@contrast/assess 1.60.0 → 1.62.0

package/lib/dataflow/sinks/install/http/server-response.js

@@ -77,7 +77,7 @@ module.exports = function(core) {
   ];
 
   const preHook = (moduleName, responseName, method) => ({ args, obj: response, result, hooked, orig }) => {
-    const methodName = `${responseName + (moduleName !== 'spdy' ? '.prototype' : '')}.${method}`;
+    const methodName = `${`${responseName}.prototype`}.${method}`;
     const name = `${moduleName}.${methodName}`;
     const sourceContext = getSinkContext(ruleId);
     if (!sourceContext) return;
@@ -91,7 +91,6 @@ module.exports = function(core) {
     const { contentType } = sourceContext.responseData;
     if (contentType && isSafeContentType(contentType)) return;
 
-    if (moduleName === 'spdy') response.spdyStream.once('finish', () => response.emit('finish'));
     if (isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
       const event = createSinkEvent({
         args: [{
@@ -175,16 +174,6 @@ module.exports = function(core) {
         });
       }
     });
-    depHooks.resolve({ name: 'spdy', version: '<5', file: 'lib/spdy/response.js' }, (response) => {
-      {
-        const method = 'end';
-        patcher.patch(response, method, {
-          name: 'spdy.response.end',
-          patchType,
-          pre: preHook('spdy', 'response', method),
-        });
-      }
-    });
   };
 
   return http;

package/lib/dataflow/sinks/install/restify.js

@@ -113,7 +113,7 @@ module.exports = function(core) {
     install() {
       // restify adds functionality to the built-in response via this patch function.
       // once it returns the request, it'll have been decorated with redirect() method.
-      depHooks.resolve({ name: 'restify', version: '<12', file: 'lib/response.js' }, (responsePatch) => patcher.patch(responsePatch, {
+      depHooks.resolve({ name: 'restify', version: '>=10 <12', file: 'lib/response.js' }, (responsePatch) => patcher.patch(responsePatch, {
         name: 'restify.response.patch',
         patchType,
         post(data) {

package/lib/dataflow/sources/install/http.js

@@ -196,7 +196,7 @@ module.exports = function (core) {
   }
 
   function install() {
-    ['http', 'https', 'spdy', 'http2'].forEach((moduleName) => {
+    ['http', 'https', 'http2'].forEach((moduleName) => {
       instrument({
         moduleName,
         patchObjects: [{

package/lib/dataflow/tracker.js

@@ -65,7 +65,7 @@ module.exports = function tracker(core) {
 
       if (distringuish.getProperties(value)) {
         const err = new Error();
-        logger.error({ err, value }, 'tracker.track called with a string value that is already tracked');
+        logger.debug({ err, value }, 'tracker.track called with a string value that is already tracked');
         return { extern: null };
       }
 

package/lib/get-source-context.js

@@ -101,7 +101,7 @@ function factory(core) {
       // that the caller previously logged, we generate a stack trace to
       // capture that information.
       const err = new Error('No source context found');
-      core.logger.warn({ err }, 'assess running outside of request scope');
+      core.logger.debug({ err }, 'assess running outside of request scope');
       return null;
     }
 

package/lib/response-scanning/install/http.js

@@ -146,18 +146,6 @@ module.exports = function(core) {
         });
       }
     });
-
-    depHooks.resolve({ name: 'spdy', version: '<5', file: 'lib/spdy/response.js' }, (response) => {
-      patcher.patch(response, 'end', {
-        name: 'spdy.response.end',
-        patchType: 'test',
-        post(data) {
-          const sourceContext = getSourceContext();
-          if (!sourceContext) return;
-          endHookChecks(sourceContext, data.obj.getHeaders?.(), StringPrototypeToLowerCase.call(data.args[0] || ''));
-        }
-      });
-    });
   };
 
   return http;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.60.0",
+  "version": "1.62.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,24 +14,24 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
-    "@contrast/core": "1.55.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.34.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/patcher": "1.27.0",
-    "@contrast/rewriter": "1.31.0",
-    "@contrast/route-coverage": "1.47.0",
-    "@contrast/scopes": "1.25.0",
-    "@contrast/sources": "1.1.0",
+    "@contrast/common": "1.37.0",
+    "@contrast/config": "1.52.0",
+    "@contrast/core": "1.57.0",
+    "@contrast/dep-hooks": "1.26.0",
+    "@contrast/distringuish": "^6.0.2",
+    "@contrast/instrumentation": "1.36.0",
+    "@contrast/logger": "1.30.0",
+    "@contrast/patcher": "1.29.0",
+    "@contrast/rewriter": "1.33.0",
+    "@contrast/route-coverage": "1.49.0",
+    "@contrast/scopes": "1.27.0",
+    "@contrast/sources": "1.3.0",
     "semver": "^7.6.0"
   }
 }