@contrast/protect 1.18.0 → 1.20.0

package/lib/input-analysis/handlers.js

@@ -692,7 +692,7 @@ module.exports = function(core) {
           key: type === 'Key' ? value : path[path.length - 1],
           value,
           score: item.score,
-          idsList: [],
+          idsList: item.idsList || [],
         };
         if (item.mongoContext) {
           result.mongoContext = item.mongoContext;

package/lib/input-tracing/handlers/index.js

@@ -22,6 +22,7 @@ const {
   isString,
   traverseKeys,
   traverseKeysAndValues,
+  agentLibIDListTypes
 } = require('@contrast/common');
 
 module.exports = function(core) {
@@ -127,10 +128,30 @@ module.exports = function(core) {
     }
   };
 
-  inputTracing.nosqlInjectionMongo = function(sourceContext, sinkContext) {
+  inputTracing.nosqlInjectionMongo = function (sourceContext, sinkContext) {
     const ruleId = 'nosql-injection-mongo';
-    const expansionResults = getResultsByRuleId(ruleId, sourceContext);
-    const stringInjectionResults = getResultsByRuleId('ssjs-injection', sourceContext);
+    const nosqlInjectionMongoResults =
+      getResultsByRuleId(ruleId, sourceContext) || [];
+    const ssjsInjectionResults =
+      getResultsByRuleId('ssjs-injection', sourceContext) || [];
+
+    const stringInjectionResults = [...ssjsInjectionResults];
+    const expansionResults = [];
+
+    nosqlInjectionMongoResults.forEach((result) => {
+      if (
+        result.idsList &&
+        result.idsList.some(
+          (el) =>
+            el === agentLibIDListTypes.MONGO_SLEEP ||
+            el === agentLibIDListTypes.TRUE_CLAUSE_1
+        )
+      ) {
+        stringInjectionResults.push(result);
+      } else {
+        expansionResults.push(result);
+      }
+    });
 
     if (expansionResults) {
       let expansionFindings = null;
@@ -138,7 +159,13 @@ module.exports = function(core) {
         expansionFindings = handleObjectValue(result, sinkContext.value);
 
         if (expansionFindings) {
-          handleFindings(sourceContext, sinkContext, ruleId, result, expansionFindings);
+          handleFindings(
+            sourceContext,
+            sinkContext,
+            ruleId,
+            result,
+            expansionFindings
+          );
         }
       }
     }
@@ -148,30 +175,44 @@ module.exports = function(core) {
 
       for (const result of stringInjectionResults) {
         if (typeof sinkContext.value === 'object') {
-          traverseKeysAndValues(sinkContext.value, function(path, type, value, obj) {
-            if (type !== 'Key' && !agentLib.isMongoQueryType(value)) return;
-
-            if (!stringFindings && type == 'Key' && value == '$accumulator') {
-              stringFindings =
-                handleStringValue(result, obj[value]?.['init'], agentLib) ||
-                handleStringValue(result, obj[value]?.['merge'], agentLib) ||
-                handleStringValue(result, obj[value]?.['finalize'], agentLib) ||
-                handleStringValue(result, obj[value]?.['accumulate'], agentLib);
-            }
-
-            if (!stringFindings && type == 'Key' && value == '$function') {
-              stringFindings =
-                handleStringValue(result, obj['$function']?.body, agentLib);
-            }
-
-            if (!stringFindings) {
-              stringFindings = handleStringValue(result, obj[value], agentLib);
+          traverseKeysAndValues(
+            sinkContext.value,
+            function (path, type, value, obj) {
+              if (type !== 'Key' && !agentLib.isMongoQueryType(value)) return;
+
+              if (!stringFindings && type == 'Key' && value == '$accumulator') {
+                stringFindings =
+                  handleStringValue(result, obj[value]?.init, agentLib) ||
+                  handleStringValue(result, obj[value]?.merge, agentLib) ||
+                  handleStringValue(result, obj[value]?.finalize, agentLib) ||
+                  handleStringValue(result, obj[value]?.accumulate, agentLib);
+              }
+
+              if (!stringFindings && type == 'Key' && value == '$function') {
+                stringFindings = handleStringValue(
+                  result,
+                  obj['$function']?.body,
+                  agentLib
+                );
+              }
+
+              if (!stringFindings) {
+                stringFindings = handleStringValue(
+                  result,
+                  obj[value],
+                  agentLib
+                );
+              }
+
+              if (stringFindings) return true;
             }
-
-            if (stringFindings) return true;
-          });
+          );
         } else if (typeof sinkContext.value === 'string') {
-          stringFindings = handleStringValue(result, sinkContext.value, agentLib);
+          stringFindings = handleStringValue(
+            result,
+            sinkContext.value,
+            agentLib
+          );
         }
 
         if (stringFindings) {
@@ -184,7 +225,13 @@ module.exports = function(core) {
             sourceContext.resultsMap[ruleId] = [nosqlInjectionResult];
           }
 
