@contrast/agent 4.7.0 → 4.9.1

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/behavior-url-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/function-definition-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/immediate-function-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/link-and-src-target-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/location-set-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/map-access-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/native-function-execution-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/no-alnum-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/redefined-function-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/style-url-injection-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/variable-assignment-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/helpers/function-call.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/reflected-xss/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/signature.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/if-else-drop-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/simple-or-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/sql-comment-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/time-function-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/custom-searchers/tsql-exec-searcher.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/sql-injection/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/ssjs-injection/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/unsafe-file-upload/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/signatures/untrusted-deserialization/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/sqli/generic-complicated.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/sqli/sql-injection-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/sqli/sql-scanner/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/sqli/sql-scanner/mysql-scanner.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/ssjs-injection/evaluator.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/ssjs-injection/ssjsinjection-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/unsafe-file-upload/unsafe-file-upload-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/untrusted-deserialization/untrusted-deserialization-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/virtual-patch/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/virtual-patch/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/virtual-patch/virtual-patch-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/xss/helpers/function-call.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/xss/reflected-xss-rule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/rules/xxe/xxerule.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sample-aggregator.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/samples.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/service.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -20,7 +20,12 @@ Copyright: 2021 Contrast Security, Inc
 
 const _ = require('lodash');
 
-const { IMPORTANCE, SAFE_HEADER_VALUES, INPUT_TYPES } = require('../constants');
+const {
+  IMPORTANCE,
+  SAFE_HEADER_VALUES,
+  INPUT_TYPES,
+  RULES
+} = require('../constants');
 const agentEmitter = require('../agent-emitter');
 const SampleAggregator = require('./sample-aggregator');
 const RuleFactory = require('./rules/rule-factory');
@@ -203,15 +208,22 @@ class ProtectService {
       appContext.request = request;
     }
 
-    for (const {
-      scoreLevel,
-      ruleId,
-      inputType: type,
-      path,
-      key: name,
-      value,
-      idsList
-    } of resultsList) {
+    for (const result of resultsList) {
+      // Coerce custom rule id
+      if (result.ruleId === RULES.NOSQL_EXPANSION) {
+        result.ruleId = RULES.NOSQL_INJECTION;
+      }
+
+      const {
+        scoreLevel,
+        ruleId,
+        inputType: type,
+        path,
+        key: name,
+        value,
+        idsList
+      } = result;
+
       if (scoreLevel === IMPORTANCE.NONE) {
         return;
       }
@@ -269,7 +281,7 @@ class ProtectService {
    * Loads IP analyzer for allowist analysis given TS settings.
    */
   updateIpAllowlist(settings) {
-    const list = _.get(settings, 'defend.ipWhitelistsList');
+    const list = _.get(settings, 'defend.ipAllowlistsList');
     if (list && list.length) {
       this.ipAllowlist = new IpAnalyzer(list);
       this.ipAllowlist.on('expired', (dtm) => {

package/lib/protect/sinks/child-process.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/eval.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/fs.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/function.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/libxmljs.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/mongodb.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -21,47 +21,41 @@ const BaseSensor = require('../../hooks/frameworks/base');
 const patcher = require('../../hooks/patcher');
 const { PATCH_TYPES } = require('../../constants');
 const { emitSinkEvent } = require('../../hooks/frameworks/common');
+const agentEmitter = require('../../agent-emitter');
+const SinkEvent = require('../models/sink-event');
 
 const { SINK_TYPES } = constants;
 const ID = 'mongodb';
 
-/**
- * json.stringify(data) in try-catch
- * @param {any} data
- * @returns {string}
- */
-const safeStringify = (data) => {
-  try {
-    return JSON.stringify(data);
-  } catch (e) {
-    // ignore errors
-  }
-};
-
-/**
- * @param {any} query `cmd.query`
- * @returns {string}
- */
-const getQueryAsString = (args, version) => {
+function getCursorQueryData(args, version) {
   const query = semver.gte(version, '3.3.0')
     ? _.get(args, '0.cmd.query')
     : _.get(args, '1.query');
 
-  if (_.isString(query)) return query.toString();
-  if (!_.isObject(query)) return;
+  if (!query) {
+    return;
+  }
+
+  if (_.isString(query)) {
+    return query.toString()
+  }
 
   if (query['$where']) {
     return query['$where'].toString();
   }
 
-  const keys = Object.keys(query);
-  if (keys.length === 1 && _.isString(query[keys[0]])) {
-    // eval: { $where : 'process.exit()' }
-    return query[keys[0]];
+  return query;
+}
+
+function getOpQueryData(op) {
+  if (!op.q) {
+    return;
   }
-  // otherwise try and look at the stringified query
-  return safeStringify(query);
-};
+  if (op.q.$where) {
+    return op.q.$where;
+  }
+  return op.q;
+}
 
 class MongoDBSensor extends BaseSensor {
   constructor(agent) {
@@ -76,8 +70,11 @@ class MongoDBSensor extends BaseSensor {
         name: 'mongodb.CoreServer.prototype',
         patchType: PATCH_TYPES.PROTECT_SINK,
         pre: (wrapCtx) => {
-          const data = getQueryAsString(wrapCtx.args, version);
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
+          emitSinkEvent(
+            getCursorQueryData(wrapCtx.args, version),
+            SINK_TYPES.NOSQL_QUERY,
+            ID
+          );
         }
       });
 
@@ -86,21 +83,12 @@ class MongoDBSensor extends BaseSensor {
         alwaysRun: true,
         name: 'mongodb.CoreServer.prototype',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          const data = getQueryAsString(wrapCtx.args, version);
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
-        }
-      });
-
-      // insert(ns, opts, options, cb)
-      patcher.patch(mongodb.CoreServer.prototype, 'insert', {
-        alwaysRun: true,
-        name: 'mongodb.CoreServer.prototype',
-        patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          const arg = _.get(wrapCtx, 'args.1');
-          const data = safeStringify(arg);
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (data) => {
+          emitSinkEvent(
+            getCursorQueryData(data.args, version),
+            SINK_TYPES.NOSQL_QUERY,
+            ID
+          );
         }
       });
 
@@ -109,10 +97,17 @@ class MongoDBSensor extends BaseSensor {
         alwaysRun: true,
         name: 'mongodb.CoreServer.prototype',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          const arg = _.get(wrapCtx, 'args.1');
-          const data = safeStringify(arg);
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (data) => {
+          const ops = Array.isArray(data.args[1])
+            ? data.args[1]
+            : [data.args[1]];
+
+          for (const op of ops) {
+            const eData = getOpQueryData(op);
+            if (eData) {
+              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+            }
+          }
         }
       });
 
@@ -121,10 +116,17 @@ class MongoDBSensor extends BaseSensor {
         alwaysRun: true,
         name: 'mongodb.CoreServer.prototype',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          const arg = _.get(wrapCtx, 'args.1');
-          const data = safeStringify(arg);
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (data) => {
+          const ops = Array.isArray(data.args[1])
+            ? data.args[1]
+            : [data.args[1]];
+
+          for (const op of ops) {
+            const eData = getOpQueryData(op);
+            if (eData) {
+              emitSinkEvent(eData, SINK_TYPES.NOSQL_QUERY, ID);
+            }
+          }
         }
       });
 
@@ -133,9 +135,8 @@ class MongoDBSensor extends BaseSensor {
         alwaysRun: true,
         name: 'mongodb.Db.prototype',
         patchType: PATCH_TYPES.PROTECT_SINK,
-        pre: (wrapCtx) => {
-          const data = _.get(wrapCtx, 'args.0');
-          emitSinkEvent(data, SINK_TYPES.NOSQL_QUERY, ID);
+        pre: (data) => {
+          emitSinkEvent(data.args[0], SINK_TYPES.NOSQL_QUERY, ID);
         }
       });
     });

package/lib/protect/sinks/mysql.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/node-serialize.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/postgres.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/protect/sinks/sequelize.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial