@contrast/core 1.10.1 → 1.11.0

package/lib/effective-config/index.js

@@ -15,20 +15,27 @@
 
 'use strict';
 
-const { Event } = require('@contrast/common');
+const { Event, featureReaders, settingsReaders, mergeRemoteData } = require('@contrast/common');
 const { configOptions } = require('@contrast/config/lib/options');
 
-const settingsReaders = require('./settings-readers');
-const featureReaders = require('./feature-readers');
-
 module.exports = function(core) {
   const { config, messages } = core;
   const effectiveConfig = createEffectiveConfig({ config, remoteData: {} });
+  function setterFn(target, name, value) {
+    let remoteValue = value;
+    if (typeof value === 'string') remoteValue = remoteValue.toLowerCase();
+    target.set(name, {
+      CanonicalName: name,
+      Name: name,
+      Value: remoteValue,
+      Source: 'ContrastUI',
+    });
+  }
 
   if (core.config?.protect?.enable === true) {
     messages.on(Event.SERVER_SETTINGS_UPDATE, (msg) => {
-      msg.features && mergeRemoteData(msg, featureReaders);
-      msg.settings && mergeRemoteData(msg, settingsReaders);
+      msg.features && mergeRemoteData(config, msg, featureReaders, setterFn, effectiveConfig);
+      msg.settings && mergeRemoteData(config, msg, settingsReaders, setterFn, effectiveConfig);
     });
   }
 
@@ -72,18 +79,4 @@ module.exports = function(core) {
 
     return content;
   }
-
-  function mergeRemoteData(remoteData, readers) {
-    for (const [name, readerFn] of Object.entries(readers)) {
-      const remoteValue = readerFn(remoteData);
-      if (config._sources[name] === 'DEFAULT' && remoteValue != null) {
-        effectiveConfig.set(name, {
-          CanonicalName: name,
-          Name: name,
-          Value: remoteValue,
-          Source: 'ContrastUI',
-        });
-      }
-    }
-  }
 };

package/lib/index.js

@@ -23,6 +23,7 @@ module.exports = function init(core = {}) {
   require('@contrast/config')(core);
   require('./logger-factory')(core);
   require('./effective-config')(core);
+  require('./system-info')(core);
   require('./sensitive-data-masking')(core);
   require('./app-info')(core);
   require('./is-agent-path')(core);

package/lib/system-info/index.js

@@ -0,0 +1,118 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+function isUsingPM2() {
+  const used = !!process.env.pmx;
+  let version = null;
+
+  for (const pathVar of ['npm_package_json', 'PWD']) {
+    const packagePath = process.env[pathVar];
+    if (packagePath) {
+      try {
+        version = require(path.join(packagePath, 'package.json')).dependencies['pm2'];
+      } catch (err) {
+        //
+      }
+    }
+    if (version) break;
+  }
+
+  return { used, version };
+}
+
+function isDocker() {
+  const MOUNTINFO_REGEX = /\/docker\/containers\/(.*?)\//;
+  const CGROUP_REGEX = /:\/docker\/([^/]+)$/;
+
+  try {
+    const results = fs.readFileSync('/proc/self/mountinfo', 'utf8').match(MOUNTINFO_REGEX);
+    if (results) return { isDocker: true, containerID: results[1] };
+  } catch (err) {
+    // else check /proc/self/cgroup
+  }
+
+  try {
+    const results = fs.readFileSync('/proc/self/cgroup', 'utf8').match(CGROUP_REGEX);
+    if (results) return { isDocker: true, containerID: results[1] };
+  } catch (err) {
+    // else check /.dockerenv
+  }
+
+  try {
+    const result = fs.statSync('/.dockerenv');
+    if (result) return { isDocker: true, containerID: undefined };
+  } catch (err) {
+    // if there's not such file we can conclude it's not docker env
+  }
+
+  return { isDocker: false, containerID: undefined };
+}
+
+module.exports = function(core) {
+  // eslint-disable-next-line node/no-extraneous-require
+  const pkg = require('@contrast/protect-agent/package.json');
+  const { config } = core;
+
+  core.getSystemInfo = function() {
+    const appPath = process.cwd();
+
+    const info = {
+      ReportDate: new Date(),
+      MachineName: os.hostname(),
+      Contrast: {
+        Url: config.api.url,
+        Proxy: config.api.proxy,
+        Server: {
+          Name: config.server.name,
+        },
+        Agent: {
+          Name: pkg.name,
+          Version: pkg.version,
+        },
+      },
+      Node: {
+        Version: process.version
+      },
+      OperatingSystem: {
+        Architecture: os.arch(),
+        Name: os.type(),
+        Version: os.release(),
+        KernelVersion: os.version(),
+        CPU: {
+          type: os.cpus()[0].model,
+          count: os.cpus().length,
+        }
+      },
+      Host: {
+        Docker: isDocker(),
+        PM2: isUsingPM2(),
+        Memory: {
+          Total: (os.totalmem() / 1e6).toFixed(0).concat(' MB'),
+          Free: (os.freemem() / 1e6).toFixed(0).concat(' MB'),
+          Used: ((os.totalmem() - os.freemem()) / 1e6).toFixed(0).concat(' MB'),
+        }
+      },
+      Application: appPath ? require(path.join(appPath, 'package.json')) : null,
+    };
+
+    return info;
+  };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,17 +17,17 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.3.1",
-    "@contrast/common": "1.3.1",
-    "@contrast/config": "1.5.1",
-    "@contrast/deadzones": "1.0.0",
-    "@contrast/dep-hooks": "1.0.5",
+    "@contrast/agentify": "1.4.0",
+    "@contrast/common": "1.4.0",
+    "@contrast/config": "1.6.0",
+    "@contrast/deadzones": "1.1.0",
+    "@contrast/dep-hooks": "1.1.0",
     "@contrast/fn-inspect": "^3.2.0",
-    "@contrast/instrumentation": "1.0.1",
-    "@contrast/logger": "1.1.2",
-    "@contrast/patcher": "1.1.0",
-    "@contrast/reporter": "1.8.2",
+    "@contrast/instrumentation": "1.1.0",
+    "@contrast/logger": "1.2.0",
+    "@contrast/patcher": "1.2.0",
+    "@contrast/reporter": "1.9.0",
     "@contrast/rewriter": "1.3.1",
-    "@contrast/scopes": "1.2.0"
+    "@contrast/scopes": "1.3.0"
   }
 }

