@contrast/common 1.8.0 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/constants.d.ts +279 -0
- package/lib/constants.d.ts.map +1 -1
- package/lib/constants.js +141 -1
- package/lib/constants.js.map +1 -1
- package/lib/index.d.ts +3 -0
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +17 -1
- package/lib/index.js.map +1 -1
- package/lib/signatures/fs.d.ts +4 -0
- package/lib/signatures/fs.d.ts.map +1 -0
- package/lib/signatures/fs.js +58 -0
- package/lib/signatures/fs.js.map +1 -0
- package/lib/signatures/index.d.ts +2 -1
- package/lib/signatures/index.d.ts.map +1 -1
- package/lib/signatures/index.js +29 -313
- package/lib/signatures/index.js.map +1 -1
- package/lib/signatures/mongodb.d.ts +3 -0
- package/lib/signatures/mongodb.d.ts.map +1 -0
- package/lib/signatures/mongodb.js +58 -0
- package/lib/signatures/mongodb.js.map +1 -0
- package/lib/signatures/mssql.d.ts +2 -1
- package/lib/signatures/mssql.d.ts.map +1 -1
- package/lib/signatures/mssql.js +3 -3
- package/lib/signatures/mssql.js.map +1 -1
- package/lib/types.d.ts +11 -0
- package/lib/types.d.ts.map +1 -1
- package/package.json +1 -1
- package/src/constants.ts +140 -0
- package/src/index.ts +16 -0
- package/src/signatures/fs.ts +65 -0
- package/src/signatures/index.ts +32 -315
- package/src/signatures/mongodb.ts +59 -0
- package/src/signatures/mssql.ts +7 -5
- package/src/types.ts +12 -0
package/lib/signatures/mssql.js
CHANGED
|
@@ -20,7 +20,7 @@ const mssql = new Map([
|
|
|
20
20
|
{
|
|
21
21
|
moduleName: 'mssql',
|
|
22
22
|
version: '>=6.4.0',
|
|
23
|
-
|
|
23
|
+
fileName: 'lib/base/prepared-statement.js',
|
|
24
24
|
methodName: 'PreparedStatement.prototype.prepare',
|
|
25
25
|
isModule: true,
|
|
26
26
|
},
|
|
@@ -30,7 +30,7 @@ const mssql = new Map([
|
|
|
30
30
|
{
|
|
31
31
|
moduleName: 'mssql',
|
|
32
32
|
version: '>=6.4.0',
|
|
33
|
-
|
|
33
|
+
fileName: 'lib/base/request.js',
|
|
34
34
|
methodName: 'Request.prototype.batch',
|
|
35
35
|
isModule: true,
|
|
36
36
|
},
|
|
@@ -40,7 +40,7 @@ const mssql = new Map([
|
|
|
40
40
|
{
|
|
41
41
|
moduleName: 'mssql',
|
|
42
42
|
version: '>=6.4.0',
|
|
43
|
-
|
|
43
|
+
fileName: 'lib/base/request.js',
|
|
44
44
|
methodName: 'Request.prototype.query',
|
|
45
45
|
isModule: true,
|
|
46
46
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mssql.js","sourceRoot":"","sources":["../../src/signatures/mssql.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;
|
|
1
|
+
{"version":3,"file":"mssql.js","sourceRoot":"","sources":["../../src/signatures/mssql.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAKH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB;IACvC;QACE,qDAAqD;QACrD;YACE,UAAU,EAAE,OAAO;YACnB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,gCAAgC;YAC1C,UAAU,EAAE,qCAAqC;YACjD,QAAQ,EAAE,IAAI;SACf;KACF;IACD;QACE,wCAAwC;QACxC;YACE,UAAU,EAAE,OAAO;YACnB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,yBAAyB;YACrC,QAAQ,EAAE,IAAI;SACf;KACF;IACD;QACE,wCAAwC;QACxC;YACE,UAAU,EAAE,OAAO;YACnB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,yBAAyB;YACrC,QAAQ,EAAE,IAAI;SACf;KACF;CACuB,CAAC,CAAC;AAE5B,kBAAe,KAAK,CAAC"}
|
package/lib/types.d.ts
CHANGED
|
@@ -5,6 +5,16 @@ export interface Installable {
|
|
|
5
5
|
install(): void | Promise<void>;
|
|
6
6
|
uninstall?(): void | Promise<void>;
|
|
7
7
|
}
|
|
8
|
+
export interface Signature {
|
|
9
|
+
moduleName: string;
|
|
10
|
+
methodName: string;
|
|
11
|
+
fileName?: string;
|
|
12
|
+
version?: string;
|
|
13
|
+
isModule: boolean;
|
|
14
|
+
isConstructor?: boolean;
|
|
15
|
+
source?: 'O' | 'P' | 'R';
|
|
16
|
+
target?: 'O' | 'P' | 'R';
|
|
17
|
+
}
|
|
8
18
|
export interface AppInfo {
|
|
9
19
|
os: {
|
|
10
20
|
type: string;
|
|
@@ -24,6 +34,7 @@ export interface AppInfo {
|
|
|
24
34
|
serverName: string;
|
|
25
35
|
serverEnvironment: string;
|
|
26
36
|
version: string;
|
|
37
|
+
session_id: string | null;
|
|
27
38
|
}
|
|
28
39
|
export type CommonRules = Rule.SQL_INJECTION | Rule.CMD_INJECTION | Rule.PATH_TRAVERSAL | Rule.REFLECTED_XSS | Rule.SSJS_INJECTION | Rule.NOSQL_INJECTION_MONGO | Rule.UNSAFE_FILE_UPLOAD | Rule.NOSQL_INJECTION | Rule.METHOD_TAMPERING | Rule.BOT_BLOCKER;
|
|
29
40
|
export type SemanticAnalysisRules = Rule.CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS | Rule.CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS | Rule.XXE | Rule.CMD_INJECTION_COMMAND_BACKDOORS | Rule.PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS;
|
package/lib/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;CAC1B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GACrB,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,cAAc,GACnB,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,cAAc,GACnB,IAAI,CAAC,qBAAqB,GAC1B,IAAI,CAAC,kBAAkB,GACvB,IAAI,CAAC,eAAe,GACpB,IAAI,CAAC,gBAAgB,GACrB,IAAI,CAAC,WAAW,CAAC;AAEnB,MAAM,MAAM,qBAAqB,GAC/B,IAAI,CAAC,sCAAsC,GAC3C,IAAI,CAAC,uCAAuC,GAC5C,IAAI,CAAC,GAAG,GACR,IAAI,CAAC,+BAA+B,GACpC,IAAI,CAAC,4CAA4C,CAAC;AAEpD,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC;AAElF,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC;AAE5D,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,MAAM;IACpD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,eAAe,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC7C,eAAe,EAAE;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EAAE,CAAC;IACJ,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,mBAAoB,SAAQ,MAAM;IACjD,eAAe,CAAC,EAAE,8BAA8B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG;KACjC,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE;CAChC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;KACtC,IAAI,IAAI,qBAAqB,GAAG,sBAAsB,EAAE;CAC1D,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;KAC9C,IAAI,IAAI,6BAA6B,GAAG,8BAA8B,EAAE;CAC1E,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,IAAI,IAAI,cAAc,GAAG,eAAe,EAAE;CAC5C,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,0BAA0B,GAAG,kCAAkC,GAAG,mBAAmB,CAAC;AAEtI,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/C,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,cAAc,EAAE,GAAG,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9B,UAAU,EAAE,GAAG,CAAC;IAChB,aAAa,EAAE,GAAG,CAAC;IACnB,YAAY,EAAE,GAAG,CAAC;IAClB,WAAW,EAAE,GAAG,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAE3B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE,GAAG,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC/E,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,wBAAwB,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACnF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,0BAA0B,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE5C,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC9F,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI,CAAC;IAC9E,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;IAC5E,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;IACtE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,wBAAwB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAAC;IACtF,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,iCAAiC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAClG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,0BAA0B,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAAC;IACxF,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC;IAC5F,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC5D;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE5C,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;IAC9E,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC5D"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@contrast/common",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.10.0",
|
|
4
4
|
"description": "Shared constants and utilities for all Contrast Agent modules",
|
|
5
5
|
"license": "UNLICENSED",
|
|
6
6
|
"author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
|
package/src/constants.ts
CHANGED
|
@@ -21,6 +21,7 @@ export enum Event {
|
|
|
21
21
|
ARCHITECTURE_COMPONENT = 'architecture-component',
|
|
22
22
|
SERVER_SETTINGS_UPDATE = 'server-settings-update',
|
|
23
23
|
ASSESS_DATAFLOW_FINDING = 'assess-dataflow-findings',
|
|
24
|
+
ASSESS_DATAFLOW_SAFE_POSITIVE = 'assess-dataflow-safe-positive',
|
|
24
25
|
ASSESS_RESPONSE_SCANNING_FINDING = 'assess-response-scanning-findings',
|
|
25
26
|
RESPONSE_FINISH = 'response-finish',
|
|
26
27
|
ROUTE_COVERAGE_DISCOVERY = 'route-coverage-discovery',
|
|
@@ -94,5 +95,144 @@ export enum InputType {
|
|
|
94
95
|
UNKNOWN = 'UNKNOWN',
|
|
95
96
|
}
|
|
96
97
|
|
|
98
|
+
export enum DataflowTag {
|
|
99
|
+
XML_ENCODED = 'XML_ENCODED',
|
|
100
|
+
XML_DECODED = 'XML_DECODED',
|
|
101
|
+
HTML_ENCODED = 'HTML_ENCODED',
|
|
102
|
+
HTML_DECODED = 'HTML_DECODED',
|
|
103
|
+
URL_ENCODED = 'URL_ENCODED',
|
|
104
|
+
URL_DECODED = 'URL_DECODED',
|
|
105
|
+
CSS_ENCODED = 'CSS_ENCODED',
|
|
106
|
+
CSS_DECODED = 'CSS_DECODED',
|
|
107
|
+
BASE64_ENCODED = 'BASE64_ENCODED',
|
|
108
|
+
BASE64_DECODED = 'BASE64_DECODED',
|
|
109
|
+
JAVASCRIPT_ENCODED = 'JAVASCRIPT_ENCODED',
|
|
110
|
+
JAVASCRIPT_DECODED = 'JAVASCRIPT_DECODED',
|
|
111
|
+
JAVA_ENCODED = 'JAVA_ENCODED',
|
|
112
|
+
JAVA_DECODED = 'JAVA_DECODED',
|
|
113
|
+
CSV_ENCODED = 'CSV_ENCODED',
|
|
114
|
+
CSV_DECODED = 'CSV_DECODED',
|
|
115
|
+
SQL_ENCODED = 'SQL_ENCODED',
|
|
116
|
+
SQL_DECODED = 'SQL_DECODED',
|
|
117
|
+
LDAP_ENCODED = 'LDAP_ENCODED',
|
|
118
|
+
