insecure) {
+    data.insecure = true;
+  }
+  data[`${key}Secure`] = evaluation;
+
   data[`${key}Value`] = sources.join(' ');
 }
 
@@ -163,7 +168,21 @@ function check(responseHeaders) {
     return false;
   }
 
-  return checkCspSources(cspHeaders);
+  const data = checkCspSources(cspHeaders);
+
+  if (data.insecure) {
+    // The TS API is expecting this with a typo
+    // temporary we'll send it like this until it is
+    // fixed on their side
+    data.refererSecure = data.referrerSecure;
+    data.refererValue = data.referrerValue;
+
+    delete data.insecure;
+    delete data.referrerSecure;
+    delete data.referrerValue;
+
+    return data;
+  }
 }
 
 module.exports = ({ common }) => ({
@@ -176,7 +195,7 @@ module.exports = ({ common }) => ({
         if (trigger) {
           common.emitFinding({
             request,
-            props: { data: trigger },
+            props: { data: JSON.stringify(trigger) },
             ruleId: RULE_ID
           });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.32.2",
+  "version": "4.32.4",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -28,7 +28,6 @@
     "Yavor Stoychev"
   ],
   "scripts": {
-    "docs": "jsdoc -c ../.jsdoc.json",
     "release": "node scripts/make-release.js",
     "tag": "node scripts/tag-release.js",
     "test:debug": "scripts/test.sh debug",
@@ -121,7 +120,7 @@
     "@bmacnaughton/string-generator": "^1.0.0",
     "@contrast/eslint-config": "^3.0.2",
     "@contrast/fake-module": "file:test/mock/contrast-fake",
-    "@contrast/screener-service": "^1.12.12",
+    "@contrast/screener-service": "^1.12.13",
     "@hapi/boom": "file:test/mock/boom",
     "@hapi/hapi": "file:test/mock/hapi",
     "@ls-lint/ls-lint": "^1.11.2",
@@ -156,7 +155,6 @@
     "inquirer": "^8.1.2",
     "jira-client": "^8.1.0",
     "joi": "^17.4.0",
-    "jsdoc": "^3.6.10",
     "libxmljs": "file:test/mock/libxmljs",
     "libxmljs2": "file:test/mock/libxmljs2",
     "lint-staged": "^12.0.2",