@contrast/protect 1.49.0 → 1.50.0

package/lib/input-analysis/install/{express4.js → express.js}

@@ -32,12 +32,34 @@ module.exports = (core) => {
     protect: { inputAnalysis },
   } = core;
 
+  function layerPostHook(name) {
+    return function(data) {
+      const layer = data.obj;
+
+      // we can exit early if
+      //  the layer doesn't match the request or
+      //  the layer doesn't recognize any parameters
+      if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route?.path === '*') {
+        return;
+      }
+
+      const sourceContext = protect.getSourceContext(name);
+
+      if (!sourceContext) {
+        return;
+      }
+
+      sourceContext.parsedParams = layer.params;
+      inputAnalysis.handleUrlParams(sourceContext, layer.params);
+    };
+  }
+
   /**
    * registers a depHook for express module instrumentation
    */
   function install() {
     depHooks.resolve(
-      { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/query.js' },
+      { name: 'express', version: '4', file: 'lib/middleware/query.js' },
       (query) => patcher.patch(query, {
         name: 'express.query',
         patchType,
@@ -84,40 +106,59 @@ module.exports = (core) => {
       }));
 
     depHooks.resolve(
-      { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/router/layer.js' },
+      { name: 'express', version: '4', file: 'lib/router/layer.js' },
       (Layer) => {
         const name = 'express.Layer.prototype.match';
         patcher.patch(Layer.prototype, 'match', {
           name,
           patchType,
-          post(data) {
-            const layer = data.obj;
-
-            // we can exit early if
-            //  the layer doesn't match the request or
-            //  the layer doesn't recognize any parameters
-            if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route?.path === '*') {
-              return;
-            }
+          post: layerPostHook(name)
+        });
 
-            const sourceContext = protect.getSourceContext(name);
+        return Layer;
+      });
 
-            if (!sourceContext) {
-              return;
+    depHooks.resolve(
+      { name: 'express', version: '5', file: 'lib/request.js' },
+      (request) => {
+        const { get } = Object.getOwnPropertyDescriptor(request, 'query');
+        const patchedGet = patcher.patch(get, {
+          name: 'request.query.get',
+          patchType,
+          post(data) {
+            const query = data.result;
+            if (query && Object.keys(query).length) {
+              const sourceContext = protect.getSourceContext();
+              if (sourceContext && !('parsedQuery' in sourceContext)) {
+                sourceContext.parsedQuery = query;
+                inputAnalysis.handleQueryParams(sourceContext, query);
+              }
             }
-
-            sourceContext.parsedParams = layer.params;
-            inputAnalysis.handleUrlParams(sourceContext, layer.params);
           }
         });
+        Object.defineProperty(request, 'query', {
+          get: patchedGet
+        });
+      }
+    );
 
+    depHooks.resolve(
+      { name: 'router', version: '2', file: 'lib/layer.js' },
+      (Layer) => {
+        const name = 'Layer.prototype.match';
+        patcher.patch(Layer.prototype, 'match', {
+          name,
+          patchType,
+          post: layerPostHook(name)
+        });
         return Layer;
-      });
+      }
+    );
   }
 
-  const express4Instrumentation = inputAnalysis.express4Instrumentation = {
+  const expressInstrumentation = inputAnalysis.expressInstrumentation = {
     install
   };
 
-  return express4Instrumentation;
+  return expressInstrumentation;
 };

package/lib/input-analysis/install/{express4.test.js → express.test.js}

@@ -7,12 +7,13 @@ const patcher = require('@contrast/patcher');
 const mocks = require('@contrast/test/mocks');
 const SecurityException = require('../../security-exception');
 const secEx = SecurityException.create();
-const expressInstr = require('./express4');
+const expressInstr = require('./express');
 
-describe('protect input-analysis express v4.x', function () {
+describe('protect input-analysis express', function () {
   let core,
     inputAnalysis,
     expressQueryMock,
+    requestMock,
     nextStub,
     query,
     Layer;
@@ -33,11 +34,17 @@ describe('protect input-analysis express v4.x', function () {
       next();
     };
 
+    requestMock = {
+      get query() {
+        return { parameter: 'parsed-query' };
+      }
+    };
+
     Layer = sinon.stub();
     Layer.prototype.match = sinon.stub().returns(true);
 
-    core.depHooks.resolve.withArgs({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/query.js' }).yields(expressQueryMock);
-    core.depHooks.resolve.withArgs({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/router/layer.js' }).yields(Layer);
+    core.depHooks.resolve.withArgs({ name: 'express', version: '4', file: 'lib/middleware/query.js' }).yields(expressQueryMock);
+    core.depHooks.resolve.withArgs({ name: 'express', version: '5', file: 'lib/request.js' }).yields(requestMock);
 
     nextStub = sinon.stub();
 
@@ -47,22 +54,7 @@ describe('protect input-analysis express v4.x', function () {
     core.patcher.patch.resetHistory();
   });
 
-  it('calls patcher for every necessary instrumentation', function () {
-    expressInstr(core).install();
-    expect(core.patcher.patch).to.have.callCount(2);
-    expect(core.patcher.patch).to.have.been.calledWithMatch(expressQueryMock, {
-      name: 'express.query',
-      patchType: 'protect-input-analysis',
-      post: sinon.match.func
-    });
-    expect(core.patcher.patch).to.have.been.calledWithMatch(Layer.prototype, 'match', {
-      name: 'express.Layer.prototype.match',
-      patchType: 'protect-input-analysis',
-      post: sinon.match.func
-    });
-  });
-
-  describe('express.query patch', function () {
+  describe('express4 query patch', function () {
     it('calls `.handleQueryParams` when parsing is successful and in right context', function () {
       core.scopes.sources.run({ protect: {} }, () => {
         const queryParser = expressQueryMock(query);
@@ -98,7 +90,6 @@ describe('protect input-analysis express v4.x', function () {
       });
 
       expect(inputAnalysis.handleQueryParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
       expect(nextStub).to.have.been.calledOnce;
     });
 
@@ -109,7 +100,6 @@ describe('protect input-analysis express v4.x', function () {
       });
 
       expect(inputAnalysis.handleQueryParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
       expect(nextStub).to.have.been.calledOnce;
     });
 
@@ -141,68 +131,111 @@ describe('protect input-analysis express v4.x', function () {
     });
   });
 
-  describe('express.Layer.prototype.match patch', function () {
-    let layer;
+  describe('express5 query get patch', function() {
+    it('does not call `.handleQueryParams` when not in context', function () {
+      core.scopes.sources.run({}, () => {
+        requestMock.query;
+      });
 
-    beforeEach(function () {
-      layer = { keys: ['foo'], params: { foo: 'bar' }, route: { path: '/test' } };
+      expect(inputAnalysis.handleQueryParams).not.to.have.been.called;
     });
 
-    it('calls `.handleUrlParams` when parsing is successful and in right context', function () {
+    it('does not call `.handleQueryParams` when no query exists', function () {
+      requestMock = {
+        get query() {
+          return {};
+        }
+      };
       core.scopes.sources.run({ protect: {} }, () => {
-        Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        requestMock.query;
       });
 
-      expect(inputAnalysis.handleUrlParams).to.have.been.calledOnce;
-      expect(inputAnalysis.handleUrlParams).to.have.been.calledWithMatch({ parsedParams: layer.params }, layer.params);
+      expect(inputAnalysis.handleQueryParams).not.to.have.been.called;
     });
 
-    it('does not call `.handleUrlParams` when match returns false', function () {
-      Layer.prototype.match.returns(false);
-
-      core.scopes.sources.run({}, () => {
-        Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+    it('does not call `.handleQueryParams` when query was already parsed', function () {
+      core.scopes.sources.run({ protect: { parsedQuery: query } }, () => {
+        requestMock.query;
       });
 
-      expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
+      expect(inputAnalysis.handleQueryParams).not.to.have.been.called;
     });
 
-    it('does not call `.handleUrlParams` when the route path is undefined', function () {
-      core.scopes.sources.run({}, () => {
-        Reflect.apply(Layer.prototype.match, { ...layer, route: undefined }, ['/bar']);
+    it('calls `.handleQueryParams` when parsing is successful and in right context', function () {
+      core.scopes.sources.run({ protect: {} }, () => {
+        requestMock.query;
       });
 
-      expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
+      expect(inputAnalysis.handleQueryParams).to.have.been.calledOnce;
+      expect(inputAnalysis.handleQueryParams).to.have.been.calledWithMatch({ parsedQuery: query }, query);
     });
+  });
 
