@contrast/core 1.43.0 → 1.45.0

package/lib/app-info.js

@@ -70,7 +70,11 @@ module.exports = function (core) {
 
 
   function checkPreLoadFlag() {
-    const { version, execArgv } = process;
+    const {
+      version,
+      execArgv,
+      env: { NODE_OPTIONS },
+    } = process;
     [
       { range: '>=18.19.0', flags: ['--import'] },
       { range: '>=16.17.0 <18.19.0', flags: ['--loader'] },
@@ -78,7 +82,8 @@ module.exports = function (core) {
     ].forEach(({ range, flags }) => {
       if (
         semver.satisfies(version, range) &&
-        !execArgv.some((el, idx) => el === '@contrast/agent' && flags.includes(execArgv[idx - 1]))
+        (execArgv.some((el, idx) => el === '@contrast/agent' && !flags.includes(execArgv[idx - 1])) ||
+        NODE_OPTIONS?.includes('@contrast/agent') && !flags.some(flag => NODE_OPTIONS.includes(flag)))
       ) {
         logger.warn(
           'For Node LTS %s, use %s command to run the agent. See: https://docs.contrastsecurity.com/en/install-node-js.html',

package/lib/app-info.test.js

@@ -85,7 +85,24 @@ describe('core app-info', function () {
     { version: 'v18.18.0', range: '>=16.17.0 <18.19.0', badFlag: '-r', goodFlag: ['--loader'] },
     { version: 'v16.16.0', range: '<16.17.0', badFlag: '--loader', goodFlag: ['-r', '--require'] }
   ].forEach(({ version, range, badFlag, goodFlag }) => {
-    it('logs a warning if non-recommended preload flag is used ', function() {
+
+    it(`does not log a warning if '@contrast/agent' is not part of exec args (${version})`, function() {
+      appInfo = proxyquire(
+        './app-info',
+        {
+          os,
+          process: {
+            ...process,
+            argv: ['node', __filename],
+            version,
+            execArgv: [badFlag, 'some/file']
+          }
+        }
+      )(core);
+      expect(core.logger.warn).to.not.have.been.called;
+    });
+
+    it(`logs a warning if non-recommended preload flag is used (${version})`, function() {
       appInfo = proxyquire(
         './app-info',
         {
@@ -104,6 +121,29 @@ describe('core app-info', function () {
         goodFlag
       );
     });
+
+    it(`logs a warning if non-recommended preload flag is used in NODE_OPTIONS (${version})`, function() {
+      appInfo = proxyquire(
+        './app-info',
+        {
+          os,
+          process: {
+            ...process,
+            argv: ['node', __filename],
+            version,
+            execArgv: [],
+            env: {
+              NODE_OPTIONS: `${badFlag} @contrast/agent`
+            }
+          }
+        }
+      )(core);
+      expect(core.logger.warn).to.have.been.calledWith(
+        'For Node LTS %s, use %s command to run the agent. See: https://docs.contrastsecurity.com/en/install-node-js.html',
+        range,
+        goodFlag
+      );
+    });
   });
 
   [
@@ -111,7 +151,7 @@ describe('core app-info', function () {
     { version: 'v18.18.0', goodFlag: '--loader' },
     { version: 'v16.16.0', goodFlag: '--require' }
   ].forEach(({ version, goodFlag }) => {
-    it('does not log a warning if recommended preload flag is used ', function() {
+    it('does not log a warning if recommended preload flag is used', function() {
       appInfo = proxyquire(
         './app-info',
         {
@@ -126,5 +166,24 @@ describe('core app-info', function () {
       )(core);
       expect(core.logger.warn).not.to.have.been.called;
     });
+
+    it('does not log a warning if recommended preload flag is used in NODE_OPTIONS', function() {
+      appInfo = proxyquire(
+        './app-info',
+        {
+          os,
+          process: {
+            ...process,
+            argv: ['node', __filename],
+            version,
+            execArgv: [],
+            env: {
+              NODE_OPTIONS: `${goodFlag} @contrast/agent`
+            }
+          }
+        }
+      )(core);
+      expect(core.logger.warn).not.to.have.been.called;
+    });
   });
 });

