@contrast/core 1.11.0 → 1.12.0

package/lib/agent-info.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { name: agentName, version: agentVersion } = require('../package.json');
+
+module.exports = function init(core) {
+  // default to version of core
+  if (!core.agentName) {
+    core.agentName = agentName;
+  }
+  if (!core.agentVersion) {
+    core.agentVersion = agentVersion;
+  }
+
+  return core;
+};

package/lib/contrast-methods.js

@@ -0,0 +1,167 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+module.exports = function (core) {
+  const { logger, patcher } = core;
+
+  const getOrig = (v) => patcher.unwrap(v);
+  const slice = patcher.unwrap(String.prototype.slice);
+  const toUntrackedString = (v) => slice.call(` ${v}`, 1);
+
+  /**
+   * Components e.g. Assess, Protect, can
+   * 1) configure rewriter to add desired ContrastMethod functions to source code
+   * 2) patch those functions on `contrastMethods.api` in order to add instrumentation
+   */
+  core.contrastMethods = {
+    api: {
+      eval(val) {
+        return val;
+      },
+
+      // Assignment Operators
+      addAssign(left, right) {
+        return this.add(left, right);
+      },
+
+      // Binary Operators
+      add(left, right) {
+        const ret = getOrig(left) + getOrig(right);
+        return ret;
+      },
+      eqEq(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left == right;
+      },
+      eqEqEq(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left === right;
+      },
+      notEq(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left != right;
+      },
+      notEqEq(left, right) {
+        left = getOrig(left);
+        right = getOrig(right);
+
+        return left !== right;
+      },
+
+      // Computed Properties
+      // Used to force a copy of handle:
+      // https://stackoverflow.com/a/31733628
+      // This is a workaround for CONTRAST-30333, in which something we
+      // suspect is a v8 bug means that handle will otherwise be clobbered
+      // and if it was externalized, we will lose the data associated with it
+      forceCopy(handle) {
+        if (typeof handle === 'string') {
+          handle = toUntrackedString(handle);
+        }
+        return handle;
+      },
+
+      // Switch Case
+      cast(val) {
+        return getOrig(val);
+      },
+
+      /**
+       * Tagged Templates
+       * The first argument received by the tag function is an array of strings.
+       * For any template literal, its length is equal to the number of
+       * substitutions (occurrences of ${...}) plus one, and is therefore always
+       * non-empty.
+       * see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates
+       * @param {string[]} strings length n+1
+       * @param {string[]} args length n
+       * @returns {string}
+       */
+      tag(strings, ...args) {
+        const [first, ...rest] = strings;
+
+        return rest.reduce(
+          (result, str, i) => result.concat(args[i], str),
+          first,
+        );
+      },
+
+      // Import Statements
+      importDefault(...args) {
+        // noop
+      },
+
+      importStarAs(...args) {
+        // noop
+      },
+
+      importNamed(...args) {
+        // noop
+      },
+
+      // Injections
+      Function: core.patcher.patch(global.Function, {
+        name: 'global.Function',
+        patchType: 'rewrite-injection',
+      }),
+      Number: core.patcher.patch(global.Number, {
+        name: 'global.Number',
+        patchType: 'rewrite-injection',
+      }),
+      Object: core.patcher.patch(global.Object, {
+        name: 'global.Object',
+        patchType: 'rewrite-injection',
+      }),
+      String: core.patcher.patch(global.String, {
+        name: 'global.String',
+        patchType: 'rewrite-injection',
+      }),
+    },
+
+    installed: false,
+
+    getGlobal() {
+      return global;
+    },
+
+    install() {
+      if (this.installed) return;
+
+      try {
+        Object.defineProperty(this.getGlobal(), 'ContrastMethods', {
+          enumerable: true,
+          configurable: false,
+          value: this.api,
+        });
+
+        this.installed = true;
+      } catch (err) {
+        // We should never expect this since the installation process is well
+        // controlled, but still we should have the defensive code.
+        logger.error({ err }, 'Unable to define global.ContrastMethods');
+      }
+    },
+  };
+
+  return core.contrastMethods;
+};

package/lib/effective-config/index.js

@@ -21,19 +21,14 @@ const { configOptions } = require('@contrast/config/lib/options');
 module.exports = function(core) {
   const { config, messages } = core;
   const effectiveConfig = createEffectiveConfig({ config, remoteData: {} });
-  function setterFn(target, name, value) {
-    let remoteValue = value;
-    if (typeof value === 'string') remoteValue = remoteValue.toLowerCase();
-    target.set(name, {
-      CanonicalName: name,
-      Name: name,
-      Value: remoteValue,
-      Source: 'ContrastUI',
-    });
-  }
+  let Status = '';
 
   if (core.config?.protect?.enable === true) {
     messages.on(Event.SERVER_SETTINGS_UPDATE, (msg) => {
+      if (!Status) {
+        Status = 'Success';
+      }
+
       msg.features && mergeRemoteData(config, msg, featureReaders, setterFn, effectiveConfig);
       msg.settings && mergeRemoteData(config, msg, settingsReaders, setterFn, effectiveConfig);
     });
@@ -42,8 +37,20 @@ module.exports = function(core) {
   core.getEffectiveConfig = function () {
     return formatEffectiveConfig(effectiveConfig);
   };
+
   return;
 
+  function setterFn(target, name, value) {
+    let remoteValue = value;
+    if (typeof value === 'string') remoteValue = remoteValue.toLowerCase();
+    target.set(name, {
+      CanonicalName: name,
+      Name: name,
+      Value: remoteValue,
+      Source: 'ContrastUI',
+    });
+  }
+
   function createEffectiveConfig({ config, remoteData }) {
     const list = configOptions.map(({ name }) => ({
       CanonicalName: name,
@@ -57,26 +64,17 @@ module.exports = function(core) {
 
   function formatEffectiveConfig(configMap) {
     const values = Array.from(configMap.values()).filter(s => s.Value != undefined);
-
     const content = {
-      report_create: new Date(),
-      status: undefined,
-      config: {
-        effective_config: values,
-        environment: values.filter(v => v.Source === 'ENV'),
-        contrast_ui: values.filter(v => v.Source === 'ContrastUI'),
-        file: values.filter(v => v.Source === 'YAML'),
+      Status,
+      ReportCreate: new Date(),
+      Config: {
+        EffectiveConfig: values,
+        Environment: values.filter(v => v.Source === 'ENV'),
+        ContrastUI: values.filter(v => v.Source === 'ContrastUI'),
+        File: values.filter(v => v.Source === 'YAML'),
       }
     };
 
-    const api = values.filter(v => v.CanonicalName == 'api.enable')[0];
-    const apiEnabled = api && api.Value;
-    if (apiEnabled) {
-      content.status = 'Success!';
-    } else {
-      content.status = 'Success! Couldn\'t connect to Teamserver, so no Teamserver data will be included!';
-    }
-
     return content;
   }
 };

package/lib/index.d.ts

@@ -26,6 +26,8 @@ import { Scopes } from '@contrast/scopes';
 import { Deadzones } from '@contrast/deadzones';
 
 export interface Core {
+  agentName: string,
+  agentVersion: string,
   agentify: Agentify<Core>;
   config: Config;
   depHooks: RequireHook;

package/lib/index.js

@@ -19,7 +19,7 @@ const EventEmitter = require('events');
 
 module.exports = function init(core = {}) {
   core.messages = new EventEmitter();
-
+  require('./agent-info')(core);
   require('@contrast/config')(core);
   require('./logger-factory')(core);
   require('./effective-config')(core);
@@ -29,6 +29,7 @@ module.exports = function init(core = {}) {
   require('./is-agent-path')(core);
   require('./capture-stacktrace')(core);
   require('@contrast/patcher')(core);
+  require('./contrast-methods')(core);
   require('@contrast/rewriter')(core);
   require('@contrast/dep-hooks')(core);
   require('@contrast/scopes')(core);

package/lib/system-info/index.js

@@ -58,34 +58,40 @@ function isDocker() {
 
   try {
     const result = fs.statSync('/.dockerenv');
-    if (result) return { isDocker: true, containerID: undefined };
+    if (result) return { isDocker: true, containerID: null };
   } catch (err) {
     // if there's not such file we can conclude it's not docker env
   }
 
-  return { isDocker: false, containerID: undefined };
+  return { isDocker: false, containerID: null };
 }
 
 module.exports = function(core) {
-  // eslint-disable-next-line node/no-extraneous-require
-  const pkg = require('@contrast/protect-agent/package.json');
-  const { config } = core;
+  const {
+    agentName,
+    agentVersion,
+    config
+  } = core;
 
+  // have values default to null so all required keys get serialized
   core.getSystemInfo = function() {
     const appPath = process.cwd();
 
     const info = {
-      ReportDate: new Date(),
+      ReportDate: new Date().toISOString(),
       MachineName: os.hostname(),
       Contrast: {
-        Url: config.api.url,
-        Proxy: config.api.proxy,
+        Url: config.api.url || null,
+        Proxy: {
+          enable: !!config.api.proxy.enable,
+          url: config.api.proxy.url || null,
+        },
         Server: {
           Name: config.server.name,
         },
         Agent: {
-          Name: pkg.name,
-          Version: pkg.version,
+          Name: agentName,
+          Version: agentVersion,
         },
       },
       Node: {
@@ -97,8 +103,8 @@ module.exports = function(core) {
         Version: os.release(),
         KernelVersion: os.version(),
         CPU: {
-          type: os.cpus()[0].model,
-          count: os.cpus().length,
+          Type: os.cpus()[0].model,
+          Count: os.cpus().length,
         }
       },
       Host: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,17 +17,17 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.4.0",
-    "@contrast/common": "1.4.0",
-    "@contrast/config": "1.6.0",
+    "@contrast/agentify": "1.5.0",
+    "@contrast/common": "1.5.0",
+    "@contrast/config": "1.7.0",
     "@contrast/deadzones": "1.1.0",
     "@contrast/dep-hooks": "1.1.0",
     "@contrast/fn-inspect": "^3.2.0",
     "@contrast/instrumentation": "1.1.0",
     "@contrast/logger": "1.2.0",
     "@contrast/patcher": "1.2.0",
-    "@contrast/reporter": "1.9.0",
-    "@contrast/rewriter": "1.3.1",
+    "@contrast/reporter": "1.10.0",
+    "@contrast/rewriter": "1.4.0",
     "@contrast/scopes": "1.3.0"
   }
-}
+}