@contrast/assess 1.32.0 → 1.33.0

package/lib/dataflow/tracker.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const distringuish = require('@contrast/distringuish');
-const { isString } = require('@contrast/common');
+const { BufferPrototypeToString, BufferFrom, isString } = require('@contrast/common');
 
 module.exports = function tracker(core) {
   const {
@@ -58,6 +58,11 @@ module.exports = function tracker(core) {
     }
 
     if (typeof value === 'string') {
+      // todo: don't track string representations of numbers
+      // if (!isNaN(+value)) {
+      //   return { extern: null };
+      // }
+
       if (distringuish.getProperties(value)) {
         const err = new Error();
         logger.error({ err, value }, 'tracker.track called with a string value that is already tracked');
@@ -68,7 +73,7 @@ module.exports = function tracker(core) {
 
       if (extern == 2) {
         // Try work-around for some wrong/unknown encoding
-        extern = distringuish.externalize(Buffer.from(value).toString());
+        extern = distringuish.externalize(BufferPrototypeToString.call(BufferFrom(value)));
       }
 
       if (!extern || !isString(extern)) {

package/lib/get-source-context.js

@@ -37,9 +37,18 @@ module.exports = function(core) {
    */
   return core.assess.getSourceContext = function getSourceContext(type, ...rest) {
     const ctx = sources.getStore()?.assess;
-
+    // <unsafe>
+    // This method is expected to be called by all Assess instrumentation components prior to doing work.
+    // Until we check policy, and whether instrumentation is locked, any instrumentation that is called before
+    // the </unsafe> section below will result in infinite recursion.
+    //
+    // E.g. Uncommenting any line below will cause a stack overflow:
+    // 'asdf'.concat()
+    // console.log() // even though this is deadzoned, we haven't checked whether instrumentation is locked yet
+    //
     // policy will not exist if assess is altogether disabled for the active request e.g. url exclusion
     if (!ctx?.policy || instrumentation.isLocked()) return null;
+    // </unsafe> but still be careful
 
     switch (type) {
       case InstrumentationType.PROPAGATOR: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,7 +17,7 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.23.0",
+    "@contrast/common": "1.24.0",
     "@contrast/distringuish": "^5.0.0",
     "@contrast/scopes": "1.4.1"
   }