@contrast/agent 4.7.1 → 4.10.0

package/lib/core/express/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -33,7 +33,7 @@ const {
 
 const EVENTS = {
   REQUEST_READY: 'Express.RequestReady',
-  BODY_PARSED: 'Express.cookiesParsed',
+  BODY_PARSED: 'Express.bodyParsed',
   COOKIES_PARSED: 'Express.cookiesParsed',
   PARAMS_PARSED: 'Express.paramsParsed',
   REQUEST_SEND: 'Express.requestSend',
@@ -246,7 +246,9 @@ const captureSignature = (layer, signature) => {
 const normalizeSignatureArg = (arg) => {
   // we weave in middleware for express that is prefixed with Contrast
   // remove this from signature
-  if (typeof arg === 'function' && arg.name.startsWith('Contrast')) {
+  if (arg === '') {
+    return null;
+  } else if (typeof arg === 'function' && arg.name.startsWith('Contrast')) {
     return null;
   } else if (typeof arg === 'function') {
     return getHandlerName(arg);
@@ -313,8 +315,11 @@ const updateRouterSignatures = (self, router, path) => {
       return;
     }
     const routePath = _.get(route, 'path', '');
-    const routeHandle = _.get(route, 'stack[0].handle');
+    const routeHandle = _.get(route, 'stack[0].handle', '');
     const routeMethod = _.get(route, 'stack[0].method');
+    if (!routeMethod) {
+      return;
+    }
     const newSignature = createSignature(self, 'Router', routeMethod, [
       path,
       routePath,

package/lib/core/fastify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -154,7 +154,8 @@ class FastifyCore {
     agentEmitter.emit(constants.EVENTS.PRE_VALIDATION, ...data);
     decorateRequest({
       body: request.body,
-      parameters: request.params
+      parameters: request.params,
+      query: request.query
     });
     done();
   }

package/lib/core/fastify/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/hapi/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -173,7 +173,8 @@ class HapiCore {
       decorateRequest({
         normalizedUri: get(request, 'route.path'),
         body: request.payload,
-        parameters: request.params
+        parameters: request.params,
+        query: request.query
       });
       return h.continue;
     });

package/lib/core/hapi/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/koa/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -216,13 +216,21 @@ class KoaCore {
    */
   registerRequestHandler(ctx) {
     ctx.req.request = ctx.request;
+    const { query } = ctx.request;
     ctx.request = new Proxy(ctx.request, {
       set(...args) {
         const [obj, prop] = args;
         const result = Reflect.set(...args);
+        if (query) {
+          decorateRequest({
+            query
+          });
+        }
         switch (prop) {
           case 'body':
-            decorateRequest({ body: obj[prop] });
+            decorateRequest({
+              body: obj[prop]
+            });
             agentEmitter.emit(constants.EVENTS.CTX_REQUEST_BODY, {
               request: obj,
               ctx

package/lib/core/koa/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/daily-rotate-file.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/dataflow-monitor.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/debug-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/perf-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/logger/umbrella-logger.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/loopback4/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/metrics/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/restify/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/restify/utils.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/assignment-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/binary-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/call-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/callees.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -67,6 +67,22 @@ const specs = [
     token: 'eval',
     modes: { assess: true, protect: true }
   },
+  // Import Declaration
+  {
+    name: '__importDefault',
+    type: 'ImportDefaultSpecifier',
+    modes: { assess: true, protect: true }
+  },
+  {
+    name: '__importNamespace',
+    type: 'ImportNamespaceSpecifier',
+    modes: { assess: true, protect: true }
+  },
+  {
+    name: '__import',
+    type: 'ImportSpecifier',
+    modes: { assess: true, protect: true }
+  },
   // Member Expression
   {
     name: '__forceCopy',

package/lib/core/rewrite/catch-clause.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/function-wrap.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/import-declaration.js

