@contrast/protect 1.28.1 → 1.30.0

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright: 2023 Contrast Security, Inc
+Copyright: 2024 Contrast Security, Inc
 Contact: support@contrastsecurity.com
 License: Commercial
 

package/lib/error-handlers/common-handler.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/init-domain.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/install/express4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -43,7 +43,7 @@ module.exports = function (core) {
       }
 
       if (!sourceContext && isSecurityException) {
-        logger.info('source context not found; unable to handle response');
+        logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
       }
       return orig();
     };
@@ -103,7 +103,7 @@ module.exports = function (core) {
       return patcher.patch(fn, {
         name: 'express.route-handler',
         patchType,
-        around(orig) {
+        around(orig, data) {
           const ret = orig();
           if (ret && ret.catch) {
             return ret.catch((err) => {
@@ -118,7 +118,7 @@ module.exports = function (core) {
               }
 
               if (!sourceContext && isSecurityException) {
-                logger.info('source context not found; unable to handle response');
+                logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
                 return;
               }
 

package/lib/error-handlers/install/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -46,13 +46,13 @@ module.exports = function (core) {
           err.output.payload = undefined;
           data.result = err;
 
-          logger.info({ mode, ruleId }, 'Request blocked');
+          logger.info({ funcKey: data.funcKey, mode, ruleId }, 'Request blocked');
 
           return;
         }
 
         if (!sourceContext && isSecurityException) {
-          logger.info('source context not found; unable to handle response');
+          logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
         }
       }
     });

package/lib/error-handlers/install/koa2.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -32,7 +32,7 @@ module.exports = function (core) {
   koa2ErrorHandler.install = function () {
     depHooks.resolve({ name: 'koa', version: '>=2.3.0' }, (Koa) => {
       patcher.patch(Koa.prototype, 'handleRequest', {
-        name: 'Koa.Application',
+        name: 'Koa.Application.handleRequest',
         patchType,
         pre(data) {
           const [ctx] = data.args;
@@ -52,7 +52,7 @@ module.exports = function (core) {
               }
 
               if (!sourceContext && isSecurityException) {
-                logger.info('source context not found; unable to handle response');
+                logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
               }
 
               return orig();

package/lib/get-source-context.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/install/node-serialize0.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,12 +15,13 @@
 
 'use strict';
 
-const agentLib = require('@contrast/agent-lib');
+const { isMainThread } = require('node:worker_threads');
+
 const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const protect = core.protect = {
-    agentLib: module.exports.instantiateAgentLib(agentLib),
+    agentLib: module.exports.instantiateAgentLib(),
   };
 
   require('./policy')(core);
@@ -49,19 +50,69 @@ module.exports = function(core) {
 
 module.exports.instantiateAgentLib = instantiateAgentLib;
 
+// this is just enough agentLib definition for initialization to work.
+// it allows us to avoid instantiating agent-lib in the loader thread
+// until we find the issue with napi-rs/agent-lib-node-bindings.
+const skeletalAgentLib = {
+  RuleType: {
+    'unsafe-file-upload': 1,
+    'path-traversal': 2,
+    'reflected-xss': 4,
+    'sql-injection': 8,
+    'cmd-injection': 16,
+    'nosql-injection-mongo': 32,
+    'bot-blocker': 64,
+    'ssjs-injection': 128,
+    'method-tampering': 256,
+    'prototype-pollution': 512
+  },
+  InputType: {
+    CookieName: 1,
+    CookieValue: 2,
+    HeaderKey: 3,
+    HeaderValue: 4,
+    JsonKey: 5,
+    JsonValue: 6,
+    Method: 7,
+    ParameterKey: 8,
+    ParameterValue: 9,
+    UriPath: 10,
+    UrlParameter: 11,
+    MultipartName: 12,
+    XmlValue: 13,
+    RawBody: 14
+  },
+  DbType: {
+    DB2: 1,
+    MySQL: 2,
+    Oracle: 3,
+    Postgres: 4,
+    Sqlite: 5,
+    SqlServer: 6,
+    Unknown: 7
+  },
+  version: '8.2.0',
+};
 /**
  * Create an instance of agent-lib and attach the constants directly to it.
  *
  * @param {Object} lib the value returned by require('@contrast/agent-lib')
  * @returns {Object} an agent-lib instance with the constants attached to it.
  */
-function instantiateAgentLib(lib) {
-  const agentLib = new lib.Agent();
-  for (const c in lib.constants) {
-    agentLib[c] = lib.constants[c];
-  }
-  if ('version' in lib) {
-    agentLib.version = lib.version;
+function instantiateAgentLib() {
+  let agentLib;
+  if (isMainThread) {
+    const lib = require('@contrast/agent-lib');
+    agentLib = new lib.Agent();
+    for (const c in lib.constants) {
+      agentLib[c] = lib.constants[c];
+    }
+    if ('version' in lib) {
+      agentLib.version = lib.version;
+    }
+  } else {
+    agentLib = skeletalAgentLib;
   }
+
   return agentLib;
 }

package/lib/input-analysis/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -92,7 +92,7 @@ const acceptedMethods = new Set([
   'version-control',
 ]);
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     logger,
     protect: {
@@ -225,7 +225,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} urlParams pojo
    */
-  inputAnalysis.handleUrlParams = function(sourceContext, urlParams) {
+  inputAnalysis.handleUrlParams = function (sourceContext, urlParams) {
     if (sourceContext.analyzedUrlParams) return;
     sourceContext.analyzedUrlParams = true;
 
@@ -240,7 +240,7 @@ module.exports = function(core) {
     const resultsList = [];
     const { UrlParameter } = agentLib.InputType;
 
-    traverseValues(urlParams, function(path, type, value) {
+    traverseValues(urlParams, function (path, type, value) {
       // url param names are not checked.
       if (type !== 'Value') {
         return;
@@ -292,7 +292,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} cookies pojo
    */
-  inputAnalysis.handleCookies = function(sourceContext, cookies) {
+  inputAnalysis.handleCookies = function (sourceContext, cookies) {
     if (sourceContext.analyzedCookies) return;
     sourceContext.analyzedCookies = true;
 
@@ -324,7 +324,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} parsedBody
    */
-  inputAnalysis.handleParsedBody = function(sourceContext, parsedBody) {
+  inputAnalysis.handleParsedBody = function (sourceContext, parsedBody) {
     if (sourceContext.analyzedBody) return;
 
     sourceContext.analyzedBody = true;
@@ -357,7 +357,7 @@ module.exports = function(core) {
 
   // was MULTIPART_NAME but maybe we should just call it what it is. it's kind
   // of a dumb rule anyway. but maybe some code actually uses the name provided.
-  inputAnalysis.handleFileUploadName = function(sourceContext, names) {
+  inputAnalysis.handleFileUploadName = function (sourceContext, names) {
     const type = agentLib.InputType.MultipartName;
     const { policy } = sourceContext;
     const resultsList = [];
@@ -401,7 +401,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleVirtualPatches = function(sourceContext, requestInput) {
+  inputAnalysis.handleVirtualPatches = function (sourceContext, requestInput) {
     const ruleId = Rule.VIRTUAL_PATCH;
 
     if (!Object.keys(requestInput).filter(Boolean).length || !sourceContext?.virtualPatchesEvaluators.length) return;
@@ -430,7 +430,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleIpAllowlist = function(sourceContext, ipAllowlist) {
+  inputAnalysis.handleIpAllowlist = function (sourceContext, ipAllowlist) {
     if (!sourceContext || !ipAllowlist.length) return;
 
     const { ip: reqIp, headers: reqHeaders } = sourceContext.reqData;
@@ -443,7 +443,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleIpDenylist = function(sourceContext, ipDenylist) {
+  inputAnalysis.handleIpDenylist = function (sourceContext, ipDenylist) {
     const ruleId = Rule.IP_DENYLIST;
 
     if (!sourceContext || !ipDenylist.length) return;
@@ -466,7 +466,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleMethodTampering = function(sourceContext, connectInputs) {
+  inputAnalysis.handleMethodTampering = function (sourceContext, connectInputs) {
     const ruleId = Rule.METHOD_TAMPERING;
     const mode = sourceContext.policy[ruleId];
     if (mode !== OFF) {
@@ -651,7 +651,7 @@ module.exports = function(core) {
     // another day.
 
     /* eslint-disable-next-line complexity */
-    traverseKeysAndValues(object, function(path, type, value) {
+    traverseKeysAndValues(object, function (path, type, value) {
       let itemType;
       let isMongoQueryType;
       // this is a bit awkward now because nosql-injection-mongo is not integrated
@@ -745,13 +745,13 @@ module.exports = function(core) {
 
         // Ignore bad IP values.
         if (!address.isValid(currentIp)) {
-          logger.warn(`Unable to parse ${currentIp}.`);
+          logger.warn('Unable to parse %s.', currentIp);
           continue;
         }
         const expired = doesExpire ? expiresAt - now <= 0 : false;
 
         if (expired) {
-          logger.info(`IP expired: ${listEntry.name}, ${listEntry.ip}`);
+          logger.info('IP expired: %s, %s', listEntry.name, listEntry.ip);
           continue;
         }
 

package/lib/input-analysis/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/body-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/busboy1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/cookie-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -54,7 +54,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis'
+                    );
                   }
                 }
               }

package/lib/input-analysis/install/express4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -64,7 +64,10 @@ module.exports = (core) => {
                     if (isSecurityException(err)) {
                       securityException = err;
                     } else {
-                      logger.error({ err }, 'Unexpected error during input analysis');
+                      logger.error(
+                        { err, funcKey: data.funcKey },
+                        'Unexpected error during input analysis'
+                      );
                     }
                   }
                 }
@@ -93,7 +96,7 @@ module.exports = (core) => {
             // we can exit early if
             //  the layer doesn't match the request or
             //  the layer doesn't recognize any parameters
-            if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route.path === '*') {
+            if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route?.path === '*') {
               return;
             }
 

package/lib/input-analysis/install/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -39,7 +39,7 @@ module.exports = (core) => {
     depHooks.resolve({ name: 'fastify', version: '>=3 <5' }, (fastify) => patcher.patch(fastify, {
       name: 'fastify.build',
       patchType,
-      post({ result: server }) {
+      post({ result: server, funcKey }) {
         server.addHook('preValidation', function (request, reply, done) {
           let securityException;
           const sourceContext = protect.getSourceContext();
@@ -67,7 +67,7 @@ module.exports = (core) => {
               if (isSecurityException(err)) {
                 securityException = err;
               } else {
-                logger.error({ err }, 'Unexpected error during input analysis');
+                logger.error({ err, funcKey }, 'Unexpected error during input analysis');
               }
             }
           }

package/lib/input-analysis/install/formidable1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -50,22 +50,24 @@ module.exports = (core) => {
       name: 'hapi.server',
       patchType,
       post(data) {
-        const server = data.result;
-        if (server) {
-          instrumentServer(server);
+        if (data.result) {
+          instrumentServer(data);
         } else {
-          logger.error('Hapi Server is called but there is no server instance!');
+          logger.error(
+            { funcKey: data.funcKey },
+            'Hapi Server is called but there is no server instance!'
+          );
         }
       }
     });
   };
 
-  const instrumentServer = (server) => {
-    server.ext('onPreStart', function onPreStart(core) {
-      logger.info('hapi version %s', core.version);
+  const instrumentServer = ({ result, funcKey }) => {
+    result.ext('onPreStart', function onPreStart(core) {
+      logger.debug('hapi version %s', core.version);
     });
 
-    server.ext('onPreHandler', function onPreHandler(req, h) {
+    result.ext('onPreHandler', function onPreHandler(req, h) {
       const sourceContext = protect.getSourceContext();
 
       if (sourceContext) {
@@ -93,7 +95,7 @@ module.exports = (core) => {
           if (isSecurityException(err)) {
             throw err;
           } else {
-            logger.error({ err }, 'Unexpected error during input analysis');
+            logger.error({ err, funcKey }, 'Unexpected error during input analysis');
           }
         }
       }

package/lib/input-analysis/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,7 +18,7 @@
 const { Event, toLowerCase } = require('@contrast/common');
 const { patchType } = require('../constants');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     logger,
     messages,
@@ -70,7 +70,7 @@ module.exports = function(core) {
     try {
       store = sources.getStore();
       if (!store) {
-        logger.debug('request store not available during http input-analysis');
+        logger.debug({ funcKey: data.funcKey }, 'request store not available during http input-analysis');
         return;
       }
 
@@ -112,14 +112,14 @@ module.exports = function(core) {
 
       block = block || inputAnalysis.handleConnect(store.protect, connectInputs);
     } catch (err) {
-      logger.error({ err }, 'Error during http input analysis');
+      logger.error({ err, funcKey: data.funcKey }, 'Error during http input analysis');
     }
 
     if (!block) {
       callNext();
     } else {
       store.protect.block(...block);
-      logger.debug({ block }, 'request blocked by not emitting request event');
+      logger.debug({ block, funcKey: data.funcKey }, 'request blocked by not emitting request event');
     }
   }
 

package/lib/input-analysis/install/koa-body5.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/koa-bodyparser4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/koa2.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/multer1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -59,7 +59,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis',
+                    );
                   }
                 }
               }
@@ -81,7 +84,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis',
+                    );
                   }
                 }
               }

package/lib/input-analysis/install/qs6.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial