@contrast/agentify 1.1.2 → 1.3.0

package/lib/contrast-methods.js

@@ -15,20 +15,72 @@
 
 'use strict';
 
-module.exports = function(deps) {
+module.exports = function(core) {
+  const { logger, patcher } = core;
+
+  const getOrig = (v) => patcher.unwrap(v);
+  const slice = patcher.unwrap(String.prototype.slice);
+  const toUntrackedString = (v) => slice.call(` ${v}`, 1);
+
   /**
    * Components e.g. Assess, Protect, can
    * 1) configure rewriter to add desired ContrastMethod functions to source code
    * 2) patch those functions on `contrastMethods.api` in order to add instrumentation
    */
-  const contrastMethods = deps.contrastMethods = {
+  const contrastMethods = {
     // TODO: Assess will require add'l methods
     // TODO: ESM will require add'l methods
     api: {
       eval(v) {
         return v;
       },
-      Function: deps.patcher.patch(global.Function, {
+      plus(left, right) {
+        const ret = getOrig(left) + getOrig(right);
+        return ret;
+      },
+      doubleEqual(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left == right;
+      },
+      notTripleEqual(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left !== right;
+      },
+      tripleEqual(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left === right;
+      },
+      notDoubleEqual(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left != right;
+      },
+      forceCopy(handle) {
+        // Used to force a copy of handle:
+        // https://stackoverflow.com/a/31733628
+        // This is a workaround for CONTRAST-30333, in which something we
+        // suspect is a v8 bug means that handle will otherwise be clobbered
+        // and if it was externalized, we will lose the data associated with it
+        if (typeof handle === 'string') {
+          handle = toUntrackedString(handle);
+        }
+        return handle;
+      },
+      cast: function __cast(val) {
+        return getOrig(val);
+      },
+      tag: function __contrastTag(strings) {
+        // XXX implemented in lib/assess/propagators/templates.js
+      },
+
+      Function: core.patcher.patch(global.Function, {
         name: 'global.Function',
         patchType: 'rewrite-injection'
       }),
@@ -56,9 +108,9 @@ module.exports = function(deps) {
     } catch (err) {
       // We should never expect this since the installation process is well
       // controlled, but still we should have the defensive code.
-      deps.logger.error({ err }, 'Unable to install global.ContrastMethods');
+      logger.error({ err }, 'Unable to install global.ContrastMethods');
     }
   };
 
-  return deps.contrastMethods;
+  return core.contrastMethods = contrastMethods;
 };

package/lib/index.js

@@ -15,16 +15,21 @@
 
 'use strict';
 
+const fs = require('fs');
+const path = require('path');
 const Module = require('module');
+const { env } = require('process');
 
 const defaultOpts = {
   install: true,
   svcList: [
     'reporter',
     'contrastMethods',
-    'instrumentationLocks',
+    'deadzones',
     'scopes',
     'sources',
+    'architectureComponents',
+    'assess',
     'protect',
     'depHooks',
     'rewriteHooks',
@@ -32,14 +37,12 @@ const defaultOpts = {
   ]
 };
 
-module.exports = function(deps) {
+module.exports = function(core) {
   // compose add'l local services
-  require('./sources')(deps);
-  require('./contrast-methods')(deps);
-  require('./instrumentation-locks')(deps);
-  require('./function-hooks')(deps);
-  require('./rewrite-hooks')(deps);
-  // TODO: NODE-2229
+  require('./sources')(core);
+  require('./contrast-methods')(core);
+  require('./function-hooks')(core);
+  require('./rewrite-hooks')(core);
 
   /**
    * The interface is a function, which when called, will hook runMain
@@ -57,10 +60,10 @@ module.exports = function(deps) {
       opts = { ...defaultOpts, ...opts };
     }
 
-    return new Agent(deps, opts);
+    return new Agent(core, opts);
   }
 
-  deps.agentify = agentify;
+  core.agentify = agentify;
 
   return agentify;
 };
@@ -68,16 +71,16 @@ module.exports = function(deps) {
 class Agent {
   /**
    *
-   * @param {object} deps dependencies
+   * @param {object} core dependencies
    * @param {object} opts
    * @param {function} opts.preRunMain custom function for registering services
    * @param {boolean} opts.install whether to automatically install
    */
-  constructor(deps, opts) {
+  constructor(core, opts) {
     const self = this;
-    const { config, logger } = deps;
+    const { config, logger } = core;
 
-    this.deps = deps;
+    this.core = core;
     this.opts = opts;
     this.runMain = Module.runMain;
 
@@ -90,7 +93,7 @@ class Agent {
         logger.info('Starting the Contrast agent');
         logger.debug({ config }, 'Agent configuration');
 
-        const plugin = await opts.preRunMain(deps);
+        const plugin = await opts.preRunMain(core);
 
         if (opts.install) {
           await self.install();
@@ -102,6 +105,8 @@ class Agent {
       } catch (err) {
         await self.handleInstallFailure(err);
       }
+
+      self.logEffectiveConfig();
       return self.runMain.apply(this, args);
     };
   }
@@ -114,7 +119,7 @@ class Agent {
    * @param {error} err Error thrown during install
    */
   async handleInstallFailure(err) {
-    this.deps.logger.error(
+    this.core.logger.error(
       { err },
       'A fatal agent installation error has occurred. The application will be run without instrumentation.'
     );
@@ -122,13 +127,34 @@ class Agent {
 
   async install() {
     for (const svcName of this.opts.svcList) {
-      this.deps.logger.trace('installing service: %s', svcName);
-      const svc = this.deps[svcName];
+      const svc = this.core[svcName];
       if (svc && svc.install) {
+        this.core.logger.trace('installing service: %s', svcName);
         await svc.install();
       }
     }
   }
+
+  logEffectiveConfig() {
+    const { config, getEffectiveConfig } = this.core;
+
+    if (env.CONTRAST__AGENT__DIAGNOSTICS__ENABLE !== 'false') {
+      const content = JSON.stringify(getEffectiveConfig(), null, 2).concat('\n\n');
+
+      if (env.CONTRAST__AGENT__DIAGNOSTICS__QUIET !== 'true') {
+        fs.writeFileSync(1, content, 'utf8');
+      }
+
+      let outputDir = env.CONTRAST__AGENT__DIAGNOSTICS__REPORT_PATH;
+      if (!outputDir && config.agent.logger.path) {
+        outputDir = path.join(config.agent.logger.path, '../contrast_effective_config.json');
+      } else {
+        outputDir = path.join(__dirname, 'contrast_effective_config.json');
+      }
+
+      fs.writeFileSync(outputDir, content, 'utf-8');
+    }
+  }
 }
 
 module.exports.Agent = Agent;

package/lib/rewrite-hooks.js

@@ -28,6 +28,7 @@ module.exports = function(deps) {
       Module.prototype._compile = function(content, filename) {
         let compiled;
         const { code } = deps.rewriter.rewrite(content, { filename, inject: true, wrap: true });
+
         try {
           compiled = origCompile.call(this, code, filename);
         } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agentify",
-  "version": "1.1.2",
+  "version": "1.3.0",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -16,4 +16,4 @@
   "scripts": {
     "test": "../scripts/test.sh"
   }
-}
+}

package/lib/instrumentation-locks.js

@@ -1,51 +0,0 @@
-/*
- * Copyright: 2022 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const Module = require('module');
-
-module.exports = function(deps) {
-  const {
-    patcher: { patch },
-    scopes: { instrumentation }
-  } = deps;
-
-  deps.instrumentationLocks = {
-    install() {
-      const name = 'Module.prototype.require';
-      const store = {
-        name: `${name}`,
-        lock: true,
-      };
-
-      // `require` has sinks and propagators that run
-      patch(Module.prototype, 'require', {
-        name,
-        patchType: 'instrumentation-lock',
-        around(next, data) {
-          if (!instrumentation.isLocked()) {
-            return instrumentation.run(store, next);
-          }
-          return next();
-        }
-      });
-
-      // likely more to come e.g. v4 deadzones
-    }
-  };
-
-  return deps.instrumentationLocks;
-};