-    it('does not call `.handleUrlParams` when the route path is `*`', function () {
-      core.scopes.sources.run({}, () => {
-        Reflect.apply(Layer.prototype.match, { ...layer, route: { path: '*' } }, ['/bar']);
+  ['4', '5'].forEach((v) => {
+    describe(`express${v} Layer.prototype.match`, function() {
+      let layer;
+      beforeEach(function() {
+        const args = v === '4'
+          ? { name: 'express', version: '4', file: 'lib/router/layer.js' }
+          : { name: 'router', version: '2', file: 'lib/layer.js' };
+        core.depHooks.resolve.withArgs(args).yields(Layer);
+        expressInstr(core).install();
+        layer = { keys: ['foo'], params: { foo: 'bar' }, route: { path: '/test' } };
       });
 
-      expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
-    });
+      it('calls `.handleUrlParams` when parsing is successful and in right context', function () {
+        core.scopes.sources.run({ protect: {} }, () => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        });
 
-    it('does not call `.handleUrlParams` when not in context', function () {
-      core.scopes.sources.run({}, () => {
-        Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        expect(inputAnalysis.handleUrlParams).to.have.been.calledOnce;
+        expect(inputAnalysis.handleUrlParams).to.have.been.calledWithMatch({ parsedParams: layer.params }, layer.params);
       });
 
-      expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
-    });
+      it('does not call `.handleUrlParams` when match returns false', function () {
+        Layer.prototype.match.returns(false);
 
-    it('does not call `.handleUrlParams` when no params are present on the current layer', function () {
-      layer = { keys: [], params: {} };
+        core.scopes.sources.run({}, () => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        });
 
-      core.scopes.sources.run({ protect: {} }, () => {
-        Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
+      });
+
+      it('does not call `.handleUrlParams` when the route path is undefined', function () {
+        core.scopes.sources.run({}, () => {
+          Reflect.apply(Layer.prototype.match, { ...layer, route: undefined }, ['/bar']);
+        });
+
+        expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
+      });
+
+      it('does not call `.handleUrlParams` when the route path is `*`', function () {
+        core.scopes.sources.run({}, () => {
+          Reflect.apply(Layer.prototype.match, { ...layer, route: { path: '*' } }, ['/bar']);
+        });
+
+        expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
+      });
+
+      it('does not call `.handleUrlParams` when not in context', function () {
+        core.scopes.sources.run({}, () => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        });
+
+        expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
+      });
+
+      it('does not call `.handleUrlParams` when no params are present on the current layer', function () {
+        layer = { keys: [], params: {} };
+
+        core.scopes.sources.run({ protect: {} }, () => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        });
+
+        expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
       });
 
-      expect(inputAnalysis.handleUrlParams).not.to.have.been.called;
-      expect(core.logger.debug).not.to.have.been.called;
     });
   });
 });

package/lib/input-analysis/install/formidable1.js

@@ -27,7 +27,7 @@ module.exports = (core) => {
 
   // Patch `formidable`
   function install() {
-    depHooks.resolve({ name: 'formidable' }, (formidable) => {
+    depHooks.resolve({ name: 'formidable', version: '<4' }, (formidable) => {
       formidable.IncomingForm.prototype.parse = patcher.patch(formidable.IncomingForm.prototype.parse, {
         name: 'Formidable.IncomingForm.prototype.parse',
         patchType,

package/lib/input-analysis/install/hapi.js

@@ -40,7 +40,7 @@ module.exports = (core) => {
       registerServerHandler
     );
     depHooks.resolve(
-      { name: '@hapi/pez' },
+      { name: '@hapi/pez', version: '<7' },
       registerMultipartHandler
     );
   }

package/lib/input-analysis/install/hapi.test.js

@@ -13,17 +13,9 @@ describe('protect input-analysis hapi', function () {
     store,
     inputAnalysis;
 
