@contrast/protect 1.29.0 → 1.30.0

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright: 2023 Contrast Security, Inc
+Copyright: 2024 Contrast Security, Inc
 Contact: support@contrastsecurity.com
 License: Commercial
 

package/lib/error-handlers/common-handler.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/init-domain.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/install/express4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -43,7 +43,7 @@ module.exports = function (core) {
       }
 
       if (!sourceContext && isSecurityException) {
-        logger.info('source context not found; unable to handle response');
+        logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
       }
       return orig();
     };
@@ -103,7 +103,7 @@ module.exports = function (core) {
       return patcher.patch(fn, {
         name: 'express.route-handler',
         patchType,
-        around(orig) {
+        around(orig, data) {
           const ret = orig();
           if (ret && ret.catch) {
             return ret.catch((err) => {
@@ -118,7 +118,7 @@ module.exports = function (core) {
               }
 
               if (!sourceContext && isSecurityException) {
-                logger.info('source context not found; unable to handle response');
+                logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
                 return;
               }
 

package/lib/error-handlers/install/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/error-handlers/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -46,13 +46,13 @@ module.exports = function (core) {
           err.output.payload = undefined;
           data.result = err;
 
-          logger.info({ mode, ruleId }, 'Request blocked');
+          logger.info({ funcKey: data.funcKey, mode, ruleId }, 'Request blocked');
 
           return;
         }
 
         if (!sourceContext && isSecurityException) {
-          logger.info('source context not found; unable to handle response');
+          logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
         }
       }
     });

package/lib/error-handlers/install/koa2.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -32,7 +32,7 @@ module.exports = function (core) {
   koa2ErrorHandler.install = function () {
     depHooks.resolve({ name: 'koa', version: '>=2.3.0' }, (Koa) => {
       patcher.patch(Koa.prototype, 'handleRequest', {
-        name: 'Koa.Application',
+        name: 'Koa.Application.handleRequest',
         patchType,
         pre(data) {
           const [ctx] = data.args;
@@ -52,7 +52,7 @@ module.exports = function (core) {
               }
 
               if (!sourceContext && isSecurityException) {
-                logger.info('source context not found; unable to handle response');
+                logger.info({ funcKey: data.funcKey }, 'source context not found; unable to handle response');
               }
 
               return orig();

package/lib/get-source-context.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/hardening/install/node-serialize0.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,12 +15,13 @@
 
 'use strict';
 
-const agentLib = require('@contrast/agent-lib');
+const { isMainThread } = require('node:worker_threads');
+
 const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const protect = core.protect = {
-    agentLib: module.exports.instantiateAgentLib(agentLib),
+    agentLib: module.exports.instantiateAgentLib(),
   };
 
   require('./policy')(core);
@@ -49,19 +50,69 @@ module.exports = function(core) {
 
 module.exports.instantiateAgentLib = instantiateAgentLib;
 
+// this is just enough agentLib definition for initialization to work.
+// it allows us to avoid instantiating agent-lib in the loader thread
+// until we find the issue with napi-rs/agent-lib-node-bindings.
+const skeletalAgentLib = {
+  RuleType: {
+    'unsafe-file-upload': 1,
+    'path-traversal': 2,
+    'reflected-xss': 4,
+    'sql-injection': 8,
+    'cmd-injection': 16,
+    'nosql-injection-mongo': 32,
+    'bot-blocker': 64,
+    'ssjs-injection': 128,
+    'method-tampering': 256,
+    'prototype-pollution': 512
+  },
+  InputType: {
+    CookieName: 1,
+    CookieValue: 2,
+    HeaderKey: 3,
+    HeaderValue: 4,
+    JsonKey: 5,
+    JsonValue: 6,
+    Method: 7,
+    ParameterKey: 8,
+    ParameterValue: 9,
+    UriPath: 10,
+    UrlParameter: 11,
+    MultipartName: 12,
+    XmlValue: 13,
+    RawBody: 14
+  },
+  DbType: {
+    DB2: 1,
+    MySQL: 2,
+    Oracle: 3,
+    Postgres: 4,
+    Sqlite: 5,
+    SqlServer: 6,
+    Unknown: 7
+  },
+  version: '8.2.0',
+};
 /**
  * Create an instance of agent-lib and attach the constants directly to it.
  *
  * @param {Object} lib the value returned by require('@contrast/agent-lib')
  * @returns {Object} an agent-lib instance with the constants attached to it.
  */
-function instantiateAgentLib(lib) {
-  const agentLib = new lib.Agent();
-  for (const c in lib.constants) {
-    agentLib[c] = lib.constants[c];
-  }
-  if ('version' in lib) {
-    agentLib.version = lib.version;
+function instantiateAgentLib() {
+  let agentLib;
+  if (isMainThread) {
+    const lib = require('@contrast/agent-lib');
+    agentLib = new lib.Agent();
+    for (const c in lib.constants) {
+      agentLib[c] = lib.constants[c];
+    }
+    if ('version' in lib) {
+      agentLib.version = lib.version;
+    }
+  } else {
+    agentLib = skeletalAgentLib;
   }
+
   return agentLib;
 }