@@ -0,0 +1,71 @@
+/**
+Copyright: 2022 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const t = require('@babel/types');
+const _ = require('lodash');
+
+const IMPORT_META_URL_MEMBER_EXPRESSION = t.memberExpression(
+  t.memberExpression(t.identifier('import'), t.identifier('meta')),
+  t.identifier('url')
+);
+
+/**
+ * Appends calls to our own instrumentable import methods, providing access to
+ * the imported modules.
+ * ```
+ * import x from 'mod';
+ * // becomes:
+ * import x from 'mod';
+ * ContrastMethods.__importDefault(x, 'mod', import.meta.url);
+ *
+ * import * as x from 'mod';
+ * // becomes:
+ * import x from 'mod';
+ * ContrastMethods.__importNamespace(x, 'mod', import.meta.url);
+ *
+ * import { foo, bar as baz } from 'mod';;
+ * // becomes
+ * ContrastMethods.__import(foo, 'foo', 'mod', import.meta.url);
+ * ContrastMethods.__import(baz, 'bar', 'mod', import.meta.url);
+ * ```
+ * @param {import('@babel/traverse').NodePath<import('@babel/types').ImportDeclaration>} path
+ * @param {import('.').State} state
+ */
+module.exports = function ImportDeclaration(path, state) {
+  const { source, specifiers } = path.node;
+
+  path.insertAfter(
+    specifiers.map((importSpec) => {
+      const spec = _.find(state.specs, { type: importSpec.type });
+      if (!spec || !state.callees[spec.name]) return;
+
+      const args = [importSpec.local];
+
+      if (t.isImportSpecifier(importSpec)) {
+        args.push(
+          t.isIdentifier(importSpec.imported)
+            ? t.stringLiteral(importSpec.imported.name)
+            : importSpec.imported
+        );
+      }
+
+      args.push(source);
+      args.push(IMPORT_META_URL_MEMBER_EXPRESSION);
+
+      return t.callExpression(state.callees[spec.name], args);
+    })
+  );
+};

package/lib/core/rewrite/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -18,23 +18,24 @@ const { default: generate } = require('@babel/generator');
 const { parse } = require('@babel/parser');
 const { default: traverse } = require('@babel/traverse');
 
+const RewriteDeadzones = require('../../assess/deadzones/rewrite');
+const { util: sourceMapUtility } = require('../../util/source-map');
 const Scopes = require('../async-storage/scopes');
 const logger = require('../logger')('contrast:rewrite');
-const RewriteDeadzones = require('../../assess/deadzones/rewrite');
-const logRewrite = require('./log');
-const RewriteLog = require('./rewrite-log');
-const isContrastMethod = require('./is-contrast-method');
-const functionWrap = require('./function-wrap');
-const prependGlobals = require('./prepend-globals');
 const AssignmentExpression = require('./assignment-expression');
 const BinaryExpression = require('./binary-expression');
 const CallExpression = require('./call-expression');
 const CatchClause = require('./catch-clause');
+const functionWrap = require('./function-wrap');
+const ImportDeclaration = require('./import-declaration');
+const isContrastMethod = require('./is-contrast-method');
+const logRewrite = require('./log');
 const MemberExpression = require('./member-expression');
 const ObjectProperty = require('./object-property');
+const prependGlobals = require('./prepend-globals');
+const RewriteLog = require('./rewrite-log');
 const SwitchStatement = require('./switch-statement');
 const TemplateLiteral = require('./template-literal');
-const sourceMapUtility = require('../../util/source-map').util;
 
 /**
  * @typedef {Object} State
@@ -105,6 +106,7 @@ class Rewriter {
         BinaryExpression,
         CallExpression,
         CatchClause,
+        ImportDeclaration,
         MemberExpression,
         ObjectProperty,
         SwitchStatement,

package/lib/core/rewrite/injections.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -100,7 +100,11 @@ const ContrastMethods = new Injection(null, 'ContrastMethods', {
   },
   __contrastEval: function __contrastEval(str) {
     return str;
-  }
+  },
+  // TODO: NODE-2020
+  __importDefault(mod, source, url) {},
+  __importNamespace(mod, source, url) {},
+  __import(mod, spec, source, url) {}
 });
 
 ContrastMethods.enable();

package/lib/core/rewrite/is-contrast-method.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/log.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/member-expression.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/object-property.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/prepend-globals.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/rewrite-log.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/switch-statement.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/rewrite/template-literal.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/core/stacktrace.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/coverage.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/feature-set.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/generator-function.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/array.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/cluster.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/dataflow-monitor.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/encoding.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/express-fileupload.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/express-session.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/fn-to-string.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/base.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/common.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/hapi16.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/http.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/http2.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 

package/lib/hooks/frameworks/index.js

@@ -1,5 +1,5 @@
 /**
-Copyright: 2021 Contrast Security, Inc
+Copyright: 2022 Contrast Security, Inc
   Contact: support@contrastsecurity.com
   License: Commercial
 
@@ -16,6 +16,7 @@ Copyright: 2021 Contrast Security, Inc
 
 const Http = require('./http');
 const Http2 = require('./http2');
+const Spdy = require('./spdy');
 const Hapi16 = require('./hapi16');
 
 module.exports = function(agent) {
@@ -23,5 +24,6 @@ module.exports = function(agent) {
   new Http(agent);
   new Http(agent, 'https');
   new Http2(agent);
+  new Spdy(agent);
   new Hapi16(agent);
 };