@contrast/protect 1.74.0 → 1.74.1

package/lib/input-analysis/handlers.js

@@ -20,6 +20,7 @@ const {
   BLOCKING_MODES,
   Rule,
   ProtectRuleMode: { OFF, MONITOR },
+  identity,
   isString,
   traverseKeysAndValues,
   traverseValues,
@@ -676,41 +677,48 @@ module.exports = Core.makeComponent({
       const findingsForScoreAtom = {};
       const valueToResultByRuleId = {};
 
-      Object.values(resultsMap).forEach(resultsByRuleId => {
-        resultsByRuleId.forEach(resultByRuleId => {
-          const {
-            ruleId,
-            exploited,
-            score,
-            value,
-            key,
-            inputType
-          } = resultByRuleId;
+      const flattened = Object.values(resultsMap).flatMap(identity);
+      for (const result of flattened) {
+        const {
+          ruleId,
+          exploited,
+          score,
+          value,
+          key,
+          inputType
+        } = result;
+        if (
+          sourceContext.policy.getRuleMode(ruleId) !== MONITOR ||
+          exploited === true ||
+          score >= 90 ||
+          !probesRules.some((rule) => rule === ruleId) ||
+          inputType == InputType.UNKNOWN ||
+          flattened.some((maybeReported) => (
+            // remove chances of duplicate analysis for "similar" findings that
+            // would have already been reported for being blocked or exploited
+            maybeReported.value == result.value &&
+            maybeReported.inputType == result.inputType &&
+            maybeReported.key == result.key &&
+            (maybeReported.exploited || maybeReported.blocked)
+          ))
+        ) {
+          continue;
+        }
 
-          if (
-            sourceContext.policy.getRuleMode(ruleId) !== MONITOR ||
-            exploited === true || // todo: remove
-            score >= 90 ||
-            !probesRules.some((rule) => rule === ruleId) ||
-            inputType == InputType.UNKNOWN
-          ) {
-            return;
+        const dataType = findingsForScoreRequest[inputType];
+        if (!dataType) {
+          if (!findingsForScoreAtom[value]) {
+            findingsForScoreAtom[value] = {};
           }
 
-          const dataType = findingsForScoreRequest[inputType];
-          if (!dataType) {
-            if (!findingsForScoreAtom[value]) {
-              findingsForScoreAtom[value] = {};
-            }
+          findingsForScoreAtom[value][inputType] = result;
+          continue;
+        }
 
-            findingsForScoreAtom[value][inputType] = resultByRuleId;
-            return;
-          }
+        dataType[key] = value;
+        valueToResultByRuleId[value] = result;
+      }
 
-          dataType[key] = value;
-          valueToResultByRuleId[value] = resultByRuleId;
-        });
-      });
       const { ParameterValue, HeaderValue, CookieValue } = findingsForScoreRequest;
       const results =
         agentLib.scoreRequestConnect(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.74.0",
+  "version": "1.74.1",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,17 +21,17 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^9.1.0",
-    "@contrast/common": "1.41.0",
-    "@contrast/config": "1.57.0",
-    "@contrast/core": "1.62.0",
-    "@contrast/dep-hooks": "1.31.0",
-    "@contrast/esm-hooks": "2.37.0",
-    "@contrast/instrumentation": "1.41.0",
-    "@contrast/logger": "1.35.0",
-    "@contrast/patcher": "1.34.0",
-    "@contrast/rewriter": "1.39.0",
-    "@contrast/scopes": "1.32.0",
-    "@contrast/stack-trace-factory": "1.2.0",
+    "@contrast/common": "1.41.1",
+    "@contrast/config": "1.57.1",
+    "@contrast/core": "1.62.1",
+    "@contrast/dep-hooks": "1.31.1",
+    "@contrast/esm-hooks": "2.37.1",
+    "@contrast/instrumentation": "1.41.1",
+    "@contrast/logger": "1.35.1",
+    "@contrast/patcher": "1.34.1",
+    "@contrast/rewriter": "1.39.1",
+    "@contrast/scopes": "1.32.1",
+    "@contrast/stack-trace-factory": "1.2.1",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",