@contrast/assess 1.54.1 → 1.56.0

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { isString } = require('@contrast/common');
+const { isString, primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 const { createSubsetTags, truncateStringValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 const { getKeyValueIndices } = require('./parse-fn');
@@ -73,7 +73,7 @@ module.exports = function (core) {
 
     return createPropagationEvent({
       get context() {
-        return `${method}(${eventArgs.map((arg, i) => i == 0 ? data.truncatedArg0 : `'${arg.value}'`)})`;
+        return `${method}(${ArrayPrototypeJoin.call(eventArgs.map((arg, i) => i == 0 ? data.truncatedArg0 : `'${arg.value}'`))})`;
       },
       name: method,
       history: [strInfo],

package/lib/dataflow/sources/install/fastify/fastify.js

@@ -36,6 +36,9 @@ module.exports = function (core) {
         patchType,
         post({ result: server, funcKey }) {
           server.addHook('preValidation', function preValidationHandler(request, reply, done) {
+            // todo(NODE-3793): support for @fastify/websocket
+            if (request.constructor.name == 'WebSocket') return;
+
             const sourceContext = getSourceContext();
             if (!sourceContext) return done();
 

package/lib/get-source-context.js

@@ -64,7 +64,6 @@ function factory(core) {
     // there is a context, but if policy is null then assess is intentionally
     // disabled (i.e., url exclusion or the request is not sampled).
     if (!ctx.policy) {
-      core.logger.trace('Assess intentionally disabled for this request');
       return null;
     }
 
@@ -84,7 +83,6 @@ function factory(core) {
     if (!ctx) return null;
 
     if (!ctx.policy) {
-      core.logger.trace('Assess intentionally disabled for this request');
       return null;
     }
 
@@ -108,7 +106,6 @@ function factory(core) {
     }
 
     if (!ctx.policy) {
-      core.logger.trace('Assess intentionally disabled for this request');
       return null;
     }
 

package/lib/sampler/common.js

@@ -84,23 +84,34 @@ class BaseSampler {
 class AssessTurnedOffSampler extends BaseSampler {
   constructor() {
     super(SamplingStrategies.AssessTurnedOff);
-    this._sampleInfo = Object.seal({ canSample: false });
+    this.sampleInfo = Object.seal({ canSample: false });
   }
 
   getSampleInfo() {
-    return this._sampleInfo;
+    return this.sampleInfo;
   }
 }
 
 class ProbabilisticSampler extends BaseSampler {
   constructor(opts) {
     super(SamplingStrategies.Probabilistic, opts);
+    this.baseline = 0;
+    this.defaultSampleInfo = Object.seal({ canSample: true });
+    // reset baseline each window_ms
+    setInterval(() => {
+      this.baseline = 0;
+    }, opts.window_ms).unref();
   }
 
   getSampleInfo(sourceInfo) {
-    const { base_probability } = this.opts;
+    const { baseline, base_probability } = this.opts;
     const { reqData } = sourceInfo.store.assess;
 
+    if (this.baseline < baseline) {
+      this.baseline++;
+      return this.defaultSampleInfo;
+    }
+
     // base caclulation
     const rand = Math.random();
     const canSample = rand < base_probability;

package/lib/sampler/index.js

@@ -70,6 +70,8 @@ module.exports = function assess(core) {
         opts = {
           base_probability: baseProbability,
           route_monitor: config.assess.probabilistic_sampling.route_monitor,
+          baseline: config.getEffectiveValue('assess.probabilistic_sampling.baseline'),
+          window_ms: config.getEffectiveValue('assess.probabilistic_sampling.window_ms'),
         };
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.54.1",
+  "version": "1.56.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,20 +17,20 @@
     "node": ">= 16.9.1"
   },
   "scripts": {
-    "test": "../scripts/test.sh"
+    "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.32.0",
-    "@contrast/config": "1.46.0",
-    "@contrast/core": "1.51.0",
-    "@contrast/dep-hooks": "1.20.0",
+    "@contrast/common": "1.33.0",
+    "@contrast/config": "1.48.0",
+    "@contrast/core": "1.53.0",
+    "@contrast/dep-hooks": "1.22.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.30.0",
-    "@contrast/logger": "1.24.0",
-    "@contrast/patcher": "1.23.0",
-    "@contrast/rewriter": "1.27.0",
-    "@contrast/route-coverage": "1.42.0",
-    "@contrast/scopes": "1.21.0",
+    "@contrast/instrumentation": "1.32.0",
+    "@contrast/logger": "1.26.0",
+    "@contrast/patcher": "1.25.0",
+    "@contrast/rewriter": "1.29.0",
+    "@contrast/route-coverage": "1.44.0",
+    "@contrast/scopes": "1.23.0",
     "semver": "^7.6.0"
   }
 }