@contrast/protect 1.28.1 → 1.30.0

package/lib/input-analysis/install/universal-cookie4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/ip-analysis.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/virtual-patches.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/handlers/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -220,6 +220,11 @@ module.exports = function(core) {
         if (stringFindings) {
           const nosqlInjectionResult = { ...result, ruleId, mappedId: ruleId };
 
+          // don't modify ssjs-injection result items so use new exploit metadata array here
+          if (nosqlInjectionResult.idsList?.some?.((id) => id.startsWith('SSJS'))) {
+            nosqlInjectionResult.exploitMetadata = [];
+          }
+
           const nosqlInjectionResults = sourceContext.resultsMap[ruleId];
           const isAlreadyPresentInNosqlresults = result.idsList &&
             result.idsList.some(

package/lib/input-tracing/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/child-process.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/eval.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/fs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/function.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/marsdb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mongodb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mssql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mysql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/postgres.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/sqlite3.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/vm.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,7 +18,21 @@
 const { isString, isNonEmptyObject } = require('@contrast/common');
 const { patchType } = require('../constants');
 
-module.exports = function(core) {
+const VM_METHODS = [
+  ['Script', 1],
+  ['createContext', 1],
+  ['compileFunction', 1],
+  ['runInContext', 2],
+  ['runInNewContext', 2],
+  ['runInThisContext', 1],
+];
+
+const SCRIPT_METHODS = [
+  'runInContext',
+  'runInNewContext'
+];
+
+module.exports = function (core) {
   const {
     scopes: { instrumentation },
     patcher,
@@ -27,15 +41,15 @@ module.exports = function(core) {
     protect: { inputTracing }
   } = core;
 
-  function pre({ args, hooked, orig, name }) {
+  const createPre = (arity) => ({ args, hooked, orig, name }) => {
     if (instrumentation.isLocked()) return;
 
     const sourceContext = protect.getSourceContext(name);
     if (!sourceContext) return;
 
-    for (let i = 0; i < (name === 'vm.runInNewContext' ? 2 : 1); i++) {
+    for (let i = 0; i < arity; i++) {
       const arg = args[i];
-      if (!((arg && isString(arg)) || isNonEmptyObject(arg))) continue;
+      if (!arg || !(isString(arg) || isNonEmptyObject(arg))) continue;
 
       const sinkContext = {
         name,
@@ -44,37 +58,29 @@ module.exports = function(core) {
       };
       inputTracing.ssjsInjection(sourceContext, sinkContext);
     }
-  }
+  };
 
-  function install() {
-    depHooks.resolve({ name: 'vm' }, (vm) => {
-      [
-        'Script',
-        'createScript',
-        'runInContext',
-        'runInThisContext',
-        'createContext',
-        'runInNewContext'
-      ].forEach(
-        (method) => {
-          const name = `vm.${method}`;
+  const vmInstrumentation = inputTracing.vmInstrumentation = {
+    install() {
+      depHooks.resolve({ name: 'vm' }, (vm) => {
+        VM_METHODS.forEach(([method, arity]) => {
           patcher.patch(vm, method, {
-            name,
+            name: `vm.${method}`,
             patchType,
-            pre
+            pre: createPre(arity)
           });
-        }
-      );
+        });
 
-      patcher.patch(vm.Script.prototype, 'runInNewContext', {
-        name: 'vm.Script.prototype.runInNewContext',
-        patchType,
-        pre
+        SCRIPT_METHODS.forEach((method) => {
+          patcher.patch(vm.Script.prototype, method, {
+            name: `vm.Script.prototype.${method}`,
+            patchType,
+            pre: createPre(1)
+          });
+        });
       });
-    });
-  }
-
-  const vmInstrumentation = inputTracing.vmInstrumentation = { install };
+    }
+  };
 
   return vmInstrumentation;
 };

package/lib/make-response-blocker.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/make-source-context.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/policy.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -17,33 +17,34 @@
 
 const {
   Rule,
-  ProtectRuleMode: {
-    BLOCK_AT_PERIMETER,
-    OFF,
-  },
-  Rule: {
-    BOT_BLOCKER,
-    CMD_INJECTION,
-    CMD_INJECTION_COMMAND_BACKDOORS,
-    CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
-    CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
-    METHOD_TAMPERING,
-    NOSQL_INJECTION,
-    NOSQL_INJECTION_MONGO,
-    PATH_TRAVERSAL,
-    PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
-    REFLECTED_XSS,
-    SQL_INJECTION,
-    SSJS_INJECTION,
-    UNSAFE_FILE_UPLOAD,
-    UNTRUSTED_DESERIALIZATION,
-    XXE,
-  },
-  Event: { SERVER_SETTINGS_UPDATE },
+  ProtectRuleMode,
+  Event,
   toLowerCase,
   split,
   join
 } = require('@contrast/common');
+const { ConfigSource } = require('@contrast/config');
+
+const { BLOCK_AT_PERIMETER, OFF } = ProtectRuleMode;
+const {
+  BOT_BLOCKER,
+  CMD_INJECTION,
+  CMD_INJECTION_COMMAND_BACKDOORS,
+  CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
+  CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
+  METHOD_TAMPERING,
+  NOSQL_INJECTION,
+  NOSQL_INJECTION_MONGO,
+  PATH_TRAVERSAL,
+  PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
+  REFLECTED_XSS,
+  SQL_INJECTION,
+  SSJS_INJECTION,
+  UNSAFE_FILE_UPLOAD,
+  UNTRUSTED_DESERIALIZATION,
+  XXE,
+} = Rule;
+const { DEFAULT_VALUE } = ConfigSource;
 
 module.exports = function (core) {
   const {
@@ -116,8 +117,14 @@ module.exports = function (core) {
     if (config.protect.rules.disabled_rules.includes(ruleId)) {
       return OFF;
     }
-    if (ruleId === 'nosql-injection-mongo') {
-      return config.protect.rules?.[ruleId]?.mode || config.protect.rules?.['nosql-injection']?.mode;
+    // If nosql-injection is set in config but nosql-injection-mongo isn't,
+    // then have nosql-injection-mongo inherit config value from umbrella rule.
+    if (
+      ruleId === 'nosql-injection-mongo' &&
+      config.getEffectiveSource(`protect.rules.${ruleId}.mode`) === DEFAULT_VALUE &&
+      config.getEffectiveSource(`protect.rules.${NOSQL_INJECTION}.mode`) !== DEFAULT_VALUE
+    ) {
+      return config.protect.rules?.[NOSQL_INJECTION]?.mode;
     }
     return config.protect.rules?.[ruleId]?.mode;
   }
@@ -235,8 +242,6 @@ module.exports = function (core) {
   }
 
   function updateGlobalPolicy(remoteSettings) {
-    let update;
-
     const protectionRules = remoteSettings?.protect?.rules;
     if (protectionRules) {
       [
@@ -246,7 +251,6 @@ module.exports = function (core) {
         CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
         METHOD_TAMPERING,
         NOSQL_INJECTION,
-        NOSQL_INJECTION_MONGO,
         PATH_TRAVERSAL,
         PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
         REFLECTED_XSS,
@@ -260,6 +264,15 @@ module.exports = function (core) {
           policy[ruleId] = OFF;
         } else {
           policy[ruleId] = config.getEffectiveValue(`protect.rules.${ruleId}.mode`);
+
+          // nosql-injection-mongo should inherit nosql-injection mode if unset in config
+          if (ruleId === NOSQL_INJECTION) {
+            if (config.getEffectiveSource(`protect.rules.${NOSQL_INJECTION_MONGO}.mode`) === DEFAULT_VALUE) {
+              policy[NOSQL_INJECTION_MONGO] = policy[ruleId];
+            } else {
+              policy[NOSQL_INJECTION_MONGO] = config.getEffectiveValue(`protect.rules.${NOSQL_INJECTION_MONGO}.mode`);
+            }
+          }
         }
       });
 
@@ -275,7 +288,7 @@ module.exports = function (core) {
 
       updateRulesMask();
       protect.policy.exclusions = compiled;
-      logger.info({ policy: protect.policy }, `protect policy updated from ${update}`);
+      logger.info({ policy: protect.policy }, 'Protect policy updated');
     }
   }
 
@@ -345,7 +358,7 @@ module.exports = function (core) {
     }
   }
 
-  messages.on(SERVER_SETTINGS_UPDATE, (msg) => {
+  messages.on(Event.SERVER_SETTINGS_UPDATE, (msg) => {
     if (!config.getEffectiveValue('protect.enable')) return;
 
     updateExclusions(msg);

package/lib/security-exception.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/install/libxmljs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -44,7 +44,7 @@ module.exports = function (core) {
       patcher.patch(mod, method, {
         name,
         patchType,
-        pre({ args, hooked, orig }) {
+        pre({ args, hooked, orig, funcKey }) {
           const sourceContext = protect.getSourceContext(name);
           const [value, options] = args;
 
@@ -68,7 +68,7 @@ module.exports = function (core) {
               throw err;
             }
 
-            logger.error({ err }, 'Unexpected error during semantic analysis');
+            logger.error({ err, funcKey }, 'Unexpected error during semantic analysis');
           }
         }
       });

package/lib/semantic-analysis/utils/xml-analysis.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/throw-security-exception.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.28.1",
+  "version": "1.30.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,9 +18,10 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^7.0.1",
-    "@contrast/common": "1.15.1",
-    "@contrast/core": "1.26.1",
-    "@contrast/esm-hooks": "1.22.1",
+    "@contrast/common": "1.16.0",
+    "@contrast/config": "1.23.0",
+    "@contrast/core": "1.27.1",
+    "@contrast/esm-hooks": "2.0.1",
     "@contrast/scopes": "1.4.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"

package/lib/esm-loader.mjs

@@ -1,70 +0,0 @@
-/*
- * Copyright: 2023 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-import esmHooks from '@contrast/esm-hooks';
-import { createRequire } from 'node:module';
-
-const ERROR_MESSAGE = 'A fatal agent installation error has occurred. The application will be run without instrumentation.';
-
-let getSource = async function getSource(url, context, defaultGetSource) {
-  return defaultGetSource(url, context, defaultGetSource);
-};
-
-let transformSource = async function transformSource(url, context, defaultTransformSource) {
-  return defaultTransformSource(url, context, defaultTransformSource);
-};
-
-let load = async function load(url, context, defaultLoad) {
-  return defaultLoad(url, context, defaultLoad);
-};
-
-const require = createRequire(import.meta.url);
-const { name: agentName, version: agentVersion } = require('../package.json');
-const core = { agentName, agentVersion };
-try {
-  require('@contrast/core/lib/events')(core);
-  require('@contrast/config')(core);
-  require('@contrast/logger').default(core);
-
-  // @contrast/info ?
-  require('@contrast/core/lib/agent-info')(core);
-  require('@contrast/core/lib/system-info')(core);
-  require('@contrast/core/lib/app-info')(core);
-  require('@contrast/core/lib/sensitive-data-masking')(core);
-  require('@contrast/core/lib/is-agent-path')(core);
-  require('@contrast/core/lib/capture-stacktrace')(core);
-
-  require('@contrast/patcher')(core);
-  require('@contrast/rewriter')(core); // merge contrast-methods?
-  require('@contrast/core/lib/contrast-methods')(core); // can we remove dependency on patcher?
-
-  require('@contrast/dep-hooks')(core);
-  require('@contrast/scopes')(core);
-  require('@contrast/deadzones')(core);
-  require('@contrast/reporter').default(core);
-  require('@contrast/instrumentation')(core);
-
-  // TODO: i think we still need to INSTALL components.
-  ({ getSource, transformSource, load } = esmHooks(core));
-} catch (err) {
-  // TODO: Consider proper UNINSTALLATION and normal startup w/o agent
-  if (core.logger) {
-    core.logger.error({ err }, ERROR_MESSAGE);
-  } else {
-    console.error(new Error(ERROR_MESSAGE, { cause: err }));
-  }
-}
-
-export { getSource, transformSource, load };