@contrast/assess 1.19.0 → 1.20.1

package/lib/dataflow/sources/handler.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -22,7 +22,7 @@ const {
   join,
 } = require('@contrast/common');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     assess: {
       eventFactory,
@@ -33,9 +33,10 @@ module.exports = function(core) {
     },
     config,
     createSnapshot,
-    logger,
   } = core;
 
+  const logger = core.logger.child({ name: 'contrast:sources' });
+
   const emptyStack = Object.freeze([]);
 
   sources.createTags = function createTags({ inputType, fieldName = '', value }) {
@@ -55,13 +56,13 @@ module.exports = function(core) {
     return tags;
   };
 
-  sources.createStacktrace = function(stacktraceOpts) {
+  sources.createStacktrace = function (stacktraceOpts) {
     return config.assess.stacktraces === 'NONE'
       ? emptyStack
       : createSnapshot(stacktraceOpts)();
   };
 
-  sources.handle = function({
+  sources.handle = function ({
     context,
     keys,
     name,
@@ -73,7 +74,7 @@ module.exports = function(core) {
     if (!data) return;
 
     if (!sourceContext) {
-      core.logger.trace({ inputType, name }, 'skipping assess source handling - no request context');
+      logger.trace({ inputType, sourceName: name }, 'skipping assess source handling - no request context');
       return null;
     }
 
@@ -119,7 +120,7 @@ module.exports = function(core) {
       const pathName = join(path, '.');
 
       if (sourceContext.sourceEventsCount >= max) {
-        core.logger.trace({ inputType, name }, 'exiting assess source handling - %s max events exceeded', max);
+        logger.trace({ inputType, sourceName: name }, 'exiting assess source handling - %s max events exceeded', max);
         return true;
       }
 
@@ -136,13 +137,13 @@ module.exports = function(core) {
 
         const event = createEvent({ pathName, value, fieldName });
         if (!event) {
-          core.logger.warn({ inputType, name, pathName, value }, 'unable to create source event');
+          logger.warn({ inputType, sourceName: name, pathName, value }, 'unable to create source event');
           return;
         }
 
         const { extern } = tracker.track(value, event);
         if (extern) {
-          logger.trace({ extern, fieldName, name, inputType }, 'tracked');
+          logger.trace({ extern, fieldName, sourceName: name, inputType }, 'tracked');
           obj[fieldName] = extern;
 
           sourceContext.sourceEventsCount++;
@@ -152,7 +153,7 @@ module.exports = function(core) {
         if (event) {
           tracker.track(value, event);
         } else {
-          core.logger.warn({ inputType, name, pathName, value }, 'unable to create source event');
+          logger.warn({ inputType, sourceName: name, pathName, value }, 'unable to create source event');
         }
       }
     });

package/lib/dataflow/sources/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,7 @@ module.exports = function (core) {
   require('./install/fastify')(core);
   require('./install/koa')(core);
   require('./install/body-parser1')(core);
-  require('./install/busboy1')(core);
+  require('./install/busboy')(core);
   require('./install/cookie-parser1')(core);
   require('./install/formidable1')(core);
   require('./install/http')(core);

package/lib/dataflow/sources/install/body-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -29,23 +29,23 @@ const INPUT_TYPES = {
 module.exports = function init(core) {
   const { assess, depHooks, logger, patcher, scopes } = core;
 
-  const createPreHook = (name) => (data) => {
+  const preHook = (data) => {
     const [req, , next] = data.args;
     data.args[2] = scopes.wrap(function contrastNext(...args) {
       const sourceContext = scopes.sources.getStore()?.assess;
 
       if (!sourceContext) {
-        logger.error({ name }, 'unable to handle source. Missing `sourceContext`');
+        logger.error({ funcKey: data.funcKey }, 'unable to handle source. Missing `sourceContext`');
         return next(...args);
       }
 
       if (sourceContext.parsedBody) {
-        logger.trace({ name }, 'values already tracked');
+        logger.trace({ funcKey: data.funcKey }, 'values already tracked');
         return next(...args);
       }
 
       // when using a specific parser, we know the input type.
-      let inputType = INPUT_TYPES[name];
+      let inputType = INPUT_TYPES[data.name];
       // when using `bodyParser()`, determine input type by content type.
       if (!inputType) {
         inputType = req.headers?.['content-type']?.includes('json')
@@ -71,7 +71,7 @@ module.exports = function init(core) {
         assess.dataflow.sources.handle({
           context,
           data: _data,
-          name,
+          name: data.name,
           keys,
           inputType,
           sourceContext,
@@ -82,7 +82,7 @@ module.exports = function init(core) {
 
         sourceContext.parsedBody = !!Object.keys(_data).length;
       } catch (err) {
-        logger.error({ name, err }, 'unable to handle source');
+        logger.error({ err, funcKey: data.funcKey }, 'unable to handle source');
       }
 
       return next(...args);
@@ -99,11 +99,10 @@ module.exports = function init(core) {
             name: 'body-parser',
             patchType,
             post(data) {
-              const name = 'body-parser.bodyParser';
               data.result = patcher.patch(data.result, {
-                name,
+                name: 'body-parser.bodyParser',
                 patchType,
-                pre: createPreHook(name),
+                pre: preHook,
               });
             },
           });
@@ -113,11 +112,10 @@ module.exports = function init(core) {
               name: `body-parser.${method}`,
               patchType,
               post(data) {
-                const name = `body-parser.${method}.${method}Parser`;
                 data.result = patcher.patch(data.result, {
-                  name,
+                  name: `body-parser.${method}.${method}Parser`,
                   patchType,
-                  pre: createPreHook(name)
+                  pre: preHook
                 });
               },
             });

package/lib/dataflow/sources/install/{busboy1.js → busboy.js}

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,6 +18,9 @@
 const { InputType } = require('@contrast/common');
 const { patchType } = require('../common');
 
+const inputType = InputType.MULTIPART_VALUE;
+const name = 'busboy';
+
 module.exports = (core) => {
   const {
     depHooks,
@@ -26,21 +29,18 @@ module.exports = (core) => {
     assess: { dataflow: { sources } },
   } = core;
 
-  const name = 'busboy';
-
   function createPreHook(finalEventName) {
-    return function(data) {
-      const { orig, hooked } = data;
+    return function (data) {
+      const { orig, hooked, funcKey } = data;
       const sourceContext = core.scopes.sources.getStore()?.assess;
-      const inputType = InputType.MULTIPART_VALUE;
 
       if (!sourceContext) {
-        logger.error({ inputType, name }, 'unable to handle source. Missing `sourceContext`');
+        logger.error({ inputType, funcKey }, 'unable to handle source. Missing `sourceContext`');
         return;
       }
 
       if (sourceContext.parsedBody) {
-        logger.trace({ inputType, name }, 'values already tracked');
+        logger.trace({ inputType, funcKey }, 'values already tracked');
         return;
       }
 
@@ -67,7 +67,7 @@ module.exports = (core) => {
           data.args[2] = obj[fieldName];
           sourceContext.busboyParsedBody = true;
         } catch (err) {
-          logger.error({ err, inputType, name }, 'unable to handle source');
+          logger.error({ err, inputType, funcKey }, 'unable to handle source');
         }
       }
 
@@ -88,8 +88,8 @@ module.exports = (core) => {
     });
 
 
-    depHooks.resolve({ name, version: '>=1.0.0' }, (busboy) => patcher.patch(
-      busboy, {
+    depHooks.resolve({ name, version: '>=1.0.0' }, (busboy) =>
+      patcher.patch(busboy, {
         name,
         patchType,
         post(data) {
@@ -99,14 +99,14 @@ module.exports = (core) => {
             pre: createPreHook('close')
           });
         }
-      }
-    ));
+      })
+    );
   }
 
-  const busboy1Instrumentation = sources.busboy1Instrumentation = {
+  const busboyInstrumentation = sources.busboyInstrumentation = {
     install
   };
 
-  return busboy1Instrumentation;
+  return busboyInstrumentation;
 };
 

package/lib/dataflow/sources/install/cookie-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -36,17 +36,18 @@ module.exports = function init(core) {
                 name,
                 patchType,
                 pre(data) {
+                  const { funcKey } = data;
                   const [req, , next] = data.args;
                   data.args[2] = function contrastNext(...args) {
                     const sourceContext = scopes.sources.getStore()?.assess;
 
                     if (!sourceContext) {
-                      logger.error({ name }, 'unable to handle source. Missing `sourceContext`');
+                      logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                       return;
                     }
 
                     if (sourceContext.parsedCookies) {
-                      logger.trace({ name }, 'cookies already tracked');
+                      logger.trace({ funcKey }, 'cookies already tracked');
                     } else if (req.cookies) {
                       try {
                         assess.dataflow.sources.handle({
@@ -62,12 +63,12 @@ module.exports = function init(core) {
 
                         sourceContext.parsedCookies = !!Object.keys(req.cookies).length;
                       } catch (err) {
-                        logger.error({ name, err }, 'unable to handle source');
+                        logger.error({ err, funcKey }, 'unable to handle source');
                       }
                     }
 
                     if (sourceContext.parsedSignedCookies) {
-                      logger.trace({ name }, 'signedCookies already tracked');
+                      logger.trace({ funcKey }, 'signedCookies already tracked');
                     } else if (req.signedCookies) {
                       try {
                         assess.dataflow.sources.handle({
@@ -83,7 +84,7 @@ module.exports = function init(core) {
 
                         sourceContext.parsedSignedCookies = !!Object.keys(req.signedCookies).length;
                       } catch (err) {
-                        logger.error({ name, err }, 'unable to handle source');
+                        logger.error({ err, funcKey }, 'unable to handle source');
                       }
                     }
 

package/lib/dataflow/sources/install/express/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/express/params.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -16,7 +16,7 @@
 'use strict';
 
 const { InputType } = require('@contrast/common');
-const { patchType } = require('../../../propagation/common');
+const { patchType } = require('../../common');
 
 module.exports = function init(core) {
   const { depHooks, patcher, logger } = core;
@@ -30,25 +30,24 @@ module.exports = function init(core) {
           patcher.patch(Layer.prototype, 'match', {
             name,
             patchType,
-            post(data) {
-              const layer = data.obj;
+            post({ obj: layer, result, orig, hooked, funcKey }) {
 
               // we can exit early if
               //  the layer doesn't match the request or
               //  the layer doesn't recognize any parameters
-              if (!data.result || !layer.keys || layer.keys.length === 0) {
+              if (!result || !layer.keys || layer.keys.length === 0) {
                 return;
               }
 
               const sourceContext = core.scopes.sources.getStore()?.assess;
 
               if (!sourceContext) {
-                logger.error({ name }, 'unable to handle source. Missing `sourceContext`');
+                logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                 return;
               }
 
               if (sourceContext.parsedParams) {
-                logger.trace({ name }, 'values already tracked');
+                logger.trace({ funcKey }, 'values already tracked');
                 return;
               }
 
@@ -58,15 +57,15 @@ module.exports = function init(core) {
                   name,
                   inputType: InputType.PARAMETER_VALUE,
                   stacktraceOpts: {
-                    constructorOpt: data.hooked,
-                    prependFrames: [data.orig]
+                    constructorOpt: hooked,
+                    prependFrames: [orig]
                   },
                   data: layer.params,
                   sourceContext
                 });
                 sourceContext.parsedParams = true;
               } catch (err) {
-                logger.error({ err, name }, 'unable to handle source');
+                logger.error({ err, funcKey }, 'unable to handle source');
               }
             }
           });

package/lib/dataflow/sources/install/express/parsedUrl.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/fastify/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -31,9 +31,8 @@ module.exports = function (core) {
       depHooks.resolve({ name: 'fastify', version: '>=3.0.0' }, (fastify) => patcher.patch(fastify, {
         name: 'fastify.constructor',
         patchType,
-        post({ result: server }) {
+        post({ result: server, funcKey }) {
           server.addHook('preValidation', function preValidationHandler(request, reply, done) {
-            const name = 'fastify.preValidation';
             const bodyType = request?.headers?.['content-type']?.includes('/json')
               ? InputType.JSON_VALUE
               : typeof request.body == 'object'
@@ -42,7 +41,7 @@ module.exports = function (core) {
             const sourceContext = core.scopes.sources.getStore()?.assess;
 
             if (!sourceContext) {
-              logger.error({ name }, 'unable to handle source. Missing `sourceContext`');
+              logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
               return;
             }
 
@@ -52,7 +51,7 @@ module.exports = function (core) {
               { key: 'body', inputType: bodyType, alreadyTrackedFlag: 'parsedBody' }
             ].forEach(({ key, inputType, alreadyTrackedFlag }) => {
               if (sourceContext[alreadyTrackedFlag]) {
-                logger.trace({ inputType, name }, 'values already tracked');
+                logger.trace({ inputType, funcKey }, 'values already tracked');
                 return;
               }
 
@@ -61,14 +60,14 @@ module.exports = function (core) {
                   context: `req.${key}`,
                   data: request[key],
                   inputType,
-                  name,
+                  name: 'fastify.preValidation',
                   stacktraceOpts: {
                     constructorOpt: preValidationHandler,
                   },
                   sourceContext
                 });
               } catch (err) {
-                logger.error({ err, inputType, name }, 'unable to handle Fastify source');
+                logger.error({ err, inputType, funcKey }, 'unable to handle Fastify source');
               }
             });
 

package/lib/dataflow/sources/install/fastify/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/formidable1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,6 +18,8 @@
 const { InputType } = require('@contrast/common');
 const { patchType } = require('../common');
 
+const inputType = InputType.MULTIPART_VALUE;
+
 module.exports = (core) => {
   const {
     depHooks,
@@ -25,8 +27,8 @@ module.exports = (core) => {
     logger,
     assess: { dataflow: { sources } },
   } = core;
-  const name = 'Formidable.IncomingForm.prototype.parse';
 
+  const name = 'Formidable.IncomingForm.prototype.parse';
 
   // Patch `formidable`
   function install() {
@@ -35,16 +37,16 @@ module.exports = (core) => {
         name,
         patchType,
         pre(data) {
+          const { funcKey } = data;
           const sourceContext = core.scopes.sources.getStore()?.assess;
-          const inputType = InputType.MULTIPART_VALUE;
 
           if (!sourceContext) {
-            logger.error({ inputType, name }, 'unable to handle source. Missing `sourceContext`');
+            logger.error({ inputType, funcKey }, 'unable to handle source. Missing `sourceContext`');
             return;
           }
 
           if (sourceContext.parsedBody) {
-            logger.trace({ inputType, name }, 'values already tracked');
+            logger.trace({ inputType, funcKey }, 'values already tracked');
             return;
           }
 
@@ -68,7 +70,7 @@ module.exports = (core) => {
                 });
                 sourceContext.parsedBody = true;
               } catch (err) {
-                logger.error({ err, inputType, name }, 'unable to handle source');
+                logger.error({ err, inputType, funcKey }, 'unable to handle source');
               }
             }
 

package/lib/dataflow/sources/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -22,7 +22,7 @@ const { toLowerCase, InputType } = require('@contrast/common');
  *  assess: import('@contrast/assess').Assess,
  * }} core
  */
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     assess: { dataflow, makeSourceContext },
     instrumentation: { instrument },
@@ -121,7 +121,7 @@ module.exports = function(core) {
         try {
           dataflow.sources.handle(sourceData);
         } catch (err) {
-          logger.error({ err, inputType, name: sourceName }, 'unable to handle http source');
+          logger.error({ err, inputType, sourceName }, 'unable to handle http source');
         }
       });
 
