npm - @contrast/agent - Versions diffs - 4.5.2 → 4.8.0 - Mend

@contrast/agent 4.5.2 → 4.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (666) hide show

package/lib/reporter/translations/to-protobuf/dtm/user-input.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/dtm/virtual-patch-details.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/dtm/xss-details.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/dtm/xxe-details.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/index.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/application-settings.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/assess-features.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/auth.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/bot-blocker.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/custom-rule-feature.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/defend-features.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
@@ -33,22 +33,24 @@ function DefendFeatures(defend = {}) {
   const {
     auth,
     botBlockers = [],
-    ipBlacklists = [],
-    ipWhitelists = [],
     logEnhancers = [],
-    ruleDefinitionList = []
+    ruleDefinitionList = [],
+    ipDenylists = [],
+    ipAllowlists = []
   } = defend;
   return wrapToObject(
     new settings.DefendFeatures([
       defend.enabled, //                                             1          enabled
       defend['bot-blocker'], //                                      2      bot_blocker
       botBlockers.map((blocker) => BotBlocker(blocker).array), //    3     bot_blockers
-      ipBlacklists.map((bl) => IpFilter(bl).array), //               4    ip_blacklists
-      ipWhitelists.map((wl) => IpFilter(wl).array), //               5     ip_whitelist
+      undefined, //                                                  4                -
+      undefined, //                                                  5                -
       logEnhancers.map((le) => LogEnhancer(le).array), //            6    log_enhancers (unsupported as of q2-2019)
       ruleDefinitionList.map((def) => RuleDefinition(def).array), // 7 rule_definitions
       Syslog(defend.syslog).array, //                                8           syslog
-      Auth(auth).array //                                            9             auth
+      Auth(auth).array, //                                           9             auth
+      ipDenylists.map((dl) => IpFilter(dl).array), //                10    ip_denylists
+      ipAllowlists.map((al) => IpFilter(al).array) //                11   ip_allowlists
     ]),
     ({ syslog, ruleDefinitionsList }) => {
       ruleDefinitionsList.forEach(({ keywordsList, patternsList }) => {

package/lib/reporter/translations/to-protobuf/settings/exclusions.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
@@ -25,7 +25,6 @@ const {
 function Exclusion({
   assessmentRules,
-  blacklist,
   inputName,
   inputType,
   matchStrategy,
@@ -33,7 +32,8 @@ function Exclusion({
   name,
   rules,
   type,
-  urls
+  urls,
+  denylist
 }) {
   return wrapToObject(
     new settings.Exclusion([
@@ -44,11 +44,12 @@ function Exclusion({
       rules, //                                  5 protection_rules
       assessmentRules, //                        6 assessment_rules
       urls, //                                   7             urls
-      blacklist, //                              8        blacklist
+      undefined, //                              8                -
       ExclusionInputType(inputType), //          9       input_type
       inputName, //                             10       input_name
       modes.includes('assess'), //              11           assess
-      modes.includes('defend') //               12          protect
+      modes.includes('defend'), //              12          protect
+      denylist //                               13         denylist
     ]),
     (exclusion) => {
       exclusion.inputType = EXCLUSION_INPUT_TYPES[exclusion.inputType];

