@contrast/protect 1.68.0 → 1.70.0

package/lib/error-handlers/index.js

@@ -28,7 +28,7 @@ module.exports = function(core) {
   require('./install/express')(core);
   require('./install/fastify')(core);
   require('./install/hapi')(core);
-  require('./install/koa2')(core);
+  require('./install/koa')(core);
   require('./install/restify')(core);
 
   errorHandlers.install = function() {

package/lib/error-handlers/install/{koa2.js → koa.js}

@@ -27,10 +27,10 @@ module.exports = function (core) {
     protect,
   } = core;
 
-  const koa2ErrorHandler = protect.errorHandlers.koa2ErrorHandler = {};
+  const koaErrorHandler = protect.errorHandlers.koaErrorHandler = {};
 
-  koa2ErrorHandler.install = function () {
-    depHooks.resolve({ name: 'koa', version: '>=2.3.0 <3' }, (Koa) => {
+  koaErrorHandler.install = function () {
+    depHooks.resolve({ name: 'koa', version: '>=2.3.0 <4' }, (Koa) => {
       patcher.patch(Koa.prototype, 'handleRequest', {
         name: 'Koa.Application.handleRequest',
         patchType,
@@ -63,5 +63,5 @@ module.exports = function (core) {
     });
   };
 
-  return koa2ErrorHandler;
+  return koaErrorHandler;
 };

package/lib/index.d.ts

@@ -122,7 +122,7 @@ export interface Protect {
       handler: (err: Error, request: IncomingMessage, reply: ServerResponse) => void,
       install: () => void
     }
-    koa2ErrorHandler: { install: () => void },
+    koaErrorHandler: { install: () => void },
     expressErrorHandler: { install: () => void },
     install: () => void,
   },

package/lib/input-analysis/handlers.js

@@ -665,7 +665,6 @@ module.exports = Core.makeComponent({
       // Detecting probes
       const rulesMask = sourceContext.policy.getRulesMask();
       if (rulesMask == 0 || !config.protect.probe_analysis.enable) return;
-      const probeReports = [];
       const { resultsMap } = sourceContext;
       const probesRules = [Rule.CMD_INJECTION, Rule.PATH_TRAVERSAL, Rule.SQL_INJECTION, Rule.XXE];
       const probes = {};
@@ -734,7 +733,6 @@ module.exports = Core.makeComponent({
           }) || [];
           alibResult.forEach(result => {
             results.push({ value, ...result });
-            probeReports.push({ value, ...result });
             valueToResultByRuleId[value] = resultByRuleId;
           });
         });
@@ -756,16 +754,7 @@ module.exports = Core.makeComponent({
           probes[key] = probe;
         });
 
-      Object.values(probes).forEach(probe => {
-        if (!resultsMap[probe.ruleId]) {
-          resultsMap[probe.ruleId] = [];
-        }
-
-        resultsMap[probe.ruleId].push(probe);
-        probeReports.push(probe);
-      });
-
-      for (const result of probeReports) {
+      for (const result of Object.values(probes)) {
         core.protect.reportFinding({ result });
       }
     };

package/lib/input-analysis/index.js

@@ -30,15 +30,14 @@ module.exports = function(core) {
   require('./install/body-parser')(core);
   require('./install/cookie-parser1')(core);
   require('./install/formidable1')(core);
-  require('./install/koa-body5')(core);
-  require('./install/koa-bodyparser4')(core);
+  require('./install/koa-bodyparsers')(core);
   require('./install/multer1')(core);
   require('./install/qs6')(core);
   require('./install/universal-cookie4')(core);
 
   // framework specific instrumentation
   require('./install/fastify')(core);
-  require('./install/koa2')(core);
+  require('./install/koa')(core);
   require('./install/express')(core);
   require('./install/hapi')(core);
   require('./install/restify')(core);

package/lib/input-analysis/install/koa-bodyparsers.js

@@ -0,0 +1,92 @@
+/*
+ * Copyright: 2025 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../constants');
+
+module.exports = (core) => {
+  const {
+    depHooks,
+    patcher,
+    protect,
+    protect: { inputAnalysis },
+  } = core;
+
+  function postFn(name) {
+    return function(data) {
+      data.result = patcher.patch(data.result, {
+        name,
+        patchType,
+        pre(data) {
+          const [ctx, origNext] = data.args;
+
+          async function contrastNext(origErr) {
+            const sourceContext = protect.getSourceContext();
+
+
+            if (sourceContext && ctx.request.body && Object.keys(ctx.request.body).length) {
+              sourceContext.parsedBody = ctx.request.body;
+              inputAnalysis.handleParsedBody(sourceContext, ctx.request.body);
+            }
+
+            await origNext(origErr);
+          }
+
+          data.args[1] = contrastNext;
+        }
+      });
+    };
+  }
+
+  function install() {
+    [['koa-body', '>=4 <6'], ['koa-bodyparser', '>=4 <5']].forEach(([name, version]) => {
+      depHooks.resolve({ name, version }, (koaBody) =>
+        patcher.patch(koaBody, {
+          name,
+          patchType,
+          post: postFn(name)
+        })
+      );
+    });
+
+    depHooks.resolve({ name: 'koa-body', version: '>=6 <7' }, (koaBody) =>
+      patcher.patch(koaBody, 'koaBody', {
+        name: 'koaBody',
+        patchType,
+        post: postFn('koa-body')
+      })
+    );
+
+    depHooks.resolve({ name: '@koa/bodyparser', version: '>=5 <7' }, (koaBody) => {
+      const patchedBodyParser = patcher.patch(koaBody.bodyParser, {
+        name: '@koa/bodyparser',
+        patchType,
+        post: postFn('@koa/bodyparser')
+      }
+      );
+      return {
+        default: patchedBodyParser,
+        bodyParser: patchedBodyParser
+      };
+    });
+  }
+
+  const koaBodyparserInstrumentation = inputAnalysis.koaBodyparserInstrumentation = {
+    install
+  };
+
+  return koaBodyparserInstrumentation;
+};

package/lib/input-analysis/install/{koa2.js → koa.js}

@@ -34,7 +34,7 @@ module.exports = (core) => {
    * registers a depHook for koa module instrumentation
    */
   function install() {
-    depHooks.resolve({ name: 'koa', version: '>=2.3.0 <3' }, (Koa) => {
+    depHooks.resolve({ name: 'koa', version: '>=2.3.0 <4' }, (Koa) => {
       function contrastStartMiddleware(ctx, next) {
         if (ctx.query && Object.keys(ctx.query).length) {
           const sourceContext = protect.getSourceContext();
@@ -65,11 +65,11 @@ module.exports = (core) => {
       });
 
       // Patch `koa-router` and `@koa/router` to handle parsed params
-      [['koa-router', '<14'], ['@koa/router', '<14']].forEach(([router, version]) => {
+      [['koa-router', '>=12 <15'], ['@koa/router', '>=12 <15']].forEach(([router, version]) => {
         depHooks.resolve(
           { name: router, version, file: 'lib/layer.js' },
           (layer) => {
-            layer.prototype = patcher.patch(layer.prototype, 'params', {
+            patcher.patch(layer.prototype, 'params', {
               name: `[${router}].layer.prototype`,
               patchType,
               post({ result }) {
@@ -119,9 +119,9 @@ module.exports = (core) => {
     });
   }
 
-  const koa2Instrumentation = inputAnalysis.koa2Instrumentation = {
+  const koaInstrumentation = inputAnalysis.koaInstrumentation = {
     install
   };
 
-  return koa2Instrumentation;
+  return koaInstrumentation;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.68.0",
+  "version": "1.70.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,16 +21,16 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^9.1.0",
-    "@contrast/common": "1.37.0",
-    "@contrast/config": "1.52.1",
-    "@contrast/core": "1.57.1",
-    "@contrast/dep-hooks": "1.26.1",
-    "@contrast/esm-hooks": "2.32.0",
-    "@contrast/instrumentation": "1.36.1",
-    "@contrast/logger": "1.30.1",
-    "@contrast/patcher": "1.29.1",
-    "@contrast/rewriter": "1.34.0",
-    "@contrast/scopes": "1.27.1",
+    "@contrast/common": "1.38.0",
+    "@contrast/config": "1.54.0",
+    "@contrast/core": "1.59.0",
+    "@contrast/dep-hooks": "1.28.0",
+    "@contrast/esm-hooks": "2.34.0",
+    "@contrast/instrumentation": "1.38.0",
+    "@contrast/logger": "1.32.0",
+    "@contrast/patcher": "1.31.0",
+    "@contrast/rewriter": "1.36.0",
+    "@contrast/scopes": "1.29.0",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",

package/lib/input-analysis/install/koa-body5.js

@@ -1,63 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../constants');
-
-module.exports = (core) => {
-  const {
-    depHooks,
-    patcher,
-    protect,
-    protect: { inputAnalysis },
-  } = core;
-
-  // Patch `koa-body` package
-  function install() {
-    depHooks.resolve({ name: 'koa-body', version: '<7' }, (koaBody) => patcher.patch(koaBody, {
-      name: 'koa-body',
-      patchType,
-      post(data) {
-        data.result = patcher.patch(data.result, {
-          name: 'koa-body',
-          patchType,
-          pre(data) {
-            const [ctx, origNext] = data.args;
-
-            async function contrastNext(origErr) {
-              const sourceContext = protect.getSourceContext();
-
-              if (sourceContext && ctx.request.body && Object.keys(ctx.request.body).length) {
-                sourceContext.parsedBody = ctx.request.body;
-                inputAnalysis.handleParsedBody(sourceContext, ctx.request.body);
-              }
-
-              await origNext(origErr);
-            }
-
-            data.args[1] = contrastNext;
-          }
-        });
-      }
-    }));
-  }
-
-  const koaBody5Instrumentation = inputAnalysis.koaBody5Instrumentation = {
-    install
-  };
-
-  return koaBody5Instrumentation;
-};

package/lib/input-analysis/install/koa-bodyparser4.js

@@ -1,64 +0,0 @@
-/*
- * Copyright: 2025 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../constants');
-
-module.exports = (core) => {
-  const {
-    depHooks,
-    patcher,
-    protect,
-    protect: { inputAnalysis },
-  } = core;
-
-  // Patch `koa-bodyparser` package
-  function install() {
-    depHooks.resolve({ name: 'koa-bodyparser', version: '<5' }, (koaBodyparser) => patcher.patch(koaBodyparser, {
-      name: 'koa-bodyparser',
-      patchType,
-      post(data) {
-        data.result = patcher.patch(data.result, {
-          name: 'koa-bodyparser',
-          patchType,
-          pre(data) {
-            const [ctx, origNext] = data.args;
-
-            async function contrastNext(origErr) {
-              const sourceContext = protect.getSourceContext();
-
-
-              if (sourceContext && ctx.request.body && Object.keys(ctx.request.body).length) {
-                sourceContext.parsedBody = ctx.request.body;
-                inputAnalysis.handleParsedBody(sourceContext, ctx.request.body);
-              }
-
-              await origNext(origErr);
-            }
-
-            data.args[1] = contrastNext;
-          }
-        });
-      }
-    }));
-  }
-
-  const koaBodyparser4Instrumentation = inputAnalysis.koaBodyparser4Instrumentation = {
-    install
-  };
-
-  return koaBodyparser4Instrumentation;
-};