LDAP_DECODED = 'LDAP_DECODED',
|
|
119
|
+
XPATH_ENCODED = 'XPATH_ENCODED',
|
|
120
|
+
XPATH_DECODED = 'XPATH_DECODED',
|
|
121
|
+
OS_ENCODED = 'OS_ENCODED',
|
|
122
|
+
OS_DECODED = 'OS_DECODED',
|
|
123
|
+
VBSCRIPT_ENCODED = 'VBSCRIPT_ENCODED',
|
|
124
|
+
VBSCRIPT_DECODED = 'VBSCRIPT_DECODED',
|
|
125
|
+
POTENTIAL_SANITIZED = 'POTENTIAL_SANITIZED',
|
|
126
|
+
POTENTIAL_VALIDATED = 'POTENTIAL_VALIDATED',
|
|
127
|
+
NO_CONTROL_CHARS = 'NO_CONTROL_CHARS',
|
|
128
|
+
CUSTOM = 'CUSTOM_CATCH_ALL',
|
|
129
|
+
// custom encoded/validated tags, only for data flow rules
|
|
130
|
+
CUSTOM_ENCODED = 'CUSTOM_ENCODED',
|
|
131
|
+
CUSTOM_ENCODED_CMD_INJECTION = 'CUSTOM_ENCODED_CMD_INJECTION',
|
|
132
|
+
CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION = 'CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION',
|
|
133
|
+
CUSTOM_ENCODED_HEADER_INJECTION = 'CUSTOM_ENCODED_HEADER_INJECTION',
|
|
134
|
+
CUSTOM_ENCODED_HQL_INJECTION = 'CUSTOM_ENCODED_HQL_INJECTION',
|
|
135
|
+
CUSTOM_ENCODED_LDAP_INJECTION = 'CUSTOM_ENCODED_LDAP_INJECTION',
|
|
136
|
+
CUSTOM_ENCODED_LOG_INJECTION = 'CUSTOM_ENCODED_LOG_INJECTION',
|
|
137
|
+
CUSTOM_ENCODED_NOSQL_INJECTIOn = 'CUSTOM_ENCODED_NOSQL_INJECTION',
|
|
138
|
+
CUSTOM_ENCODED_PATH_TRAVERSAL = 'CUSTOM_ENCODED_PATH_TRAVERSAL',
|
|
139
|
+
CUSTOM_ENCODED_REDOS = 'CUSTOM_ENCODED_REDOS',
|
|
140
|
+
CUSTOM_ENCODED_REFLECTED_XSS = 'CUSTOM_ENCODED_REFLECTED_XSS',
|
|
141
|
+
CUSTOM_ENCODED_REFLECTION_INJECTION = 'CUSTOM_ENCODED_REFLECTION_INJECTION',
|
|
142
|
+
CUSTOM_ENCODED_SMTP_INJECTION = 'CUSTOM_ENCODED_SMTP_INJECTION',
|
|
143
|
+
CUSTOM_ENCODED_SQL_INJECTION = 'CUSTOM_ENCODED_SQL_INJECTION',
|
|
144
|
+
CUSTOM_ENCODED_SSRF = 'CUSTOM_ENCODED_SSRF',
|
|
145
|
+
CUSTOM_ENCODED_STORED_XSS = 'CUSTOM_ENCODED_STORED_XSS',
|
|
146
|
+
CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION = 'CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION',
|
|
147
|
+
CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION = 'CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION',
|
|
148
|
+
CUSTOM_ENCODED_UNSAFE_READLINE = 'CUSTOM_ENCODED_UNSAFE_READLINE',
|
|
149
|
+
CUSTOM_ENCODED_UNSAFE_XML_DECODE = 'CUSTOM_ENCODED_UNSAFE_XML_DECODE',
|
|
150
|
+
CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION = 'CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION',
|
|
151
|
+
CUSTOM_ENCODED_UNVALIDATED_FORWARD = 'CUSTOM_ENCODED_UNVALIDATED_FORWARD',
|
|
152
|
+
CUSTOM_ENCODED_UNVALIDATED_REDIRECT = 'CUSTOM_ENCODED_UNVALIDATED_REDIRECT',
|
|
153
|
+
CUSTOM_ENCODED_XPATH_INJECTION = 'CUSTOM_ENCODED_XPATH_INJECTION',
|
|
154
|
+
CUSTOM_ENCODED_XXE = 'CUSTOM_ENCODED_XXE',
|
|
155
|
+
CUSTOM_SECURITY_CONTROL_APPLIED = 'CUSTOM_SECURITY_CONTROL_APPLIED',
|
|
156
|
+
CUSTOM_VALIDATED = 'CUSTOM_VALIDATED',
|
|
157
|
+
CUSTOM_VALIDATED_CMD_INJECTION = 'CUSTOM_VALIDATED_CMD_INJECTION',
|
|
158
|
+
CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION = 'CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION',
|
|
159
|
+
CUSTOM_VALIDATED_HEADER_INJECTION = 'CUSTOM_VALIDATED_HEADER_INJECTION',
|
|
160
|
+
