@contrast/assess 1.67.2 → 1.68.0

package/lib/crypto-analysis/install/crypto.js

@@ -100,24 +100,24 @@ module.exports = function (core) {
 
             if (!event) return;
 
+            let skipLib;
+            const stack = config.getEffectiveValue('assess.stacktraces') === 'NONE' ?
+              core.stackTraceFactory.create() :
+              event.stack;
+
             // check stacktrace for trusted libraries
-            if (config.getEffectiveValue('assess.stacktraces') === 'NONE') {
-              const { stack } = new Error(event.stacktraceOpts);
-              for (const lib of SAFE_HASH_LIBS) {
-                if (stack.indexOf(lib) >= 0) return;
-              }
-            } else {
-              for (const { file } of event.stack) {
-                for (const lib of SAFE_HASH_LIBS) {
-                  logger.trace(
-                    { funcKey: data.funcKey },
-                    'skipping reporting for %s - trusting %s',
-                    Rule.CRYPTO_BAD_MAC,
-                    lib
-                  );
-                  if (file.indexOf(lib) >= 0) return;
-                }
-              }
+            for (const safeLib of SAFE_HASH_LIBS) {
+              if (stack.some((frame) => frame.indexOf(safeLib) >= 0)) skipLib = safeLib;
+            }
+
+            if (skipLib) {
+              logger.trace(
+                { funcKey: data.funcKey },
+                'skipping reporting for %s - trusting %s',
+                Rule.CRYPTO_BAD_MAC,
+                skipLib
+              );
+              return;
             }
 
             cryptoAnalysis.report({ finding: event, ruleId: Rule.CRYPTO_BAD_MAC });

package/lib/dataflow/sources/handler.js

@@ -38,8 +38,8 @@ module.exports = Core.makeComponent({
           tracker
         }
       },
+      stackTraceFactory,
       config,
-      createSnapshot,
     } = core;
 
     const logger = core.logger.child({ name: 'contrast:sources' });
@@ -65,7 +65,7 @@ module.exports = Core.makeComponent({
     sources.createStacktrace = function(stacktraceOpts) {
       return config.assess.stacktraces === 'NONE' || config.assess.stacktraces === 'SINK'
         ? empties.ARRAY
-        : createSnapshot(stacktraceOpts)();
+        : stackTraceFactory.create(stacktraceOpts);
     };
 
     sources.handle = function({
@@ -117,7 +117,7 @@ module.exports = Core.makeComponent({
           result: { tracked: true, value },
         };
 
-        const event = eventFactory.createSourceEvent(eventData);;
+        const event = eventFactory.createSourceEvent(eventData);
         if (event && onEvent) onEvent(event, fieldName, pathName);
 
         return event;

package/lib/event-factory.js

@@ -15,9 +15,16 @@
 
 'use strict';
 
-const { Event, InputType, empties, primordials: { StringPrototypeMatch } } = require('@contrast/common');
+const {
+  Event,
+  InputType,
+  empties,
+  isString,
+  primordials: { StringPrototypeMatch }
+} = require('@contrast/common');
 const { ConfigSource } = require('@contrast/config');
 const { Core } = require('@contrast/core/lib/ioc/core');
+
 const ANNOTATION_REGEX = /^(A|O|R|P|P\d+)$/;
 const SOURCE_EVENT_MSG = 'Source event not created: %s';
 const PROPAGATION_EVENT_MSG = 'Propagation event not created: %s';
@@ -26,10 +33,10 @@ module.exports = Core.makeComponent({
   name: 'assess.eventFactory',
   factory(core) {
     const {
-      createSnapshot,
       config,
       logger,
       scopes: { sources },
+      stackTraceFactory,
     } = core;
 
     const eventFactory = core.assess.eventFactory = {};
@@ -62,7 +69,7 @@ module.exports = Core.makeComponent({
         logger.debug(SOURCE_EVENT_MSG, `event has no tags: ${data.name}`);
         return null;
       }
-      if (!data.stack || !Array.isArray(data.stack)) {
+      if (!data.stack || (!Array.isArray(data.stack) && !isString(data.stack))) {
         logger.debug(SOURCE_EVENT_MSG, `invalid stack: ${data.name}`);
         return null;
       }
@@ -102,7 +109,7 @@ module.exports = Core.makeComponent({
       }
 
       if (eventFactory.stacktraces === 'ALL') {
-        data.stack = createSnapshot(data.stacktraceOpts)();
+        data.stack = stackTraceFactory.create(data.stacktraceOpts);
       } else {
         data.stack = empties.ARRAY;
       }
@@ -144,7 +151,7 @@ module.exports = Core.makeComponent({
       }
 
       if (eventFactory.stacktraces !== 'NONE') {
-        data.stack = createSnapshot(data.stacktraceOpts)();
+        data.stack = stackTraceFactory.create(data.stacktraceOpts);
       } else {
         data.stack = empties.ARRAY;
       }
@@ -172,7 +179,7 @@ module.exports = Core.makeComponent({
         return null;
       }
       if (eventFactory.stacktraces !== 'NONE') {
-        data.stack = createSnapshot(data.stacktraceOpts)();
+        data.stack = stackTraceFactory.create(data.stacktraceOpts);
       } else {
         data.stack = empties.ARRAY;
       }
@@ -213,7 +220,7 @@ module.exports = Core.makeComponent({
         return null;
       }
       if (eventFactory.stacktraces !== 'NONE') {
-        data.stack = createSnapshot(data.stacktraceOpts)();
+        data.stack = stackTraceFactory.create(data.stacktraceOpts);
       } else {
         data.stack = empties.ARRAY;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.67.2",
+  "version": "1.68.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,18 +20,19 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.39.1",
-    "@contrast/config": "1.55.1",
-    "@contrast/core": "1.60.1",
-    "@contrast/dep-hooks": "1.29.1",
+    "@contrast/common": "1.40.0",
+    "@contrast/config": "1.56.0",
+    "@contrast/core": "1.61.0",
+    "@contrast/dep-hooks": "1.30.0",
     "@contrast/distringuish": "^6.0.2",
-    "@contrast/instrumentation": "1.39.1",
-    "@contrast/logger": "1.33.1",
-    "@contrast/patcher": "1.32.1",
-    "@contrast/rewriter": "1.37.2",
-    "@contrast/route-coverage": "1.53.2",
-    "@contrast/scopes": "1.30.1",
-    "@contrast/sources": "1.6.1",
+    "@contrast/instrumentation": "1.40.0",
+    "@contrast/logger": "1.34.0",
+    "@contrast/patcher": "1.33.0",
+    "@contrast/rewriter": "1.38.0",
+    "@contrast/route-coverage": "1.54.0",
+    "@contrast/scopes": "1.31.0",
+    "@contrast/sources": "1.7.0",
+    "@contrast/stack-trace-factory": "1.1.0",
     "semver": "^7.6.0"
   }
 }