@contrast/protect 1.16.0 → 1.18.0

package/lib/input-analysis/handlers.js

@@ -169,12 +169,8 @@ module.exports = function(core) {
       { URLS: connectInputs.rawUrl, HEADERS: connectInputs.headers }
     );
 
-    // initialize findings to the basics
-    let block = undefined;
-    if (rulesMask !== 0) {
-      const findings = agentLib.scoreRequestConnect(rulesMask, connectInputs, preferWW);
-      block = mergeFindings(sourceContext, findings);
-    }
+    const findings = agentLib.scoreRequestConnect(rulesMask, connectInputs, preferWW);
+    let block = mergeFindings(sourceContext, findings);
 
     if (!block) {
       block = inputAnalysis.handleMethodTampering(sourceContext, connectInputs);
@@ -510,7 +506,7 @@ module.exports = function(core) {
       }
     }
 
-    if (!config.protect.probe_analysis.enable || sourceContext.allowed) return;
+    if (!config.protect.probe_analysis.enable) return;
 
     // Detecting probes
     const { resultsMap, policy: { rulesMask } } = sourceContext;

package/lib/input-analysis/install/http.js

@@ -49,6 +49,20 @@ module.exports = function(core) {
     let store, block;
     const { args: [type, req, res] } = data;
 
+    function callNext() {
+      setImmediate(() => {
+        const domain = initDomain(req, res);
+
+        if (domain) {
+          domain.run(() => {
+            next.call(data.obj, ...data.args);
+          });
+        } else {
+          next.call(data.obj, ...data.args);
+        }
+      });
+    }
+
     if (type !== 'request') {
       return next();
     }
@@ -61,6 +75,11 @@ module.exports = function(core) {
       }
 
       store.protect = core.protect.makeSourceContext(req, res);
+      if (store.protect.allowed) {
+        callNext();
+        return;
+      }
+
       const {
         reqData: { headers, uriPath, method },
         resData,
@@ -97,17 +116,7 @@ module.exports = function(core) {
     }
 
     if (!block) {
-      setImmediate(() => {
-        const domain = initDomain(req, res);
-
-        if (domain) {
-          domain.run(() => {
-            next.call(data.obj, ...data.args);
-          });
-        } else {
-          next.call(data.obj, ...data.args);
-        }
-      });
+      callNext();
     } else {
       store.protect.block(...block);
       logger.debug({ block }, 'request blocked by not emitting request event');

package/lib/input-tracing/install/fs.js

@@ -15,115 +15,101 @@
 
 'use strict';
 
-const { isString } = require('@contrast/common');
+const { FS_METHODS, isString } = require('@contrast/common');
 const { patchType } = require('../constants');
 
-const fsMethods = [
-  { method: 'access' },
-  { method: 'accessSync' },
-  { method: 'appendFile' },
-  { method: 'appendFileSync' },
-  { method: 'chmod' },
-  { method: 'chmodSync' },
-  { method: 'chown' },
-  { method: 'chownSync' },
-  { method: 'copyFile', indices: [0, 1] },
-  { method: 'copyFileSync', indices: [0, 1] },
-  { method: 'createReadStream' },
-  { method: 'createWriteStream' },
-  { method: 'lchmod' },
-  { method: 'lchmodSync' },
-  { method: 'lchown' },
-  { method: 'lchownSync' },
-  { method: 'mkdir' },
-  { method: 'mkdirSync' },
-  { method: 'open' },
-  { method: 'openSync' },
-  { method: 'readFile' },
-  { method: 'readFileSync' },
-  { method: 'readdir' },
-  { method: 'readdirSync' },
-  { method: 'readlink' },
-  { method: 'readlinkSync' },
-  { method: 'rename', indices: [0, 1] },
-  { method: 'renameSync', indices: [0, 1] },
-  { method: 'rmdir' },
-  { method: 'rmdirSync' },
-  { method: 'symlink', indices: [0, 1] },
-  { method: 'symlinkSync', indices: [0, 1] },
-  { method: 'truncate' },
-  { method: 'truncateSync' },
-  { method: 'unlink' },
-  { method: 'unlinkSync' },
-  { method: 'writeFile' },
-  { method: 'writeFileSync' },
-];
-
-module.exports = function(core) {
-  const {
-    scopes: { instrumentation },
-    patcher,
-    depHooks,
-    protect,
-    protect: { inputTracing }
-  } = core;
-
-  function getValues(indices, args) {
-    return indices.reduce((acc, idx) => {
-      const value = args[idx];
-      if (value && isString(value)) acc.push(value);
-      return acc;
-    }, []);
-  }
-
-  function install() {
-    depHooks.resolve({ name: 'fs' }, fs => {
-      fsMethods.forEach(({ method, indices = [0] }) => {
-        const name = `fs.${method}`;
-
-        // may not exist depending on OS
-        if (!fs[method]) return;
-
-        patcher.patch(fs, method, {
-          name,
-          patchType,
-          pre({ args, hooked, name, orig }) {
-            // don't proceed if instrumentation is off e.g. within require() call
-            if (instrumentation.isLocked()) return;
-
-            // obtain the Protect sourceContext
-            const sourceContext = protect.getSourceContext('fs');
-
-            if (!sourceContext) return;
-
-            // build list of values on which to perform INPUT TRACING
-            const values = getValues(indices, args);
-            if (!values.length) return;
-
-            // while we need to check whether instrumentation is locked above, we
-            // don't need to necessarily need to lock it here - there are no
-            // lower-level calls that we instrument
-            for (const value of values) {
-              const sinkContext = {
-                name,
-                value,
-                stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
-              };
-              inputTracing.handlePathTraversal(sourceContext, sinkContext);
-              core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(sourceContext, sinkContext);
+function getValues(indices, args) {
+  return indices.reduce((acc, idx) => {
+    const value = args[idx];
+    if (value && isString(value)) acc.push(value);
+    return acc;
+  }, []);
+}
+
+module.exports = function init(core) {
+  const { depHooks, patcher } = core;
+
+  const preHook = (indices) => ({ args, hooked, name, orig }) => {
+    // don't proceed if instrumentation is off e.g. within require() call
+    if (core.scopes.instrumentation.isLocked()) return;
+
+    // obtain the Protect sourceContext
+    const sourceContext = core.protect.getSourceContext('fs');
+
+    if (!sourceContext) return;
+
+    // build list of values on which to perform INPUT TRACING
+    const values = getValues(indices, args);
+    if (!values.length) return;
+
+    // while we need to check whether instrumentation is locked above, we
+    // don't need to necessarily need to lock it here - there are no
+    // lower-level calls that we instrument
+    for (const value of values) {
+      const sinkContext = {
+        name,
+        value,
+        stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
+      };
+
+      core.protect.inputTracing.handlePathTraversal(
+        sourceContext,
+        sinkContext
+      );
+      core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(
+        sourceContext,
+        sinkContext,
+      );
+    }
+  };
+
+  return core.protect.inputTracing.fsInstrumentation = {
+    install() {
+      depHooks.resolve({ name: 'fs' }, (fs) => {
+        for (const method of FS_METHODS) {
+          // not all methods are available on every OS or Node version.
+          if (fs[method.name]) {
+            patcher.patch(fs, method.name, {
+              name: `fs.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+
+          if (method.sync) {
+            const syncName = `${method.name}Sync`;
+            if (fs[syncName]) {
+              patcher.patch(fs, syncName, {
+                name: `fs.${syncName}`,
+                patchType,
+                pre: preHook(method.indices)
+              });
             }
           }
-        });
+
+          if (method.promises && fs.promises && fs.promises[method.name]) {
+            patcher.patch(fs.promises, method.name, {
+              name: `fs.promises.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+        }
       });
-    });
-  }
 
-  const fsInstrumentation = inputTracing.fsInstrumentation = {
-    getValues,
-    install,
+      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+        for (const method of FS_METHODS) {
+          if (method.promises && fsPromises[method.name]) {
+            patcher.patch(fsPromises, method.name, {
+              name: `fsPromises.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+        }
+      });
+    }
   };
-
-  return fsInstrumentation;
 };
 
-module.exports.fsMethods = fsMethods;
+module.exports.FS_METHODS = FS_METHODS;

package/lib/make-source-context.js

@@ -44,7 +44,7 @@ module.exports = function(core) {
     const policy = getPolicy({ uriPath });
 
     // URL exclusions can disable all rules
-    if (!policy) {
+    if (!policy || policy.rulesMask === 0) {
       return { allowed: true };
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,9 +18,9 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^5.3.4",
-    "@contrast/common": "1.7.0",
-    "@contrast/core": "1.14.0",
-    "@contrast/esm-hooks": "1.10.0",
+    "@contrast/common": "1.9.0",
+    "@contrast/core": "1.16.0",
+    "@contrast/esm-hooks": "1.12.0",
     "@contrast/scopes": "1.3.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"