@contrast/agent 4.7.0 → 4.9.1

package/lib/core/arch-components/dynamodbv3.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/arch-components/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -18,3 +18,4 @@ require('./sqlite3');
 require('./postgres');
 require('./dynamodb');
 require('./dynamodbv3');
+require('./rethinkdb');

package/lib/core/arch-components/mongodb.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -28,25 +28,29 @@ ModuleHook.resolve(
       patchType: PATCH_TYPES.ARCH_COMPONENT,
       alwaysRun: true,
       post(ctx) {
-        try {
-          const { servers = [] } = this.s.options;
-          if (servers.length === 0) {
-            logger.warn('Unable to find any MongoDB servers\n');
-          }
-          for (const server of servers) {
-            agentEmitter.emit('architectureComponent', {
-              vendor: 'MongoDB',
-              url: `mongodb://${server.host}`,
-              remoteHost: '',
-              remotePort: server.port
-            });
-          }
-        } catch (err) {
-          logger.warn(
-            'unable to report MongoDB architecture component\n%o',
-            err
-          );
+        if (!ctx.result || !ctx.result.then) {
+          return;
         }
+
+        // We should report only when connection is successful
+        ctx.result.then(function(client) {
+          try {
+            const { servers = [] } = ctx.obj.s && ctx.obj.s.options;
+            for (const server of servers) {
+              agentEmitter.emit('architectureComponent', {
+                vendor: 'MongoDB',
+                url: `mongodb://${server.host}:${server.port}`,
+                remoteHost: '',
+                remotePort: server.port
+              });
+            }
+          } catch (err) {
+            logger.warn(
+              'unable to report MongoDB architecture component\n%o',
+              err
+            );
+          }
+        });
       }
     });
   }

package/lib/core/arch-components/mysql.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/arch-components/postgres.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -26,15 +26,33 @@ ModuleHook.resolve({ name: 'pg', file: 'lib/client.js' }, (pgClient) =>
     alwaysRun: true,
     post(wrapCtx) {
       try {
-        const { host, port } = wrapCtx.result;
+        const {
+          host = process.env.PGHOST,
+          port = process.env.PGPORT
+        } = wrapCtx.result;
+
+        if (!host) {
+          return;
+        }
+
+        let url = host;
+
+        // build protocol and port into url prior to parsing
+        if (url.indexOf('://') === -1) {
+          url = `postgresql://${url}`;
+        }
+        if (port !== undefined) {
+          url = `${url}:${port}`;
+        }
+
         agentEmitter.emit('architectureComponent', {
           vendor: 'PostgreSQL',
           remotePort: port || 0,
-          url: new URL(host).toString()
+          url: new URL(url).toString()
         });
       } catch (err) {
         logger.warn(
-          'unable to report PostgreSQL architecture component\n',
+          'unable to report PostgreSQL architecture component\n%o',
           err
         );
       }

package/lib/core/arch-components/rethinkdb.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/arch-components/sqlite3.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -13,6 +13,7 @@ Copyright: 2021 Contrast Security, Inc
   way not consistent with the End User License Agreement.
 */
 'use strict';
+
 const patcher = require('../../hooks/patcher');
 const ModuleHook = require('../../hooks/require');
 const agentEmitter = require('../../agent-emitter');
@@ -26,17 +27,14 @@ ModuleHook.resolve({ name: 'sqlite3' }, (sqlite3) => {
     alwaysRun: true,
     post(wrapCtx) {
       try {
-        // can either be a path to a file or `:memory:'.
-        const url = new URL(wrapCtx.args[0]).toString();
-
         agentEmitter.emit('architectureComponent', {
           vendor: 'SQLite3',
-          url,
+          url: wrapCtx.args[0],
           remoteHost: '',
           remotePort: 0
         });
       } catch (err) {
-        logger.warn('unable to report SQLite3 architecture component\n', err);
+        logger.warn('unable to report SQLite3 architecture component\n%o', err);
       }
     }
   });

package/lib/core/async-storage/context.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/hooks/bluebird.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/hooks/mongodb-core.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/hooks/mysql.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/hooks/redis.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/hooks/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/async-storage/scopes/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/common/formidable.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/common/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/config/options.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -33,7 +33,8 @@ Copyright: 2021 Contrast Security, Inc
  * @module lib/core/config/options
  */
 'use strict';
-const program = require('commander');
+const { Command, Option } = require('commander');
+const program = new Command();
 const os = require('os');
 const url = require('url');
 const path = require('path');
@@ -284,7 +285,7 @@ const agent = [
   {
     name: 'agent.node.array_request_sampling.enable',
     arg: '[false]',
-    default: true,
+    default: false,
     fn: castBoolean,
     desc: 'enable sampling of array members for dataflow'
   },
@@ -486,6 +487,12 @@ const agent = [
     desc:
       'set limit for stack trace size (larger limits will improve accuracy but increase memory usage)'
   },
+  {
+    name: 'agent.traverse_and_track',
+    arg: '<traverse-and-track>',
+    default: false,
+    desc: 'source membrane alternative'
+  },
   {
     name: 'agent.polling.app_activity_ms',
     arg: '<ms>',
@@ -967,6 +974,16 @@ if (process.env.CONTRAST_DEV) {
     }
   ];
 }
+const sails = [
+  {
+    name: 'pathToSails',
+    arg: '<path>',
+  },
+  {
+    name: 'gdsrc',
+    arg: '<path>',
+  }
+];
 
 const options = [].concat(
   misc,
@@ -1008,6 +1025,23 @@ options.forEach((option) => {
   program.option(name, option.desc);
 });
 
