@contrast/assess 1.75.0 → 1.76.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -373,7 +373,7 @@ module.exports = function (core) {
|
|
|
373
373
|
}
|
|
374
374
|
|
|
375
375
|
instr.install = function () {
|
|
376
|
-
depHooks.resolve({ name: 'mongodb', version: '<
|
|
376
|
+
depHooks.resolve({ name: 'mongodb', version: '<8' }, (mongodb, meta) => {
|
|
377
377
|
if (!mongodb.Collection || !mongodb.Db) {
|
|
378
378
|
meta.rerun();
|
|
379
379
|
return;
|
|
@@ -107,7 +107,18 @@ module.exports = function(core) {
|
|
|
107
107
|
core.assess.dataflow.sinks.sqlite3 = {
|
|
108
108
|
install() {
|
|
109
109
|
|
|
110
|
-
depHooks.resolve({ name: '
|
|
110
|
+
depHooks.resolve({ name: 'node:sqlite', version: '*' }, nodeSqlite => {
|
|
111
|
+
['exec', 'prepare'].forEach((method) => {
|
|
112
|
+
const name = `nodeSqlite.DatabaseSync.prototype.${method}`;
|
|
113
|
+
patcher.patch(nodeSqlite.DatabaseSync.prototype, method, {
|
|
114
|
+
name,
|
|
115
|
+
patchType,
|
|
116
|
+
pre: pre('node:sqlite', method)
|
|
117
|
+
});
|
|
118
|
+
});
|
|
119
|
+
});
|
|
120
|
+
|
|
121
|
+
depHooks.resolve({ name: 'better-sqlite3', version: '<13' }, betterSqlite3 => {
|
|
111
122
|
['exec', 'prepare'].forEach((method) => {
|
|
112
123
|
const name = `better-sqlite3.prototype.${method}`;
|
|
113
124
|
patcher.patch(betterSqlite3.prototype, method, {
|
|
@@ -31,53 +31,60 @@ module.exports = function (core) {
|
|
|
31
31
|
|
|
32
32
|
const source = sources.fastifyInstrumentation.fastify = {
|
|
33
33
|
install() {
|
|
34
|
-
depHooks.resolve({ name: 'fastify', version: '>=4 <6' }, (fastify) =>
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
34
|
+
depHooks.resolve({ name: 'fastify', version: '>=4 <6' }, (fastify) => {
|
|
35
|
+
const patched = patcher.patch(fastify, {
|
|
36
|
+
name: 'fastify.constructor',
|
|
37
|
+
patchType,
|
|
38
|
+
post({ result: server, funcKey }) {
|
|
39
|
+
server.addHook('preValidation', function preValidationHandler(request, reply, done) {
|
|
40
|
+
// todo(NODE-3793): support for @fastify/websocket
|
|
41
|
+
if (request.constructor.name == 'WebSocket') return;
|
|
41
42
|
|
|
42
|
-
|
|
43
|
-
|
|
43
|
+
const sourceContext = getSourceContext();
|
|
44
|
+
if (!sourceContext) return done();
|
|
44
45
|
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
46
|
+
const bodyType = request?.headers?.['content-type']?.includes('/json')
|
|
47
|
+
? InputType.JSON_VALUE
|
|
48
|
+
: typeof request.body == 'object'
|
|
49
|
+
? InputType.PARAMETER_VALUE
|
|
50
|
+
: InputType.BODY;
|
|
50
51
|
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
52
|
+
[
|
|
53
|
+
{ key: 'query', inputType: InputType.QUERYSTRING, alreadyTrackedFlag: 'parsedQuery' },
|
|
54
|
+
{ key: 'params', inputType: InputType.URL_PARAMETER, alreadyTrackedFlag: 'parsedParams' },
|
|
55
|
+
{ key: 'body', inputType: bodyType, alreadyTrackedFlag: 'parsedBody' }
|
|
56
|
+
].forEach(({ key, inputType, alreadyTrackedFlag }) => {
|
|
57
|
+
if (sourceContext[alreadyTrackedFlag]) {
|
|
58
|
+
logger.trace({ inputType, funcKey }, 'values already tracked');
|
|
59
|
+
return;
|
|
60
|
+
}
|
|
60
61
|
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
62
|
+
try {
|
|
63
|
+
sources.handle({
|
|
64
|
+
context: `req.${key}`,
|
|
65
|
+
data: request[key],
|
|
66
|
+
inputType,
|
|
67
|
+
name: 'fastify.preValidation',
|
|
68
|
+
stacktraceOpts: {
|
|
69
|
+
constructorOpt: preValidationHandler,
|
|
70
|
+
},
|
|
71
|
+
sourceContext
|
|
72
|
+
});
|
|
73
|
+
} catch (err) {
|
|
74
|
+
logger.error({ err, inputType, funcKey }, 'unable to handle Fastify source');
|
|
75
|
+
}
|
|
76
|
+
});
|
|
77
|
+
|
|
78
|
+
return done();
|
|
75
79
|
});
|
|
80
|
+
},
|
|
81
|
+
});
|
|
82
|
+
|
|
83
|
+
fastify.fastify = patched;
|
|
84
|
+
fastify.default = patched;
|
|
76
85
|
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
},
|
|
80
|
-
}));
|
|
86
|
+
return patched;
|
|
87
|
+
});
|
|
81
88
|
}
|
|
82
89
|
};
|
|
83
90
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@contrast/assess",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.76.0",
|
|
4
4
|
"description": "Contrast service providing framework-agnostic Assess support",
|
|
5
5
|
"license": "SEE LICENSE IN LICENSE",
|
|
6
6
|
"author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
|
|
@@ -21,18 +21,18 @@
|
|
|
21
21
|
},
|
|
22
22
|
"dependencies": {
|
|
23
23
|
"@contrast/common": "1.41.1",
|
|
24
|
-
"@contrast/config": "1.
|
|
25
|
-
"@contrast/core": "1.
|
|
26
|
-
"@contrast/dep-hooks": "1.
|
|
24
|
+
"@contrast/config": "1.59.0",
|
|
25
|
+
"@contrast/core": "1.64.0",
|
|
26
|
+
"@contrast/dep-hooks": "1.33.0",
|
|
27
27
|
"@contrast/distringuish": "6.0.2",
|
|
28
|
-
"@contrast/instrumentation": "1.
|
|
29
|
-
"@contrast/logger": "1.
|
|
30
|
-
"@contrast/patcher": "1.
|
|
31
|
-
"@contrast/rewriter": "1.
|
|
32
|
-
"@contrast/route-coverage": "1.
|
|
33
|
-
"@contrast/scopes": "1.
|
|
34
|
-
"@contrast/sources": "1.
|
|
35
|
-
"@contrast/stack-trace-factory": "1.
|
|
28
|
+
"@contrast/instrumentation": "1.43.0",
|
|
29
|
+
"@contrast/logger": "1.37.0",
|
|
30
|
+
"@contrast/patcher": "1.36.0",
|
|
31
|
+
"@contrast/rewriter": "1.41.0",
|
|
32
|
+
"@contrast/route-coverage": "1.58.0",
|
|
33
|
+
"@contrast/scopes": "1.34.0",
|
|
34
|
+
"@contrast/sources": "1.10.0",
|
|
35
|
+
"@contrast/stack-trace-factory": "1.5.0",
|
|
36
36
|
"semver": "7.6.0"
|
|
37
37
|
}
|
|
38
38
|
}
|