-  const Hapi = {
-    name: 'hapi',
-    version: '>=18 <22'
-  };
-  const HapiHapi = {
-    name: '@hapi/hapi',
-    version: '>=18 <22'
-  };
-  const HapiPez = {
-    name: '@hapi/pez'
-  };
+  const Hapi = { name: 'hapi' };
+  const HapiHapi = { name: '@hapi/hapi' };
+  const HapiPez = { name: '@hapi/pez' };
 
   beforeEach(function () {
     core = mocks.core();
@@ -53,9 +45,9 @@ describe('protect input-analysis hapi', function () {
     HapiPez.Dispenser = function () { };
     HapiPez.Dispenser.prototype.emit = function () { };
 
-    core.depHooks.resolve.withArgs({ name: Hapi.name, version: Hapi.version }).yields(Hapi);
-    core.depHooks.resolve.withArgs({ name: HapiHapi.name, version: HapiHapi.version }).yields(HapiHapi);
-    core.depHooks.resolve.withArgs({ name: HapiPez.name }).yields(HapiPez);
+    core.depHooks.resolve.withArgs(sinon.match({ name: Hapi.name })).yields(Hapi);
+    core.depHooks.resolve.withArgs(sinon.match({ name: HapiHapi.name })).yields(HapiHapi);
+    core.depHooks.resolve.withArgs(sinon.match({ name: HapiPez.name })).yields(HapiPez);
 
     hapiSources = require('./hapi')(core);
     hapiSources.install();

package/lib/input-analysis/install/koa-body5.js

@@ -27,7 +27,7 @@ module.exports = (core) => {
 
   // Patch `koa-body` package
   function install() {
-    depHooks.resolve({ name: 'koa-body' }, (koaBody) => patcher.patch(koaBody, {
+    depHooks.resolve({ name: 'koa-body', version: '<7' }, (koaBody) => patcher.patch(koaBody, {
       name: 'koa-body',
       patchType,
       post(data) {

package/lib/input-analysis/install/koa-bodyparser4.js

@@ -27,7 +27,7 @@ module.exports = (core) => {
 
   // Patch `koa-bodyparser` package
   function install() {
-    depHooks.resolve({ name: 'koa-bodyparser' }, (koaBodyparser) => patcher.patch(koaBodyparser, {
+    depHooks.resolve({ name: 'koa-bodyparser', version: '<5' }, (koaBodyparser) => patcher.patch(koaBodyparser, {
       name: 'koa-bodyparser',
       patchType,
       post(data) {

package/lib/input-analysis/install/koa2.js

@@ -34,7 +34,7 @@ module.exports = (core) => {
    * registers a depHook for koa module instrumentation
    */
   function install() {
-    depHooks.resolve({ name: 'koa', version: '>=2.3.0' }, (Koa) => {
+    depHooks.resolve({ name: 'koa', version: '>=2.3.0 <3' }, (Koa) => {
       function contrastStartMiddleware(ctx, next) {
         if (ctx.query && Object.keys(ctx.query).length) {
           const sourceContext = protect.getSourceContext();
@@ -65,15 +65,15 @@ module.exports = (core) => {
       });
 
       // Patch `koa-router` and `@koa/router` to handle parsed params
-      ['koa-router', '@koa/router'].forEach(router => {
+      [['koa-router', '<14'], ['@koa/router', '<14']].forEach(([router, version]) => {
         depHooks.resolve(
-          { name: router, file: 'lib/layer.js' },
+          { name: router, version, file: 'lib/layer.js' },
           (layer) => {
             layer.prototype = patcher.patch(layer.prototype, 'params', {
               name: `[${router}].layer.prototype`,
               patchType,
               post({ result }) {
-                const sourceContext = protect.getSourceContext(`[${router}].layer`);
+                const sourceContext = protect.getSourceContext();
 
                 if (sourceContext && Object.keys(result).length) {
                   sourceContext.parsedParams = result;
@@ -87,7 +87,7 @@ module.exports = (core) => {
       });
 
       // Patch `koa-cookie`
-      depHooks.resolve({ name: 'koa-cookie' }, (koaCookie) => {
+      depHooks.resolve({ name: 'koa-cookie', version: '<2' }, (koaCookie) => {
         const { default: cookieParser } = koaCookie;
         koaCookie.default = patcher.patch(cookieParser, {
           name: 'koa-cookie',

package/lib/input-analysis/install/multer1.js

@@ -30,7 +30,7 @@ module.exports = (core) => {
 
   // Patch `multer`
   function install() {
-    depHooks.resolve({ name: 'multer', file: 'lib/make-middleware.js' }, (multerMakeMiddleware) => patcher.patch(multerMakeMiddleware, {
+    depHooks.resolve({ name: 'multer', version: '<2', file: 'lib/make-middleware.js' }, (multerMakeMiddleware) => patcher.patch(multerMakeMiddleware, {
       name: 'multer.make-middleware',
       patchType,
       post(data) {

package/lib/input-analysis/install/qs6.js

@@ -27,7 +27,7 @@ module.exports = (core) => {
 
   // Patch `qs`
   function install() {
-    depHooks.resolve({ name: 'qs' },
+    depHooks.resolve({ name: 'qs', version: '<7' },
       (qs) => patcher.patch(qs, 'parse', {
         name: 'qs',
         patchType,

package/lib/input-analysis/install/restify.js

@@ -25,7 +25,7 @@ module.exports = function init(core) {
   return inputAnalysis.restifyInstrumentation = {
     install() {
       depHooks.resolve(
-        { name: 'restify', file: 'lib/server.js', version: '>=8' },
+        { name: 'restify', file: 'lib/server.js', version: '>=8 <12' },
         (Server) => {
           patcher.patch(Server.prototype, '_afterUse', {
             name: 'restify.Server.prototype._afterUse',

package/lib/input-analysis/install/restify.test.js

@@ -22,7 +22,7 @@ describe('protect input-analysis restify v8+', function () {
     req = {};
 
     core.depHooks.resolve
-      .withArgs({ name: 'restify', file: 'lib/server.js', version: '>=8' })
+      .withArgs({ name: 'restify', file: 'lib/server.js', version: '>=8 <12' })
       .yields(Server);
 
     inputAnalysis.restifyInstrumentation.install();

package/lib/input-analysis/install/universal-cookie4.js

@@ -27,7 +27,7 @@ module.exports = (core) => {
 
   // Patch `universal-cookie` package
   function install() {
-    depHooks.resolve({ name: 'universal-cookie', file: 'cjs/utils.js' }, (uCookieUtils) => patcher.patch(uCookieUtils, 'parseCookies', {
+    depHooks.resolve({ name: 'universal-cookie', version: '<8', file: 'cjs/utils.js' }, (uCookieUtils) => patcher.patch(uCookieUtils, 'parseCookies', {
       name: 'universal-cookie.utils',
       patchType,
       post({ result }) {

package/lib/input-tracing/install/child-process.js

@@ -49,7 +49,7 @@ module.exports = function (core) {
 
 
   function install() {
-    depHooks.resolve({ name: 'child_process' }, cp => {
+    depHooks.resolve({ name: 'child_process', version: '*' }, cp => {
       ['exec', 'execSync'].forEach((method) => {
         const name = `child_process.${method}`;
         patcher.patch(cp, method, {

package/lib/input-tracing/install/fs.js

@@ -65,7 +65,7 @@ module.exports = function init(core) {
 
   return core.protect.inputTracing.fsInstrumentation = {
     install() {
-      depHooks.resolve({ name: 'fs' }, (fs) => {
+      depHooks.resolve({ name: 'fs', version: '*' }, (fs) => {
         for (const method of FS_METHODS) {
           // not all methods are available on every OS or Node version.
           if (fs[method.name]) {
@@ -97,7 +97,7 @@ module.exports = function init(core) {
         }
       });
 
-      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+      depHooks.resolve({ name: 'fs/promises', version: '*' }, (fsPromises) => {
         for (const method of FS_METHODS) {
           if (method.promises && fsPromises[method.name]) {
             patcher.patch(fsPromises, method.name, {

package/lib/input-tracing/install/fs.test.js

@@ -30,8 +30,8 @@ describe('protect input-tracing fs', function () {
     core = mocks.core();
     core.logger = mocks.logger();
     core.depHooks = mocks.depHooks();
-    core.depHooks.resolve.withArgs({ name: 'fs' }).yields(fs);
-    core.depHooks.resolve.withArgs({ name: 'fs/promises' }).yields(fsPromises);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'fs' })).yields(fs);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'fs/promises' })).yields(fsPromises);
     core.scopes = mocks.scopes();
     sinon.stub(core.scopes.sources, 'getStore').returns(store);
     core.patcher = patcher(core);

package/lib/input-tracing/install/http.js

@@ -27,7 +27,7 @@ module.exports = function(core) {
   } = core;
 
   function install() {
-    depHooks.resolve({ name: 'http' }, http => {
+    depHooks.resolve({ name: 'http', version: '*' }, http => {
       for (const method of ['write', 'end']) {
         const name = `http.ServerResponse.prototype.${method}`;
         patcher.patch(http.ServerResponse.prototype, method, {
@@ -36,7 +36,7 @@ module.exports = function(core) {
           pre(data) {
             if (instrumentation.isLocked()) return;
 
