@contrast/protect 1.20.0 → 1.21.0

package/lib/semantic-analysis/install/libxmljs.js

@@ -19,64 +19,72 @@ const { isString } = require('@contrast/common');
 const SecurityException = require('../../security-exception');
 const { patchType } = require('../constants');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     depHooks,
     patcher,
     logger,
-    protect: { semanticAnalysis },
     protect,
   } = core;
 
-  function install() {
-    depHooks.resolve({ name: 'libxmljs' }, hookLibXml);
-    // libxmljs2 is a fork of libxml that has identical signatures.
-    // the only difference is that libxmljs2 is used by juice-shop and thus
-    // we're missing sinks in one of our most important sample apps.
-    depHooks.resolve({ name: 'libxmljs2' }, hookLibXml);
-  }
+  /**
+   * @param {boolean} newApi
+   */
+  const handler = (newApi) => (mod, metadata) => {
+    const checkOptions = newApi
+      ? (opts) => !opts?.noent && !opts?.replaceEntities
+      : (opts) => !opts?.noent;
 
-  function hookLibXml(libxmljs) {
-    patcher.patch(libxmljs, 'parseXmlString', {
-      name: 'libxmljs.parseXmlString',
-      patchType,
-      pre: preParseXmlMethod
-    });
+    const methods = newApi
+      ? ['parseXml', 'parseXmlAsync']
+      : ['parseXml', 'parseXmlString'];
 
-    patcher.patch(libxmljs, 'parseXml', {
-      name: 'libxmljs.parseXml',
-      patchType,
-      pre: preParseXmlMethod
-    });
-  }
+    methods.forEach((method) => {
+      const name = `${metadata.name}:${method}`;
+      patcher.patch(mod, method, {
+        name,
+        patchType,
+        pre({ args, hooked, orig }) {
+          const sourceContext = protect.getSourceContext(name);
+          const [value, options] = args;
 
-  function preParseXmlMethod({ args, hooked, orig }) {
-    const sourceContext = protect.getSourceContext('libxmljs.parseXmlString');
-    const value = args[0];
+          if (!sourceContext || !value || !isString(value) || checkOptions(options)) {
+            return;
+          }
 
-    // If noent isn't set to true than libxml won't load
-    // external entities, so this isn't vulnerable
-    // see: https://help.semmle.com/wiki/display/JS/XML+external+entity+expansion
-    if (!sourceContext || !value || !isString(value) || !args[1].noent) return;
+          const sinkContext = {
+            name,
+            value,
+            stacktraceOpts: {
+              constructorOpt: hooked,
+              prependFrames: [orig]
+            },
+          };
 
-    const sinkContext = {
-      name: 'libxmljs.parseXmlString',
-      value,
-      stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
-    };
+          try {
+            protect.semanticAnalysis.handleXXE(sourceContext, sinkContext);
+          } catch (err) {
+            if (SecurityException.isSecurityException(err)) {
+              throw err;
+            }
 
-    try {
-      semanticAnalysis.handleXXE(sourceContext, sinkContext);
-    } catch (err) {
-      if (SecurityException.isSecurityException(err)) {
-        throw err;
-      }
+            logger.error({ err }, 'Unexpected error during semantic analysis');
+          }
+        }
+      });
+    });
+  };
 
-      logger.error({ err }, 'Unexpected error during semantic analysis');
-    }
-  }
+  protect.semanticAnalysis.libxmljs = {
+    install() {
+      // libxmljs changed its API in version 1.0.0
+      depHooks.resolve({ name: 'libxmljs', version: '>=1' }, handler(true));
 
-  const libxmljs = semanticAnalysis.libxmljs = { install };
+      // libxmljs versions prior to 1.0.0 and libxmljs2 share the same API
+      depHooks.resolve({ name: 'libxmljs', version: '<1' }, handler(false));
+      depHooks.resolve({ name: 'libxmljs2' }, handler(false));
+    }
+  };
 
-  return libxmljs;
+  return protect.semanticAnalysis.libxmljs;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,9 +18,9 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^7.0.1",
-    "@contrast/common": "1.11.0",
-    "@contrast/core": "1.18.0",
-    "@contrast/esm-hooks": "1.14.0",
+    "@contrast/common": "1.12.0",
+    "@contrast/core": "1.19.0",
+    "@contrast/esm-hooks": "1.15.0",
     "@contrast/scopes": "1.4.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"