package/lib/reporter/translations/to-protobuf/settings/index.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/input-analysis-result.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/inventory-features.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/ip-filter.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/log-enhancer.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/protection-rule.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/reaction.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/rule-definition.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/sampling.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/server-features.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/syslog.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/translations/to-protobuf/settings/virtual-patch.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/reporter/ts-reporter.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/tracker.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
@@ -45,12 +45,6 @@ const defaultContrastProperties = {
   }
 };
-// NOTE: this function just exists for us to get a better view
-// of the module's performance while profiling
-function getExtStringProps(ext) {
-  return distringuish.getProperties(ext);
-}
 // i'm not sure why this is a class. there are no methods, and externalized
 // strings don't have an instance of the class; they have an object with the
 // same property names.
@@ -74,37 +68,6 @@ class Tracker {
     this.metadata = new WeakMap();
   }
-  /**
-   * Map lookup for metadata of a value
-   *
-   * @param {*} value Tracked value
-   * @return {ContrastProperties|undefined}
-   */
-  getData(value) {
-    if (typeof value === 'string') {
-      const props = getExtStringProps(value);
-      if (props == null) {
-        return defaultContrastProperties;
-      }
-      return props;
-    }
-    return this.metadata.get(value) || defaultContrastProperties;
-  }
-  /**
-   * Resets a string's tracking metadata to the default contrast properties.
-   * This will effectively untrack the associated string, but it will still be
-   * the externalized value.
-   * @param {object} trackingData A tracked string's metadata
-   */
-  untrack(str) {
-    const trackingData = this.getData(str);
-    if (trackingData.tracked) {
-      Object.assign(trackingData, defaultContrastProperties);
-    }
-  }
   trackString(str) {
     if (str.length === 0) {
       return str;
@@ -113,7 +76,7 @@ class Tracker {
     // XXX: this is the closest we have to a dedup.
     // it may be kind of expensive. we need to consider whether or not
     // this is worthwhile
-    if (this.getData(str).tracked) {
+    if (this.getData(str)) {
       return str;
     }
@@ -143,38 +106,15 @@ class Tracker {
     return value;
   }
-  // trackArray(value, parent, sourceType, parentKey) {}
-  /**
-   * Associate properties with a string.
-   *
-   * @param   {*} value value to track
-   * @returns {*}       the value - tracked if some type of string, otherwise untracked
-   */
-  track(value) {
-    if (typeof value === 'string') {
-      return this.trackString(value);
-    }
-    if (value instanceof String) {
-      return this.trackStringObject(value);
-    }
-    return value;
-  }
   /**
    * Associate properties with a string. Returns null if str is not a string,
    * is a zero-length string, or any internal error takes place.
    *
-   * This behavior is different than track in that it requires the caller to check
-   * the return value. track always returned properties even if the value was not a
-   * string or there were no properties associated with the string value.
-   *
    * @param {*} str a value to track.
    * @returns {Object|null} {str, props} or null on error.
    */
-  track2(str) {
+  track(str) {
     if (typeof str === 'string') {
       // is the string already tracked?
       let props = distringuish.getProperties(str);
@@ -217,7 +157,7 @@ class Tracker {
    * @param {*} str any value
    * @return {ContrastProperties|null}
    */
-  getData2(str) {
+  getData(str) {
     if (typeof str === 'string') {
       return distringuish.getProperties(str);
     }
@@ -227,12 +167,20 @@ class Tracker {
     return null;
   }
-  untrack2(str) {
+  /**
+   * Resets a string's tracking metadata to the default contrast properties.
+   * This will effectively untrack the associated string, but it will still be
+   * the externalized value.
+   * @param {object} trackingData A tracked string's metadata
+   */
+  untrack(str) {
     if (typeof str === 'string') {
-      if (!distringuish.getProperties(str)) {
+      let props = distringuish.getProperties(str);
+      if (!props) {
         return null;
       }
       // return an untracked version of the string
+      Object.assign(props, {event: null, tagRanges: [], tracked: false})
       return distringuish.internalize(str);
     }
     if (str instanceof String) {

package/lib/util/base64.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/bitset.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/block-request.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/callback-resolver.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-stack.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/brackets.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/clean-string-base.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/comments.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/concatenations.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/jsclean-string.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/placeholders.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/clean-string/util.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/colors.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/file-finder.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/heap-dump.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/html-util.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/ip-analyzer.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/is-agent-path.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/is-contrast-error.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/is-piped-to-dev.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/is-string.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/partial.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/pkg-name.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/request-util.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/resolve-obj.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/route-info.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/some.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial

package/lib/util/source-map.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
@@ -133,7 +133,7 @@ class SourceMapUtility {
       const { line, source } = consumer.originalPositionFor({
         line: lineNumber,
         column
-      });
+      }) || { line: undefined, source: undefined };
       if (line) lineNumber = line;
       if (source) file = this.replaceSource(file, source);

package/lib/util/static-rules.js CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial