@contrast/agent 4.4.1 → 4.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (156) hide show
  1. package/bin/VERSION +1 -1
  2. package/bin/linux/contrast-service +0 -0
  3. package/bin/mac/contrast-service +0 -0
  4. package/bin/windows/contrast-service.exe +0 -0
  5. package/lib/assess/hapi/route-coverage.js +3 -3
  6. package/lib/assess/membrane/index.js +2 -8
  7. package/lib/assess/membrane/source-membrane.js +3 -4
  8. package/lib/assess/models/base-event.js +2 -2
  9. package/lib/assess/models/call-context.js +0 -3
  10. package/lib/assess/policy/propagators.json +20 -0
  11. package/lib/assess/policy/signatures.json +103 -0
  12. package/lib/assess/propagators/path/common.js +165 -36
  13. package/lib/assess/propagators/path/join.js +5 -1
  14. package/lib/assess/propagators/path/normalize.js +5 -1
  15. package/lib/assess/propagators/path/resolve.js +11 -2
  16. package/lib/assess/response-scanning/autocomplete-missing.js +0 -2
  17. package/lib/assess/response-scanning/parameter-pollution.js +0 -2
  18. package/lib/core/arch-components/dynamodb.js +1 -2
  19. package/lib/core/arch-components/dynamodbv3.js +44 -0
  20. package/lib/core/arch-components/index.js +1 -0
  21. package/lib/core/async-storage/hooks/bluebird.js +20 -0
  22. package/lib/core/config/options.js +3 -2
  23. package/lib/core/express/utils.js +1 -1
  24. package/lib/core/logger/debug-logger.js +15 -17
  25. package/lib/core/stacktrace.js +3 -4
  26. package/lib/feature-set.js +2 -1
  27. package/lib/hooks/encoding.js +1 -1
  28. package/lib/hooks/frameworks/base.js +8 -2
  29. package/lib/hooks/frameworks/http.js +23 -16
  30. package/lib/hooks/frameworks/http2.js +73 -0
  31. package/lib/hooks/frameworks/index.js +8 -3
  32. package/lib/hooks/http.js +112 -128
  33. package/lib/hooks/patcher.js +10 -12
  34. package/lib/hooks/require.js +16 -22
  35. package/lib/instrumentation.js +0 -3
  36. package/lib/protect/analysis/aho-corasick.js +13 -30
  37. package/lib/protect/rules/cmd-injection-command-backdoors/backdoor-detector.js +3 -3
  38. package/lib/protect/rules/signatures/reflected-xss/helpers/function-call.js +1 -1
  39. package/lib/protect/rules/xss/helpers/function-call.js +1 -1
  40. package/lib/util/clean-stack.js +1 -1
  41. package/lib/util/clean-string/brackets.js +3 -3
  42. package/lib/util/clean-string/concatenations.js +1 -1
  43. package/lib/util/clean-string/util.js +1 -2
  44. package/lib/util/ip-analyzer.js +1 -1
  45. package/lib/util/some.js +27 -0
  46. package/lib/util/xml-analyzer/external-entity-finder.js +1 -1
  47. package/package.json +14 -15
  48. package/lib/hooks/frameworks/https.js +0 -42
  49. package/node_modules/bindings/LICENSE.md +0 -22
  50. package/node_modules/bindings/README.md +0 -98
  51. package/node_modules/bindings/bindings.js +0 -221
  52. package/node_modules/bindings/package.json +0 -32
  53. package/node_modules/file-uri-to-path/.npmignore +0 -1
  54. package/node_modules/file-uri-to-path/.travis.yml +0 -30
  55. package/node_modules/file-uri-to-path/History.md +0 -21
  56. package/node_modules/file-uri-to-path/LICENSE +0 -20
  57. package/node_modules/file-uri-to-path/README.md +0 -74
  58. package/node_modules/file-uri-to-path/index.d.ts +0 -2
  59. package/node_modules/file-uri-to-path/index.js +0 -66
  60. package/node_modules/file-uri-to-path/package.json +0 -36
  61. package/node_modules/file-uri-to-path/test/test.js +0 -24
  62. package/node_modules/file-uri-to-path/test/tests.json +0 -13
  63. package/node_modules/glossy/LICENSE +0 -19
  64. package/node_modules/glossy/README.md +0 -129
  65. package/node_modules/glossy/index.js +0 -12
  66. package/node_modules/glossy/lib/glossy/parse.js +0 -520
  67. package/node_modules/glossy/lib/glossy/produce.js +0 -459
  68. package/node_modules/glossy/package.json +0 -47
  69. package/node_modules/glossy/test/decide.js +0 -7
  70. package/node_modules/glossy/test/decode_pri.js +0 -24
  71. package/node_modules/glossy/test/parse_3164.js +0 -104
  72. package/node_modules/glossy/test/parse_5424.js +0 -106
  73. package/node_modules/glossy/test/parse_5848.js +0 -40
  74. package/node_modules/glossy/test/parse_8601.js +0 -14
  75. package/node_modules/glossy/test/parse_rfc3339.js +0 -9
  76. package/node_modules/glossy/test/produce.js +0 -162
  77. package/node_modules/glossy/test/runner.js +0 -40
  78. package/node_modules/glossy/test/structure_data.js +0 -24
  79. package/node_modules/nan/CHANGELOG.md +0 -537
  80. package/node_modules/nan/LICENSE.md +0 -13
  81. package/node_modules/nan/README.md +0 -455
  82. package/node_modules/nan/doc/asyncworker.md +0 -146
  83. package/node_modules/nan/doc/buffers.md +0 -54
  84. package/node_modules/nan/doc/callback.md +0 -76
  85. package/node_modules/nan/doc/converters.md +0 -41
  86. package/node_modules/nan/doc/errors.md +0 -226
  87. package/node_modules/nan/doc/json.md +0 -62
  88. package/node_modules/nan/doc/maybe_types.md +0 -583
  89. package/node_modules/nan/doc/methods.md +0 -664
  90. package/node_modules/nan/doc/new.md +0 -147
  91. package/node_modules/nan/doc/node_misc.md +0 -123
  92. package/node_modules/nan/doc/object_wrappers.md +0 -263
  93. package/node_modules/nan/doc/persistent.md +0 -296
  94. package/node_modules/nan/doc/scopes.md +0 -73
  95. package/node_modules/nan/doc/script.md +0 -38
  96. package/node_modules/nan/doc/string_bytes.md +0 -62
  97. package/node_modules/nan/doc/v8_internals.md +0 -199
  98. package/node_modules/nan/doc/v8_misc.md +0 -85
  99. package/node_modules/nan/include_dirs.js +0 -1
  100. package/node_modules/nan/nan.h +0 -2898
  101. package/node_modules/nan/nan_callbacks.h +0 -88
  102. package/node_modules/nan/nan_callbacks_12_inl.h +0 -514
  103. package/node_modules/nan/nan_callbacks_pre_12_inl.h +0 -520
  104. package/node_modules/nan/nan_converters.h +0 -72
  105. package/node_modules/nan/nan_converters_43_inl.h +0 -68
  106. package/node_modules/nan/nan_converters_pre_43_inl.h +0 -42
  107. package/node_modules/nan/nan_define_own_property_helper.h +0 -29
  108. package/node_modules/nan/nan_implementation_12_inl.h +0 -430
  109. package/node_modules/nan/nan_implementation_pre_12_inl.h +0 -263
  110. package/node_modules/nan/nan_json.h +0 -166
  111. package/node_modules/nan/nan_maybe_43_inl.h +0 -356
  112. package/node_modules/nan/nan_maybe_pre_43_inl.h +0 -268
  113. package/node_modules/nan/nan_new.h +0 -340
  114. package/node_modules/nan/nan_object_wrap.h +0 -156
  115. package/node_modules/nan/nan_persistent_12_inl.h +0 -132
  116. package/node_modules/nan/nan_persistent_pre_12_inl.h +0 -242
  117. package/node_modules/nan/nan_private.h +0 -73
  118. package/node_modules/nan/nan_string_bytes.h +0 -305
  119. package/node_modules/nan/nan_typedarray_contents.h +0 -96
  120. package/node_modules/nan/nan_weak.h +0 -437
  121. package/node_modules/nan/package.json +0 -41
  122. package/node_modules/nan/tools/1to2.js +0 -412
  123. package/node_modules/nan/tools/README.md +0 -14
  124. package/node_modules/nan/tools/package.json +0 -19
  125. package/node_modules/unix-dgram/LICENSE +0 -13
  126. package/node_modules/unix-dgram/README.md +0 -107
  127. package/node_modules/unix-dgram/binding.gyp +0 -20
  128. package/node_modules/unix-dgram/build/Makefile +0 -324
  129. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram/src/unix_dgram.o.d +0 -58
  130. package/node_modules/unix-dgram/build/Release/.deps/Release/obj.target/unix_dgram.node.d +0 -1
  131. package/node_modules/unix-dgram/build/Release/.deps/Release/unix_dgram.node.d +0 -1
  132. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram/src/unix_dgram.o +0 -0
  133. package/node_modules/unix-dgram/build/Release/obj.target/unix_dgram.node +0 -0
  134. package/node_modules/unix-dgram/build/Release/unix_dgram.node +0 -0
  135. package/node_modules/unix-dgram/build/binding.Makefile +0 -6
  136. package/node_modules/unix-dgram/build/config.gypi +0 -213
  137. package/node_modules/unix-dgram/build/unix_dgram.target.mk +0 -159
  138. package/node_modules/unix-dgram/lib/unix_dgram.js +0 -168
  139. package/node_modules/unix-dgram/package.json +0 -36
  140. package/node_modules/unix-dgram/src/unix_dgram.cc +0 -404
  141. package/node_modules/unix-dgram/src/win_dummy.cc +0 -7
  142. package/node_modules/unix-dgram/test/test-connect-callback.js +0 -68
  143. package/node_modules/unix-dgram/test/test-connect.js +0 -53
  144. package/node_modules/unix-dgram/test/test-dgram-unix.js +0 -58
  145. package/node_modules/unix-dgram/test/test-send-error.js +0 -26
  146. package/node_modules/winston-syslog/.eslintrc +0 -7
  147. package/node_modules/winston-syslog/.travis.yml +0 -14
  148. package/node_modules/winston-syslog/CHANGELOG.md +0 -9
  149. package/node_modules/winston-syslog/LICENSE +0 -20
  150. package/node_modules/winston-syslog/README.md +0 -135
  151. package/node_modules/winston-syslog/lib/utils.js +0 -26
  152. package/node_modules/winston-syslog/lib/winston-syslog.js +0 -385
  153. package/node_modules/winston-syslog/package.json +0 -56
  154. package/node_modules/winston-syslog/test/format-test.js +0 -122
  155. package/node_modules/winston-syslog/test/syslog-test.js +0 -95
  156. package/node_modules/winston-syslog/test/unix-connect-test.js +0 -133
package/bin/VERSION CHANGED
@@ -1 +1 @@
1
- 2.26.0
1
+ 2.27.3
Binary file
Binary file
Binary file
@@ -151,9 +151,9 @@ class RouteCoverage {
151
151
  */
152
152
  createSignature({ method, path }) {
153
153
  let signature = 'server.route({ method: ';
154
- Array.isArray(method)
155
- ? (signature += `["${method.join('", "')}"]`)
156
- : (signature += `"${method}"`);
154
+ signature += Array.isArray(method)
155
+ ? `["${method.join('", "')}"]`
156
+ : `"${method}"`;
157
157
 
158
158
  signature += `, path: "${path}" })`;
159
159
  return signature;
@@ -280,10 +280,6 @@ class Membrane {
280
280
  return this.wrapArray(target, metadata);
281
281
  }
282
282
 
283
- // Object.defineProperty(target, util.inspect.custom, {
284
- // target: typeof target === 'string' ? () => `'${target}'` : () => target
285
- // });
286
-
287
283
  return this.wrapObject(target, metadata);
288
284
  }
289
285
  }
@@ -310,12 +306,10 @@ function makeHandler(membrane, metadata) {
310
306
  // https://www.ecma-international.org/ecma-262/7.0/#sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
311
307
  // satisfy invariant
312
308
  const desc = Object.getOwnPropertyDescriptor(tar, prop);
313
- // if (desc && (desc.writable || desc.set || desc.configurable)) {
314
309
  if (desc && desc.configurable) {
315
310
  r = membrane.wrap(r, copyMetadata(tar, prop, metadata));
316
- } else {
317
- // invariant case; can't wrap
318
- }
311
+ } // else: invariant case; can't wrap
312
+
319
313
  return r;
320
314
  },
321
315
 
@@ -294,10 +294,9 @@ module.exports = class SourceMembrane extends Membrane {
294
294
  if (!(metadata.sourceType && metadata.path)) {
295
295
  return false;
296
296
  }
297
- const koaQueryString = metadata.path.match(/(\w+)=/);
298
- if (koaQueryString) {
299
- // get 1st capture group, fall back to `metadata.path` if for some reason this does not exist
300
- metadata.path = koaQueryString[1] || metadata.path;
297
+ const koaQueryString = metadata.path.split('=');
298
+ if (koaQueryString[1]) {
299
+ metadata.path = koaQueryString[0];
301
300
  }
302
301
  return true;
303
302
  }
@@ -166,7 +166,7 @@ class BaseEvent {
166
166
  * @return {BaseEvent[]} sorted list of events
167
167
  */
168
168
  function sortEvents(events) {
169
- const sorted = events.sort((a, b) => {
169
+ events.sort((a, b) => {
170
170
  let parentsfactor = 0;
171
171
  if (a.parents.length > b.parents.length) {
172
172
  parentsfactor = -1;
@@ -184,7 +184,7 @@ function sortEvents(events) {
184
184
  return parentsfactor + timefactor;
185
185
  });
186
186
 
187
- return sorted;
187
+ return events;
188
188
  }
189
189
 
190
190
  module.exports = BaseEvent;
@@ -153,9 +153,6 @@ module.exports = class CallContext {
153
153
  return value.toString();
154
154
  }
155
155
 
156
- // FIXME
157
- // if value === JSON, if value === Buffer, etc to put proper constructor name for static methods?
158
-
159
156
  const constructorName = _.get(value, 'constructor.name', 'null');
160
157
 
161
158
  if (constructorName === 'Object' && value) {
@@ -67,6 +67,26 @@
67
67
  "type": "keep"
68
68
  }
69
69
  },
70
+ "dust.escapeHtml": {
71
+ "enabled": true,
72
+ "source": "P",
73
+ "target": "R",
74
+ "tags": ["html-encoded"],
75
+ "type": "overload",
76
+ "command": {
77
+ "type": "keep"
78
+ }
79
+ },
80
+ "dust.escapeJs": {
81
+ "enabled": true,
82
+ "source": "P",
83
+ "target": "R",
84
+ "tags": ["javascript-encoded"],
85
+ "type": "overload",
86
+ "command": {
87
+ "type": "keep"
88
+ }
89
+ },
70
90
  "pug.compile": {
71
91
  "enabled": true,
72
92
  "provider": "./propagators/pug-compile.js"