CUSTOM_VALIDATED_HQL_INJECTION = 'CUSTOM_VALIDATED_HQL_INJECTION',
|
|
161
|
+
CUSTOM_VALIDATED_LDAP_INJECTION = 'CUSTOM_VALIDATED_LDAP_INJECTION',
|
|
162
|
+
CUSTOM_VALIDATED_LOG_INJECTION = 'CUSTOM_VALIDATED_LOG_INJECTION',
|
|
163
|
+
CUSTOM_VALIDATED_NOSQL_INJECTION = 'CUSTOM_VALIDATED_NOSQL_INJECTION',
|
|
164
|
+
CUSTOM_VALIDATED_PATH_TRAVERSAL = 'CUSTOM_VALIDATED_PATH_TRAVERSAL',
|
|
165
|
+
CUSTOM_VALIDATED_REDOS = 'CUSTOM_VALIDATED_REDOS',
|
|
166
|
+
CUSTOM_VALIDATED_REFLECTED_XSS = 'CUSTOM_VALIDATED_REFLECTED_XSS',
|
|
167
|
+
CUSTOM_VALIDATED_REFLECTION_INJECTION = 'CUSTOM_VALIDATED_REFLECTION_INJECTION',
|
|
168
|
+
CUSTOM_VALIDATED_SMTP_INJECTION = 'CUSTOM_VALIDATED_SMTP_INJECTION',
|
|
169
|
+
CUSTOM_VALIDATED_SQL_INJECTION = 'CUSTOM_VALIDATED_SQL_INJECTION',
|
|
170
|
+
CUSTOM_VALIDATED_SSRF = 'CUSTOM_VALIDATED_SSRF',
|
|
171
|
+
CUSTOM_VALIDATED_STORED_XSS = 'CUSTOM_VALIDATED_STORED_XSS',
|
|
172
|
+
CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION = 'CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION',
|
|
173
|
+
CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION = 'CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION',
|
|
174
|
+
CUSTOM_VALIDATED_UNSAFE_READLINE = 'CUSTOM_VALIDATED_UNSAFE_READLINE',
|
|
175
|
+
CUSTOM_VALIDATED_UNSAFE_XML_DECODE = 'CUSTOM_VALIDATED_UNSAFE_XML_DECODE',
|
|
176
|
+
CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION = 'CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION',
|
|
177
|
+
CUSTOM_VALIDATED_UNVALIDATED_FORWARD = 'CUSTOM_VALIDATED_UNVALIDATED_FORWARD',
|
|
178
|
+
CUSTOM_VALIDATED_UNVALIDATED_REDIRECT = 'CUSTOM_VALIDATED_UNVALIDATED_REDIRECT',
|
|
179
|
+
CUSTOM_VALIDATED_XPATH_INJECTION = 'CUSTOM_VALIDATED_XPATH_INJECTION',
|
|
180
|
+
CUSTOM_VALIDATED_XXE = 'CUSTOM_VALIDATED_XXE',
|
|
181
|
+
// tracked_string range tags
|
|
182
|
+
NO_NEWLINES = 'NO_NEWLINES',
|
|
183
|
+
UNTRUSTED = 'UNTRUSTED',
|
|
184
|
+
CROSS_SITE = 'CROSS_SITE',
|
|
185
|
+
LIMITED_CHARS = 'LIMITED_CHARS',
|
|
186
|
+
ALPHANUM_SPACE_HYPHEN = 'ALPHANUM_SPACE_HYPHEN',
|
|
187
|
+
STRING_TYPE_CHECKED = 'STRING_TYPE_CHECKED',
|
|
188
|
+
DATABASE_WRITE = 'DATABASE_WRITE',
|
|
189
|
+
HEADER = 'HEADER',
|
|
190
|
+
COOKIE = 'COOKIE',
|
|
191
|
+
WEAK_URL_ENCODED = 'WEAK_URL_ENCODED',
|
|
192
|
+
}
|
|
193
|
+
|
|
97
194
|
export const BLOCKING_MODES = ['block', 'block_at_perimeter'];
|
|
98
195
|
|
|
196
|
+
export const FS_METHODS = [
|
|
197
|
+
{ name: 'access', promises: true, sync: true, indices: [0] },
|
|
198
|
+
{ name: 'appendFile', promises: true, sync: true, indices: [0] },
|
|
199
|
+
{ name: 'chmod', promises: true, sync: true, indices: [0] },
|
|
200
|
+
{ name: 'chown', promises: true, sync: true, indices: [0] },
|
|
201
|
+
{ name: 'copyFile', promises: true, sync: true, indices: [0, 1] },
|
|
202
|
+
{ name: 'cp', promises: true, sync: true, indices: [0, 1] },
|
|
203
|
+
{ name: 'createReadStream', promises: false, sync: false, indices: [0] },
|
|
204
|
+
{ name: 'createWriteStream', promises: false, sync: false, indices: [0] },
|
|
205
|
+
{ name: 'exists', promises: false, sync: true, indices: [0] },
|
|
206
|
+