+// In NODE-2059 it was discovered that a module was appending config options that the
+// agent didn't recognize and was causing the application to not load properly.
+// The agent doesn't need to do anything with these options. It just needs to not
+// throw an error when it encounters them but we also don't need them displayed on
+// the agent's config option list. The newest version of Commander lets us do exactly this.
+// This is structured so that if anything like this is discovered again, they can be 
+// added in easily.
+const hiddenOptions = [].concat(
+  sails
+)
+
+hiddenOptions.forEach((option) => {
+  program.addOption(
+    new Option(`--${option.name} ${option.arg}`).hideHelp()
+  )
+});
+
 function getDefault(optionName) {
   let option;
   options.forEach((entry) => {

package/lib/core/config/util.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/exclusions/exclusion-factory.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/exclusions/exclusion.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -31,12 +31,9 @@ class Exclusion {
     return this.assess && this.appliesToRule(id, this.assessmentRulesList);
   }
 
+  // When an exclusion applies to all rules, its rules list is empty
   appliesToRule(id, list) {
-    // When an exclusion applies to all rules, its rules list is empty
-    const appliesToAllRules = list.length === 0;
-    const appliesToRuleId = list.includes(id);
-
-    return appliesToAllRules || appliesToRuleId;
+    return list.length === 0 || list.includes(id);
   }
 
   appliesToAllAssessRules() {

package/lib/core/exclusions/input.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/exclusions/url.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/express/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -120,6 +120,24 @@ class ExpressFramework {
         }
       }
     });
+
+    patcher.patch(express.response, 'push', {
+      name: 'express.response.push',
+      patchType: PATCH_TYPES.PROTECT_SINK,
+      pre(data) {
+        agentEmitter.emit(
+          EVENTS.REQUEST_SEND,
+          data.args[0],
+          SINK_TYPES.RESPONSE_BODY
+        );
+
+        const body = data.args[0];
+        if (isString(body)) {
+          emitSendEvent(body.valueOf());
+        }
+      }
+    });
+
     patcher.patch(express.response, 'end', {
       name: 'express.response.end',
       patchType: PATCH_TYPES.PROTECT_SINK,
@@ -310,7 +328,9 @@ class ExpressFramework {
     }, 'textParser');
 
     this.useAfter(function ContrastBodyParsed(req, res, next) {
-      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, INPUT_TYPES.BODY);
+      agentEmitter.emit(EVENTS.BODY_PARSED, req, res, {
+        type: INPUT_TYPES.BODY
+      });
       next();
     }, 'urlencodedParser');
 
@@ -356,7 +376,7 @@ class ExpressFramework {
     const self = this;
 
     // Hook the request handler so that we can access the top of each route.
-    // This is the only place the "params" hash is avaible
+    // This is the only place the "params" hash is available
     const Layer = ExpressFramework.getStack(app)[0].constructor;
     const _handle = Layer.prototype.handle_request;
     if (_handle) {
@@ -399,9 +419,12 @@ class ExpressFramework {
 
             Whatever the core issue is, it doesn't appear to have any effects
             elsewhere in any of our Express/Kraken framework support.
+
+            BODY_PARSED event is emitted to support Sails framework
            */
           if (req.body) {
             decorateRequest({ body: req.body });
+            agentEmitter.emit(EVENTS.BODY_PARSED, req, res, req.body);
           }
         }
       });

package/lib/core/express/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -33,7 +33,7 @@ const {
 
 const EVENTS = {
   REQUEST_READY: 'Express.RequestReady',
-  BODY_PARSED: 'Express.cookiesParsed',
+  BODY_PARSED: 'Express.bodyParsed',
   COOKIES_PARSED: 'Express.cookiesParsed',
   PARAMS_PARSED: 'Express.paramsParsed',
   REQUEST_SEND: 'Express.requestSend',
@@ -246,7 +246,9 @@ const captureSignature = (layer, signature) => {
 const normalizeSignatureArg = (arg) => {
   // we weave in middleware for express that is prefixed with Contrast
   // remove this from signature
-  if (typeof arg === 'function' && arg.name.startsWith('Contrast')) {
+  if (arg === '') {
+    return null;
+  } else if (typeof arg === 'function' && arg.name.startsWith('Contrast')) {
     return null;
   } else if (typeof arg === 'function') {
     return getHandlerName(arg);
@@ -313,8 +315,11 @@ const updateRouterSignatures = (self, router, path) => {
       return;
     }
     const routePath = _.get(route, 'path', '');
-    const routeHandle = _.get(route, 'stack[0].handle');
+    const routeHandle = _.get(route, 'stack[0].handle', '');
     const routeMethod = _.get(route, 'stack[0].method');
+    if (!routeMethod) {
+      return;
+    }
     const newSignature = createSignature(self, 'Router', routeMethod, [
       path,
       routePath,

package/lib/core/fastify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/fastify/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/hapi/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/hapi/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/koa/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/koa/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/daily-rotate-file.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/dataflow-monitor.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/debug-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/perf-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/umbrella-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/loopback4/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/metrics/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/restify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/restify/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/assignment-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/binary-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/call-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/callees.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial