@contrast/agent 4.6.0 → 4.9.0

package/lib/hooks/frameworks/hapi16.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/http.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/http2.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -16,6 +16,7 @@ Copyright: 2021 Contrast Security, Inc
 
 const Http = require('./http');
 const Http2 = require('./http2');
+const Spdy = require('./spdy');
 const Hapi16 = require('./hapi16');
 
 module.exports = function(agent) {
@@ -23,5 +24,6 @@ module.exports = function(agent) {
   new Http(agent);
   new Http(agent, 'https');
   new Http2(agent);
+  new Spdy(agent);
   new Hapi16(agent);
 };

package/lib/hooks/frameworks/spdy.js

@@ -0,0 +1,87 @@
+/**
+Copyright: 2022 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const {
+  PATCH_TYPES,
+  HTTP_RESPONSE_HOOKED_METHOD_KEYS,
+  SINK_TYPES
+} = require('../../constants');
+const patcher = require('../patcher');
+const HttpFramework = require('./http');
+const { isString } = require('../../util/is-string');
+const { emitSendEvent } = require('../../hooks/frameworks/common');
+const agentEmitter = require('../../agent-emitter');
+
+class SpdyFramework extends HttpFramework {
+  /**
+   * @param {Agent} agent
+   */
+  constructor(agent) {
+    super(agent, 'spdy');
+  }
+
+  /**
+   * @param {import('spdy')} spdy
+   * @returns {import('spdy')}
+   */
+  onRequire(spdy) {
+    patcher.patch(spdy, 'createServer', {
+      name: `${this.id}.createServer`,
+      patchType: PATCH_TYPES.FRAMEWORK,
+      alwaysRun: true,
+      post: ({ args, result }) => {
+        this.handleServerCreate(args, result);
+      }
+    });
+
+    patcher.patch(spdy.response, 'push', {
+      name: 'spdy.response.push',
+      patchType: PATCH_TYPES.FRAMEWORK,
+      pre(data) {
+        agentEmitter.emit(
+          HTTP_RESPONSE_HOOKED_METHOD_KEYS.PUSH,
+          data.args[0],
+          SINK_TYPES.RESPONSE_BODY
+        );
+
+        const body = data.args[0];
+        if (isString(body)) {
+          emitSendEvent(body.valueOf());
+        }
+      }
+    });
+
+    return spdy;
+  }
+
+  /**
+   * Emits a create event for the new Server instance.
+   * @param {any[]} args The arguments passed to the Server constructor
+   * @param {import('net').Server} server The http Server instance
+   */
+  handleServerCreate(args, server) {
+    super.handleServerCreate(args, server);
+
+    patcher.patch(server, 'listen', {
+      name: `${this.id}.SpdyFramework.listen`,
+      patchType: PATCH_TYPES.FRAMEWORK,
+      alwaysRun: true,
+      pre: ({ args, obj }) => this.handleServerListen(args, obj)
+    });
+  }
+}
+
+module.exports = SpdyFramework;

package/lib/hooks/hapi-16-reply.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/hapi-16-session.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/http.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -195,5 +195,16 @@ module.exports = (agent) => {
       }
     });
   });
+
+  moduleHook.resolve({ name: 'spdy' }, (spdy) => {
+    patcher.patch(spdy, 'createServer', {
+      name: `create-server-spdy-hooks`,
+      patchType: PATCH_TYPES.MISC,
+      alwaysRun: true,
+      post({ result }) {
+        hookServer(result, agent);
+      }
+    });
+  });
 };
 module.exports.hookServer = hookServer;

package/lib/hooks/module/extensions.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/module/helpers.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/module/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/newrelic.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/object-is.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/object-to-primitive.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -31,13 +31,12 @@ const tracker = require('../tracker');
 function wrapNativeMethod(origFn, str) {
   let s = Reflect.apply(origFn, str, []);
   const origProps = tracker.getData(str);
-  if (origProps.tracked) {
-    s = tracker.track(s);
-
-    const contrastProps = tracker.getData(s);
-    if (contrastProps.tracked) {
-      contrastProps.tagRanges = origProps.tagRanges;
-      contrastProps.event = origProps.event;
+  if (origProps) {
+    const tracked = tracker.track(s);
+    if (tracked) {
+      s = tracked.str;
+      tracked.props.tagRanges = origProps.tagRanges;
+      tracked.props.event = origProps.event;
     }
   }
   return s;

package/lib/hooks/patcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -97,12 +97,7 @@ Function.prototype._contrast_toString = function() {
   return Reflect.apply(functionToString, this, arguments);
 };
 
