@contrast/protect 1.74.0 → 1.75.0

package/lib/input-analysis/handlers.js

@@ -20,6 +20,7 @@ const {
   BLOCKING_MODES,
   Rule,
   ProtectRuleMode: { OFF, MONITOR },
+  identity,
   isString,
   traverseKeysAndValues,
   traverseValues,
@@ -28,7 +29,7 @@ const {
     ArrayPrototypeJoin,
     ArrayPrototypeSlice,
     StringPrototypeToLowerCase,
-    StringPrototypeSplit,
+    StringPrototypeMatch,
   }
 } = require('@contrast/common');
 const { Core } = require('@contrast/core/lib/ioc/core');
@@ -52,16 +53,13 @@ const { Core } = require('@contrast/core/lib/ioc/core');
 // input and make a decision immediately (i.e., there is no sink). so these two
 // rules will need to be implemented by the agent and called from these handlers.
 
-
 // agent-lib treats each type of nosql database as a separate
 // rule. they are all mapped to 'nosql-injection' in the agent.
 // maybe this will need to change.
 const agentLibRuleTypeToName = {
   'nosql-injection-mongo': 'nosql-injection'
 };
-
 const preferWW = { preferWorthWatching: true };
-
 const acceptedMethods = new Set([
   'acl',
   'baseline-control',
@@ -95,9 +93,11 @@ const acceptedMethods = new Set([
   'update',
   'version-control',
 ]);
+const componentName = 'protect.inputAnalysis.handlers';
+const noInstrumentationStore = { lock: true, name: componentName };
 
 module.exports = Core.makeComponent({
-  name: 'protect.inputAnalysis.handlers',
+  name: componentName,
   factory(core) {
     const {
       logger,
@@ -106,6 +106,7 @@ module.exports = Core.makeComponent({
         agentLib,
         inputAnalysis,
       },
+      scopes,
       config,
     } = core;
 
@@ -676,41 +677,48 @@ module.exports = Core.makeComponent({
       const findingsForScoreAtom = {};
       const valueToResultByRuleId = {};
 
-      Object.values(resultsMap).forEach(resultsByRuleId => {
-        resultsByRuleId.forEach(resultByRuleId => {
-          const {
-            ruleId,
-            exploited,
-            score,
-            value,
-            key,
-            inputType
-          } = resultByRuleId;
+      const flattened = Object.values(resultsMap).flatMap(identity);
+      for (const result of flattened) {
+        const {
+          ruleId,
+          exploited,
+          score,
+          value,
+          key,
+          inputType
+        } = result;
+        if (
+          sourceContext.policy.getRuleMode(ruleId) !== MONITOR ||
+          exploited === true ||
+          score >= 90 ||
+          !probesRules.some((rule) => rule === ruleId) ||
+          inputType == InputType.UNKNOWN ||
+          flattened.some((maybeReported) => (
+            // remove chances of duplicate analysis for "similar" findings that
+            // would have already been reported for being blocked or exploited
+            maybeReported.value == result.value &&
+            maybeReported.inputType == result.inputType &&
+            maybeReported.key == result.key &&
+            (maybeReported.exploited || maybeReported.blocked)
+          ))
+        ) {
+          continue;
+        }
 
-          if (
-            sourceContext.policy.getRuleMode(ruleId) !== MONITOR ||
-            exploited === true || // todo: remove
-            score >= 90 ||
-            !probesRules.some((rule) => rule === ruleId) ||
-            inputType == InputType.UNKNOWN
-          ) {
-            return;
+        const dataType = findingsForScoreRequest[inputType];
+        if (!dataType) {
+          if (!findingsForScoreAtom[value]) {
+            findingsForScoreAtom[value] = {};
           }
 
-          const dataType = findingsForScoreRequest[inputType];
-          if (!dataType) {
-            if (!findingsForScoreAtom[value]) {
-              findingsForScoreAtom[value] = {};
-            }
+          findingsForScoreAtom[value][inputType] = result;
+          continue;
+        }
 
-            findingsForScoreAtom[value][inputType] = resultByRuleId;
-            return;
-          }
+        dataType[key] = value;
+        valueToResultByRuleId[value] = result;
+      }
 
-          dataType[key] = value;
-          valueToResultByRuleId[value] = resultByRuleId;
-        });
-      });
       const { ParameterValue, HeaderValue, CookieValue } = findingsForScoreRequest;
       const results =
         agentLib.scoreRequestConnect(
@@ -938,12 +946,21 @@ module.exports = Core.makeComponent({
     function ipListAnalysis(reqIp, reqHeaders, list) {
       const forwardedIps = [];
 
-      for (let i = 0; i < reqHeaders.length; i++) {
-        if (reqHeaders[i] === 'x-forwarded-for') {
-          const ipsFromHeaders = StringPrototypeSplit.call(reqHeaders[i + 1], /[,;]+/);
-          forwardedIps.push(...ipsFromHeaders);
+      // RegExp.exec will still get called under the hood even with using primordials
+      scopes.instrumentation.run(noInstrumentationStore, () => {
+        for (let i = 0; i < reqHeaders.length; i++) {
+          if (reqHeaders[i] === 'x-forwarded-for') {
+            // This matches one or more valid IPv4/IPv6 characters, automatically
+            // skipping delimiters, whitespace, and invalid characters
+            const matches = StringPrototypeMatch.call(reqHeaders[i + 1], /[0-9a-fA-F.:]+/g);
+            if (matches) {
+              for (const ip of matches) {
+                forwardedIps.push(ip);
+              }
+            }
+          }
         }
-      }
+      });
 
       const ipsToCheck = [reqIp, ...forwardedIps];
       const now = new Date().getTime();
@@ -960,7 +977,7 @@ module.exports = Core.makeComponent({
 
           // Ignore bad IP values.
           if (!address.isValid(currentIp)) {
-            logger.warn('Unable to parse %s.', currentIp);
+            logger.debug({ value: currentIp, length: currentIp.length }, 'Unable to parse IP address %s.', currentIp);
             continue;
           }
           const expired = doesExpire ? expiresAt - now <= 0 : false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.74.0",
+  "version": "1.75.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,18 +20,18 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent-lib": "^9.1.0",
-    "@contrast/common": "1.41.0",
-    "@contrast/config": "1.57.0",
-    "@contrast/core": "1.62.0",
-    "@contrast/dep-hooks": "1.31.0",
-    "@contrast/esm-hooks": "2.37.0",
-    "@contrast/instrumentation": "1.41.0",
-    "@contrast/logger": "1.35.0",
-    "@contrast/patcher": "1.34.0",
-    "@contrast/rewriter": "1.39.0",
-    "@contrast/scopes": "1.32.0",
-    "@contrast/stack-trace-factory": "1.2.0",
+    "@contrast/agent-lib": "9.2.0",
+    "@contrast/common": "1.41.1",
+    "@contrast/config": "1.58.0",
+    "@contrast/core": "1.63.0",
+    "@contrast/dep-hooks": "1.32.0",
+    "@contrast/esm-hooks": "2.38.0",
+    "@contrast/instrumentation": "1.42.0",
+    "@contrast/logger": "1.36.0",
+    "@contrast/patcher": "1.35.0",
+    "@contrast/rewriter": "1.40.0",
+    "@contrast/scopes": "1.33.0",
+    "@contrast/stack-trace-factory": "1.3.0",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",