@contrast/protect 1.17.0 → 1.19.0

package/lib/input-analysis/handlers.js

@@ -169,12 +169,8 @@ module.exports = function(core) {
       { URLS: connectInputs.rawUrl, HEADERS: connectInputs.headers }
     );
 
-    // initialize findings to the basics
-    let block = undefined;
-    if (rulesMask !== 0) {
-      const findings = agentLib.scoreRequestConnect(rulesMask, connectInputs, preferWW);
-      block = mergeFindings(sourceContext, findings);
-    }
+    const findings = agentLib.scoreRequestConnect(rulesMask, connectInputs, preferWW);
+    let block = mergeFindings(sourceContext, findings);
 
     if (!block) {
       block = inputAnalysis.handleMethodTampering(sourceContext, connectInputs);
@@ -510,7 +506,7 @@ module.exports = function(core) {
       }
     }
 
-    if (!config.protect.probe_analysis.enable || sourceContext.allowed) return;
+    if (!config.protect.probe_analysis.enable) return;
 
     // Detecting probes
     const { resultsMap, policy: { rulesMask } } = sourceContext;
@@ -696,7 +692,7 @@ module.exports = function(core) {
           key: type === 'Key' ? value : path[path.length - 1],
           value,
           score: item.score,
-          idsList: [],
+          idsList: item.idsList || [],
         };
         if (item.mongoContext) {
           result.mongoContext = item.mongoContext;

package/lib/input-analysis/install/http.js

@@ -49,6 +49,20 @@ module.exports = function(core) {
     let store, block;
     const { args: [type, req, res] } = data;
 
+    function callNext() {
+      setImmediate(() => {
+        const domain = initDomain(req, res);
+
+        if (domain) {
+          domain.run(() => {
+            next.call(data.obj, ...data.args);
+          });
+        } else {
+          next.call(data.obj, ...data.args);
+        }
+      });
+    }
+
     if (type !== 'request') {
       return next();
     }
@@ -61,6 +75,11 @@ module.exports = function(core) {
       }
 
       store.protect = core.protect.makeSourceContext(req, res);
+      if (store.protect.allowed) {
+        callNext();
+        return;
+      }
+
       const {
         reqData: { headers, uriPath, method },
         resData,
@@ -97,17 +116,7 @@ module.exports = function(core) {
     }
 
     if (!block) {
-      setImmediate(() => {
-        const domain = initDomain(req, res);
-
-        if (domain) {
-          domain.run(() => {
-            next.call(data.obj, ...data.args);
-          });
-        } else {
-          next.call(data.obj, ...data.args);
-        }
-      });
+      callNext();
     } else {
       store.protect.block(...block);
       logger.debug({ block }, 'request blocked by not emitting request event');

package/lib/input-tracing/handlers/index.js

@@ -22,6 +22,7 @@ const {
   isString,
   traverseKeys,
   traverseKeysAndValues,
+  agentLibIDListTypes
 } = require('@contrast/common');
 
 module.exports = function(core) {
@@ -127,10 +128,30 @@ module.exports = function(core) {
     }
   };
 
-  inputTracing.nosqlInjectionMongo = function(sourceContext, sinkContext) {
+  inputTracing.nosqlInjectionMongo = function (sourceContext, sinkContext) {
     const ruleId = 'nosql-injection-mongo';
-    const expansionResults = getResultsByRuleId(ruleId, sourceContext);
-    const stringInjectionResults = getResultsByRuleId('ssjs-injection', sourceContext);
+    const nosqlInjectionMongoResults =
+      getResultsByRuleId(ruleId, sourceContext) || [];
+    const ssjsInjectionResults =
+      getResultsByRuleId('ssjs-injection', sourceContext) || [];
+
+    const stringInjectionResults = [...ssjsInjectionResults];
+    const expansionResults = [];
+
+    nosqlInjectionMongoResults.forEach((result) => {
+      if (
+        result.idsList &&
+        result.idsList.some(
+          (el) =>
+            el === agentLibIDListTypes.MONGO_SLEEP ||
+            el === agentLibIDListTypes.TRUE_CLAUSE_1
+        )
+      ) {
+        stringInjectionResults.push(result);
+      } else {
+        expansionResults.push(result);
+      }
+    });
 
     if (expansionResults) {
       let expansionFindings = null;
@@ -138,7 +159,13 @@ module.exports = function(core) {
         expansionFindings = handleObjectValue(result, sinkContext.value);
 
         if (expansionFindings) {
-          handleFindings(sourceContext, sinkContext, ruleId, result, expansionFindings);
+          handleFindings(
+            sourceContext,
+            sinkContext,
+            ruleId,
+            result,
+            expansionFindings
+          );
         }
       }
     }
@@ -148,30 +175,44 @@ module.exports = function(core) {
 
       for (const result of stringInjectionResults) {
         if (typeof sinkContext.value === 'object') {
-          traverseKeysAndValues(sinkContext.value, function(path, type, value, obj) {
-            if (type !== 'Key' && !agentLib.isMongoQueryType(value)) return;
-
-            if (!stringFindings && type == 'Key' && value == '$accumulator') {
-              stringFindings =
-                handleStringValue(result, obj[value]?.['init'], agentLib) ||
-                handleStringValue(result, obj[value]?.['merge'], agentLib) ||
-                handleStringValue(result, obj[value]?.['finalize'], agentLib) ||
-                handleStringValue(result, obj[value]?.['accumulate'], agentLib);
-            }
-
-            if (!stringFindings && type == 'Key' && value == '$function') {
-              stringFindings =
-                handleStringValue(result, obj['$function']?.body, agentLib);
-            }
-
-            if (!stringFindings) {
-              stringFindings = handleStringValue(result, obj[value], agentLib);
+          traverseKeysAndValues(
+            sinkContext.value,
+            function (path, type, value, obj) {
+              if (type !== 'Key' && !agentLib.isMongoQueryType(value)) return;
+
+              if (!stringFindings && type == 'Key' && value == '$accumulator') {
+                stringFindings =
+                  handleStringValue(result, obj[value]?.init, agentLib) ||
+                  handleStringValue(result, obj[value]?.merge, agentLib) ||
+                  handleStringValue(result, obj[value]?.finalize, agentLib) ||
+                  handleStringValue(result, obj[value]?.accumulate, agentLib);
+              }
+
+              if (!stringFindings && type == 'Key' && value == '$function') {
+                stringFindings = handleStringValue(
+                  result,
+                  obj['$function']?.body,
+                  agentLib
+                );
+              }
+
+              if (!stringFindings) {
+                stringFindings = handleStringValue(
+                  result,
+                  obj[value],
+                  agentLib
+                );
+              }
+
+              if (stringFindings) return true;
             }
-
-            if (stringFindings) return true;
-          });
+          );
         } else if (typeof sinkContext.value === 'string') {
-          stringFindings = handleStringValue(result, sinkContext.value, agentLib);
+          stringFindings = handleStringValue(
+            result,
+            sinkContext.value,
+            agentLib
+          );
         }
 
         if (stringFindings) {
@@ -184,7 +225,13 @@ module.exports = function(core) {
             sourceContext.resultsMap[ruleId] = [nosqlInjectionResult];
           }
 
-          handleFindings(sourceContext, sinkContext, ruleId, nosqlInjectionResult, stringFindings);
+          handleFindings(
+            sourceContext,
+            sinkContext,
+            ruleId,
+            nosqlInjectionResult,
+            stringFindings
+          );
         }
       }
     }

package/lib/input-tracing/install/fs.js

@@ -15,115 +15,101 @@
 
 'use strict';
 
-const { isString } = require('@contrast/common');
+const { FS_METHODS, isString } = require('@contrast/common');
 const { patchType } = require('../constants');
 
-const fsMethods = [
-  { method: 'access' },
-  { method: 'accessSync' },
-  { method: 'appendFile' },
-  { method: 'appendFileSync' },
-  { method: 'chmod' },
-  { method: 'chmodSync' },
-  { method: 'chown' },
-  { method: 'chownSync' },
-  { method: 'copyFile', indices: [0, 1] },
-  { method: 'copyFileSync', indices: [0, 1] },
-  { method: 'createReadStream' },
-  { method: 'createWriteStream' },
-  { method: 'lchmod' },
-  { method: 'lchmodSync' },
-  { method: 'lchown' },
-  { method: 'lchownSync' },
-  { method: 'mkdir' },
-  { method: 'mkdirSync' },
-  { method: 'open' },
-  { method: 'openSync' },
-  { method: 'readFile' },
-  { method: 'readFileSync' },
-  { method: 'readdir' },
-  { method: 'readdirSync' },
-  { method: 'readlink' },
-  { method: 'readlinkSync' },
-  { method: 'rename', indices: [0, 1] },
-  { method: 'renameSync', indices: [0, 1] },
-  { method: 'rmdir' },
-  { method: 'rmdirSync' },
-  { method: 'symlink', indices: [0, 1] },
-  { method: 'symlinkSync', indices: [0, 1] },
-  { method: 'truncate' },
-  { method: 'truncateSync' },
-  { method: 'unlink' },
-  { method: 'unlinkSync' },
-  { method: 'writeFile' },
-  { method: 'writeFileSync' },
-];
-
-module.exports = function(core) {
-  const {
-    scopes: { instrumentation },
-    patcher,
-    depHooks,
-    protect,
-    protect: { inputTracing }
-  } = core;
-
-  function getValues(indices, args) {
-    return indices.reduce((acc, idx) => {
-      const value = args[idx];
-      if (value && isString(value)) acc.push(value);
-      return acc;
-    }, []);
-  }
-
-  function install() {
-    depHooks.resolve({ name: 'fs' }, fs => {
-      fsMethods.forEach(({ method, indices = [0] }) => {
-        const name = `fs.${method}`;
-
-        // may not exist depending on OS
-        if (!fs[method]) return;
-
-        patcher.patch(fs, method, {
-          name,
-          patchType,
-          pre({ args, hooked, name, orig }) {
-            // don't proceed if instrumentation is off e.g. within require() call
-            if (instrumentation.isLocked()) return;
-
-            // obtain the Protect sourceContext
-            const sourceContext = protect.getSourceContext('fs');
-
-            if (!sourceContext) return;
-
-            // build list of values on which to perform INPUT TRACING
-            const values = getValues(indices, args);
-            if (!values.length) return;
-
-            // while we need to check whether instrumentation is locked above, we
-            // don't need to necessarily need to lock it here - there are no
-            // lower-level calls that we instrument
-            for (const value of values) {
-              const sinkContext = {
-                name,
-                value,
-                stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
-              };
-              inputTracing.handlePathTraversal(sourceContext, sinkContext);
-              core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(sourceContext, sinkContext);
+function getValues(indices, args) {
+  return indices.reduce((acc, idx) => {
+    const value = args[idx];
+    if (value && isString(value)) acc.push(value);
+    return acc;
+  }, []);
+}
+
+module.exports = function init(core) {
+  const { depHooks, patcher } = core;
+
+  const preHook = (indices) => ({ args, hooked, name, orig }) => {
+    // don't proceed if instrumentation is off e.g. within require() call
+    if (core.scopes.instrumentation.isLocked()) return;
+
+    // obtain the Protect sourceContext
+    const sourceContext = core.protect.getSourceContext('fs');
+
+    if (!sourceContext) return;
+
+    // build list of values on which to perform INPUT TRACING
+    const values = getValues(indices, args);
+    if (!values.length) return;
+
+    // while we need to check whether instrumentation is locked above, we
+    // don't need to necessarily need to lock it here - there are no
+    // lower-level calls that we instrument
+    for (const value of values) {
+      const sinkContext = {
+        name,
+        value,
+        stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
+      };
+
+      core.protect.inputTracing.handlePathTraversal(
+        sourceContext,
+        sinkContext
+      );
+      core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(
+        sourceContext,
+        sinkContext,
+      );
+    }
+  };
+
+  return core.protect.inputTracing.fsInstrumentation = {
+    install() {
+      depHooks.resolve({ name: 'fs' }, (fs) => {
+        for (const method of FS_METHODS) {
+          // not all methods are available on every OS or Node version.
+          if (fs[method.name]) {
+            patcher.patch(fs, method.name, {
+              name: `fs.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+
+          if (method.sync) {
+            const syncName = `${method.name}Sync`;
+            if (fs[syncName]) {
+              patcher.patch(fs, syncName, {
+                name: `fs.${syncName}`,
+                patchType,
+                pre: preHook(method.indices)
+              });
             }
           }
-        });
+
+          if (method.promises && fs.promises && fs.promises[method.name]) {
+            patcher.patch(fs.promises, method.name, {
+              name: `fs.promises.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+        }
       });
-    });
-  }
 
-  const fsInstrumentation = inputTracing.fsInstrumentation = {
-    getValues,
-    install,
+      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+        for (const method of FS_METHODS) {
+          if (method.promises && fsPromises[method.name]) {
+            patcher.patch(fsPromises, method.name, {
+              name: `fsPromises.${method.name}`,
+              patchType,
+              pre: preHook(method.indices)
+            });
+          }
+        }
+      });
+    }
   };
-
-  return fsInstrumentation;
 };
 
-module.exports.fsMethods = fsMethods;
+module.exports.FS_METHODS = FS_METHODS;

package/lib/input-tracing/install/mongodb.js

@@ -26,7 +26,7 @@ module.exports = function (core) {
 
   function getCursorQueryData(args, version) {
     const query = semver.gte(version, '3.3.0')
-      ? args[0]?.cmd?.query
+      ? args[0]?.cmd?.query || args[1]?.query
       : args[1]?.query;
 
     if (!query) {
@@ -67,12 +67,12 @@ module.exports = function (core) {
     inputTracing.nosqlInjectionMongo(sourceContext, sinkContext);
   }
 
-  function v4CollectionVal({ args, ...ctx }) {
+  function CollectionVal({ args, ...ctx }) {
     const value = typeof args[0] == 'function' ? null : args[0];
     preHook(value, ctx);
   }
 
-  function v4DbVal({ args, ...ctx }) {
+  function dbCommandVal({ args, ...ctx }) {
     const value = args[0]?.filter;
     preHook(value, ctx);
   }
@@ -87,7 +87,7 @@ module.exports = function (core) {
     preHook(value, ctx);
   }
 
-  function v3DbVal({ args, ...ctx }) {
+  function firstArgVal({ args, ...ctx }) {
     const value = args[0];
     preHook(value, ctx);
   }
@@ -106,16 +106,19 @@ module.exports = function (core) {
     [
       {
         moduleName,
-        version: '>=4.0.0',
+        version: '>=2.0.0 <3.0.0 || >=4.0.0',
         patchObjects: [
           {
             name: 'Collection.prototype',
             methods: [
+              'update',
               'updateOne',
               'replaceOne',
               'updateMany',
+              'remove',
               'deleteOne',
               'deleteMany',
+              'findAndModify',
               'findOneAndDelete',
               'findOneAndReplace',
               'findOneAndUpdate',
@@ -125,13 +128,13 @@ module.exports = function (core) {
               'aggregate'
             ],
             patchType,
-            preHookFn: v4CollectionVal
+            preHookFn: CollectionVal
           },
           {
             name: 'Db.prototype',
             methods: ['command'],
             patchType,
-            preHookFn: v4DbVal
+            preHookFn: dbCommandVal
           }
         ]
       },
@@ -157,18 +160,30 @@ module.exports = function (core) {
             patchType,
             preHookFn: v3CursorVal
           },
+          {
+            name: 'Db.prototype',
+            methods: ['command'],
+            patchType,
+            preHookFn: dbCommandVal
+          },
           {
             name: 'Db.prototype',
             methods: ['eval'],
             patchType,
-            preHookFn: v3DbVal
-          }
+            preHookFn: firstArgVal
+          },
+          {
+            name: 'Collection.prototype',
+            methods: ['find'],
+            patchType,
+            preHookFn: firstArgVal
+          },
         ]
       },
       {
         moduleName,
         file: 'lib/topologies/topology_base.js',
-        version: '<4.0.0',
+        version: '<4.0.0 >=3.0.0',
         patchObjects: [
           {
             name: 'TopologyBase.prototype',
@@ -187,7 +202,7 @@ module.exports = function (core) {
       {
         moduleName,
         file: 'lib/topologies/native_topology.js',
-        version: '<4.0.0',
+        version: '<4.0.0 >=3.0.0',
         patchObjects: [
           {
             name: 'NativeTopology.prototype',
@@ -204,7 +219,7 @@ module.exports = function (core) {
             preHookFn: v3CursorVal
           }
         ]
-      }
+      },
     ].forEach(({ moduleName, file, version, patchObjects }) => {
       instrument({
         moduleName,

package/lib/make-source-context.js

@@ -44,7 +44,7 @@ module.exports = function(core) {
     const policy = getPolicy({ uriPath });
 
     // URL exclusions can disable all rules
-    if (!policy) {
+    if (!policy || policy.rulesMask === 0) {
       return { allowed: true };
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.17.0",
+  "version": "1.19.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,11 +17,11 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent-lib": "^5.3.4",
-    "@contrast/common": "1.8.0",
-    "@contrast/core": "1.15.0",
-    "@contrast/esm-hooks": "1.11.0",
-    "@contrast/scopes": "1.3.0",
+    "@contrast/agent-lib": "^7.0.1",
+    "@contrast/common": "1.10.0",
+    "@contrast/core": "1.17.0",
+    "@contrast/esm-hooks": "1.13.0",
+    "@contrast/scopes": "1.4.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"
   },