package/lib/build-id.js

@@ -0,0 +1,51 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { CRC32 } = require('@tsxper/crc32');
+const { readFile } = require('fs/promises');
+const { resolve } = require('path');
+
+/**
+ * @param {Object} core
+ * @param {import('@contrast/common').AppInfo} core.appInfo
+ * @returns
+ */
+module.exports = function init(core) {
+  /** @type {string | undefined} */
+  let _buildId;
+
+  /**
+   * Attempts to hash the contents of the `package-lock.json` neighbor of the
+   * application's `package.json`. If no package-lock is detected, fall back to
+   * the app's `package.json` to generate the build ID.
+   * @returns {Promise<number | void>}
+   */
+  return core.getBuildId = async function getBuildId() {
+    if (_buildId) return _buildId;
+
+    const crc32 = new CRC32();
+    try {
+      const buf = await readFile(resolve(core.appInfo.app_dir, 'package-lock.json'));
+      return _buildId = crc32.forBuffer(buf).toString(16);
+    } catch (err) {
+      // unable to hash package-lock.json, fall back to stored package.json
+    }
+
+    const str = JSON.stringify(core.appInfo.pkg);
+    return _buildId = crc32.forString(str).toString(16);
+  };
+};

package/lib/build-id.test.js

@@ -0,0 +1,39 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+
+describe('core build-id', function () {
+  let fs, getBuildId;
+
+  beforeEach(function() {
+    fs = { readFile: sinon.stub().rejects() };
+
+    getBuildId = proxyquire('./build-id', { 'fs/promises': fs })({
+      appInfo: {
+        app_dir: '/app',
+        pkg: { 'name': 'test', 'main': 'index.js', 'dependencies': {} }
+      }
+    });
+  });
+
+  it('resolves a string when package-lock is found', async function () {
+    fs.readFile.onCall(0).resolves(
+      Buffer.from('{"name":"test","lockfileVersion":3,"requires":true,"packages":{}}')
+    );
+
+    expect(await getBuildId()).to.equal('c6378fdf');
+  });
+
+  it('resolves a string when package-lock is not found first', async function () {
+    expect(await getBuildId()).to.equal('55d7b2de');
+  });
+
+  it('memoizes the result', async function () {
+    expect(await getBuildId()).to.equal('55d7b2de');
+    expect(fs.readFile).to.have.callCount(1);
+    await getBuildId();
+    expect(fs.readFile).to.have.callCount(1);
+  });
+});

package/lib/index.d.ts

@@ -13,7 +13,7 @@
  * way not consistent with the End User License Agreement.
  */
 
-import { AppInfo, Messages, SystemInfo } from '@contrast/common';
+import { AppInfo, Messages, SystemInfo, ThreadTransferData } from '@contrast/common';
 
 interface Frame {
   eval: string | undefined;
@@ -30,7 +30,7 @@ interface CreateSnapshotOpts {
 }
 
 export interface Core {
-  threadTransferData: any;
+  threadTransferData: ThreadTransferData;
   agentName: string;
   agentVersion: string;
   reportingInstance: string;
@@ -47,5 +47,6 @@ export interface Core {
   sensitiveDataMasking: any;
 
   getSystemInfo(): Promise<SystemInfo>;
+  getBuildId(): Promse<number | void>;
   Perf: any;
 }

package/lib/messages.js

@@ -18,10 +18,11 @@
 const EventEmitter = require('events');
 
 module.exports = function init(core) {
-  const messages = new EventEmitter();
+  const perf = new core.Perf('messages');
+  const messages = perf.wrapEmitter(new EventEmitter());
 
   // pad for number of components that listen for server-settings-update messages
-  messages.setMaxListeners(20);
+  messages.setMaxListeners(10 + messages.getMaxListeners());
 
   return core.messages = messages;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -16,12 +16,13 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.28.0",
-    "@contrast/config": "1.38.0",
+    "@contrast/common": "1.29.0",
+    "@contrast/config": "1.40.0",
     "@contrast/find-package-json": "^1.1.0",
     "@contrast/fn-inspect": "^4.3.0",
-    "@contrast/logger": "1.16.0",
-    "@contrast/patcher": "1.15.0",
+    "@contrast/logger": "1.18.0",
+    "@contrast/patcher": "1.17.0",
+    "@tsxper/crc32": "^2.1.3",
     "axios": "^1.7.4",
     "semver": "^7.6.0"
   }