@contrast/assess 1.65.0 → 1.66.0

package/lib/configuration-analysis/install/apollo-server.js

@@ -39,7 +39,7 @@ module.exports = function (core) {
   const apolloServer = core.assess.configurationAnalysis.apolloServer = {};
 
   apolloServer.install = function () {
-    return depHooks.resolve({ name: '@apollo/server', version: '>=4', file: 'dist/cjs' }, (xport) => {
+    return depHooks.resolve({ name: '@apollo/server', version: '>=4' }, (xport) => {
       if (!xport.ApolloServer) return;
       patcher.patch(xport, 'ApolloServer', {
         name: '@apollo/server.ApolloServer',

package/lib/configuration-analysis/install/graphql-yoga.js

@@ -39,7 +39,7 @@ module.exports = function (core) {
   const graphqlYoga = core.assess.configurationAnalysis.graphqlYoga = {};
 
   graphqlYoga.install = function () {
-    return depHooks.resolve({ name: '@graphql-yoga/plugin-disable-introspection', version: '*', file: 'cjs' }, (xport) => patcher.patch(xport, 'useDisableIntrospection', {
+    return depHooks.resolve({ name: '@graphql-yoga/plugin-disable-introspection', version: '*' }, (xport) => patcher.patch(xport, 'useDisableIntrospection', {
       name: '@graphql-yoga/plugin-disable-introspection.useDisableIntrospection',
       patchType,
       post(data) {

package/lib/dataflow/sinks/install/fs.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
         tracker,
         sinks: { isVulnerable, reportFindings },
       },
+      ruleScopes
     },
   } = core;
 
@@ -60,12 +61,12 @@ module.exports = function(core) {
     }, []);
   }
 
-  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
+  const around = (name, method, moduleName = 'fs', fullMethodName = '') => (next, data) => {
     const { name: methodName, indices } = method;
-    if (!getSinkContext(ruleId)) return;
+    if (!getSinkContext(ruleId)) return next();
 
     const values = getValues(indices, data.args);
-    if (!values.length) return;
+    if (!values.length) return next();
 
     const args = values.map((v) => {
       const strInfo = tracker.getData(v);
@@ -111,6 +112,7 @@ module.exports = function(core) {
         });
       }
     }
+    return ruleScopes.run(ruleId, next);
   };
 
   core.assess.dataflow.sinks.pathTraversal = {
@@ -123,7 +125,7 @@ module.exports = function(core) {
             patcher.patch(fs, method.name, {
               name,
               patchType,
-              pre: pre(name, method),
+              around: around(name, method),
             });
           }
 
@@ -134,19 +136,10 @@ module.exports = function(core) {
               patcher.patch(fs, syncName, {
                 name,
                 patchType,
-                pre: pre(name, method, 'fs', syncName),
+                around: around(name, method, 'fs', syncName),
               });
             }
           }
-
-          if (method.promises && fs.promises && fs.promises[method.name]) {
-            const name = `fs.promises.${method.name}`;
-            patcher.patch(fs.promises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fs.promises'),
-            });
-          }
         }
       });
 
@@ -157,7 +150,7 @@ module.exports = function(core) {
             patcher.patch(fsPromises, method.name, {
               name,
               patchType,
-              pre: pre(name, method, 'fsPromises'),
+              around: around(name, method, 'fsPromises'),
             });
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,17 +21,17 @@
   },
   "dependencies": {
     "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.0",
-    "@contrast/core": "1.59.0",
-    "@contrast/dep-hooks": "1.28.0",
+    "@contrast/config": "1.54.1",
+    "@contrast/core": "1.59.1",
+    "@contrast/dep-hooks": "1.28.1",
     "@contrast/distringuish": "^6.0.2",
-    "@contrast/instrumentation": "1.38.0",
-    "@contrast/logger": "1.32.0",
-    "@contrast/patcher": "1.31.0",
-    "@contrast/rewriter": "1.36.0",
-    "@contrast/route-coverage": "1.51.0",
-    "@contrast/scopes": "1.29.0",
-    "@contrast/sources": "1.5.0",
+    "@contrast/instrumentation": "1.38.1",
+    "@contrast/logger": "1.32.1",
+    "@contrast/patcher": "1.31.1",
+    "@contrast/rewriter": "1.36.1",
+    "@contrast/route-coverage": "1.52.0",
+    "@contrast/scopes": "1.29.1",
+    "@contrast/sources": "1.5.1",
     "semver": "^7.6.0"
   }
 }