@@ -130,7 +130,7 @@ module.exports = function(core) {
         req.rawHeaders[i + 1] = req.headers[header];
       }
     } catch (err) {
-      logger.error({ err }, 'Error during Assess request handling');
+      logger.error({ err, funcKey: data.funcKey }, 'Error during Assess request handling');
     }
 
     setImmediate(() => {

package/lib/dataflow/sources/install/koa/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/koa/koa-bodyparsers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,25 +28,26 @@ module.exports = (core) => {
 
   // Patch `koa-body` v4.x.x and `koa-bodyparser` v5.x.x packages
   function install() {
-    ['koa-body', 'koa-bodyparser'].forEach(function (packageName) {
-      depHooks.resolve({ name: packageName }, (koaBody) => patcher.patch(koaBody, {
-        name: packageName,
+    ['koa-body', 'koa-bodyparser'].forEach((name) => {
+      depHooks.resolve({ name }, (koaBody) => patcher.patch(koaBody, {
+        name,
         patchType,
         post(data) {
           data.result = patcher.patch(data.result, {
-            name: packageName,
+            name,
             patchType,
             pre(data) {
+              const { funcKey } = data;
               const sourceContext = core.scopes.sources.getStore()?.assess;
               const [ctx, origNext] = data.args;
 
               if (!sourceContext) {
-                logger.error({ name: packageName }, 'unable to handle source. Missing `sourceContext`');
+                logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                 return;
               }
 
               if (sourceContext.parsedBody) {
-                logger.trace({ name: packageName }, 'values already tracked');
+                logger.trace({ funcKey }, 'values already tracked');
                 return;
               }
 
@@ -61,7 +62,7 @@ module.exports = (core) => {
                 try {
                   sources.handle({
                     context: 'ctx.request.body',
-                    name: packageName,
+                    name,
                     inputType,
                     stacktraceOpts: {
                       constructorOpt: contrastNext,
@@ -72,7 +73,7 @@ module.exports = (core) => {
 
                   sourceContext.parsedBody = !!Object.keys(ctx.request.body).length;
                 } catch (err) {
-                  logger.error({ err, inputType, name: packageName }, 'unable to handle Koa source');
+                  logger.error({ err, inputType, funcKey }, 'unable to handle Koa source');
                 }
 
                 await origNext(origErr);

package/lib/dataflow/sources/install/koa/koa-multer.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/koa/koa-routers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -32,22 +32,20 @@ module.exports = (core) => {
       depHooks.resolve(
         { name: router, file: 'lib/layer.js' },
         (layer) => {
-          const name = `[${router}].layer.prototype`;
-
           layer.prototype = patcher.patch(layer.prototype, 'params', {
-            name,
+            name: `[${router}].layer.prototype`,
             patchType,
-            post({ orig, hooked, result }) {
+            post({ orig, hooked, result, name, funcKey }) {
               const sourceContext = core.scopes.sources.getStore()?.assess;
               const inputType = InputType.URL_PARAMETER;
 
               if (!sourceContext) {
-                logger.error({ name, inputType }, 'unable to handle source. Missing `sourceContext`');
+                logger.error({ inputType, funcKey }, 'unable to handle source. Missing `sourceContext`');
                 return;
               }
 
               if (sourceContext.parsedParams) {
-                logger.trace({ name, inputType }, 'values already tracked');
+                logger.trace({ inputType, funcKey }, 'values already tracked');
                 return;
               }
 
@@ -66,7 +64,7 @@ module.exports = (core) => {
 
                 sourceContext.parsedParams = Boolean(Object.keys(result).length);
               } catch (err) {
-                logger.error({ err, inputType, name }, 'unable to handle Koa source');
+                logger.error({ err, inputType, funcKey }, 'unable to handle Koa source');
               }
             }
           });