@contrast/protect 1.2.1 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/error-handlers/constants.js +15 -0
- package/lib/error-handlers/index.js +17 -0
- package/lib/error-handlers/install/express4.js +89 -0
- package/lib/error-handlers/install/fastify3.js +17 -4
- package/lib/error-handlers/install/koa2.js +16 -2
- package/lib/esm-loader.mjs +15 -0
- package/lib/get-source-context.js +33 -0
- package/lib/hardening/constants.js +20 -0
- package/lib/hardening/handlers.js +65 -0
- package/lib/hardening/index.js +29 -0
- package/lib/hardening/install/node-serialize0.js +59 -0
- package/lib/index.d.ts +127 -19
- package/lib/index.js +19 -0
- package/lib/input-analysis/constants.js +20 -0
- package/lib/input-analysis/handlers.js +201 -16
- package/lib/input-analysis/index.js +40 -3
- package/lib/input-analysis/install/body-parser1.js +122 -0
- package/lib/input-analysis/install/cookie-parser1.js +80 -0
- package/lib/input-analysis/install/express4.js +103 -0
- package/lib/input-analysis/install/fastify3.js +51 -24
- package/lib/input-analysis/install/formidable1.js +72 -0
- package/lib/input-analysis/install/http.js +30 -4
- package/lib/input-analysis/install/koa-body5.js +63 -0
- package/lib/input-analysis/install/koa-bodyparser4.js +64 -0
- package/lib/input-analysis/install/koa2.js +38 -48
- package/lib/input-analysis/install/multer1.js +88 -0
- package/lib/input-analysis/install/qs6.js +57 -0
- package/lib/input-analysis/install/universal-cookie4.js +52 -0
- package/lib/input-analysis/ip-analysis.js +76 -0
- package/lib/input-analysis/virtual-patches.js +109 -0
- package/lib/input-tracing/constants.js +15 -0
- package/lib/input-tracing/handlers/index.js +225 -66
- package/lib/input-tracing/index.js +25 -2
- package/lib/input-tracing/install/child-process.js +28 -7
- package/lib/input-tracing/install/eval.js +60 -0
- package/lib/input-tracing/install/fs.js +21 -4
- package/lib/input-tracing/install/http.js +63 -0
- package/lib/input-tracing/install/mongodb.js +233 -0
- package/lib/input-tracing/install/mysql.js +21 -4
- package/lib/input-tracing/install/postgres.js +20 -4
- package/lib/input-tracing/install/sequelize.js +22 -5
- package/lib/input-tracing/install/sqlite3.js +21 -4
- package/lib/input-tracing/install/vm.js +132 -0
- package/lib/make-response-blocker.js +15 -0
- package/lib/make-source-context.js +22 -1
- package/lib/security-exception.js +15 -0
- package/lib/semantic-analysis/handlers.js +160 -0
- package/lib/semantic-analysis/index.js +38 -0
- package/lib/throw-security-exception.js +17 -6
- package/package.json +10 -12
- package/lib/cli-rewriter.js +0 -20
- package/lib/input-analysis/install/co-body.js +0 -51
- package/lib/input-analysis/install/cookie-parser.js +0 -48
- package/lib/input-analysis/install/formidable.js +0 -53
- package/lib/input-analysis/install/multer.js +0 -52
- package/lib/input-analysis/install/qs.js +0 -40
- package/lib/input-analysis/install/universal-cookie.js +0 -34
- package/lib/input-tracing/handlers/nosql-injection-mongo.js +0 -48
- package/lib/utils.js +0 -88
package/lib/utils.js
DELETED
|
@@ -1,88 +0,0 @@
|
|
|
1
|
-
'use strict';
|
|
2
|
-
|
|
3
|
-
/**
|
|
4
|
-
* Get a symbol parameter value on the given object. The function should be
|
|
5
|
-
* used with a `target` for which we are sure that the Symbol property we need is set before
|
|
6
|
-
* any eventual duplicating Symbol properties. In case of duplicating Symbol properties
|
|
7
|
-
* we will always get the one that's set first.
|
|
8
|
-
* @param {Object} target built outgoing response
|
|
9
|
-
* @param {String} symbolName full symbol stringified
|
|
10
|
-
* @returns {Object} value of the requested symbol property
|
|
11
|
-
*/
|
|
12
|
-
function getSymbolProperty(target, symbolName) {
|
|
13
|
-
if (!target) return;
|
|
14
|
-
for (const sym of Object.getOwnPropertySymbols(target)) {
|
|
15
|
-
if (sym.toString() === `Symbol(${symbolName})`) {
|
|
16
|
-
return target[sym];
|
|
17
|
-
}
|
|
18
|
-
}
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
/**
|
|
22
|
-
* simpleTraverse() walks an object and calls a user function for each key
|
|
23
|
-
* and string value. It is a "simple traverse" in that it
|
|
24
|
-
* 1) doesn't make value callbacks unless the value is a non-empty string
|
|
25
|
-
* 2) it only recognizes items that can be expressed in JSON, i.e., POJO
|
|
26
|
-
* and arrays.
|
|
27
|
-
* 3) it doesn't make callbacks for array indexes (though they appear in
|
|
28
|
-
* the path). array indexes are always numeric and are not a threat.
|
|
29
|
-
*
|
|
30
|
-
* N.B. the path array that is passed to the callback is a dynamic path; new
|
|
31
|
-
* keys are pushed and popped onto the path as simpleTraverse() walks the
|
|
32
|
-
* object. in order to capture the path at the time of the callback, the
|
|
33
|
-
* callback must copy the array, e.g., `path.slice()`, in order to "freeze"
|
|
34
|
-
* it at the time of the callback. the reason for this is that most keys/values
|
|
35
|
-
* are not going to be of interest, and there is no reason to create a new array
|
|
36
|
-
* unless the key/value is of interest.
|
|
37
|
-
*
|
|
38
|
-
* @param {Object} obj the object to traverse
|
|
39
|
-
* @param {Function} cb(path, type, value) is called for each non-array-index key
|
|
40
|
-
* and string value. It is not called for non-string or empty-string Values.
|
|
41
|
-
* path {[String]} the path prior to the 'Key' or 'Value'; includes array indexes.
|
|
42
|
-
* type {String} 'Key' or 'Value'
|
|
43
|
-
* value {String} the Key or Leaf string
|
|
44
|
-
*
|
|
45
|
-
*/
|
|
46
|
-
function simpleTraverse(obj, cb) {
|
|
47
|
-
if (typeof obj !== 'object' || obj === null) {
|
|
48
|
-
return;
|
|
49
|
-
}
|
|
50
|
-
const path = [];
|
|
51
|
-
/* eslint-disable complexity */
|
|
52
|
-
function traverse(obj) {
|
|
53
|
-
const isArray = Array.isArray(obj);
|
|
54
|
-
for (const k in obj) {
|
|
55
|
-
if (isArray) {
|
|
56
|
-
// if it is an array, store each index in path but don't call the
|
|
57
|
-
// callback on the index itself as they are just numeric strings.
|
|
58
|
-
path.push(k);
|
|
59
|
-
if (typeof obj[k] === 'object' && obj[k] !== null) {
|
|
60
|
-
traverse(obj[k]);
|
|
61
|
-
} else if (typeof obj[k] === 'string' && obj[k]) {
|
|
62
|
-
cb(path, 'Value', obj[k]);
|
|
63
|
-
}
|
|
64
|
-
path.pop();
|
|
65
|
-
} else if (typeof obj[k] === 'object' && obj[k] !== null) {
|
|
66
|
-
cb(path, 'Key', k);
|
|
67
|
-
path.push(k);
|
|
68
|
-
traverse(obj[k]);
|
|
69
|
-
path.pop();
|
|
70
|
-
} else {
|
|
71
|
-
cb(path, 'Key', k);
|
|
72
|
-
// only callback if the value is a non-empty string
|
|
73
|
-
if (typeof obj[k] === 'string' && obj[k]) {
|
|
74
|
-
path.push(k);
|
|
75
|
-
cb(path, 'Value', obj[k]);
|
|
76
|
-
path.pop();
|
|
77
|
-
}
|
|
78
|
-
}
|
|
79
|
-
}
|
|
80
|
-
}
|
|
81
|
-
|
|
82
|
-
traverse(obj);
|
|
83
|
-
}
|
|
84
|
-
|
|
85
|
-
module.exports = {
|
|
86
|
-
getSymbolProperty,
|
|
87
|
-
simpleTraverse,
|
|
88
|
-
};
|