@contrast/assess 1.34.0 → 1.35.0

package/lib/dataflow/sources/handler.js

@@ -63,7 +63,7 @@ module.exports = function (core) {
   };
 
   sources.createStacktrace = function (stacktraceOpts) {
-    return config.assess.stacktraces === 'NONE'
+    return config.assess.stacktraces === 'NONE' || config.assess.stacktraces === 'SINK'
       ? emptyStack
       : createSnapshot(stacktraceOpts)();
   };

package/lib/dataflow/sources/handler.test.js

@@ -139,6 +139,44 @@ describe('assess dataflow sources handler', function () {
       });
     });
 
+    ['SINK', 'NONE'].forEach((option) => {
+      it(`does not capture stacktrace for assess.stacktraces=${option}`, function() {
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          core.config.assess.stacktraces = option;
+          const trackedObj = sources.handle({
+            name: 'test-source-name',
+            inputType: InputType.QUERYSTRING,
+            data: { prop1: 'foo' },
+            sourceContext
+          });
+
+          const trackData = tracker.getData(trackedObj.prop1);
+          expect(trackData.stack).to.deep.equal([]);
+        });
+      });
+    });
+
+    ['SOME', 'ALL'].forEach((option) => {
+      it(`captures stacktrace for assess.stacktraces=${option}`, function() {
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          core.config.assess.stacktraces = option;
+          const trackedObj = sources.handle({
+            name: 'test-source-name',
+            inputType: InputType.QUERYSTRING,
+            data: { prop1: 'foo' },
+            sourceContext
+          });
+
+          const trackData = tracker.getData(trackedObj.prop1);
+          expect(trackData.stack).to.be.instanceOf(Array);
+          expect(trackData.stack.length).to.be.greaterThan(0);
+        });
+      });
+    });
+
+
     it('traverses objects and tracks string values', function () {
       simulateRequestScope(() => {
         const sourceContext = core.scopes.sources.getStore()?.assess;

package/lib/event-factory.test.js

@@ -199,14 +199,16 @@ testMethod('assess event-factory', function () {
       });
     });
 
-    it('returns an event without stacktrace generator function when stacktraces option is not set to "ALL"', function () {
-      core.config.assess.stacktraces = 'SOME';
-      core.scopes.sources.run(validStore, function () {
-        const result = createPropagationEvent(validData);
+    ['SOME', 'SINK', 'NONE'].forEach((option) => {
+      it(`returns an event without stacktrace generator function when stacktraces option is not set to "ALL" and set to ${option}`, function () {
+        core.config.assess.stacktraces = option;
+        core.scopes.sources.run(validStore, function () {
+          const result = createPropagationEvent(validData);
 
-        expect(result).to.be.like(validResult);
-        expect(result.time).not.to.be.undefined;
-        expect(result.stack).to.deep.equal([]);
+          expect(result).to.be.like(validResult);
+          expect(result.time).not.to.be.undefined;
+          expect(result.stack).to.deep.equal([]);
+        });
       });
     });
   });
@@ -296,14 +298,17 @@ testMethod('assess event-factory', function () {
       });
     });
 
-    it('returns an event with stacktrace generator function when stacktraces option is not set to "NONE"', function () {
-      core.config.assess.stacktraces = 'ALL';
-      core.scopes.sources.run(validStore, function () {
-        const result = createSinkEvent(validData);
+    ['ALL', 'SOME', 'SINK'].forEach((option) => {
+      it(`returns an event with stacktrace generator function when stacktraces option is not set to "NONE" and set to ${option}`, function () {
+        core.config.assess.stacktraces = option;
+        core.scopes.sources.run(validStore, function () {
+          const result = createSinkEvent(validData);
 
-        expect(result).to.be.like(validResult);
-        expect(result.time).not.to.be.undefined;
-        expect(result.stack).to.be.instanceOf(Array);
+          expect(result).to.be.like(validResult);
+          expect(result.time).not.to.be.undefined;
+          expect(result.stack).to.be.instanceOf(Array);
+          expect(result.stack.length).to.be.greaterThan(0);
+        });
       });
     });
 

package/lib/index.d.ts

@@ -12,17 +12,22 @@
  * engineered, modified, repackaged, sold, redistributed or otherwise used in a
  * way not consistent with the End User License Agreement.
  */
-import { IncomingMessage, ServerResponse } from 'node:http';
-import {
-  Rule,
-  SessionConfigurationRule,
-} from '@contrast/common';
+import { Rule, SessionConfigurationRule } from '@contrast/common';
+import { Config } from '@contrast/config';
 import { Core as _Core } from '@contrast/core';
+import { Deadzones } from '@contrast/deadzones';
+import { DepHooks } from '@contrast/dep-hooks';
+import { Logger } from '@contrast/logger';
+import { Patcher } from '@contrast/patcher';
+import { ReporterBus } from '@contrast/reporter';
+import { Rewriter } from '@contrast/rewriter';
+import { Scopes } from '@contrast/scopes';
+import { IncomingMessage, ServerResponse } from 'node:http';
 
 export interface Core extends _Core {
   config: Config;
   logger: Logger;
-  depHooks: RequireHook;
+  depHooks: DepHooks;
   patcher: Patcher
   rewriter: Rewriter;
   scopes: Scopes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,15 +18,15 @@
   },
   "dependencies": {
     "@contrast/common": "1.25.0",
-    "@contrast/config": "1.32.0",
-    "@contrast/core": "1.36.0",
-    "@contrast/dep-hooks": "1.4.0",
+    "@contrast/config": "1.33.0",
+    "@contrast/core": "1.37.0",
+    "@contrast/dep-hooks": "1.5.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.14.0",
-    "@contrast/logger": "1.9.0",
-    "@contrast/patcher": "1.8.0",
-    "@contrast/rewriter": "1.12.0",
-    "@contrast/scopes": "1.5.0",
+    "@contrast/instrumentation": "1.15.0",
+    "@contrast/logger": "1.10.0",
+    "@contrast/patcher": "1.9.0",
+    "@contrast/rewriter": "1.13.0",
+    "@contrast/scopes": "1.6.0",
     "semver": "^7.6.0"
   }
 }