@contrast/assess 1.47.0 → 1.48.0

package/lib/dataflow/propagation/install/contrast-methods/add.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const { isString } = require('@contrast/common');
 const { createAppendTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -40,7 +41,11 @@ module.exports = function(core) {
         // first get result, then following logic acts as post-hook in patcher speak
         const result = add(...args);
 
-        if (!result || !getPropagatorContext()) return result;
+        if (
+          !result ||
+          !isString(result) ||
+          !getPropagatorContext()
+        ) return result;
 
         const rInfo = tracker.getData(result);
         if (rInfo) {

package/lib/dataflow/propagation/install/fastify-send.js

@@ -26,8 +26,8 @@ module.exports = function (core) {
 
   return core.assess.dataflow.propagation.fastifySend = {
     install() {
-      depHooks.resolve({ name: '@fastify/send', version: '<4', file: 'lib/SendStream.js' }, (_SendStream) => {
-        patcher.patch(_SendStream.prototype, 'sendFile', {
+      depHooks.resolve({ name: '@fastify/send', version: '<3', file: 'lib/SendStream.js' }, (SendStream) => {
+        patcher.patch(SendStream.prototype, 'sendFile', {
           name: '@fastify/send/lib/SendStream.js',
           patchType,
           usePerf: 'sync',
@@ -41,6 +41,22 @@ module.exports = function (core) {
           },
         });
       });
+
+      depHooks.resolve({ name: '@fastify/send', version: '>=3 <5', file: 'lib/send.js' }, (send) => {
+        patcher.patch(send, 'send', {
+          name: '@fastify/send/lib/send.js',
+          patchType,
+          usePerf: 'sync',
+          pre(data) {
+            const { args } = data;
+
+            if (!getPropagatorContext()) return;
+
+            const untrackedPath = StringPrototypeSlice.call(` ${args[1]}`, 1);
+            args[1] = untrackedPath;
+          },
+        });
+      });
     }
   };
 };

package/lib/dataflow/sources/install/hapi/hapi.js

@@ -31,7 +31,7 @@ module.exports = function (core) {
 
   const source = sources.hapiInstrumentation.hapi = {
     install() {
-      return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <22' }, (hapi) => {
+      depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <22' }, (hapi) => {
         ['server', 'Server'].forEach((server) => {
           patcher.patch(hapi, server, {
             name: `hapi.${server}`,
@@ -40,7 +40,7 @@ module.exports = function (core) {
 
               server.ext('onRequest', (req, h) => {
                 const sourceContext = getSourceContext();
-                if (!sourceContext) return;
+                if (!sourceContext) return h.continue;
 
                 [
                   { key: 'query', inputType: InputType.QUERYSTRING, trackedFlag: 'parsedQuery' },
@@ -70,9 +70,10 @@ module.exports = function (core) {
                 });
                 return h.continue;
               });
+
               server.ext('onPostAuth', (req, h) => {
                 const sourceContext = core.scopes.sources.getStore()?.assess;
-                if (!sourceContext) return;
+                if (!sourceContext) return h.continue;
 
                 [
                   { key: 'state', inputType: InputType.COOKIE_VALUE, trackedFlag: 'parsedCookies' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,17 +20,17 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.29.1",
-    "@contrast/config": "1.40.2",
-    "@contrast/core": "1.45.2",
-    "@contrast/dep-hooks": "1.14.2",
+    "@contrast/common": "1.30.0",
+    "@contrast/config": "1.41.0",
+    "@contrast/core": "1.46.0",
+    "@contrast/dep-hooks": "1.15.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.24.2",
-    "@contrast/logger": "1.18.2",
-    "@contrast/patcher": "1.17.2",
-    "@contrast/rewriter": "1.21.4",
-    "@contrast/route-coverage": "1.35.2",
-    "@contrast/scopes": "1.15.2",
+    "@contrast/instrumentation": "1.25.0",
+    "@contrast/logger": "1.19.0",
+    "@contrast/patcher": "1.18.0",
+    "@contrast/rewriter": "1.22.0",
+    "@contrast/route-coverage": "1.36.0",
+    "@contrast/scopes": "1.16.0",
     "semver": "^7.6.0"
   }
 }