{ name: 'lchmod', promises: true, sync: true, indices: [0] },
|
|
207
|
+
{ name: 'lchown', promises: true, sync: true, indices: [0] },
|
|
208
|
+
{ name: 'link', promises: true, sync: true, indices: [0] },
|
|
209
|
+
{ name: 'lstat', promises: true, sync: true, indices: [0] },
|
|
210
|
+
{ name: 'lutimes', promises: true, sync: true, indices: [0] },
|
|
211
|
+
{ name: 'mkdir', promises: true, sync: true, indices: [0] },
|
|
212
|
+
{ name: 'mkdtemp', promises: true, sync: true, indices: [0] },
|
|
213
|
+
{ name: 'open', promises: true, sync: true, indices: [0] },
|
|
214
|
+
{ name: 'openAsBlob', promises: false, sync: false, indices: [0] },
|
|
215
|
+
{ name: 'opendir', promises: true, sync: true, indices: [0] },
|
|
216
|
+
{ name: 'readdir', promises: true, sync: true, indices: [0] },
|
|
217
|
+
{ name: 'readFile', promises: true, sync: true, indices: [0] },
|
|
218
|
+
{ name: 'readlink', promises: true, sync: true, indices: [0] },
|
|
219
|
+
{ name: 'realpath', promises: true, sync: true, indices: [0] },
|
|
220
|
+
{ name: 'rename', promises: true, sync: true, indices: [0, 1] },
|
|
221
|
+
{ name: 'rmdir', promises: true, sync: true, indices: [0] },
|
|
222
|
+
{ name: 'rm', promises: true, sync: true, indices: [0] },
|
|
223
|
+
{ name: 'stat', promises: true, sync: true, indices: [0] },
|
|
224
|
+
{ name: 'statfs', promises: true, sync: true, indices: [0] },
|
|
225
|
+
{ name: 'symlink', promises: true, sync: true, indices: [0, 1] },
|
|
226
|
+
{ name: 'truncate', promises: true, sync: true, indices: [0] },
|
|
227
|
+
{ name: 'unlink', promises: true, sync: true, indices: [0] },
|
|
228
|
+
{ name: 'unwatchFile', promises: false, sync: false, indices: [0] },
|
|
229
|
+
{ name: 'utimes', promises: true, sync: true, indices: [0] },
|
|
230
|
+
{ name: 'watch', promises: true, sync: false, indices: [0] },
|
|
231
|
+
{ name: 'watchFile', promises: false, sync: false, indices: [0] },
|
|
232
|
+
{ name: 'writeFile', promises: true, sync: true, indices: [0] },
|
|
233
|
+
] as const;
|
|
234
|
+
|
|
235
|
+
export enum agentLibIDListTypes {
|
|
236
|
+
MONGO_SLEEP = 'MONGO-SLEEP',
|
|
237
|
+
TRUE_CLAUSE_1 = 'TRUE-CLAUSE-1'
|
|
238
|
+
}
|
package/src/index.ts
CHANGED
|
@@ -131,6 +131,14 @@ export function callChildComponentMethodsSync(parent: any, method: 'install' | '
|
|
|
131
131
|
}
|
|
132
132
|
}
|
|
133
133
|
|
|
134
|
+
export async function callChildComponentMethods(parent: any, method: 'install' | 'uninstall', order?: string[]) {
|
|
135
|
+
const keys = order || Object.keys(parent);
|
|
136
|
+
for (const key of keys) {
|
|
137
|
+
const component: any = parent[key];
|
|
138
|
+
await component?.[method]?.();
|
|
139
|
+
}
|
|
140
|
+
}
|
|
141
|
+
|
|
134
142
|
export function groupResultsMap(resultsMap: Partial<ResultMap>) {
|
|
135
143
|
const result: {
|
|
136
144
|
commonResultsMap: Partial<CommonRulesResultsMap>;
|
|
@@ -209,6 +217,7 @@ export function mergeRemoteData(
|
|
|
209
217
|
export const featureReaders = {
|
|
210
218
|
'agent.logger.level': (remoteData: any) => remoteData.logger?.level,
|
|
211
219
|
'agent.logger.path': (remoteData: any) => remoteData.logger?.path,
