@contrast/agent 4.5.2 → 4.8.0

package/lib/hooks/patcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -97,12 +97,7 @@ Function.prototype._contrast_toString = function() {
   return Reflect.apply(functionToString, this, arguments);
 };
 
-function runHooks(type, options, data, fn, thisTarget) {
-  const fnHooks = hooks.get(fn);
-  if (!fnHooks) {
-    return;
-  }
-
+function runHooks(type, data, thisTarget, fnHooks) {
   fnHooks.forEach((hook, key) => {
     if (hook[type]) {
       hook[type].apply(thisTarget, [data]);
@@ -116,7 +111,7 @@ function runHooks(type, options, data, fn, thisTarget) {
  * @return {boolean}
  */
 function argsTracked(args) {
-  return some(args, (arg) => arg && tracker.getData(arg).tracked);
+  return some(args, (arg) => arg && tracker.getData(arg));
 }
 
 /**
@@ -185,11 +180,17 @@ function runOriginalFunction(fn, { args, name }, target) {
   return fn.apply(this, args);
 }
 
-function recordTime(func, funcKey, type) {
+const runWrapper =
+  !process.hrtime.bigint || !perfLoggingEnabled
+    ? runWithoutRecordingTime
+    : runAndRecordTime;
+
+function runWithoutRecordingTime(func) {
+  return () => func();
+}
+
+function runAndRecordTime(func, funcKey, type) {
   return () => {
-    if (!process.hrtime.bigint || !perfLoggingEnabled) {
-      return func();
-    }
     const start = process.hrtime.bigint();
     const rv = func();
     perfLogger[type](funcKey, Number(process.hrtime.bigint() - start));
@@ -217,6 +218,7 @@ function hookFunction(fn, options) {
   const { funcKey } = options;
   logger.trace(`hook ${funcKey}`);
 
+  // eslint-disable-next-line complexity
   function hooked(...args) {
     const target = new.target;
 
@@ -247,36 +249,59 @@ function hookFunction(fn, options) {
       perfLogger.logEvent(funcKey);
     }
 
-    // Run the pre event in a no instrumentation scope
+    let hasPreHook, hasPostHook;
+    const fnHooks = hooks && hooks.get(hooked);
+
+    // If there's a pre event run it in a no instrumentation scope
     // this will prevent other instrumentation from running
     // within the pre function
-    Scopes.runInNoInstrumentationScope(
-      recordTime(
-        () => runHooks('pre', options, data, hooked, this),
-        funcKey,
-        'pre'
-      ),
-      `${funcKey} pre`
-    );
+    if (fnHooks) {
+      for (const storedHooks of fnHooks.values()) {
+        hasPreHook = Boolean(hasPreHook || (storedHooks && storedHooks.pre));
+        hasPostHook = Boolean(hasPostHook || (storedHooks && storedHooks.post));
+      }
+    }
 
-    // run original function in scope that was passed in
-    data.result = Scopes.runIn(
-      options.scope,
-      recordTime(() => getResult.call(this, fn, data, target), funcKey, 'orig'),
-      funcKey
-    );
+    if (hasPreHook) {
+      Scopes.runInNoInstrumentationScope(
+        runWrapper(() => runHooks('pre', data, this, fnHooks), funcKey, 'pre'),
+        `${funcKey} pre`
+      );
+    }
 
-    // Run the post event in a no instrumentation scope
+    // Run original function in scope that was passed in
+    // or just run the original function when the passed scope is undefined
+    if (options.scope) {
+      data.result = Scopes.runIn(
+        options.scope,
+        runWrapper(
+          () => getResult.call(this, fn, data, target),
+          funcKey,
+          'orig'
+        ),
+        funcKey
+      );
+    } else {
+      data.result = runWrapper(
+        () => getResult.call(this, fn, data, target),
+        funcKey,
+        'orig'
+      )();
+    }
+
+    // If there's a post event run it in a no instrumentation scope
     // this will prevent other instrumentation from running
     // within the post function
-    Scopes.runInNoInstrumentationScope(
-      recordTime(
-        () => runHooks('post', options, data, hooked, this),
-        funcKey,
-        'post'
-      ),
-      `${funcKey} post`
-    );
+    if (hasPostHook) {
+      Scopes.runInNoInstrumentationScope(
+        runWrapper(
+          () => runHooks('post', data, this, fnHooks),
+          funcKey,
+          'post'
+        ),
+        `${funcKey} post`
+      );
+    }
 
