@contrast/protect 1.57.0 → 1.58.0

package/lib/error-handlers/install/express.js

@@ -59,6 +59,9 @@ module.exports = function (core) {
         name: 'finalHandler',
         patchType,
         post(data) {
+          // no need to perform this runtime patch if protect is disabled
+          if (!core.config.getEffectiveValue('protect.enable')) return;
+
           data.result = patcher.patch(data.result, {
             name: 'finalHandler.returnedFunction',
             patchType,

package/lib/get-source-context.js

@@ -19,6 +19,8 @@ module.exports = function init(core) {
   const { scopes: { sources } } = core;
 
   function getSourceContext() {
+    if (!core.config.getEffectiveValue('protect.enable')) return null;
+
     const sourceContext = sources.getStore()?.protect;
     return sourceContext?.allowed ? null : sourceContext;
   }

package/lib/index.js

@@ -16,10 +16,12 @@
 'use strict';
 
 const { isMainThread } = require('node:worker_threads');
-
 const { callChildComponentMethodsSync } = require('@contrast/common');
+const { ConfigSource } = require('@contrast/config');
 
 module.exports = function(core) {
+  const { config } = core;
+
   const protect = core.protect = {
     agentLib: module.exports.instantiateAgentLib(),
   };
@@ -36,7 +38,15 @@ module.exports = function(core) {
   require('./semantic-analysis')(core);
 
   protect.install = function() {
-    if (!core.config.getEffectiveValue('protect.enable')) {
+    // only force instrumentation if assess is explicitly enabled in local config
+    const forceInstrumentation =
+      config.preinstrument &&
+      config.getEffectiveSource('protect.enable') !== ConfigSource.DEFAULT_VALUE;
+
+    if (
+      !forceInstrumentation &&
+      !core.config.getEffectiveValue('protect.enable')
+    ) {
       core.logger.debug('protect is disabled, skipping installation');
       return;
     }