@contrast/protect 1.66.0 → 1.68.0

package/lib/hardening/handlers.js

@@ -18,6 +18,7 @@
 const {
   BLOCKING_MODES,
   isString,
+  InputType,
   Rule: { UNTRUSTED_DESERIALIZATION }
 } = require('@contrast/common');
 
@@ -25,6 +26,7 @@ const NODE_SERIALIZE_RCE_TOKEN = '_$$ND_FUNC$$_';
 
 module.exports = function(core) {
   const {
+    protect,
     protect: {
       hardening,
       throwSecurityException,
@@ -40,32 +42,46 @@ module.exports = function(core) {
     return results;
   }
 
-  hardening.handleUntrustedDeserialization = function(sourceContext, sinkContext) {
-    const ruleId = UNTRUSTED_DESERIALIZATION;
-    const mode = sourceContext.policy[ruleId];
-    const { name, value, stacktraceOpts } = sinkContext;
+  function handleFindings(sourceContext, sinkContext, ruleId, result, findings, mode) {
+    const { stacktraceOpts } = sinkContext;
 
-    if (mode === 'off') return;
+    captureStacktrace(sinkContext, stacktraceOpts);
+    getResults(sourceContext, ruleId).push(result);
 
-    if (name === 'node-serialize.unserialize') {
-      if (!isString(value) || !value.indexOf(NODE_SERIALIZE_RCE_TOKEN)) return;
+    let blockInfo;
+    if (BLOCKING_MODES.includes(mode)) {
+      result.blocked = true;
+      blockInfo = [mode, ruleId];
+      sourceContext.securityException = blockInfo;
+    }
 
-      const blocked = BLOCKING_MODES.includes(mode);
-      const results = getResults(sourceContext, ruleId);
+    protect.reportFinding({ findings, result, sinkContext });
 
-      captureStacktrace(sinkContext, stacktraceOpts);
-      results.push({
-        value: sinkContext.value,
-        blocked,
-        exploitMetadata: [{ deserializer: name, command: false }],
-        sinkContext,
-      });
+    if (blockInfo) throwSecurityException(sourceContext);
+  }
 
-      if (blocked) {
-        sourceContext.securityException = [mode, ruleId];
-        throwSecurityException(sourceContext);
-      }
-    }
+  hardening.handleUntrustedDeserialization = function (sourceContext, sinkContext) {
+    const ruleId = UNTRUSTED_DESERIALIZATION;
+    const mode = sourceContext.policy.getRuleMode(ruleId);
+    const { name, value } = sinkContext;
+
+    if (
+      mode === 'off' ||
+      name !== 'node-serialize.unserialize' ||
+      !isString(value) ||
+      !value.indexOf(NODE_SERIALIZE_RCE_TOKEN)
+    ) return;
+
+    const result = {
+      value: sinkContext.value,
+      ruleId: UNTRUSTED_DESERIALIZATION,
+      blocked: false,
+      exploited: true,
+      inputType: InputType.UNKNOWN,
+    };
+    const findings = { deserializer: name, command: false };
+
+    handleFindings(sourceContext, sinkContext, ruleId, result, findings, mode);
   };
 
   return hardening;

package/lib/index.d.ts

@@ -13,7 +13,7 @@
  * way not consistent with the End User License Agreement.
  */
 
-import { ReqData, ProtectMessage, ResultMap, ProtectRuleMode, Blocker } from '@contrast/common';
+import { ReqData, ProtectMessage, ResultMap, ProtectRuleMode, Blocker, ProtectFindingEventArg } from '@contrast/common';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import * as http from 'node:http';
 import * as https from 'node:https';
@@ -60,7 +60,8 @@ export interface Protect {
   makeSourceContext: (req: IncomingMessage, res: ServerResponse) => ProtectRequestStore,
   throwSecurityException: (sourceContext: ProtectRequestStore) => void,
   policy: ProtectPolicy,
-  getPolicy(): ProtectPolicy, // creates copy for request scope
+  getPolicy: () => ProtectPolicy, // creates copy for request scope
+  reportFindings: (e: ProtectFindingEventArg) => void,
   inputAnalysis: {
     handleConnect: (sourceContext: ProtectRequestStore, connectInputs: ConnectInputs) => undefined | [string, string],
     handleRequestEnd: (sourceContext: ProtectRequestStore) => void, //NYI

package/lib/index.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { isMainThread } = require('node:worker_threads');
-const { callChildComponentMethodsSync } = require('@contrast/common');
+const { callChildComponentMethodsSync, Event } = require('@contrast/common');
 const { ConfigSource } = require('@contrast/config');
 
 module.exports = function(core) {
@@ -37,7 +37,7 @@ module.exports = function(core) {
   require('./hardening')(core);
   require('./semantic-analysis')(core);
 
-  protect.install = function() {
+  protect.install = function install() {
     // only force instrumentation if assess is explicitly enabled in local config
     const forceInstrumentation =
       config.preinstrument &&
@@ -60,6 +60,13 @@ module.exports = function(core) {
     ctx.store.protect = protect.makeSourceContext(ctx);
   });
 
+  protect.reportFinding = function reportFinding(data) {
+    core.messages.emit(Event.PROTECT_FINDING, {
+      store: core.scopes.sources.getStore(),
+      ...data,
+    });
+  };
+
   return protect;
 };