-function runHooks(type, options, data, fn, thisTarget) {
-  const fnHooks = hooks.get(fn);
-  if (!fnHooks) {
-    return;
-  }
-
+function runHooks(type, data, thisTarget, fnHooks) {
   fnHooks.forEach((hook, key) => {
     if (hook[type]) {
       hook[type].apply(thisTarget, [data]);
@@ -116,7 +111,7 @@ function runHooks(type, options, data, fn, thisTarget) {
  * @return {boolean}
  */
 function argsTracked(args) {
-  return some(args, (arg) => arg && tracker.getData(arg).tracked);
+  return some(args, (arg) => arg && tracker.getData(arg));
 }
 
 /**
@@ -185,11 +180,17 @@ function runOriginalFunction(fn, { args, name }, target) {
   return fn.apply(this, args);
 }
 
-function recordTime(func, funcKey, type) {
+const runWrapper =
+  !process.hrtime.bigint || !perfLoggingEnabled
+    ? runWithoutRecordingTime
+    : runAndRecordTime;
+
+function runWithoutRecordingTime(func) {
+  return () => func();
+}
+
+function runAndRecordTime(func, funcKey, type) {
   return () => {
-    if (!process.hrtime.bigint || !perfLoggingEnabled) {
-      return func();
-    }
     const start = process.hrtime.bigint();
     const rv = func();
     perfLogger[type](funcKey, Number(process.hrtime.bigint() - start));
@@ -217,6 +218,7 @@ function hookFunction(fn, options) {
   const { funcKey } = options;
   logger.trace(`hook ${funcKey}`);
 
+  // eslint-disable-next-line complexity
   function hooked(...args) {
     const target = new.target;
 
@@ -247,36 +249,59 @@ function hookFunction(fn, options) {
       perfLogger.logEvent(funcKey);
     }
 
-    // Run the pre event in a no instrumentation scope
+    let hasPreHook, hasPostHook;
+    const fnHooks = hooks && hooks.get(hooked);
+
+    // If there's a pre event run it in a no instrumentation scope
     // this will prevent other instrumentation from running
     // within the pre function
-    Scopes.runInNoInstrumentationScope(
-      recordTime(
-        () => runHooks('pre', options, data, hooked, this),
-        funcKey,
-        'pre'
-      ),
-      `${funcKey} pre`
-    );
+    if (fnHooks) {
+      for (const storedHooks of fnHooks.values()) {
+        hasPreHook = Boolean(hasPreHook || (storedHooks && storedHooks.pre));
+        hasPostHook = Boolean(hasPostHook || (storedHooks && storedHooks.post));
+      }
+    }
 
-    // run original function in scope that was passed in
-    data.result = Scopes.runIn(
-      options.scope,
-      recordTime(() => getResult.call(this, fn, data, target), funcKey, 'orig'),
-      funcKey
-    );
+    if (hasPreHook) {
+      Scopes.runInNoInstrumentationScope(
+        runWrapper(() => runHooks('pre', data, this, fnHooks), funcKey, 'pre'),
+        `${funcKey} pre`
+      );
+    }
 
-    // Run the post event in a no instrumentation scope
+    // Run original function in scope that was passed in
+    // or just run the original function when the passed scope is undefined
+    if (options.scope) {
+      data.result = Scopes.runIn(
+        options.scope,
+        runWrapper(
+          () => getResult.call(this, fn, data, target),
+          funcKey,
+          'orig'
+        ),
+        funcKey
+      );
+    } else {
+      data.result = runWrapper(
+        () => getResult.call(this, fn, data, target),
+        funcKey,
+        'orig'
+      )();
+    }
+
+    // If there's a post event run it in a no instrumentation scope
     // this will prevent other instrumentation from running
     // within the post function
-    Scopes.runInNoInstrumentationScope(
-      recordTime(
-        () => runHooks('post', options, data, hooked, this),
-        funcKey,
-        'post'
-      ),
-      `${funcKey} post`
-    );
+    if (hasPostHook) {
+      Scopes.runInNoInstrumentationScope(
+        runWrapper(
+          () => runHooks('post', data, this, fnHooks),
+          funcKey,
+          'post'
+        ),
+        `${funcKey} post`
+      );
+    }
 
     return data.result;
   }
@@ -436,8 +461,7 @@ function hook(obj, prop, opts) {
     }
   } catch (err) {
     logger.info(
-      `unable to patch unconfigurable property ${opts.name}:${prop}
-`,
+      `unable to patch unconfigurable property ${opts.name}:${prop}`,
       err
     );
   }
@@ -543,7 +567,6 @@ function unwrap(fn) {
 module.exports = {
   patch,
   preempt,
-  recordTime,
   resetInstrumentation,
   unpatch,
   unwrap

package/lib/hooks/require.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/stealthy-require.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/instrumentation.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/libraries.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/library-usage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/list-installed.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/analysis/aho-corasick.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/analysis/dfsa-analyzer.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/errors/handler.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/errors/security-exception.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/express/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/fastify/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/error-handler.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/hapi/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/input-analysis.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/sinks.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/koa/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/listeners.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/loopback4/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/loopback4/sources.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/application-context.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/sink-event.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/models/source-event.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial