@contrast/agentify 1.3.0 → 1.4.0

package/lib/contrast-methods.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-module.exports = function(core) {
+module.exports = function (core) {
   const { logger, patcher } = core;
 
   const getOrig = (v) => patcher.unwrap(v);
@@ -28,70 +28,123 @@ module.exports = function(core) {
    * 2) patch those functions on `contrastMethods.api` in order to add instrumentation
    */
   const contrastMethods = {
-    // TODO: Assess will require add'l methods
-    // TODO: ESM will require add'l methods
     api: {
       eval(v) {
         return v;
       },
-      plus(left, right) {
+
+      // Binary Operators
+      add(left, right) {
         const ret = getOrig(left) + getOrig(right);
         return ret;
       },
-      doubleEqual(left, right) {
+      eqEq(left, right) {
         left = getOrig(left);
         right = getOrig(right);
 
         return left == right;
       },
-      notTripleEqual(left, right) {
+      eqEqEq(left, right) {
         left = getOrig(left);
         right = getOrig(right);
 
-        return left !== right;
+        return left === right;
       },
-      tripleEqual(left, right) {
+      notEqEq(left, right) {
         left = getOrig(left);
         right = getOrig(right);
 
-        return left === right;
+        return left !== right;
       },
-      notDoubleEqual(left, right) {
+      notEq(left, right) {
         left = getOrig(left);
         right = getOrig(right);
 
         return left != right;
       },
+
+      // Computed Properties
+      // Used to force a copy of handle:
+      // https://stackoverflow.com/a/31733628
+      // This is a workaround for CONTRAST-30333, in which something we
+      // suspect is a v8 bug means that handle will otherwise be clobbered
+      // and if it was externalized, we will lose the data associated with it
       forceCopy(handle) {
-        // Used to force a copy of handle:
-        // https://stackoverflow.com/a/31733628
-        // This is a workaround for CONTRAST-30333, in which something we
-        // suspect is a v8 bug means that handle will otherwise be clobbered
-        // and if it was externalized, we will lose the data associated with it
         if (typeof handle === 'string') {
           handle = toUntrackedString(handle);
         }
         return handle;
       },
-      cast: function __cast(val) {
+
+      // Switch Case
+      cast(val) {
         return getOrig(val);
       },
-      tag: function __contrastTag(strings) {
-        // XXX implemented in lib/assess/propagators/templates.js
+
+      /**
+       * Tagged Templates
+       * The first argument received by the tag function is an array of strings.
+       * For any template literal, its length is equal to the number of
+       * substitutions (occurrences of ${...}) plus one, and is therefore always
+       * non-empty.
+       * see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates
+       * @param {string[]} strings length n+1
+       * @param {string[]} args length n
+       * @returns {string}
+       */
+      tag(strings, ...args) {
+        const [first, ...rest] = strings;
+
+        return rest.reduce(
+          (result, str, i) => result.concat(args[i], str),
+          first,
+        );
+      },
+
+      // Import Statements
+      importDefault(...args) {
+        // noop
       },
 
+      importStarAs(...args) {
+        // noop
+      },
+
+      importNamed(...args) {
+        // noop
+      },
+
+      // Injections
       Function: core.patcher.patch(global.Function, {
         name: 'global.Function',
-        patchType: 'rewrite-injection'
+        patchType: 'rewrite-injection',
+      }),
+      JSON: core.patcher.patch(global.JSON, {
+        name: 'global.JSON',
+        patchType: 'rewrite-injection',
+      }),
+      Number: core.patcher.patch(global.Number, {
+        name: 'global.Number',
+        patchType: 'rewrite-injection',
+      }),
+      Object: core.patcher.patch(global.Object, {
+        name: 'global.Object',
+        patchType: 'rewrite-injection',
+      }),
+      String: core.patcher.patch(global.String, {
+        name: 'global.String',
+        patchType: 'rewrite-injection',
       }),
     },
+
     installed: false,
+
     getGlobal() {
       return global;
-    }
+    },
   };
 
-  contrastMethods.install = function() {
+  contrastMethods.install = function () {
     if (contrastMethods.installed) {
       return;
     }
@@ -102,15 +155,15 @@ module.exports = function(core) {
       Object.defineProperty(global, 'ContrastMethods', {
         enumerable: true,
         configurable: false,
-        value: contrastMethods.api
+        value: contrastMethods.api,
       });
       contrastMethods.installed = true;
     } catch (err) {
       // We should never expect this since the installation process is well
       // controlled, but still we should have the defensive code.
-      logger.error({ err }, 'Unable to install global.ContrastMethods');
+      logger.error({ err }, 'Unable to inject global.ContrastMethods');
     }
   };
 
-  return core.contrastMethods = contrastMethods;
+  return (core.contrastMethods = contrastMethods);
 };

package/lib/function-hooks.js

@@ -81,7 +81,7 @@ module.exports = function (deps) {
       unwritten = rewriter.unwrite(unwritten);
       unwritten = unwritten.replace(METHOD_CONTEXT, '');
       unwritten = unwritten.replace(FUNCTION_CONTEXT, '');
-      unwritten = unwritten.replace(/;$/, ''); // removes trailing semicolon
+      unwritten = unwritten.replace(/;\s*$/, ''); // removes trailing semicolon/whitespace
       return unwritten;
     } catch (err) {
       logger.warn({ err, code }, 'Failed to unwrite function code');

package/lib/index.js

@@ -18,7 +18,6 @@
 const fs = require('fs');
 const path = require('path');
 const Module = require('module');
-const { env } = require('process');
 
 const defaultOpts = {
   install: true,
@@ -32,8 +31,10 @@ const defaultOpts = {
     'assess',
     'protect',
     'depHooks',
+    'routeCoverage',
+    'libraryAnalysis',
     'rewriteHooks',
-    'functionHooks',
+    'functionHooks'
   ]
 };
 
@@ -106,7 +107,7 @@ class Agent {
         await self.handleInstallFailure(err);
       }
 
-      self.logEffectiveConfig();
+      self.logDiagnosticFiles();
       return self.runMain.apply(this, args);
     };
   }
@@ -135,24 +136,35 @@ class Agent {
     }
   }
 
-  logEffectiveConfig() {
-    const { config, getEffectiveConfig } = this.core;
+  logDiagnosticFiles() {
+    const { config, getEffectiveConfig, getSystemInfo } = this.core;
 
-    if (env.CONTRAST__AGENT__DIAGNOSTICS__ENABLE !== 'false') {
-      const content = JSON.stringify(getEffectiveConfig(), null, 2).concat('\n\n');
+    if (config.agent.diagnostics.enable !== false) {
+      const effectiveConfig = JSON.stringify(getEffectiveConfig(), null, 2).concat('\n\n');
+      const systemInfo = JSON.stringify(getSystemInfo(), null, 2).concat('\n\n');
 
-      if (env.CONTRAST__AGENT__DIAGNOSTICS__QUIET !== 'true') {
-        fs.writeFileSync(1, content, 'utf8');
+      if (!config.agent.diagnostics.quiet) {
+        fs.writeFileSync(1, effectiveConfig, 'utf8');
+        fs.writeFileSync(1, systemInfo, 'utf8');
       }
 
-      let outputDir = env.CONTRAST__AGENT__DIAGNOSTICS__REPORT_PATH;
+      let outputDir = config.agent.diagnostics.report_path;
       if (!outputDir && config.agent.logger.path) {
-        outputDir = path.join(config.agent.logger.path, '../contrast_effective_config.json');
-      } else {
-        outputDir = path.join(__dirname, 'contrast_effective_config.json');
+        outputDir = path.join(config.agent.logger.path, '..');
       }
 
-      fs.writeFileSync(outputDir, content, 'utf-8');
+      try {
+        fs.writeFileSync(path.join(outputDir, 'contrast_effective_config.json'), effectiveConfig, 'utf-8');
+        fs.writeFileSync(path.join(outputDir, 'contrast_system_info.json'), systemInfo, 'utf-8');
+      } catch (err) {
+        outputDir = path.join(process.cwd());
+        try {
+          fs.writeFileSync(path.join(outputDir, 'contrast_effective_config.json'), effectiveConfig, 'utf-8');
+          fs.writeFileSync(path.join(outputDir, 'contrast_system_info.json'), systemInfo, 'utf-8');
+        } catch (err) {
+          fs.writeFileSync(1, `Couldn't create the diagnostic files: ${err}`, 'utf-8');
+        }
+      }
     }
   }
 }

package/lib/rewrite-hooks.js

@@ -27,7 +27,12 @@ module.exports = function(deps) {
 
       Module.prototype._compile = function(content, filename) {
         let compiled;
-        const { code } = deps.rewriter.rewrite(content, { filename, inject: true, wrap: true });
+        const { code } = deps.rewriter.rewrite(content, {
+          filename,
+          isModule: false,
+          inject: true,
+          wrap: true,
+        });
 
         try {
           compiled = origCompile.call(this, code, filename);

package/lib/sources.js

@@ -14,73 +14,66 @@
  */
 
 'use strict';
+const patchType = 'http-sources';
 
 module.exports = function(core) {
-  const { depHooks, patcher, logger, scopes: { sources: sourcesStorage } } = core;
-  const sources = core.sources = {};
+  const {
+    instrumentation: { instrument },
+    scopes: { sources: sourcesStorage }
+  } = core;
 
-  sources.install = function install() {
-    depHooks.resolve({ name: 'http' }, http => patchServerEmit(http, 'httpServer'));
-    depHooks.resolve({ name: 'https' }, https => patchServerEmit(https, 'httpsServer'));
-    depHooks.resolve({ name: 'http2' }, http2 => {
-      patchCreateServer(http2, 'http2Server');
-      patchCreateServer(http2, 'http2SecureServer', 'createSecureServer');
-    });
-    depHooks.resolve({ name: 'spdy' }, spdy => patchServerEmit(spdy, 'spdyServer'));
-  };
-
-  function patchServerEmit(serverSource, sourceName) {
-    serverSource.Server.prototype = patcher.patch(serverSource.Server.prototype, 'emit', {
-      name: `${sourceName}.Server.prototype.emit`,
-      patchType: 'http-sources',
-      around: emitAroundHook(sourceName)
-    });
-  }
-
-  function patchCreateServer(serverSource, sourceName, constructorName = 'createServer') {
-    patcher.patch(serverSource, constructorName, {
-      name: sourceName,
-      patchType: 'http-sources',
-      post: createServerPostHook(sourceName)
-    });
-  }
-
-  function createServerPostHook(serverType) {
-    return function(data) {
-      const { result: server } = data;
-      const serverPrototype = server ? Object.getPrototypeOf(server) : null;
-
-      if (!serverPrototype) {
-        logger.error('Unable to patch server prototype, continue without instrumentation');
-        return;
-      }
-
-      patcher.patch(serverPrototype, 'emit', {
-        name: 'Server.prototype.emit',
-        patchType: 'req-async-storage',
-        around: emitAroundHook(serverType)
-      });
-    };
-  }
-
-  function emitAroundHook(serverType) {
-    return function emitAroundHook(next, data) {
+  function aroundHook(serverType) {
+    return function around(next, data) {
       const { args: [event] } = data;
-
       if (event !== 'request') return next();
-
       const store = { serverType };
-
       return sourcesStorage.run(store, next);
     };
   }
 
-  return {
-    install: sources.install,
-    functions: {
-      patchCreateServer,
-      createServerPostHook,
-      emitAroundHook
-    }
+  function install() {
+    [{
+      moduleName: 'http'
+    },
+    {
+      moduleName: 'https'
+    },
+    {
+      moduleName: 'spdy'
+    },
+    {
+      moduleName: 'http2',
+      patchObjectsProps: [
+        {
+          methods: ['createServer', 'createSecureServer'],
+          patchType,
+          patchObjects: [
+            {
+              name: 'Server.prototype',
+              methods: ['emit'],
+              patchType,
+              around: aroundHook('http2')
+            }
+          ]
+        }
+      ]
+    }].forEach(({ moduleName, patchObjectsProps }) => {
+      const patchObjects = patchObjectsProps || [
+        {
+          name: 'Server.prototype',
+          methods: ['emit'],
+          patchType,
+          around: aroundHook(moduleName)
+        }
+      ];
+      instrument({
+        moduleName,
+        patchObjects
+      });
+    });
+  }
+  return core.sources = {
+    install,
+    aroundHook
   };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agentify",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -16,4 +16,4 @@
   "scripts": {
     "test": "../scripts/test.sh"
   }
-}
+}