-            const sourceContext = protect.getSourceContext(name);
+            const sourceContext = protect.getSourceContext();
             if (!sourceContext) return;
 
             const value = data.args[0]?.toString?.();

package/lib/input-tracing/install/http2.js

@@ -27,7 +27,7 @@ module.exports = function(core) {
   } = core;
 
   function install() {
-    depHooks.resolve({ name: 'http2' }, http2 => {
+    depHooks.resolve({ name: 'http2', version: '*' }, http2 => {
       for (const method of ['write', 'end']) {
         const name = `http2.Http2ServerResponse.prototype.${method}`;
         patcher.patch(http2.Http2ServerResponse.prototype, method, {
@@ -36,7 +36,7 @@ module.exports = function(core) {
           pre(data) {
             if (instrumentation.isLocked()) return;
 
-            const sourceContext = protect.getSourceContext(name);
+            const sourceContext = protect.getSourceContext();
 
             if (!sourceContext) return;
 

package/lib/input-tracing/install/marsdb.js

@@ -43,7 +43,7 @@ module.exports = function(core) {
   }
 
   function install() {
-    depHooks.resolve({ name: 'marsdb' }, marsdb => {
+    depHooks.resolve({ name: 'marsdb', version: '<1' }, marsdb => {
       methods.forEach((method) => {
         const name = `marsdb.Collection.prototype.${method}`;
 
@@ -52,7 +52,7 @@ module.exports = function(core) {
           patchType,
           pre({ args, hooked, orig }) {
             const value = getCursorQueryData(args);
-            const sourceContext = getSourceContext(name);
+            const sourceContext = getSourceContext();
 
             if (
               !sourceContext ||

package/lib/input-tracing/install/marsdb.test.js

@@ -34,7 +34,7 @@ describe('protect input-tracing marsdb', function () {
       mockMarsDb.Collection.prototype[method] = () => { };
     });
 
-    core.depHooks.resolve.withArgs({ name: 'marsdb' }).yields(mockMarsDb);
+    core.depHooks.resolve.yields(mockMarsDb);
 
     marsdbInstr = require('./marsdb')(core);
   });

package/lib/input-tracing/install/mongodb.js

@@ -142,7 +142,7 @@ module.exports = function(core) {
     const argsIdxsToCheck = vulnerableArgIdxs || [0];
     return function(next, data) {
       const { args, name, hooked, orig } = data;
-      const sourceCtx = getSourceContext(name);
+      const sourceCtx = getSourceContext();
 
       if (instrumentation.isLocked() || !sourceCtx) {
         return next();
@@ -158,7 +158,7 @@ module.exports = function(core) {
   }
 
   instr.install = function() {
-    depHooks.resolve({ name: 'mongodb' }, (mongodb, version) => {
+    depHooks.resolve({ name: 'mongodb', version: '<7' }, (mongodb, version) => {
       patchCollection(mongodb, version);
       patchDatabase(mongodb, version);
     });

package/lib/input-tracing/install/mongodb.test.js

@@ -39,9 +39,7 @@ describe('protect input-tracing mongodb', function() {
     ({ core, simulateRequestScope } = initProtectFixture());
     require('../../get-source-context')(core);
 
-    core.depHooks.resolve
-      .withArgs({ name: 'mongodb' })
-      .yields({ Collection, Db });
+    core.depHooks.resolve.yields({ Collection, Db });
 
     instr = require('./mongodb')(core);
     instr.install();
@@ -247,7 +245,7 @@ describe('protect input-tracing mongodb', function() {
         command() { }
       }
       core.depHooks.resolve
-        .withArgs({ name: 'mongodb' })
+        .withArgs(sinon.match({ name: 'mongodb' }))
         .yields({ Collection, Db }, 'v5.x.x');
 
       const instr = require('./mongodb')(core);