     return data.result;
   }
@@ -436,8 +461,7 @@ function hook(obj, prop, opts) {
     }
   } catch (err) {
     logger.info(
-      `unable to patch unconfigurable property ${opts.name}:${prop}
-`,
+      `unable to patch unconfigurable property ${opts.name}:${prop}`,
       err
     );
   }
@@ -543,7 +567,6 @@ function unwrap(fn) {
 module.exports = {
   patch,
   preempt,
-  recordTime,
   resetInstrumentation,
   unpatch,
   unwrap

package/lib/hooks/require.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -14,44 +14,38 @@ Copyright: 2021 Contrast Security, Inc
 */
 'use strict';
 
-/**
- * @module lib/hooks/moduleHook
- * @class ModuleHook
- */
-
 const Module = require('module');
-const agentEmitter = require('../agent-emitter');
 const RequireHook = require('@contrast/require-hook');
+const agentEmitter = require('../agent-emitter');
 const logger = require('../core/logger')('hooks:require');
 
 class ModuleHook {
-  constructor(options) {
+  constructor() {
     this.reqHook = new RequireHook(logger);
 
-    // RequireHook takes care of hooking
-    // but still need to patch require to emit 'require' events
-    const origModRequire = Module.prototype.require;
-    Module.prototype.require = function(name) {
-      agentEmitter.emit('require', name);
-      return origModRequire.call(this, name);
+    // RequireHook takes care of hooking but we still need to patch require to
+    // emit 'require' events
+    const origModLoad = Module._load;
+    Module._load = function __loadAndEmit(...args) {
+      const [request] = args;
+      agentEmitter.emit('require', request);
+      return Reflect.apply(origModLoad, this, args);
     };
   }
 
   /**
-   *
    * Collects instrumentation functions that will run on the specified
-   * module's file at the time it is loaded via <code>require</code>.
-   * @param {Object} descriptor describes module you're hook(name, version, file)
-   * @param {Function} instrumentation The function to run on the module at
-   *                        the time it is required in the code
+   * module's file at the time it is loaded via `require`.
+   * @param {RequireHook.Descriptor} descriptor describes the module to hook
+   * @param {Function} handler The function to run on the module at the time it is required
    */
-  resolve(descriptor, instrumentation) {
-    this.reqHook.resolve(descriptor, instrumentation);
+  resolve(descriptor, handler) {
+    this.reqHook.resolve(descriptor, handler);
   }
 
   /**
-   * reset the hooked state for a module so that it's handlers re-run (used in unit tests)
-   *
+   * Reset the hooked state for a module so that it's handlers re-run.
+   * NOTE: used in unit tests.
    * @param {string} name the name of the module
    */
   reset(name) {

package/lib/hooks/stealthy-require.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/instrumentation.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -40,9 +40,6 @@ module.exports = function instrument(agent, reporter) {
     return;
   }
 
-  const stackFactory = require('./core/stacktrace').singleton;
-  stackFactory.stackTraceLimit = agent.config.agent.stack_trace_limit;
-
   // The order of these matters, do not re-order
   collectLibInfo(agent);
   // (CONTRAST-31526) this must be required first to load global.ContrastMethods

package/lib/libraries.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/library-usage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/list-installed.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/analysis/aho-corasick.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/analysis/dfsa-analyzer.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/errors/handler.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/errors/security-exception.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/error-handler.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/input-analysis.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/listeners.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/loopback4/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/loopback4/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/application-context.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/sink-event.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/source-event.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/restify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/restify/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/restify/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/assessment.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/attack-patterns.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/java-script-scanner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/postgresqlscanner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/scan-state.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/substring-finder.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/base-scanner/token-sequence.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/bot-blocker/bot-blocker-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/bot-blocker/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection/cmdinjection-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-command-backdoors/backdoor-detector.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-command-backdoors/cmd-injection-command-backdoors-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-semantic-chained-commands/chained-command-scanner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-semantic-chained-commands/cmd-injection-semantic-chained-commands-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/cmd-injection-semantic-dangerous-paths-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/cmd-injection-semantic-dangerous-paths/dangerous-paths-scanner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial