@contrast/common 1.36.0 → 1.38.0

package/lib/constants.d.ts

@@ -6,11 +6,11 @@ export declare enum Event {
     ASSESS_DATAFLOW_FINDING = "assess-dataflow-findings",
     ASSESS_DATAFLOW_SAFE_POSITIVE = "assess-dataflow-safe-positive",
     ASSESS_RESPONSE_SCANNING_FINDING = "assess-response-scanning-findings",
-    ASSESS_SESSION_CONFIGURATION_FINDING = "assess-session-configuration-findings",
+    ASSESS_CONFIGURATION_FINDING = "assess-configuration-findings",
     ASSESS_CRYPTO_ANALYSIS_FINDING = "assess-crypto-analysis-finding",
     LIBRARY = "library",
     LIBRARY_USAGE = "library-usage",
-    PROTECT = "protect",
+    PROTECT_FINDING = "protect-finding",
     ROUTE_COVERAGE_OBSERVATION = "route-coverage-observation",
     SERVER_SETTINGS_UPDATE = "server-settings-update",// UI remote settings updates
     UNINSTALL = "uninstall",// disable all components/features
@@ -60,9 +60,10 @@ export declare enum ResponseScanningRule {
     XCONTENTTYPE_HEADER_MISSING = "xcontenttype-header-missing",
     XXSPROTECTION_HEADER_DISABLED = "xxssprotection-header-disabled"
 }
-export declare enum SessionConfigurationRule {
+export declare enum ConfigurationRule {
     HTTPONLY = "httponly",
-    SECURE_FLAG_MISSING = "secure-flag-missing"
+    SECURE_FLAG_MISSING = "secure-flag-missing",
+    GRAPHQL_INTROSPECTION = "graphql-introspection"
 }
 export declare enum InputType {
     UNDEFINED_TYPE = "UNDEFINED_TYPE",
@@ -86,7 +87,8 @@ export declare enum InputType {
     METHOD = "METHOD",
     REQUEST = "REQUEST",
     URL_PARAMETER = "URL_PARAMETER",
-    UNKNOWN = "UNKNOWN"
+    UNKNOWN = "UNKNOWN",
+    WEBSOCKET = "WEBSOCKET"
 }
 export declare enum ExclusionType {
     BODY = "BODY",
@@ -96,6 +98,12 @@ export declare enum ExclusionType {
     QUERYSTRING = "QUERYSTRING",
     URL = "URL"
 }
+export declare enum RouteType {
+    HTTP = "HTTP",
+    MESSAGE_BROKER = "MESSAGE_BROKER",
+    MIDDLEWARE = "MIDDLEWARE",
+    RPC = "RPC"
+}
 export declare enum DataflowTag {
     XML_ENCODED = "XML_ENCODED",
     XML_DECODED = "XML_DECODED",

package/lib/constants.js

@@ -14,7 +14,7 @@
  * way not consistent with the End User License Agreement.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.URI_REGEXES = exports.symbols = exports.agentLibIDListTypes = exports.FS_METHODS = exports.BLOCKING_MODES = exports.ServerEnvironment = exports.DataflowTag = exports.ExclusionType = exports.InputType = exports.SessionConfigurationRule = exports.ResponseScanningRule = exports.Rule = exports.ProtectRuleMode = exports.Event = void 0;
+exports.URI_REGEXES = exports.symbols = exports.agentLibIDListTypes = exports.FS_METHODS = exports.BLOCKING_MODES = exports.ServerEnvironment = exports.DataflowTag = exports.RouteType = exports.ExclusionType = exports.InputType = exports.ConfigurationRule = exports.ResponseScanningRule = exports.Rule = exports.ProtectRuleMode = exports.Event = void 0;
 var Event;
 (function (Event) {
     // lifecycle
@@ -26,11 +26,11 @@ var Event;
     Event["ASSESS_DATAFLOW_FINDING"] = "assess-dataflow-findings";
     Event["ASSESS_DATAFLOW_SAFE_POSITIVE"] = "assess-dataflow-safe-positive";
     Event["ASSESS_RESPONSE_SCANNING_FINDING"] = "assess-response-scanning-findings";
-    Event["ASSESS_SESSION_CONFIGURATION_FINDING"] = "assess-session-configuration-findings";
+    Event["ASSESS_CONFIGURATION_FINDING"] = "assess-configuration-findings";
     Event["ASSESS_CRYPTO_ANALYSIS_FINDING"] = "assess-crypto-analysis-finding";
     Event["LIBRARY"] = "library";
     Event["LIBRARY_USAGE"] = "library-usage";
-    Event["PROTECT"] = "protect";
+    Event["PROTECT_FINDING"] = "protect-finding";
     Event["ROUTE_COVERAGE_OBSERVATION"] = "route-coverage-observation";
     // state changes
     Event["SERVER_SETTINGS_UPDATE"] = "server-settings-update";
@@ -85,11 +85,12 @@ var ResponseScanningRule;
     ResponseScanningRule["XCONTENTTYPE_HEADER_MISSING"] = "xcontenttype-header-missing";
     ResponseScanningRule["XXSPROTECTION_HEADER_DISABLED"] = "xxssprotection-header-disabled";
 })(ResponseScanningRule || (exports.ResponseScanningRule = ResponseScanningRule = {}));
-var SessionConfigurationRule;
-(function (SessionConfigurationRule) {
-    SessionConfigurationRule["HTTPONLY"] = "httponly";
-    SessionConfigurationRule["SECURE_FLAG_MISSING"] = "secure-flag-missing";
-})(SessionConfigurationRule || (exports.SessionConfigurationRule = SessionConfigurationRule = {}));
+var ConfigurationRule;
+(function (ConfigurationRule) {
+    ConfigurationRule["HTTPONLY"] = "httponly";
+    ConfigurationRule["SECURE_FLAG_MISSING"] = "secure-flag-missing";
+    ConfigurationRule["GRAPHQL_INTROSPECTION"] = "graphql-introspection";
+})(ConfigurationRule || (exports.ConfigurationRule = ConfigurationRule = {}));
 var InputType;
 (function (InputType) {
     InputType["UNDEFINED_TYPE"] = "UNDEFINED_TYPE";
@@ -114,6 +115,7 @@ var InputType;
     InputType["REQUEST"] = "REQUEST";
     InputType["URL_PARAMETER"] = "URL_PARAMETER";
     InputType["UNKNOWN"] = "UNKNOWN";
+    InputType["WEBSOCKET"] = "WEBSOCKET";
 })(InputType || (exports.InputType = InputType = {}));
 var ExclusionType;
 (function (ExclusionType) {
@@ -124,6 +126,13 @@ var ExclusionType;
     ExclusionType["QUERYSTRING"] = "QUERYSTRING";
     ExclusionType["URL"] = "URL";
 })(ExclusionType || (exports.ExclusionType = ExclusionType = {}));
+var RouteType;
+(function (RouteType) {
+    RouteType["HTTP"] = "HTTP";
+    RouteType["MESSAGE_BROKER"] = "MESSAGE_BROKER";
+    RouteType["MIDDLEWARE"] = "MIDDLEWARE";
+    RouteType["RPC"] = "RPC";
+})(RouteType || (exports.RouteType = RouteType = {}));
 var DataflowTag;
 (function (DataflowTag) {
     DataflowTag["XML_ENCODED"] = "XML_ENCODED";

package/lib/types.d.ts

@@ -1,6 +1,6 @@
 import { EventEmitter } from 'events';
 import { ServerResponse } from 'node:http';
-import { Event, ProtectRuleMode, Rule } from './constants';
+import { Event, ProtectRuleMode, RouteType, Rule } from './constants';
 export interface Installable {
     install(...args: any[]): void | Promise<void>;
     uninstall?(): void | Promise<void>;
@@ -150,9 +150,8 @@ export interface Result {
     mongoExpansionResult?: boolean;
     path?: string[];
     ruleId: Rule;
-    score: number;
+    score?: number;
     value: string;
-    sinkContext?: any;
 }
 export interface SemanticAnalysisResult extends Result {
     ruleId: SemanticAnalysisRules;
@@ -230,6 +229,7 @@ export interface SourceInfo {
     contentType?: string;
     ip: string;
     httpVersion: string;
+    getHeader(name: string): string | null;
 }
 /**
  * this is known as RequestStore even though, in the future, instrumentation
@@ -335,6 +335,10 @@ export interface RouteInfo {
      * @example "get"
      */
     method?: string;
+    /**
+     * The type of route that is being reported. Default should be RouteType.HTTP.
+     */
+    type: RouteType;
     /**
      * URL for a route.
      * @example "prefix/route/path"
@@ -346,6 +350,20 @@ export interface RouteInfo {
      */
     normalizedUrl: string;
 }
+export interface ProtectFindingEventArg {
+    store: RequestStore;
+    result: Result;
+    sinkContext?: {
+        name: string;
+        value: any;
+        stacktraceOpts?: {
+            constructorOpt: any;
+            prependFrames: any[];
+        };
+        stack?: any[];
+    };
+    findings?: any;
+}
 /**
  * Agent event emitter for messaging to/from external systems. Use cases are
  * reporting agent findings and broadcasting settings updates.
@@ -358,7 +376,7 @@ export interface Messages extends EventEmitter {
     emit(event: Event.ASSESS_DATAFLOW_FINDING, msg: any): boolean;
     emit(event: Event.LIBRARY, msg: Library): boolean;
     emit(event: Event.LIBRARY_USAGE, msg: LibraryUsage): boolean;
-    emit(event: Event.PROTECT, msg: RequestStore): boolean;
+    emit(event: Event.PROTECT_FINDING, msg: ProtectFindingEventArg): boolean;
     emit(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, routes: RouteInfo[]): boolean;
     emit(event: Event.ROUTE_COVERAGE_OBSERVATION, route: RouteInfo): boolean;
     emit(event: Event.SERVER_SETTINGS_UPDATE, msg: Record<string, any>): boolean;
@@ -369,7 +387,7 @@ export interface Messages extends EventEmitter {
     on(event: Event.ASSESS_DATAFLOW_FINDING, listenter: (msg: any) => void): this;
     on(event: Event.LIBRARY, listener: (msg: Library) => void): this;
     on(event: Event.LIBRARY_USAGE, listener: (msg: LibraryUsage) => void): this;
-    on(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
+    on(event: Event.PROTECT_FINDING, listener: (msg: ProtectFindingEventArg) => void): this;
     on(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, listener: (routes: RouteInfo[]) => void): this;
     on(event: Event.ROUTE_COVERAGE_OBSERVATION, listener: (route: RouteInfo) => void): this;
     on(event: Event.SERVER_SETTINGS_UPDATE, listener: (msg: Record<string, any>) => void): this;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/common",
-  "version": "1.36.0",
+  "version": "1.38.0",
   "description": "Shared constants and utilities for all Contrast Agent modules",
   "license": "UNLICENSED",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",