@contrast/agent 4.4.0-beta.0 → 4.4.1

package/lib/assess/models/tag-range/index.js

@@ -14,7 +14,6 @@ Copyright: 2021 Contrast Security, Inc
 */
 'use strict';
 
-const _ = require('lodash');
 const logger = require('../../../core/logger')('contrast:tagRange');
 
 const Relationships = require('./relationships');
@@ -27,14 +26,13 @@ const DEFAULT_TAG = 'untrusted';
  */
 class TagRange {
   /**
-   * Validates the arguments to the contructor call.
-   * @param {number} start The starting index to track.
-   * @param {number} stop  The stopping index to track.
-   * @param {string} tag   The name of the tag.
+   * @param {number} start The starting index of string tracking on the data having the tag.
+   * @param {number} stop  The stopping index of string tracking on the data having the tag.
+   * @param {string?} tag  The name of the tag (default is "untrusted").
    */
-  static validate(start, stop, tag = DEFAULT_TAG) {
-    const bothFinite = _.isFinite(start) && _.isFinite(stop);
-    if (start > stop || !bothFinite) {
+  constructor(start, stop, tag = DEFAULT_TAG) {
+    // Validates the arguments to the contructor call.
+    if (!(start <= stop && start >= 0)) {
       logger.debug(
         'could not create tag %s with invalid range start: %s, stop %s.',
         tag,
@@ -42,15 +40,7 @@ class TagRange {
         stop
       );
     }
-  }
 
-  /**
-   * @param {number} start The starting index of string tracking on the data having the tag.
-   * @param {number} stop  The stopping index of string tracking on the data having the tag.
-   * @param {string?} tag  The name of the tag (default is "untrusted").
-   */
-  constructor(start, stop, tag = DEFAULT_TAG) {
-    TagRange.validate(start, stop, tag);
     /** @type {string} */
     this.tag = tag;
     /** @type {number} */

package/lib/assess/policy/signatures.json

@@ -397,11 +397,13 @@
     },
     "ejs.Template.prototype.generateSource": {
       "moduleName": "ejs",
+      "version": ">=2.6.2",
       "methodName": "Template.prototype.generateSource",
       "isModule": true
     },
     "ejs.utils.escapeXML": {
       "moduleName": "ejs",
+      "version": ">=2.6.2",
       "fileName": "lib/utils.js",
       "methodName": "escapeXML",
       "isModule": true

package/lib/assess/policy/util.js

@@ -372,12 +372,19 @@ utils.createHookFromSignature = function(signature, options, patchType) {
       requireHook.resolve(
         {
           name: signature.moduleName,
-          file: signature.fileName
+          file: signature.fileName,
+          version: signature.version
         },
         requireCallback
       );
     } else {
-      requireHook.resolve({ name: signature.moduleName }, requireCallback);
+      requireHook.resolve(
+        {
+          name: signature.moduleName,
+          version: signature.version
+        },
+        requireCallback
+      );
     }
   } else {
     const mod = global[signature.moduleName],

package/lib/assess/sinks/mongodb.js

@@ -33,6 +33,7 @@ const { PATCH_TYPES } = require('../../constants');
 const requireHook = require('../../hooks/require');
 const { Signature, CallContext } = require('../models');
 const policy = require('../policy');
+const Scopes = require('../../core/async-storage/scopes');
 
 const ruleId = 'nosql-injection';
 const disallowedTags = [
@@ -268,13 +269,16 @@ module.exports = ({ common }) => {
    */
   mongoSink.assess = (query, context) => {
     const searchDepth = 3;
-
-    const vulnerableString = common.isVulnerable({
-      searchDepth,
-      disallowedTags,
-      requiredTags,
-      input: query
-    });
+    let vulnerableString;
+
+    Scopes.runInAllowAllScope(() => {
+      vulnerableString = common.isVulnerable({
+        searchDepth,
+        disallowedTags,
+        requiredTags,
+        input: query
+      });
+    }, 'mongodbSink.assess');
 
     if (vulnerableString) {
       mongoSink.report(vulnerableString, context);

package/node_modules/unix-dgram/build/Makefile

@@ -309,7 +309,7 @@ endif
 
 quiet_cmd_regen_makefile = ACTION Regenerating $@
 cmd_regen_makefile = cd $(srcdir); /opt/hostedtoolcache/node/12.22.6/x64/lib/node_modules/npm/node_modules/node-gyp/gyp/gyp_main.py -fmake --ignore-environment "-Dlibrary=shared_library" "-Dvisibility=default" "-Dnode_root_dir=/home/runner/.cache/node-gyp/12.22.6" "-Dnode_gyp_dir=/opt/hostedtoolcache/node/12.22.6/x64/lib/node_modules/npm/node_modules/node-gyp" "-Dnode_lib_file=/home/runner/.cache/node-gyp/12.22.6/<(target_arch)/node.lib" "-Dmodule_root_dir=/home/runner/work/node-agent/node-agent/target/node_modules/unix-dgram" "-Dnode_engine=v8" "--depth=." "-Goutput_dir=." "--generator-output=build" -I/home/runner/work/node-agent/node-agent/target/node_modules/unix-dgram/build/config.gypi -I/opt/hostedtoolcache/node/12.22.6/x64/lib/node_modules/npm/node_modules/node-gyp/addon.gypi -I/home/runner/.cache/node-gyp/12.22.6/include/node/common.gypi "--toplevel-dir=." binding.gyp
-Makefile: $(srcdir)/binding.gyp $(srcdir)/../../../../../../../../opt/hostedtoolcache/node/12.22.6/x64/lib/node_modules/npm/node_modules/node-gyp/addon.gypi $(srcdir)/../../../../../../.cache/node-gyp/12.22.6/include/node/common.gypi $(srcdir)/build/config.gypi
+Makefile: $(srcdir)/../../../../../../../../opt/hostedtoolcache/node/12.22.6/x64/lib/node_modules/npm/node_modules/node-gyp/addon.gypi $(srcdir)/../../../../../../.cache/node-gyp/12.22.6/include/node/common.gypi $(srcdir)/binding.gyp $(srcdir)/build/config.gypi
 	$(call do_cmd,regen_makefile)
 
 # "all" is a concatenation of the "all" targets from all the included

package/node_modules/unix-dgram/build/config.gypi

@@ -126,7 +126,7 @@
     "progress": "",
     "https_proxy": "",
     "save_prod": "",
-    "npm_session": "122c0d87d87563f8",
+    "npm_session": "fb860f4007af86fc",
     "audit": "true",
     "cidr": "",
     "onload_script": "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.4.0-beta.0",
+  "version": "4.4.1",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",
@@ -74,7 +74,7 @@
     "@contrast/fn-inspect": "^2.4.2",
     "@contrast/heapdump": "^1.1.0",
     "@contrast/protobuf-api": "^3.2.0",
-    "@contrast/require-hook": "^2.0.4",
+    "@contrast/require-hook": "^2.0.5",
     "@contrast/synchronous-source-maps": "^1.1.0",
     "amqp-connection-manager": "^3.2.2",
     "amqplib": "^0.8.0",