@contrast/protect 1.74.1 → 1.75.0

package/lib/input-analysis/handlers.js

@@ -29,7 +29,7 @@ const {
     ArrayPrototypeJoin,
     ArrayPrototypeSlice,
     StringPrototypeToLowerCase,
-    StringPrototypeSplit,
+    StringPrototypeMatch,
   }
 } = require('@contrast/common');
 const { Core } = require('@contrast/core/lib/ioc/core');
@@ -53,16 +53,13 @@ const { Core } = require('@contrast/core/lib/ioc/core');
 // input and make a decision immediately (i.e., there is no sink). so these two
 // rules will need to be implemented by the agent and called from these handlers.
 
-
 // agent-lib treats each type of nosql database as a separate
 // rule. they are all mapped to 'nosql-injection' in the agent.
 // maybe this will need to change.
 const agentLibRuleTypeToName = {
   'nosql-injection-mongo': 'nosql-injection'
 };
-
 const preferWW = { preferWorthWatching: true };
-
 const acceptedMethods = new Set([
   'acl',
   'baseline-control',
@@ -96,9 +93,11 @@ const acceptedMethods = new Set([
   'update',
   'version-control',
 ]);
+const componentName = 'protect.inputAnalysis.handlers';
+const noInstrumentationStore = { lock: true, name: componentName };
 
 module.exports = Core.makeComponent({
-  name: 'protect.inputAnalysis.handlers',
+  name: componentName,
   factory(core) {
     const {
       logger,
@@ -107,6 +106,7 @@ module.exports = Core.makeComponent({
         agentLib,
         inputAnalysis,
       },
+      scopes,
       config,
     } = core;
 
@@ -946,12 +946,21 @@ module.exports = Core.makeComponent({
     function ipListAnalysis(reqIp, reqHeaders, list) {
       const forwardedIps = [];
 
-      for (let i = 0; i < reqHeaders.length; i++) {
-        if (reqHeaders[i] === 'x-forwarded-for') {
-          const ipsFromHeaders = StringPrototypeSplit.call(reqHeaders[i + 1], /[,;]+/);
-          forwardedIps.push(...ipsFromHeaders);
+      // RegExp.exec will still get called under the hood even with using primordials
+      scopes.instrumentation.run(noInstrumentationStore, () => {
+        for (let i = 0; i < reqHeaders.length; i++) {
+          if (reqHeaders[i] === 'x-forwarded-for') {
+            // This matches one or more valid IPv4/IPv6 characters, automatically
+            // skipping delimiters, whitespace, and invalid characters
+            const matches = StringPrototypeMatch.call(reqHeaders[i + 1], /[0-9a-fA-F.:]+/g);
+            if (matches) {
+              for (const ip of matches) {
+                forwardedIps.push(ip);
+              }
+            }
+          }
         }
-      }
+      });
 
       const ipsToCheck = [reqIp, ...forwardedIps];
       const now = new Date().getTime();
@@ -968,7 +977,7 @@ module.exports = Core.makeComponent({
 
           // Ignore bad IP values.
           if (!address.isValid(currentIp)) {
-            logger.warn('Unable to parse %s.', currentIp);
+            logger.debug({ value: currentIp, length: currentIp.length }, 'Unable to parse IP address %s.', currentIp);
             continue;
           }
           const expired = doesExpire ? expiresAt - now <= 0 : false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.74.1",
+  "version": "1.75.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,18 +20,18 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent-lib": "^9.1.0",
+    "@contrast/agent-lib": "9.2.0",
     "@contrast/common": "1.41.1",
-    "@contrast/config": "1.57.1",
-    "@contrast/core": "1.62.1",
-    "@contrast/dep-hooks": "1.31.1",
-    "@contrast/esm-hooks": "2.37.1",
-    "@contrast/instrumentation": "1.41.1",
-    "@contrast/logger": "1.35.1",
-    "@contrast/patcher": "1.34.1",
-    "@contrast/rewriter": "1.39.1",
-    "@contrast/scopes": "1.32.1",
-    "@contrast/stack-trace-factory": "1.2.1",
+    "@contrast/config": "1.58.0",
+    "@contrast/core": "1.63.0",
+    "@contrast/dep-hooks": "1.32.0",
+    "@contrast/esm-hooks": "2.38.0",
+    "@contrast/instrumentation": "1.42.0",
+    "@contrast/logger": "1.36.0",
+    "@contrast/patcher": "1.35.0",
+    "@contrast/rewriter": "1.40.0",
+    "@contrast/scopes": "1.33.0",
+    "@contrast/stack-trace-factory": "1.3.0",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",