@contrast/protect 1.13.0 → 1.14.0

package/lib/index.js

@@ -19,6 +19,8 @@ const agentLib = require('@contrast/agent-lib');
 const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
+  if (!core.config.protect.enable) return;
+
   const protect = core.protect = {
     agentLib: module.exports.instantiateAgentLib(agentLib),
   };
@@ -35,6 +37,7 @@ module.exports = function(core) {
   require('./semantic-analysis')(core);
 
   protect.install = function() {
+    core.rewriter.install('protect');
     callChildComponentMethodsSync(protect, 'install');
   };
 

package/lib/input-analysis/handlers.js

@@ -20,6 +20,7 @@ const {
   traverseKeysAndValues,
   traverseValues,
   Rule,
+  ProtectRuleMode,
   isString,
   ProtectRuleMode: { OFF },
 } = require('@contrast/common');
@@ -435,57 +436,105 @@ module.exports = function(core) {
   inputAnalysis.handleRequestEnd = function handleRequestEnd(sourceContext) {
     if (!config.protect.probe_analysis.enable || sourceContext.allowed) return;
 
-    const { resultsMap } = sourceContext;
+    // Detecting probes
+    const { resultsMap, policy: { rulesMask } } = sourceContext;
+
     const probesRules = [Rule.CMD_INJECTION, Rule.PATH_TRAVERSAL, Rule.SQL_INJECTION, Rule.XXE];
-    const props = {};
+    const probes = {};
+
+    const findingsForScoreRequest = {
+      HeaderValue: {},
+      ParameterValue: {},
+      CookieValue: {},
+    };
+    const findingsForScoreAtom = {};
+    const valueToResultByRuleId = {};
 
-    // Detecting probes
     Object.values(resultsMap).forEach(resultsByRuleId => {
-      resultsByRuleId.forEach((resultByRuleId) => {
+      resultsByRuleId.forEach(resultByRuleId => {
         const {
           ruleId,
-          blocked,
           exploitMetadata,
+          score,
           value,
+          key,
           inputType
         } = resultByRuleId;
-        if (blocked || !blocked && exploitMetadata.length > 0 || !probesRules.some(rule => rule === ruleId)) return;
 
-        const { policy: { rulesMask } } = sourceContext;
+        if (
+          !isMonitorMode(ruleId, sourceContext) ||
+          exploitMetadata.length > 0 ||
+          score >= 90 ||
+          !probesRules.some((rule) => rule === ruleId)
+        ) {
+          return;
+        }
 
-        const results = (agentLib.scoreAtom(
-          rulesMask,
-          value,
-          agentLib.InputType[inputType],
-          {
-            preferWorthWatching: false
+        const dataType = findingsForScoreRequest[inputType];
+        if (!dataType) {
+          if (!findingsForScoreAtom[value]) {
+            findingsForScoreAtom[value] = {};
           }
-        ) || []).filter(({ score }) => score >= 90);
 
-        if (!results.length) return;
+          findingsForScoreAtom[value][inputType] = resultByRuleId;
+          return;
+        }
 
-        results.forEach(result => {
-          const isAlreadyBlocked = (resultsMap[result.ruleId] || []).some(element =>
-            element.blocked && element.inputType === inputType && element.value === value
-          );
+        dataType[key] = value;
+        valueToResultByRuleId[value] = resultByRuleId;
+      });
+    });
 
-          if (isAlreadyBlocked) return;
+    const { ParameterValue, HeaderValue, CookieValue } = findingsForScoreRequest;
+
+    const results =
+      agentLib.scoreRequestConnect(
+        rulesMask,
+        {
+          queries: Object.entries(ParameterValue).flat(),
+          headers: Object.entries(HeaderValue).flat(),
+          cookies: Object.entries(CookieValue).flat(),
+        },
+        {
+          preferWorthWatching: false,
+        }
+      ).resultsList || [];
+
+    Object.entries(findingsForScoreAtom).forEach(([value, inputTypes]) => {
+      Object.entries(inputTypes).forEach(([inputType, resultByRuleId]) =>
+        (
+          agentLib.scoreAtom(rulesMask, value, agentLib.InputType[inputType], {
+            preferWorthWatching: false,
+          }) || []
+        ).forEach(result => {
+          results.push({ value, ...result });
+          valueToResultByRuleId[value] = resultByRuleId;
+        })
+      );
+    });
 
-          const probe = Object.assign({}, resultByRuleId, result, {
-            mappedId: result.ruleId
-          });
-          const key = [probe.ruleId, probe.inputType, ...probe.path, probe.value].join('|');
-          props[key] = probe;
+    results
+      .filter(({ score, ruleId }) => score >= 90 && isMonitorMode(ruleId, sourceContext))
+      .forEach((result) => {
+        const resultByRuleId = valueToResultByRuleId[result.value];
+        const probe = Object.assign({}, resultByRuleId, result, {
+          mappedId: result.ruleId,
         });
+        const key = [
+          probe.ruleId,
+          probe.inputType,
+          ...probe.path,
+          probe.value,
+        ].join('|');
+        probes[key] = probe;
       });
-    });
 
-    Object.values(props).forEach(prop => {
-      if (!resultsMap[prop.ruleId]) {
-        resultsMap[prop.ruleId] = [];
+    Object.values(probes).forEach(probe => {
+      if (!resultsMap[probe.ruleId]) {
+        resultsMap[probe.ruleId] = [];
       }
 
-      resultsMap[prop.ruleId].push(prop);
+      resultsMap[probe.ruleId].push(probe);
     });
   };
 
@@ -817,3 +866,7 @@ function getValueAtKey(obj, path, key) {
   }
   return key in obj ? obj[key] : undefined;
 }
+
+function isMonitorMode(ruleId, sourceContext) {
+  return sourceContext.policy[ruleId] === ProtectRuleMode.MONITOR;
+}

package/lib/input-analysis/ip-analysis.js

@@ -29,8 +29,8 @@ module.exports = (core) => {
 
   messages.on(Event.SERVER_SETTINGS_UPDATE, (serverUpdate) => {
     const now = new Date().getTime();
-    const updatedIpAllowList = serverUpdate.features?.defend?.ipAllowlist.map((ipEntry) => ipEntryMap(ipEntry, now));
-    const updatedIpDenyList = serverUpdate.features?.defend?.ipDenylist.map((ipEntry) => ipEntryMap(ipEntry, now));
+    const updatedIpAllowList = serverUpdate.features?.defend?.ipAllowlist?.map?.((ipEntry) => ipEntryMap(ipEntry, now));
+    const updatedIpDenyList = serverUpdate.features?.defend?.ipDenylist?.map?.((ipEntry) => ipEntryMap(ipEntry, now));
 
     if (updatedIpAllowList) {
       ipAllowlist.length = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,9 +18,9 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^5.3.4",
-    "@contrast/common": "1.4.0",
-    "@contrast/core": "1.11.0",
-    "@contrast/esm-hooks": "1.7.0",
+    "@contrast/common": "1.5.0",
+    "@contrast/core": "1.12.0",
+    "@contrast/esm-hooks": "1.8.0",
     "@contrast/scopes": "1.3.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"
@@ -28,4 +28,4 @@
   "optionalDependencies": {
     "async-hook-domain": "^3.0.2"
   }
-}
+}