@contrast/core 1.7.1 → 1.8.1

package/lib/app-info.js

@@ -22,10 +22,10 @@ const process = require('process');
 
 const MAX_ATTEMPTS = 5;
 
-module.exports = function (deps) {
-  const { logger, config } = deps;
+module.exports = function (core) {
+  const { logger, config } = core;
 
-  const appInfo = (deps.appInfo = {
+  const appInfo = (core.appInfo = {
     os: {
       type: os.type(),
       platform: os.platform(),
@@ -83,7 +83,7 @@ module.exports = function (deps) {
     }
 
     if (packageLocation) {
-      deps.logger.info('using package.json at %s', packageLocation);
+      core.logger.info('using package.json at %s', packageLocation);
     }
 
     return packageLocation;

package/lib/capture-stacktrace.js

@@ -32,6 +32,10 @@ module.exports = function(core) {
     return stacktraceFactory.captureStacktrace(...args);
   };
 
+  core.createSnapshot = function(...args) {
+    return stacktraceFactory.createSnapshot(...args);
+  };
+
   return core.captureStacktrace;
 };
 

package/lib/effective-config/feature-readers.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const featureReaders = {
+  'agent.logger.level': (remoteData) => remoteData.features?.logLevel,
+  'agent.logger.path': (remoteData) => remoteData.features?.logFile,
+  'agent.security_logger.syslog.enable': (remoteData) => remoteData.features?.defend?.syslog?.syslogEnabled,
+  'agent.security_logger.syslog.ip': (remoteData) => remoteData.features?.defend?.syslog?.syslogIpAddress,
+  'agent.security_logger.syslog.port': (remoteData) => remoteData.features?.defend?.syslog?.syslogPortNumber,
+  'agent.security_logger.syslog.facility': (remoteData) => remoteData.features?.defend?.syslog?.syslogFacilityCode,
+  'agent.security_logger.syslog.severity_exploited': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityExploit,
+  'agent.security_logger.syslog.severity_blocked': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityBlocke,
+  'agent.security_logger.syslog.severity_probed': (remoteData) => remoteData.features?.defend?.syslog?.syslogSeverityProbed,
+};
+
+module.exports = featureReaders;

package/lib/effective-config/index.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { Event } = require('@contrast/common');
+const { configOptions } = require('@contrast/config/lib/options');
+
+const settingsReaders = require('./settings-readers');
+const featureReaders = require('./feature-readers');
+
+module.exports = function(core) {
+  const { config, messages } = core;
+  const effectiveConfig = createEffectiveConfig({ config, remoteData: {} });
+
+  if (core.config?.protect?.enable === true) {
+    messages.on(Event.SERVER_SETTINGS_UPDATE, (msg) => {
+      msg.features && mergeRemoteData(msg, featureReaders);
+      msg.settings && mergeRemoteData(msg, settingsReaders);
+    });
+  }
+
+  core.getEffectiveConfig = function () {
+    return formatEffectiveConfig(effectiveConfig);
+  };
+  return;
+
+  function createEffectiveConfig({ config, remoteData }) {
+    const list = configOptions.map(({ name }) => ({
+      CanonicalName: name,
+      Name: name,
+      Value: config._flat[name],
+      Source: config._sources[name]
+    }));
+
+    return new Map(list.map((entry) => [entry.CanonicalName, entry]));
+  }
+
+  function formatEffectiveConfig(configMap) {
+    const values = Array.from(configMap.values()).filter(s => s.Value != undefined);
+
+    const content = {
+      report_create: new Date(),
+      status: undefined,
+      config: {
+        effective_config: values,
+        environment: values.filter(v => v.Source === 'ENV'),
+        contrast_ui: values.filter(v => v.Source === 'ContrastUI'),
+        file: values.filter(v => v.Source === 'YAML'),
+      }
+    };
+
+    const api = values.filter(v => v.CanonicalName == 'api.enable')[0];
+    const apiEnabled = api && api.Value;
+    if (apiEnabled) {
+      content.status = 'Success!';
+    } else {
+      content.status = 'Success! Couldn\'t connect to Teamserver, so no Teamserver data will be included!';
+    }
+
+    return content;
+  }
+
+  function mergeRemoteData(remoteData, readers) {
+    for (const [name, readerFn] of Object.entries(readers)) {
+      const remoteValue = readerFn(remoteData);
+      if (config._sources[name] === 'DEFAULT' && remoteValue != null) {
+        effectiveConfig.set(name, {
+          CanonicalName: name,
+          Name: name,
+          Value: remoteValue,
+          Source: 'ContrastUI',
+        });
+      }
+    }
+  }
+};

