@contrast/protect 1.42.0 → 1.44.0

package/lib/input-analysis/handlers.js

@@ -24,9 +24,12 @@ const {
   traverseKeysAndValues,
   traverseValues,
   InputType,
-  ArrayPrototypeJoin,
-  StringPrototypeToLowerCase,
-  StringPrototypeSplit,
+  primordials: {
+    ArrayPrototypeJoin,
+    ArrayPrototypeSlice,
+    StringPrototypeToLowerCase,
+    StringPrototypeSplit,
+  }
 } = require('@contrast/common');
 
 //
@@ -256,7 +259,7 @@ module.exports = function (core) {
         resultsList.push({
           ruleId: item.ruleId,
           inputType: 'UrlParameter',
-          path: path.slice(),
+          path: ArrayPrototypeSlice.call(path),
           key: path.pop(), // there should always be at least the param name
           value,
           score: item.score,
@@ -692,7 +695,7 @@ module.exports = function (core) {
         const result = {
           ruleId: item.ruleId,
           inputType: `${inputTypeStr}${type}`,
-          path: mongoPath || path.slice(),
+          path: mongoPath || ArrayPrototypeSlice.call(path),
           key: type === 'Key' ? value : path[path.length - 1],
           value,
           score: item.score,

package/lib/input-analysis/install/body-parser1.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const { primordials: { JSONParse } } = require('@contrast/common');
 const { isSecurityException } = require('../../security-exception');
 
 module.exports = (core) => {
@@ -35,7 +36,7 @@ module.exports = (core) => {
 
         if (fnName === 'bodyParser.text' && typeof req.body === 'string') {
           try {
-            sourceContext.parsedBody = JSON.parse(req.body);
+            sourceContext.parsedBody = JSONParse(req.body);
           } catch (err) {
             logger.error({ err }, 'Error parsing with bodyParser.text()');
             origNext();

package/lib/input-analysis/install/http.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { Event, StringPrototypeToLowerCase } = require('@contrast/common');
+const { Event, primordials: { StringPrototypeToLowerCase, ArrayPrototypeSlice } } = require('@contrast/common');
 const { patchType } = require('../constants');
 
 module.exports = function (core) {
@@ -38,7 +38,7 @@ module.exports = function (core) {
   function removeCookies(headers) {
     for (let i = 0; i < headers.length; i += 2) {
       if (headers[i] === 'cookies') {
-        headers = headers.slice();
+        headers = ArrayPrototypeSlice.call(headers);
         headers.splice(i, 2);
       }
     }
@@ -94,7 +94,7 @@ module.exports = function (core) {
       const connectInputs = {
         headers: removeCookies(headers),
         uriPath,
-        method:StringPrototypeToLowerCase.call(method),
+        method: StringPrototypeToLowerCase.call(method),
       };
 
       if (inputAnalysis.virtualPatchesEvaluators?.length) {

package/lib/input-analysis/install/http.test.js

@@ -10,6 +10,10 @@ describe('protect input-analysis http', function () {
 
   describe('initialization', function () {
     let core, httpInstr, mockServer;
+    // this captures the sinon stub before it is wrapped by Perf so we can
+    // determine if it was called/not called as expected. if we don't do this
+    // the core.depHooks.install() will be replaced by the Perf wrapper and
+    // sinon will complain that it's not a spy/call-to-spy.
 
     beforeEach(function () {
       ({ core } = initProtectFixture());
@@ -38,7 +42,9 @@ describe('protect input-analysis http', function () {
 
     it('should not be initialized after being required', function () {
       expect(httpInstr.install).a('function');
-      expect(core.depHooks.install).not.to.have.been.called;
+      // the next two lines are effectively: expect(core.depHooks.install).not.to.have.been.called;
+      const depHooksInstall = core.Perf.all.get('agentify').get('agentify:@contrast/dep-hooks:install');
+      expect(depHooksInstall).equal(undefined);
       expect(core.depHooks.resolve).not.to.have.been.called;
     });
 

package/lib/input-analysis/ip-analysis.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { Event, StringPrototypeSubstr } = require('@contrast/common');
+const { Event, primordials: { StringPrototypeSubstr } } = require('@contrast/common');
 const address = require('ipaddr.js');
 
 module.exports = (core) => {

package/lib/input-analysis/virtual-patches.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { Event, StringPrototypeToLowerCase } = require('@contrast/common');
+const { Event, primordials: { StringPrototypeToLowerCase, RegExpPrototypeTest } } = require('@contrast/common');
 
 module.exports = (core) => {
   const {
@@ -95,13 +95,13 @@ function buildVPEvaluators(virtualPatches, evaluatorsArray) {
 function buildEvaluationCheck(evaluation) {
   switch (evaluation) {
     case 'MATCHES':
-      return (reqValue, matchedValue) => new RegExp(matchedValue, 'i').test(reqValue);
+      return (reqValue, matchedValue) => RegExpPrototypeTest.call(new RegExp(matchedValue, 'i'), reqValue);
     case 'EQUALS':
       return (reqValue, matchedValue) => reqValue.toString() === matchedValue.toString();
     case 'CONTAINS':
       return (reqValue, matchedValue) => reqValue.includes(matchedValue);
     case 'DOESNT_MATCH':
-      return (reqValue, matchedValue) => !new RegExp(matchedValue, 'i').test(reqValue);
+      return (reqValue, matchedValue) => !RegExpPrototypeTest.call(new RegExp(matchedValue, 'i'), reqValue);
       // This is a typo but it is how it's passed from ContrastUI
     case 'DOESNT_EQUALS':
       return (reqValue, matchedValue) => reqValue.toString() !== matchedValue.toString();

package/lib/input-tracing/handlers/index.js

@@ -20,7 +20,7 @@ const {
   ProtectRuleMode: { OFF },
   BLOCKING_MODES,
   isString,
-  JSONStringify,
+  primordials: { JSONStringify },
   traverseKeys,
   traverseKeysAndValues,
   agentLibIDListTypes,

package/lib/make-response-blocker.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const {
-  StringPrototypeToUpperCase,
+  primordials: { StringPrototypeToUpperCase },
   symbols: { kMetrics }
 } = require('@contrast/common');
 

package/lib/make-source-context.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { StringPrototypeToLowerCase, StringPrototypeSlice } = require('@contrast/common');
+const { primordials: { StringPrototypeToLowerCase, StringPrototypeSlice } } = require('@contrast/common');
 
 module.exports = function(core) {
   const {

package/lib/policy.js

@@ -19,9 +19,12 @@ const {
   Rule,
   ProtectRuleMode,
   Event,
-  ArrayPrototypeJoin,
-  StringPrototypeToLowerCase,
-  StringPrototypeSplit,
+  primordials: {
+    ArrayPrototypeJoin,
+    StringPrototypeToLowerCase,
+    StringPrototypeSplit,
+    RegExpPrototypeTest
+  }
 } = require('@contrast/common');
 const { ConfigSource } = require('@contrast/config');
 
@@ -90,7 +93,7 @@ module.exports = function (core) {
     if (regExpNeeded) {
       const rx = new RegExp(`^${ArrayPrototypeJoin.call(urls, '|')}$`);
 
-      return (uriPath) => rx ? rx.test(uriPath) : false;
+      return (uriPath) => rx ? RegExpPrototypeTest.call(rx, uriPath) : false;
     }
 
     return (uriPath) => urls.some((url) => url === uriPath);
@@ -107,7 +110,7 @@ module.exports = function (core) {
   function createInputNameMatcher(dtmInputName) {
     if (regExpCheck(dtmInputName)) {
       const rx = new RegExp(`^${dtmInputName}$`);
-      return (inputName) => rx ? rx.test(inputName) : false;
+      return (inputName) => rx ? RegExpPrototypeTest.call(rx, inputName) : false;
     }
 
     return (inputName) => inputName === dtmInputName;

package/lib/semantic-analysis/handlers.js

@@ -21,7 +21,11 @@ const {
   ProtectRuleMode: { OFF },
   InputType,
   traverseValues,
-  StringPrototypeReplace,
+  primordials: {
+    StringPrototypeReplace,
+    ArrayPrototypeSlice,
+    RegExpPrototypeTest
+  }
 } = require('@contrast/common');
 
 const {
@@ -166,7 +170,7 @@ function findBackdoorInjection(sourceContext, command) {
           found = {
             key,
             inputType: path.length > 1 ? InputType.JSON_VALUE : inputType,
-            path: path.slice(0, -1),
+            path: ArrayPrototypeSlice.call(path, 0, -1),
             value: command
           };
 
@@ -195,6 +199,6 @@ function isBackdoorDetected(requestValue, command) {
   return (
     normalizedValue === normalizedCommand ||
       (normalizedCommand.endsWith(normalizedValue) &&
-        SINK_EXPLOIT_PATTERN_START.test(normalizedCommand))
+      RegExpPrototypeTest.call(SINK_EXPLOIT_PATTERN_START, normalizedCommand))
   );
 }

package/lib/semantic-analysis/utils/xml-analysis.js

@@ -14,7 +14,7 @@
  */
 'use strict';
 
-const { StringPrototypeSubstr, StringPrototypeToLowerCase } = require('@contrast/common');
+const { primordials: { StringPrototypeSubstr, StringPrototypeToLowerCase, RegExpPrototypeTest, RegExpPrototypeExec } } = require('@contrast/common');
 
 const PROTOCOLS = {
   FTP: 'FTP',
@@ -67,7 +67,7 @@ function isExternalEntity(str) {
     if (str.startsWith(val)) return true;
   }
 
-  return FILE_PATTERN_WINDOWS.test(str);
+  return RegExpPrototypeTest.call(FILE_PATTERN_WINDOWS, str);
 }
 
 /**
@@ -77,7 +77,7 @@ module.exports.findExternalEntities = function(xml = '') {
   const entities = [];
   let match;
 
-  while ((match = entityRegex.exec(xml))) {
+  while ((match = RegExpPrototypeExec.call(entityRegex, xml))) {
     const {
       groups: { type, uri1, uri2 }
     } = match;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,16 +18,16 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^7.0.1",
-    "@contrast/common": "1.25.0",
-    "@contrast/config": "1.32.0",
-    "@contrast/core": "1.36.0",
-    "@contrast/dep-hooks": "1.4.0",
-    "@contrast/esm-hooks": "2.10.0",
-    "@contrast/instrumentation": "1.14.0",
-    "@contrast/logger": "1.9.0",
-    "@contrast/patcher": "1.8.0",
-    "@contrast/rewriter": "1.12.0",
-    "@contrast/scopes": "1.5.0",
+    "@contrast/common": "1.26.0",
+    "@contrast/config": "1.34.0",
+    "@contrast/core": "1.38.0",
+    "@contrast/dep-hooks": "1.6.0",
+    "@contrast/esm-hooks": "2.12.0",
+    "@contrast/instrumentation": "1.16.0",
+    "@contrast/logger": "1.11.0",
+    "@contrast/patcher": "1.10.0",
+    "@contrast/rewriter": "1.14.0",
+    "@contrast/scopes": "1.7.0",
     "ipaddr.js": "^2.0.1",
     "semver": "^7.6.0"
   },