package/lib/effective-config/feature-readers.js

@@ -1,30 +0,0 @@
-/*
- * Copyright: 2022 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const featureReaders = {
-  'agent.logger.level': (remoteData) => remoteData.features?.logLevel,
-  'agent.logger.path': (remoteData) => remoteData.features?.logFile,
-  'agent.security_logger.syslog.enable': (remoteData) => remoteData.features?.defend?.syslog?.syslogEnabled,
-  'agent.security_logger.syslog.ip': (remoteData) => remoteData.features?.defend?.syslog?.syslogIpAddress,
-  'agent.security_logger.syslog.port': (remoteData) => remoteData.features?.defend?.syslog?.syslogPortNumber,
-  'agent.security_logger.syslog.facility': (remoteData) => remoteData.features?.defend?.syslog?.syslogFacilityCode,
-  'agent.security_logger.syslog.severity_exploited': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityExploit,
-  'agent.security_logger.syslog.severity_blocked': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityBlocke,
-  'agent.security_logger.syslog.severity_probed': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityProbed,
-};
-
-module.exports = featureReaders;

package/lib/effective-config/settings-readers.js

@@ -1,57 +0,0 @@
-/*
- * Copyright: 2022 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const {
-  ProtectRuleMode: {
-    OFF,
-    BLOCK,
-    MONITOR,
-    BLOCK_AT_PERIMETER
-  }
-} = require('@contrast/common');
-
-const settingsReaders = [
-  'protect.rules.cmd-injection.mode',
-  'protect.rules.cmd-injection-command-backdoors.mode',
-  'protect.rules.cmd-injection-semantic-chained-commands.mode',
-  'protect.rules.cmd-injection-semantic-dangerous-paths.mode',
-  'protect.rules.method-tampering.mode',
-  'protect.rules.nosql-injection.mode',
-  'protect.rules.nosql-injection-mongo.mode',
-  'protect.rules.path-traversal.mode',
-  'protect.rules.path-traversal-semantic-file-security-bypass.mode',
-  'protect.rules.reflected-xss.mode',
-  'protect.rules.sql-injection.mode',
-  'protect.rules.ssjs-injection.mode',
-  'protect.rules.unsafe-file-upload.mode',
-  'protect.rules.untrusted-deserialization.mode',
-  'protect.rules.xxe.mode',
-].reduce((acc, name) => {
-  const ruleId = name.split('.')[2];
-  return Object.assign(acc, {
-    [name]: (remoteData) => {
-      const remoteSetting = remoteData.settings?.defend?.protectionRules?.find(r => r.id == ruleId);
-      switch (remoteSetting?.mode) {
-        case 'OFF': return OFF;
-        case 'MONITORING': return MONITOR;
-        case 'BLOCKING': return remoteSetting.blockAtEntry ? BLOCK_AT_PERIMETER : BLOCK;
-      }
-    }
-  });
-}, {});
-
-module.exports = settingsReaders;