@contrast/agent 4.6.0 → 4.9.0

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/agent-loader.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/bin/VERSION

@@ -1 +1 @@
-2.27.3
+2.28.5

package/bootstrap.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -26,7 +26,16 @@ const orig = Module.runMain;
  * script from cli
  */
 Module.runMain = async function(...args) {
+  const { isMainThread } = require('worker_threads');
+
   try {
+    // Skip instrumenting worker threads.
+    if (!isMainThread) {
+      orig.apply(this, args);
+
+      return;
+    }
+
     const { enabled } = await loader.init(process.argv);
     if (enabled) {
       await loader.bootstrap(process.argv);
@@ -37,9 +46,10 @@ Module.runMain = async function(...args) {
     orig.apply(this, args);
     loader.logTime(appStartTime, 'application');
     loader.logTime(startTime, 'agent & application');
-  
-  } catch(err) {
+  } catch (err) {
+    // eslint-disable-next-line no-console
     console.error(err);
+    // eslint-disable-next-line no-process-exit
     process.exit(-1);
   }
 };

package/cli-rewriter.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/esm.mjs

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -22,6 +22,7 @@ if (enabled) {
   await loader.bootstrap(process.argv);
 }
 await loader.resetArgs(process.argv[0], process.argv[1]);
+const { readFile } = require('fs').promises;
 
 const agent = require(`./lib/agent.js`);
 const logger = require(`./lib/core/logger/index.js`)('contrast:esm-loaders');
@@ -95,3 +96,35 @@ export async function transformSource(source, context, defaultTransformSource) {
     return defaultTransformSource(source, context, defaultTransformSource);
   }
 }
+
+/**
+ * For Node 16 and above, the 'getFormat', 'getSource' and 'transformSource' have been 
+ * consolidated into one 'load' hook. The logic is similar to that of transformSource
+ * except that the source is not provided and must be either read in from the file provided
+ * or accessed from the cache.
+ * 
+ * @see https://nodejs.org/dist/latest-v16.x/docs/api/esm.html#loadurl-context-defaultload
+ * @param {string} url
+ * @param {{ format: string, url: string }} context
+ * @param {Function} defaultLoad
+ * @returns {Promise<{ format: string, source: string | SharedArrayBuffer | Uint8Array }>}
+ */
+export async function load(url, context, defaultLoad) {
+  const filename = fileURLToPath(url);
+
+  try {
+    const cached = helpers.find(agent, filename);
+    const source = cached || await readFile(filename, 'utf8');
+    const result = rewriter.rewriteFile(source, filename, { sourceType: 'module' });
+    helpers.cacheWithSourceMap(agent, filename, result);
+    return { format: context.format, source: result.code };
+
+  } catch (err) {
+    logger.error(
+      'Failed to load rewritten code for %s, err: %o, rewritten code %s, loading original code.',
+      filename,
+      err
+    );
+    return defaultLoad(url, context, defaultLoad);
+  }
+}

package/lib/agent-emitter.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/agent.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/app-info.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/deadzones/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/deadzones/rewrite.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/express/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/express/route-coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/express/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/express/sinks/xss.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/express/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/route-coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/sinks/response-scanning.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/sinks/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/sinks/xss.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/fastify/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/route-coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sinks/response-scanning.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sinks/session.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sinks/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sinks/xss.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/hapi/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -20,6 +20,7 @@ const KoaFrameworkInstrumentation = require('./koa');
 const HapiFrameworkInstrumentation = require('./hapi');
 const Loopback4FrameworkInstrumentation = require('./loopback4');
 const ExpressFrameworkInstrumentation = require('./express');
+const SpdyFrameworkInstrumentation = require('./spdy');
 const assessSources = require('./sources');
 
 module.exports = function(agent) {
@@ -29,5 +30,6 @@ module.exports = function(agent) {
   new HapiFrameworkInstrumentation(agent);
   new Loopback4FrameworkInstrumentation(agent);
   new ExpressFrameworkInstrumentation(agent);
+  new SpdyFrameworkInstrumentation(agent);
   assessSources.init(agent);
 };

package/lib/assess/koa/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/route-coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/sinks/response-scanning.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/sinks/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/sinks/xss.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/koa/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/route-coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/sinks/response-scanning.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/sinks/xss.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/loopback4/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/membrane/debraner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/membrane/deserialization-membrane.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -58,19 +58,18 @@ class DeserializationMembrane extends Membrane {
     });
 
     const tracked = tracker.track(str);
-    const strData = tracker.getData(tracked);
 
-    if (!strData.tracked) {
+    if (!tracked) {
       return str;
     }
 
-    strData.event = event;
+    tracked.props.event = event;
     event.parents.push(this.event);
-    strData.tagRanges = this.tagRanges.map(
+    tracked.props.tagRanges = this.tagRanges.map(
       (t) => new TagRange(0, str.length - 1, t.tag)
     );
 
-    return tracked;
+    return tracked.str;
   }
 }
 

package/lib/assess/membrane/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/membrane/source-membrane.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -13,7 +13,6 @@ Copyright: 2021 Contrast Security, Inc
   way not consistent with the End User License Agreement.
 */
 'use strict';
-const _ = require('lodash');
 
 const logger = require('../../core/logger')('contrast:source-membrane');
 const Membrane = require('./index');
@@ -39,14 +38,6 @@ const signature = new Signature({
   isModule: false
 });
 
-const numericCheck = /^[0-9]+$/;
-function isNumeric(input) {
-  // regex from validator.js/lib/isNumeric.js:
-  // https://github.com/validatorjs/validator.js/blob/master/lib/isNumeric.js
-  // do we want to allow symbols (plus/minus sign, decimal point?)
-  return numericCheck.test(input);
-}
-
 module.exports = class SourceMembrane extends Membrane {
   /**
    * @param {object} config agent config to use for array sampling.
@@ -72,9 +63,7 @@ module.exports = class SourceMembrane extends Membrane {
     if (cfg.array_request_sampling) {
       this.sample = cfg.array_request_sampling.enable;
       this.sampleThreshold = cfg.array_request_sampling.threshold;
-      this.sampleInterval = this.sample
-        ? cfg.array_request_sampling.interval
-        : 1;
+      this.sampleInterval = cfg.array_request_sampling.interval || 1;
     }
     // used when a reqSourceEvent must be created because an entire object
     // is being stringified but individual properties are not being referenced
@@ -147,7 +136,7 @@ module.exports = class SourceMembrane extends Membrane {
     if (!this.ensureMetadata(metadata)) {
       return str;
     }
-    const tracked = tracker.track2(str);
+    const tracked = tracker.track(str);
     if (!tracked) {
       return str;
     }
@@ -304,8 +293,7 @@ module.exports = class SourceMembrane extends Membrane {
   /**
    * The `TagRanges` returned  will include the `untrusted` tag. There will be
    * `exclusion:${ruleId}` tags for input exclusions pertaining to specific
-   * rules and whose name matches the property name described in metadata. And
-   * `limited-chars` tags are included if string is numeric.
+   * rules and whose name matches the property name described in metadata.
    * @param {string} str string being tracked by membrane
    * @param {object} metadata metadata about source type and key name
    * @returns {TagRange[]}
@@ -342,10 +330,6 @@ module.exports = class SourceMembrane extends Membrane {
       }
     }
 
-    if (isNumeric(str)) {
-      tagRanges.push(new TagRange(start, stop, 'limited-chars'));
-    }
-
     if (metadata.sourceType === 'header') {
       if (metadata.path.toLocaleLowerCase() !== 'referer') {
         tagRanges.push(new TagRange(start, stop, 'header'));
@@ -368,11 +352,6 @@ module.exports = class SourceMembrane extends Membrane {
   wrapArray(arr, metadata) {
     metadata.isArray = true;
 
-    // if not sampling, treat it as any object. not sampling has 100%
-    // accuracy.
-    if (!this.sample) {
-      return super.wrapArray(arr, metadata);
-    }
     // don't sample more than once
     if (this.wrappedArrays.has(arr)) {
       return arr;
@@ -380,16 +359,20 @@ module.exports = class SourceMembrane extends Membrane {
 
     const limit = Math.min(this.sampleThreshold, arr.length);
 
-    for (let i = 0; i < limit; i++) {
-      if (i % this.sampleInterval === 0 && arr[i]) {
-        const m = _.cloneDeep(metadata);
-        if (m.path) {
-          m.path += `[${i}]`;
-        } else {
-          m.path = `[${i}]`;
+    // if not sampling, treat it as any object. not sampling has 100% accuracy.
+    if (!this.sample || (limit === arr.length && this.sampleInterval === 1)) {
+      return super.wrapObject(arr, metadata);
+    } else if (!this.sampleThreshold) {
+      return arr;
+    } else {
+      const origPath = metadata.path;
+      for (let i = 0; i < limit; i += this.sampleInterval) {
+        if (arr[i]) {
+          const m = Object.assign({}, metadata);
+          m.path = origPath ? `${origPath}[${i}]` : `[${i}]`;
+          const wrapped = this.wrap(arr[i], m);
+          arr[i] = wrapped;
         }
-
-        arr[i] = this.wrap(arr[i], m);
       }
     }
 

package/lib/assess/models/base-event.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/assess/models/call-context.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -96,7 +96,7 @@ module.exports = class CallContext {
   }
 
   static isTracked(str) {
-    if (tracker.getData2(str)) {
+    if (tracker.getData(str)) {
       return true;
     }
     return !!(str && typeof str === 'object' && str[PROXY_TARGET]);