@contrast/protect 1.65.0 → 1.66.0

package/lib/input-analysis/install/http.js

@@ -112,7 +112,7 @@ module.exports = function (core) {
   }
 
   function install() {
-    ['http', 'https', 'spdy', 'http2'].forEach((moduleName) => {
+    ['http', 'https', 'http2'].forEach((moduleName) => {
       instrument({
         moduleName,
         patchObjects: [{

package/lib/input-tracing/index.js

@@ -36,7 +36,6 @@ module.exports = function(core) {
   require('./install/mysql')(core);
   require('./install/postgres')(core);
   require('./install/sequelize')(core);
-  require('./install/spdy')(core);
   require('./install/sqlite3')(core);
   require('./install/vm')(core);
   // TODO: NODE-2360 (oracledb)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,23 +14,23 @@
   "types": "lib/index.d.ts",
   "engines": {
     "npm": ">=6.13.7 <7 || >= 8.3.1",
-    "node": ">= 16.9.1"
+    "node": ">= 18.7.0"
   },
   "scripts": {
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
     "@contrast/agent-lib": "^9.1.0",
-    "@contrast/common": "1.35.0",
-    "@contrast/config": "1.50.0",
-    "@contrast/core": "1.55.0",
-    "@contrast/dep-hooks": "1.24.0",
-    "@contrast/esm-hooks": "2.29.0",
-    "@contrast/instrumentation": "1.34.0",
-    "@contrast/logger": "1.28.0",
-    "@contrast/patcher": "1.27.0",
-    "@contrast/rewriter": "1.31.0",
-    "@contrast/scopes": "1.25.0",
+    "@contrast/common": "1.36.0",
+    "@contrast/config": "1.51.0",
+    "@contrast/core": "1.56.0",
+    "@contrast/dep-hooks": "1.25.0",
+    "@contrast/esm-hooks": "2.30.0",
+    "@contrast/instrumentation": "1.35.0",
+    "@contrast/logger": "1.29.0",
+    "@contrast/patcher": "1.28.0",
+    "@contrast/rewriter": "1.32.0",
+    "@contrast/scopes": "1.26.0",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",

package/lib/input-tracing/install/spdy.js

@@ -1,63 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../constants');
-
-module.exports = function(core) {
-  const {
-    scopes: { instrumentation },
-    patcher,
-    depHooks,
-    protect,
-    protect: { inputTracing }
-  } = core;
-
-  function install() {
-    depHooks.resolve({ name: 'spdy', version: '<5' }, spdy => {
-      const name = 'spdy.response.end';
-      patcher.patch(spdy.response, 'end', {
-        name,
-        patchType,
-        pre({ args, obj: response, hooked }) {
-          if (instrumentation.isLocked()) return;
-
-          const sourceContext = protect.getSourceContext();
-
-          if (!sourceContext) return;
-
-          const value = args[0]?.toString();
-          if (!value) return;
-
-          const sinkContext = {
-            name,
-            value,
-            stacktraceOpts: { constructorOpt: hooked },
-          };
-
-          response.spdyStream.once('finish', () => response.emit('finish'));
-          inputTracing.handleReflectedXss(sourceContext, sinkContext);
-        }
-      });
-    });
-  }
-
-  const spdyInstrumentation = inputTracing.spdyInstrumentation = {
-    install
-  };
-
-  return spdyInstrumentation;
-};