-          handleFindings(sourceContext, sinkContext, ruleId, nosqlInjectionResult, stringFindings);
+          handleFindings(
+            sourceContext,
+            sinkContext,
+            ruleId,
+            nosqlInjectionResult,
+            stringFindings
+          );
         }
       }
     }

package/lib/input-tracing/install/mongodb.js

@@ -26,7 +26,7 @@ module.exports = function (core) {
 
   function getCursorQueryData(args, version) {
     const query = semver.gte(version, '3.3.0')
-      ? args[0]?.cmd?.query
+      ? args[0]?.cmd?.query || args[1]?.query
       : args[1]?.query;
 
     if (!query) {
@@ -67,12 +67,12 @@ module.exports = function (core) {
     inputTracing.nosqlInjectionMongo(sourceContext, sinkContext);
   }
 
-  function v4CollectionVal({ args, ...ctx }) {
+  function CollectionVal({ args, ...ctx }) {
     const value = typeof args[0] == 'function' ? null : args[0];
     preHook(value, ctx);
   }
 
-  function v4DbVal({ args, ...ctx }) {
+  function dbCommandVal({ args, ...ctx }) {
     const value = args[0]?.filter;
     preHook(value, ctx);
   }
@@ -87,7 +87,7 @@ module.exports = function (core) {
     preHook(value, ctx);
   }
 
-  function v3DbVal({ args, ...ctx }) {
+  function firstArgVal({ args, ...ctx }) {
     const value = args[0];
     preHook(value, ctx);
   }
@@ -106,16 +106,19 @@ module.exports = function (core) {
     [
       {
         moduleName,
-        version: '>=4.0.0',
+        version: '>=2.0.0 <3.0.0 || >=4.0.0',
         patchObjects: [
           {
             name: 'Collection.prototype',
             methods: [
+              'update',
               'updateOne',
               'replaceOne',
               'updateMany',
+              'remove',
               'deleteOne',
               'deleteMany',
+              'findAndModify',
               'findOneAndDelete',
               'findOneAndReplace',
               'findOneAndUpdate',
@@ -125,13 +128,13 @@ module.exports = function (core) {
               'aggregate'
             ],
             patchType,
-            preHookFn: v4CollectionVal
+            preHookFn: CollectionVal
           },
           {
             name: 'Db.prototype',
             methods: ['command'],
             patchType,
-            preHookFn: v4DbVal
+            preHookFn: dbCommandVal
           }
         ]
       },
@@ -157,18 +160,30 @@ module.exports = function (core) {
             patchType,
             preHookFn: v3CursorVal
           },
+          {
+            name: 'Db.prototype',
+            methods: ['command'],
+            patchType,
+            preHookFn: dbCommandVal
+          },
           {
             name: 'Db.prototype',
             methods: ['eval'],
             patchType,
-            preHookFn: v3DbVal
-          }
+            preHookFn: firstArgVal
+          },
+          {
+            name: 'Collection.prototype',
+            methods: ['find'],
+            patchType,
+            preHookFn: firstArgVal
+          },
         ]
       },
       {
         moduleName,
         file: 'lib/topologies/topology_base.js',
-        version: '<4.0.0',
+        version: '<4.0.0 >=3.0.0',
         patchObjects: [
           {
             name: 'TopologyBase.prototype',
@@ -187,7 +202,7 @@ module.exports = function (core) {
       {
         moduleName,
         file: 'lib/topologies/native_topology.js',
-        version: '<4.0.0',
+        version: '<4.0.0 >=3.0.0',
         patchObjects: [
           {
             name: 'NativeTopology.prototype',
@@ -204,7 +219,7 @@ module.exports = function (core) {
             preHookFn: v3CursorVal
           }
         ]
-      }
+      },
     ].forEach(({ moduleName, file, version, patchObjects }) => {
       instrument({
         moduleName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,11 +17,11 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent-lib": "^5.3.4",
-    "@contrast/common": "1.9.0",
-    "@contrast/core": "1.16.0",
-    "@contrast/esm-hooks": "1.12.0",
-    "@contrast/scopes": "1.3.0",
+    "@contrast/agent-lib": "^7.0.1",
+    "@contrast/common": "1.11.0",
+    "@contrast/core": "1.18.0",
+    "@contrast/esm-hooks": "1.14.0",
+    "@contrast/scopes": "1.4.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"
   },