@contrast/protect 1.2.1 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. package/lib/error-handlers/constants.js +15 -0
  2. package/lib/error-handlers/index.js +17 -0
  3. package/lib/error-handlers/install/express4.js +89 -0
  4. package/lib/error-handlers/install/fastify3.js +17 -4
  5. package/lib/error-handlers/install/koa2.js +16 -2
  6. package/lib/esm-loader.mjs +15 -0
  7. package/lib/get-source-context.js +33 -0
  8. package/lib/hardening/constants.js +20 -0
  9. package/lib/hardening/handlers.js +65 -0
  10. package/lib/hardening/index.js +29 -0
  11. package/lib/hardening/install/node-serialize0.js +59 -0
  12. package/lib/index.d.ts +127 -19
  13. package/lib/index.js +19 -0
  14. package/lib/input-analysis/constants.js +20 -0
  15. package/lib/input-analysis/handlers.js +201 -16
  16. package/lib/input-analysis/index.js +40 -3
  17. package/lib/input-analysis/install/body-parser1.js +122 -0
  18. package/lib/input-analysis/install/cookie-parser1.js +80 -0
  19. package/lib/input-analysis/install/express4.js +103 -0
  20. package/lib/input-analysis/install/fastify3.js +51 -24
  21. package/lib/input-analysis/install/formidable1.js +72 -0
  22. package/lib/input-analysis/install/http.js +30 -4
  23. package/lib/input-analysis/install/koa-body5.js +63 -0
  24. package/lib/input-analysis/install/koa-bodyparser4.js +64 -0
  25. package/lib/input-analysis/install/koa2.js +38 -48
  26. package/lib/input-analysis/install/multer1.js +88 -0
  27. package/lib/input-analysis/install/qs6.js +57 -0
  28. package/lib/input-analysis/install/universal-cookie4.js +52 -0
  29. package/lib/input-analysis/ip-analysis.js +76 -0
  30. package/lib/input-analysis/virtual-patches.js +109 -0
  31. package/lib/input-tracing/constants.js +15 -0
  32. package/lib/input-tracing/handlers/index.js +225 -66
  33. package/lib/input-tracing/index.js +25 -2
  34. package/lib/input-tracing/install/child-process.js +28 -7
  35. package/lib/input-tracing/install/eval.js +60 -0
  36. package/lib/input-tracing/install/fs.js +21 -4
  37. package/lib/input-tracing/install/http.js +63 -0
  38. package/lib/input-tracing/install/mongodb.js +233 -0
  39. package/lib/input-tracing/install/mysql.js +21 -4
  40. package/lib/input-tracing/install/postgres.js +20 -4
  41. package/lib/input-tracing/install/sequelize.js +22 -5
  42. package/lib/input-tracing/install/sqlite3.js +21 -4
  43. package/lib/input-tracing/install/vm.js +132 -0
  44. package/lib/make-response-blocker.js +15 -0
  45. package/lib/make-source-context.js +22 -1
  46. package/lib/security-exception.js +15 -0
  47. package/lib/semantic-analysis/handlers.js +160 -0
  48. package/lib/semantic-analysis/index.js +38 -0
  49. package/lib/throw-security-exception.js +17 -6
  50. package/package.json +10 -12
  51. package/lib/cli-rewriter.js +0 -20
  52. package/lib/input-analysis/install/co-body.js +0 -51
  53. package/lib/input-analysis/install/cookie-parser.js +0 -48
  54. package/lib/input-analysis/install/formidable.js +0 -53
  55. package/lib/input-analysis/install/multer.js +0 -52
  56. package/lib/input-analysis/install/qs.js +0 -40
  57. package/lib/input-analysis/install/universal-cookie.js +0 -34
  58. package/lib/input-tracing/handlers/nosql-injection-mongo.js +0 -48
  59. package/lib/utils.js +0 -88
package/lib/utils.js DELETED
@@ -1,88 +0,0 @@
1
- 'use strict';
2
-
3
- /**
4
- * Get a symbol parameter value on the given object. The function should be
5
- * used with a `target` for which we are sure that the Symbol property we need is set before
6
- * any eventual duplicating Symbol properties. In case of duplicating Symbol properties
7
- * we will always get the one that's set first.
8
- * @param {Object} target built outgoing response
9
- * @param {String} symbolName full symbol stringified
10
- * @returns {Object} value of the requested symbol property
11
- */
12
- function getSymbolProperty(target, symbolName) {
13
- if (!target) return;
14
- for (const sym of Object.getOwnPropertySymbols(target)) {
15
- if (sym.toString() === `Symbol(${symbolName})`) {
16
- return target[sym];
17
- }
18
- }
19
- }
20
-
21
- /**
22
- * simpleTraverse() walks an object and calls a user function for each key
23
- * and string value. It is a "simple traverse" in that it
24
- * 1) doesn't make value callbacks unless the value is a non-empty string
25
- * 2) it only recognizes items that can be expressed in JSON, i.e., POJO
26
- * and arrays.
27
- * 3) it doesn't make callbacks for array indexes (though they appear in
28
- * the path). array indexes are always numeric and are not a threat.
29
- *
30
- * N.B. the path array that is passed to the callback is a dynamic path; new
31
- * keys are pushed and popped onto the path as simpleTraverse() walks the
32
- * object. in order to capture the path at the time of the callback, the
33
- * callback must copy the array, e.g., `path.slice()`, in order to "freeze"
34
- * it at the time of the callback. the reason for this is that most keys/values
35
- * are not going to be of interest, and there is no reason to create a new array
36
- * unless the key/value is of interest.
37
- *
38
- * @param {Object} obj the object to traverse
39
- * @param {Function} cb(path, type, value) is called for each non-array-index key
40
- * and string value. It is not called for non-string or empty-string Values.
41
- * path {[String]} the path prior to the 'Key' or 'Value'; includes array indexes.
42
- * type {String} 'Key' or 'Value'
43
- * value {String} the Key or Leaf string
44
- *
45
- */
46
- function simpleTraverse(obj, cb) {
47
- if (typeof obj !== 'object' || obj === null) {
48
- return;
49
- }
50
- const path = [];
51
- /* eslint-disable complexity */
52
- function traverse(obj) {
53
- const isArray = Array.isArray(obj);
54
- for (const k in obj) {
55
- if (isArray) {
56
- // if it is an array, store each index in path but don't call the
57
- // callback on the index itself as they are just numeric strings.
58
- path.push(k);
59
- if (typeof obj[k] === 'object' && obj[k] !== null) {
60
- traverse(obj[k]);
61
- } else if (typeof obj[k] === 'string' && obj[k]) {
62
- cb(path, 'Value', obj[k]);
63
- }
64
- path.pop();
65
- } else if (typeof obj[k] === 'object' && obj[k] !== null) {
66
- cb(path, 'Key', k);
67
- path.push(k);
68
- traverse(obj[k]);
69
- path.pop();
70
- } else {
71
- cb(path, 'Key', k);
72
- // only callback if the value is a non-empty string
73
- if (typeof obj[k] === 'string' && obj[k]) {
74
- path.push(k);
75
- cb(path, 'Value', obj[k]);
76
- path.pop();
77
- }
78
- }
79
- }
80
- }
81
-
82
- traverse(obj);
83
- }
84
-
85
- module.exports = {
86
- getSymbolProperty,
87
- simpleTraverse,
88
- };