|
|
220
|
+
'application.session_id': (remoteData: any) => remoteData?.settings?.assessment?.session_id,
|
|
212
221
|
'agent.security_logger.syslog.enable': (remoteData: any) => remoteData.security_logger?.syslog?.enable,
|
|
213
222
|
'agent.security_logger.syslog.ip': (remoteData: any) => remoteData.security_logger?.syslog?.ip,
|
|
214
223
|
'agent.security_logger.syslog.port': (remoteData: any) => remoteData.security_logger?.syslog?.port,
|
|
@@ -282,3 +291,10 @@ const { trim: origTrim } = String.prototype;
|
|
|
282
291
|
export function trim(str: string, ...args: []) {
|
|
283
292
|
return origTrim.call(str, ...args);
|
|
284
293
|
}
|
|
294
|
+
|
|
295
|
+
import { inspect as originalInspect } from 'util';
|
|
296
|
+
export function inspect(...args: any) {
|
|
297
|
+
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
|
|
298
|
+
// @ts-ignore
|
|
299
|
+
return originalInspect.call(null, ...args);
|
|
300
|
+
}
|
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
/*
|
|
2
|
+
* Copyright: 2022 Contrast Security, Inc
|
|
3
|
+
* Contact: support@contrastsecurity.com
|
|
4
|
+
* License: Commercial
|
|
5
|
+
|
|
6
|
+
* NOTICE: This Software and the patented inventions embodied within may only be
|
|
7
|
+
* used as part of Contrast Security’s commercial offerings. Even though it is
|
|
8
|
+
* made available through public repositories, use of this Software is subject to
|
|
9
|
+
* the applicable End User Licensing Agreement found at
|
|
10
|
+
* https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
|
|
11
|
+
* between Contrast Security and the End User. The Software may not be reverse
|
|
12
|
+
* engineered, modified, repackaged, sold, redistributed or otherwise used in a
|
|
13
|
+
* way not consistent with the End User License Agreement.
|
|
14
|
+
*/
|
|
15
|
+
|
|
16
|
+
import { FS_METHODS } from '../constants';
|
|
17
|
+
import { Signature } from '../types';
|
|
18
|
+
|
|
19
|
+
const fs = new Map<string, Signature>(
|
|
20
|
+
FS_METHODS.reduce((sigs, method) => {
|
|
21
|
+
sigs.push([
|
|
22
|
+
`fs.${method.name}`,
|
|
23
|
+
{
|
|
24
|
+
moduleName: 'fs',
|
|
25
|
+
methodName: method.name,
|
|
26
|
+
isModule: true,
|
|
27
|
+
}
|
|
28
|
+
]);
|
|
29
|
+
|
|
30
|
+
if (method.sync) {
|
|
31
|
+
sigs.push([
|
|
32
|
+
`fs.${method.name}Sync`,
|
|
33
|
+
{
|
|
34
|
+
moduleName: 'fs',
|
|
35
|
+
methodName: `${method.name}Sync`,
|
|
36
|
+
isModule: true,
|
|
37
|
+
}
|
|
38
|
+
]);
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
if (method.promises) {
|
|
42
|
+
sigs.push([
|
|
43
|
+
`fs.promises.${method.name}`,
|
|
44
|
+
{
|
|
45
|
+
moduleName: 'fs.promises',
|
|
46
|
+
methodName: method.name,
|
|
47
|
+
isModule: true,
|
|
48
|
+
}
|
|
49
|
+
]);
|
|
50
|
+
|
|
51
|
+
sigs.push([
|
|
52
|
+
`fsPromises.${method.name}`,
|
|
53
|
+
{
|
|
54
|
+
moduleName: 'fsPromises',
|
|
55
|
+
methodName: method.name,
|
|
56
|
+
isModule: true,
|
|
57
|
+
}
|
|
58
|
+
]);
|
|
59
|
+
}
|
|
60
|
+
|
|
61
|
+
return sigs;
|
|
62
|
+
}, [] as [string, Signature][])
|
|
63
|
+
);
|
|
64
|
+
|
|
65
|
+
export default fs;
|