package/lib/input-analysis/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -92,7 +92,7 @@ const acceptedMethods = new Set([
   'version-control',
 ]);
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     logger,
     protect: {
@@ -225,7 +225,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} urlParams pojo
    */
-  inputAnalysis.handleUrlParams = function(sourceContext, urlParams) {
+  inputAnalysis.handleUrlParams = function (sourceContext, urlParams) {
     if (sourceContext.analyzedUrlParams) return;
     sourceContext.analyzedUrlParams = true;
 
@@ -240,7 +240,7 @@ module.exports = function(core) {
     const resultsList = [];
     const { UrlParameter } = agentLib.InputType;
 
-    traverseValues(urlParams, function(path, type, value) {
+    traverseValues(urlParams, function (path, type, value) {
       // url param names are not checked.
       if (type !== 'Value') {
         return;
@@ -292,7 +292,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} cookies pojo
    */
-  inputAnalysis.handleCookies = function(sourceContext, cookies) {
+  inputAnalysis.handleCookies = function (sourceContext, cookies) {
     if (sourceContext.analyzedCookies) return;
     sourceContext.analyzedCookies = true;
 
@@ -324,7 +324,7 @@ module.exports = function(core) {
    * @param {Object} sourceContext
    * @param {Object} parsedBody
    */
-  inputAnalysis.handleParsedBody = function(sourceContext, parsedBody) {
+  inputAnalysis.handleParsedBody = function (sourceContext, parsedBody) {
     if (sourceContext.analyzedBody) return;
 
     sourceContext.analyzedBody = true;
@@ -357,7 +357,7 @@ module.exports = function(core) {
 
   // was MULTIPART_NAME but maybe we should just call it what it is. it's kind
   // of a dumb rule anyway. but maybe some code actually uses the name provided.
-  inputAnalysis.handleFileUploadName = function(sourceContext, names) {
+  inputAnalysis.handleFileUploadName = function (sourceContext, names) {
     const type = agentLib.InputType.MultipartName;
     const { policy } = sourceContext;
     const resultsList = [];
@@ -401,7 +401,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleVirtualPatches = function(sourceContext, requestInput) {
+  inputAnalysis.handleVirtualPatches = function (sourceContext, requestInput) {
     const ruleId = Rule.VIRTUAL_PATCH;
 
     if (!Object.keys(requestInput).filter(Boolean).length || !sourceContext?.virtualPatchesEvaluators.length) return;
@@ -430,7 +430,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleIpAllowlist = function(sourceContext, ipAllowlist) {
+  inputAnalysis.handleIpAllowlist = function (sourceContext, ipAllowlist) {
     if (!sourceContext || !ipAllowlist.length) return;
 
     const { ip: reqIp, headers: reqHeaders } = sourceContext.reqData;
@@ -443,7 +443,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleIpDenylist = function(sourceContext, ipDenylist) {
+  inputAnalysis.handleIpDenylist = function (sourceContext, ipDenylist) {
     const ruleId = Rule.IP_DENYLIST;
 
     if (!sourceContext || !ipDenylist.length) return;
@@ -466,7 +466,7 @@ module.exports = function(core) {
     }
   };
 
-  inputAnalysis.handleMethodTampering = function(sourceContext, connectInputs) {
+  inputAnalysis.handleMethodTampering = function (sourceContext, connectInputs) {
     const ruleId = Rule.METHOD_TAMPERING;
     const mode = sourceContext.policy[ruleId];
     if (mode !== OFF) {
@@ -651,7 +651,7 @@ module.exports = function(core) {
     // another day.
 
     /* eslint-disable-next-line complexity */
-    traverseKeysAndValues(object, function(path, type, value) {
+    traverseKeysAndValues(object, function (path, type, value) {
       let itemType;
       let isMongoQueryType;
       // this is a bit awkward now because nosql-injection-mongo is not integrated
@@ -745,13 +745,13 @@ module.exports = function(core) {
 
         // Ignore bad IP values.
         if (!address.isValid(currentIp)) {
-          logger.warn(`Unable to parse ${currentIp}.`);
+          logger.warn('Unable to parse %s.', currentIp);
           continue;
         }
         const expired = doesExpire ? expiresAt - now <= 0 : false;
 
         if (expired) {
-          logger.info(`IP expired: ${listEntry.name}, ${listEntry.ip}`);
+          logger.info('IP expired: %s, %s', listEntry.name, listEntry.ip);
           continue;
         }
 

package/lib/input-analysis/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/body-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/busboy1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/cookie-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -54,7 +54,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis'
+                    );
                   }
                 }
               }

package/lib/input-analysis/install/express4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -64,7 +64,10 @@ module.exports = (core) => {
                     if (isSecurityException(err)) {
                       securityException = err;
                     } else {
-                      logger.error({ err }, 'Unexpected error during input analysis');
+                      logger.error(
+                        { err, funcKey: data.funcKey },
+                        'Unexpected error during input analysis'
+                      );
                     }
                   }
                 }

package/lib/input-analysis/install/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -39,7 +39,7 @@ module.exports = (core) => {
     depHooks.resolve({ name: 'fastify', version: '>=3 <5' }, (fastify) => patcher.patch(fastify, {
       name: 'fastify.build',
       patchType,
-      post({ result: server }) {
+      post({ result: server, funcKey }) {
         server.addHook('preValidation', function (request, reply, done) {
           let securityException;
           const sourceContext = protect.getSourceContext();
@@ -67,7 +67,7 @@ module.exports = (core) => {
               if (isSecurityException(err)) {
                 securityException = err;
               } else {
-                logger.error({ err }, 'Unexpected error during input analysis');
+                logger.error({ err, funcKey }, 'Unexpected error during input analysis');
               }
             }
           }

package/lib/input-analysis/install/formidable1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -50,22 +50,24 @@ module.exports = (core) => {
       name: 'hapi.server',
       patchType,
       post(data) {
-        const server = data.result;
-        if (server) {
-          instrumentServer(server);
+        if (data.result) {
+          instrumentServer(data);
         } else {
-          logger.error('Hapi Server is called but there is no server instance!');
+          logger.error(
+            { funcKey: data.funcKey },
+            'Hapi Server is called but there is no server instance!'
+          );
         }
       }
     });
   };
 
-  const instrumentServer = (server) => {
-    server.ext('onPreStart', function onPreStart(core) {
-      logger.info('hapi version %s', core.version);
+  const instrumentServer = ({ result, funcKey }) => {
+    result.ext('onPreStart', function onPreStart(core) {
+      logger.debug('hapi version %s', core.version);
     });
 
-    server.ext('onPreHandler', function onPreHandler(req, h) {
+    result.ext('onPreHandler', function onPreHandler(req, h) {
       const sourceContext = protect.getSourceContext();
 
       if (sourceContext) {
@@ -93,7 +95,7 @@ module.exports = (core) => {
           if (isSecurityException(err)) {
             throw err;
           } else {
-            logger.error({ err }, 'Unexpected error during input analysis');
+            logger.error({ err, funcKey }, 'Unexpected error during input analysis');
           }
         }
       }

package/lib/input-analysis/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,7 +18,7 @@
 const { Event, toLowerCase } = require('@contrast/common');
 const { patchType } = require('../constants');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     logger,
     messages,
@@ -70,7 +70,7 @@ module.exports = function(core) {
     try {
       store = sources.getStore();
       if (!store) {
-        logger.debug('request store not available during http input-analysis');
+        logger.debug({ funcKey: data.funcKey }, 'request store not available during http input-analysis');
         return;
       }
 
@@ -112,14 +112,14 @@ module.exports = function(core) {
 
       block = block || inputAnalysis.handleConnect(store.protect, connectInputs);
     } catch (err) {
-      logger.error({ err }, 'Error during http input analysis');
+      logger.error({ err, funcKey: data.funcKey }, 'Error during http input analysis');
     }
 
     if (!block) {
       callNext();
     } else {
       store.protect.block(...block);
-      logger.debug({ block }, 'request blocked by not emitting request event');
+      logger.debug({ block, funcKey: data.funcKey }, 'request blocked by not emitting request event');
     }
   }
 

package/lib/input-analysis/install/koa-body5.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/koa-bodyparser4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/koa2.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/multer1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -59,7 +59,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis',
+                    );
                   }
                 }
               }
@@ -81,7 +84,10 @@ module.exports = (core) => {
                   if (isSecurityException(err)) {
                     securityException = err;
                   } else {
-                    logger.error({ err }, 'Unexpected error during input analysis');
+                    logger.error(
+                      { err, funcKey: data.funcKey },
+                      'Unexpected error during input analysis',
+                    );
                   }
                 }
               }

package/lib/input-analysis/install/qs6.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/install/universal-cookie4.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/ip-analysis.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-analysis/virtual-patches.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/handlers/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/child-process.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/eval.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/fs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/function.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/marsdb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mongodb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mssql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/mysql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/postgres.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/sqlite3.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/input-tracing/install/vm.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/make-response-blocker.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/make-source-context.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/policy.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -17,33 +17,34 @@
 
 const {
   Rule,
-  ProtectRuleMode: {
-    BLOCK_AT_PERIMETER,
-    OFF,
-  },
-  Rule: {
-    BOT_BLOCKER,
-    CMD_INJECTION,
-    CMD_INJECTION_COMMAND_BACKDOORS,
-    CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
-    CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
-    METHOD_TAMPERING,
-    NOSQL_INJECTION,
-    NOSQL_INJECTION_MONGO,
-    PATH_TRAVERSAL,
-    PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
-    REFLECTED_XSS,
-    SQL_INJECTION,
-    SSJS_INJECTION,
-    UNSAFE_FILE_UPLOAD,
-    UNTRUSTED_DESERIALIZATION,
-    XXE,
-  },
+  ProtectRuleMode,
   Event,
   toLowerCase,
   split,
   join
 } = require('@contrast/common');
+const { ConfigSource } = require('@contrast/config');
+
+const { BLOCK_AT_PERIMETER, OFF } = ProtectRuleMode;
+const {
+  BOT_BLOCKER,
+  CMD_INJECTION,
+  CMD_INJECTION_COMMAND_BACKDOORS,
+  CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
+  CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
+  METHOD_TAMPERING,
+  NOSQL_INJECTION,
+  NOSQL_INJECTION_MONGO,
+  PATH_TRAVERSAL,
+  PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
+  REFLECTED_XSS,
+  SQL_INJECTION,
+  SSJS_INJECTION,
+  UNSAFE_FILE_UPLOAD,
+  UNTRUSTED_DESERIALIZATION,
+  XXE,
+} = Rule;
+const { DEFAULT_VALUE } = ConfigSource;
 
 module.exports = function (core) {
   const {
@@ -116,8 +117,14 @@ module.exports = function (core) {
     if (config.protect.rules.disabled_rules.includes(ruleId)) {
       return OFF;
     }
-    if (ruleId === 'nosql-injection-mongo') {
-      return config.protect.rules?.[ruleId]?.mode || config.protect.rules?.['nosql-injection']?.mode;
+    // If nosql-injection is set in config but nosql-injection-mongo isn't,
+    // then have nosql-injection-mongo inherit config value from umbrella rule.
+    if (
+      ruleId === 'nosql-injection-mongo' &&
+      config.getEffectiveSource(`protect.rules.${ruleId}.mode`) === DEFAULT_VALUE &&
+      config.getEffectiveSource(`protect.rules.${NOSQL_INJECTION}.mode`) !== DEFAULT_VALUE
+    ) {
+      return config.protect.rules?.[NOSQL_INJECTION]?.mode;
     }
     return config.protect.rules?.[ruleId]?.mode;
   }
@@ -235,8 +242,6 @@ module.exports = function (core) {
   }
 
   function updateGlobalPolicy(remoteSettings) {
-    let update;
-
     const protectionRules = remoteSettings?.protect?.rules;
     if (protectionRules) {
       [
@@ -246,7 +251,6 @@ module.exports = function (core) {
         CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
         METHOD_TAMPERING,
         NOSQL_INJECTION,
-        NOSQL_INJECTION_MONGO,
         PATH_TRAVERSAL,
         PATH_TRAVERSAL_SEMANTIC_FILE_SECURITY_BYPASS,
         REFLECTED_XSS,
@@ -260,6 +264,15 @@ module.exports = function (core) {
           policy[ruleId] = OFF;
         } else {
           policy[ruleId] = config.getEffectiveValue(`protect.rules.${ruleId}.mode`);
+
+          // nosql-injection-mongo should inherit nosql-injection mode if unset in config
+          if (ruleId === NOSQL_INJECTION) {
+            if (config.getEffectiveSource(`protect.rules.${NOSQL_INJECTION_MONGO}.mode`) === DEFAULT_VALUE) {
+              policy[NOSQL_INJECTION_MONGO] = policy[ruleId];
+            } else {
+              policy[NOSQL_INJECTION_MONGO] = config.getEffectiveValue(`protect.rules.${NOSQL_INJECTION_MONGO}.mode`);
+            }
+          }
         }
       });
 
@@ -275,7 +288,7 @@ module.exports = function (core) {
 
       updateRulesMask();
       protect.policy.exclusions = compiled;
-      logger.info({ policy: protect.policy }, `protect policy updated from ${update}`);
+      logger.info({ policy: protect.policy }, 'Protect policy updated');
     }
   }
 

package/lib/security-exception.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/constants.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/semantic-analysis/install/libxmljs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -44,7 +44,7 @@ module.exports = function (core) {
       patcher.patch(mod, method, {
         name,
         patchType,
-        pre({ args, hooked, orig }) {
+        pre({ args, hooked, orig, funcKey }) {
           const sourceContext = protect.getSourceContext(name);
           const [value, options] = args;
 
@@ -68,7 +68,7 @@ module.exports = function (core) {
               throw err;
             }
 
-            logger.error({ err }, 'Unexpected error during semantic analysis');
+            logger.error({ err, funcKey }, 'Unexpected error during semantic analysis');
           }
         }
       });

package/lib/semantic-analysis/utils/xml-analysis.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/throw-security-exception.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,8 +19,9 @@
   "dependencies": {
     "@contrast/agent-lib": "^7.0.1",
     "@contrast/common": "1.16.0",
-    "@contrast/core": "1.27.0",
-    "@contrast/esm-hooks": "1.23.0",
+    "@contrast/config": "1.23.0",
+    "@contrast/core": "1.27.1",
+    "@contrast/esm-hooks": "2.0.1",
     "@contrast/scopes": "1.4.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.3.7"

package/lib/esm-loader.mjs

@@ -1,70 +0,0 @@
-/*
- * Copyright: 2023 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-import esmHooks from '@contrast/esm-hooks';
-import { createRequire } from 'node:module';
-
-const ERROR_MESSAGE = 'A fatal agent installation error has occurred. The application will be run without instrumentation.';
-
-let getSource = async function getSource(url, context, defaultGetSource) {
-  return defaultGetSource(url, context, defaultGetSource);
-};
-
-let transformSource = async function transformSource(url, context, defaultTransformSource) {
-  return defaultTransformSource(url, context, defaultTransformSource);
-};
-
-let load = async function load(url, context, defaultLoad) {
-  return defaultLoad(url, context, defaultLoad);
-};
-
-const require = createRequire(import.meta.url);
-const { name: agentName, version: agentVersion } = require('../package.json');
-const core = { agentName, agentVersion };
-try {
-  require('@contrast/core/lib/messages')(core);
-  require('@contrast/config')(core);
-  require('@contrast/logger').default(core);
-
-  // @contrast/info ?
-  require('@contrast/core/lib/agent-info')(core);
-  require('@contrast/core/lib/system-info')(core);
-  require('@contrast/core/lib/app-info')(core);
-  require('@contrast/core/lib/sensitive-data-masking')(core);
-  require('@contrast/core/lib/is-agent-path')(core);
-  require('@contrast/core/lib/capture-stacktrace')(core);
-
-  require('@contrast/patcher')(core);
-  require('@contrast/rewriter')(core); // merge contrast-methods?
-  require('@contrast/core/lib/contrast-methods')(core); // can we remove dependency on patcher?
-
-  require('@contrast/dep-hooks')(core);
-  require('@contrast/scopes')(core);
-  require('@contrast/deadzones')(core);
-  require('@contrast/reporter').default(core);
-  require('@contrast/instrumentation')(core);
-
-  // TODO: i think we still need to INSTALL components.
-  ({ getSource, transformSource, load } = esmHooks(core));
-} catch (err) {
-  // TODO: Consider proper UNINSTALLATION and normal startup w/o agent
-  if (core.logger) {
-    core.logger.error({ err }, ERROR_MESSAGE);
-  } else {
-    console.error(new Error(ERROR_MESSAGE, { cause: err }));
-  }
-}
-
-export { getSource, transformSource, load };