@contrast/agentify 1.30.0 → 1.31.0

package/lib/rewrite-hooks.js

@@ -17,7 +17,7 @@
 'use strict';
 
 const Module = require('node:module');
-const rewriteIsDeadzoned = require('./rewrite-is-deadzoned');
+const { rewriteIsDeadzoned } = require('./rewrite-is-deadzoned');
 
 /**
  * @param {import('.').Core & {

package/lib/rewrite-is-deadzoned.js

@@ -37,7 +37,7 @@ const DEADZONED_PATHS = [
   'browserify',
   'bson',
   'bunyan',
-  '@cyclonedx/cyclonedx-library',
+  '@cyclonedx',
   'coffeescript',
   'compression',
   'etag',
@@ -61,21 +61,82 @@ const DEADZONED_PATHS = [
   'node-webpack',
   'pem',
   'react',
-  'react-dom',
-  'react-dom/server',
+  'react-dom', // doesn't this cover the next line?
+  //'react-dom/server',
   'requirejs',
   'semver',
   'strong-remoting',
   'type-is',
   'uglify-js',
-].map((pkgName) => ['node_modules', pkgName, ''].join(sep));
+];
+
+// maybe make the value an object for more complex strategies in the future
+// NOTE: they key should appear in the list above as well. if it's not there
+// then this object will never be checked.
+const CUSTOM_REWRITERS = {
+  'acorn': 'no-propagation',
+  'archiver': 'no-propagation',
+  'babel-core': 'no-propagation',
+  '@babel': 'no-propagation',
+  'bcryptjs': 'no-propagation',
+  'bson': 'no-propagation',
+  'coffeescript': 'no-propagation',
+  'jsrsasign': 'no-propagation',
+  'less': 'no-propagation',
+  '@cyclonedx': 'no-propagation',
+};
+
+const nodeModules = `${sep}node_modules${sep}`;
+
+function rewriteIsDeadzoned(absolutePath) {
+  // we should only match the last node_modules folder
+  const startingPoint = absolutePath.lastIndexOf(nodeModules) + nodeModules.length;
 
-module.exports = function rewriteIsDeadzoned(filename) {
-  // make all windows separators into unix separators
   for (const path of DEADZONED_PATHS) {
-    const start = filename.indexOf(path);
-    if (start >= 0) return filename.indexOf('node_modules', start + path.length) == -1;
+    const start = absolutePath.indexOf(path, startingPoint);
+    // we return the name of the deadzoned module if it is found
+    if (start >= 0 && (start + path.length === absolutePath.length || absolutePath[start + path.length] === sep)) {
+      return path;
+    }
+  }
+
+  return undefined;
+}
+
+// the next function is used if/when we implement custom rewrite strategies.
+// NODE-3512 implements that and this was taken from there.
+
+/**
+ * Returns an array with a package name and that package's rewrite strategy.
+ * The package name is only returned the package strategy is not 'default'.
+ * Strategies:
+ * - 'default': rewrite the module using the original, default rewriter
+ * - 'deadzone': do not rewrite the module
+ * - 'no-propagation': rewrite the module with the no-propagation rewriter
+ *
+ * why does this return the package name? mostly just because it had to extract
+ * it from the path, so returning means the caller doesn't have to.
+ *
+ * @param {string} absolutePath
+ * @returns {[string | undefined, 'default' | 'deadzone' | 'no-propagation']}
+ */
+function getPackageRewriteStrategy(absolutePath) {
+  const pkg = rewriteIsDeadzoned(absolutePath);
+  if (!pkg) {
+    return [undefined, 'default'];
   }
 
-  return false;
+  const strategy = CUSTOM_REWRITERS[pkg];
+  if (strategy && process.env.CSI_USE_CUSTOM_REWRITERS) {
+    return [pkg, strategy];
+  }
+
+  return [pkg, 'deadzone'];
+}
+
+module.exports = {
+  DEADZONED_PATHS,
+  CUSTOM_REWRITERS,
+  rewriteIsDeadzoned,
+  getPackageRewriteStrategy,
 };

package/lib/rewrite-is-deadzoned.test.js

@@ -0,0 +1,85 @@
+'use strict';
+
+const { normalize } = require('node:path');
+const { deepEqual } = require('node:assert').strict;
+
+const {
+  getPackageRewriteStrategy, DEADZONED_PATHS, CUSTOM_REWRITERS
+} = require('./rewrite-is-deadzoned');
+
+describe('verify getPackageRewriteStrategy()', function() {
+  before(function() {
+    process.env.CSI_USE_CUSTOM_REWRITERS = '1';
+  });
+  after(function() {
+    delete process.env.CSI_USE_CUSTOM_REWRITERS;
+  });
+
+  // test deadzoned paths and custom rewriters
+  for (const path of DEADZONED_PATHS) {
+    if (CUSTOM_REWRITERS[path]) {
+      it(`should return "${CUSTOM_REWRITERS[path]}" for ${path}`, function() {
+        const p = normalize(`/path/to/node_modules/${path}`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, CUSTOM_REWRITERS[path]]);
+      });
+      it(`should return "${CUSTOM_REWRITERS[path]}" for ${path} with additional elements`, function() {
+        const p = normalize(`/path/to/node_modules/${path}/server`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, CUSTOM_REWRITERS[path]]);
+      });
+      it(`should return "${CUSTOM_REWRITERS[path]}" for ${path} with specific .js file`, function() {
+        const p = normalize(`/path/to/node_modules/${path}/core/index.js`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, CUSTOM_REWRITERS[path]]);
+      });
+    } else {
+      it(`should return "deadzone" for ${path}`, function() {
+        const p = normalize(`/path/to/node_modules/${path}`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, 'deadzone']);
+      });
+      it(`should return "deadzone" for ${path} with additional elements`, function() {
+        const p = normalize(`/path/to/node_modules/${path}/server`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, 'deadzone']);
+      });
+      it(`should return "deadzone" for ${path} with specific .js file`, function() {
+        const p = normalize(`/path/to/node_modules/${path}/core/index.js`);
+        const result = getPackageRewriteStrategy(p);
+        deepEqual(result, [path, 'deadzone']);
+      });
+    }
+  }
+
+  // test default (not deadzoned or custom) paths
+  for (const path of ['xyzzy', 'fubar', 'seven']) {
+    it(`should return "default" for ${path}`, function() {
+      const p = normalize(`/path/to/node_modules/${path}`);
+      const result = getPackageRewriteStrategy(p);
+      deepEqual(result, [undefined, 'default']);
+    });
+    it(`should return "default" for ${path} with additional elements`, function() {
+      const p = normalize(`/path/to/node_modules/${path}/server`);
+      const result = getPackageRewriteStrategy(p);
+      deepEqual(result, [undefined, 'default']);
+    });
+    it(`should return "default" for ${path} with specific .js file`, function() {
+      const p = normalize(`/path/to/node_modules/${path}/core/index.js`);
+      const result = getPackageRewriteStrategy(p);
+      deepEqual(result, [undefined, 'default']);
+    });
+  }
+
+  const doubleCheck = [
+    '/home/bruce/github/csi/node-mono/node_modules/@cyclonedx/cyclonedx-library/dist.node/serialize/xml/types.js'
+  ];
+
+  for (let path of doubleCheck) {
+    path = normalize(path);
+    it(`should return "no-propagation" for ${path}`, function() {
+      const result = getPackageRewriteStrategy(path);
+      deepEqual(result, ['@cyclonedx', 'no-propagation']);
+    });
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agentify",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Configures Contrast agent services and instrumentation within an application",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,20 +17,20 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.24.0",
-    "@contrast/config": "1.31.0",
-    "@contrast/core": "1.35.0",
-    "@contrast/deadzones": "1.5.0",
-    "@contrast/dep-hooks": "1.3.3",
-    "@contrast/esm-hooks": "2.9.0",
+    "@contrast/common": "1.25.0",
+    "@contrast/config": "1.32.0",
+    "@contrast/core": "1.36.0",
+    "@contrast/deadzones": "1.6.0",
+    "@contrast/dep-hooks": "1.4.0",
+    "@contrast/esm-hooks": "2.10.0",
     "@contrast/find-package-json": "^1.1.0",
-    "@contrast/instrumentation": "1.13.0",
-    "@contrast/logger": "1.8.4",
-    "@contrast/metrics": "1.11.0",
-    "@contrast/patcher": "1.7.4",
-    "@contrast/reporter": "1.30.0",
-    "@contrast/rewriter": "1.11.0",
-    "@contrast/scopes": "1.4.1",
+    "@contrast/instrumentation": "1.14.0",
+    "@contrast/logger": "1.9.0",
+    "@contrast/metrics": "1.12.0",
+    "@contrast/patcher": "1.8.0",
+    "@contrast/reporter": "1.31.0",
+    "@contrast/rewriter": "1.12.0",
+    "@contrast/scopes": "1.5.0",
     "semver": "^7.6.0"
   }
 }