package/lib/effective-config/settings-readers.js

@@ -0,0 +1,57 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  ProtectRuleMode: {
+    OFF,
+    BLOCK,
+    MONITOR,
+    BLOCK_AT_PERIMETER
+  }
+} = require('@contrast/common');
+
+const settingsReaders = [
+  'protect.rules.cmd-injection.mode',
+  'protect.rules.cmd-injection-command-backdoors.mode',
+  'protect.rules.cmd-injection-semantic-chained-commands.mode',
+  'protect.rules.cmd-injection-semantic-dangerous-paths.mode',
+  'protect.rules.method-tampering.mode',
+  'protect.rules.nosql-injection.mode',
+  'protect.rules.nosql-injection-mongo.mode',
+  'protect.rules.path-traversal.mode',
+  'protect.rules.path-traversal-semantic-file-security-bypass.mode',
+  'protect.rules.reflected-xss.mode',
+  'protect.rules.sql-injection.mode',
+  'protect.rules.ssjs-injection.mode',
+  'protect.rules.unsafe-file-upload.mode',
+  'protect.rules.untrusted-deserialization.mode',
+  'protect.rules.xxe.mode',
+].reduce((acc, name) => {
+  const ruleId = name.split('.')[2];
+  return Object.assign(acc, {
+    [name]: (remoteData) => {
+      const remoteSetting = remoteData.settings?.defend?.protectionRules?.find(r => r.id == ruleId);
+      switch (remoteSetting?.mode) {
+        case 'OFF': return OFF;
+        case 'MONITORING': return MONITOR;
+        case 'BLOCKING': return remoteSetting.blockAtEntry ? BLOCK_AT_PERIMETER : BLOCK;
+      }
+    }
+  });
+}, {});
+
+module.exports = settingsReaders;

package/lib/index.d.ts

@@ -23,6 +23,7 @@ import { Protect } from '@contrast/protect';
 import { Rewriter } from '@contrast/rewriter';
 import RequireHook from '@contrast/require-hook';
 import { Scopes } from '@contrast/scopes';
+import { Deadzones } from '@contrast/deadzones';
 
 export interface Core {
   agentify: Agentify<Core>;
@@ -36,6 +37,7 @@ export interface Core {
   protect: Protect;
   rewriter: Rewriter;
   scopes: Scopes;
+  deadzones: Deadzones;
 }
 
 declare function init(): Core;

package/lib/index.js

@@ -22,6 +22,7 @@ module.exports = function init(core = {}) {
 
   require('@contrast/config')(core);
   require('./logger-factory')(core);
+  require('./effective-config')(core);
   require('./sensitive-data-masking')(core);
   require('./app-info')(core);
   require('./is-agent-path')(core);
@@ -30,8 +31,10 @@ module.exports = function init(core = {}) {
   require('@contrast/rewriter')(core);
   require('@contrast/dep-hooks')(core);
   require('@contrast/scopes')(core);
+  require('@contrast/deadzones')(core);
   require('@contrast/reporter').default(core);
   require('@contrast/agentify')(core);
+  require('@contrast/instrumentation')(core);
 
   return core;
 };

package/lib/sensitive-data-masking/index.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { simpleTraverse } = require('@contrast/common');
+const { traverseKeys } = require('@contrast/common');
 const { CONTRAST_REDACTED } = require('./constants');
 
 module.exports = function(core) {
@@ -35,13 +35,11 @@ module.exports = function(core) {
     let redactedText;
     if (!target) return;
 
-    simpleTraverse(target, (path, type, value, obj) => {
-      if (type === 'Key') {
-        redactedText = getRedactedText(value);
-        if (redactedText) {
-          obj[value] = redactedText;
-          redactedText = undefined;
-        }
+    traverseKeys(target, (path, type, value, obj) => {
+      redactedText = getRedactedText(value);
+      if (redactedText) {
+        obj[value] = redactedText;
+        redactedText = undefined;
       }
     });
   }

package/lib/sensitive-data-masking/protect-listener.js

@@ -84,7 +84,7 @@ module.exports = function (core) {
 
     if (policy.maskAttackVector) {
       // attack values
-      const inputAnalysis = Object.entries(msg.protect?.findings.resultsMap);
+      const inputAnalysis = Object.entries(msg.protect?.resultsMap);
       for (const [, results] of inputAnalysis) {
         for (const result of results) {
           const redactedText = getRedactedText(result.key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/core",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Preconfigured Contrast agent core services and models",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,15 +17,17 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agentify": "1.1.2",
-    "@contrast/common": "^1.1.5",
-    "@contrast/config": "1.3.3",
+    "@contrast/agentify": "1.2.0",
+    "@contrast/common": "1.2.0",
+    "@contrast/config": "1.4.0",
+    "@contrast/deadzones": "1.0.0",
     "@contrast/dep-hooks": "1.0.5",
     "@contrast/fn-inspect": "^3.2.0",
+    "@contrast/instrumentation": "1.0.0",
     "@contrast/logger": "1.1.1",
-    "@contrast/patcher": "1.0.6",
-    "@contrast/reporter": "1.6.2",
-    "@contrast/rewriter": "1.2.0",
+    "@contrast/patcher": "1.1.0",
+    "@contrast/reporter": "1.7.0",
+    "@contrast/rewriter": "1.3.0",
     "@contrast/scopes": "1.2.0"
   }
 }