@contrast/protect 1.75.5 → 1.77.0

package/lib/input-analysis/index.js

@@ -31,7 +31,7 @@ module.exports = function(core) {
   require('./install/cookie-parser1')(core);
   require('./install/formidable1')(core);
   require('./install/koa-bodyparsers')(core);
-  require('./install/multer1')(core);
+  require('./install/multer')(core);
   require('./install/qs6')(core);
   require('./install/universal-cookie4')(core);
 
@@ -41,6 +41,7 @@ module.exports = function(core) {
   require('./install/express')(core);
   require('./install/hapi')(core);
   require('./install/restify')(core);
+  require('./install/@sap')(core);
 
   // virtual patches
   require('./virtual-patches')(core);

package/lib/input-analysis/install/@sap.js

@@ -0,0 +1,72 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { traverseValues } = require('@contrast/common');
+const { patchType } = require('../constants');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    protect,
+    protect: { inputAnalysis },
+  } = core;
+
+  function install() {
+    depHooks.resolve(
+      { name: '@sap/cds', version: '*', file: 'lib/srv/cds.Service.js' }, (Service) => {
+        patcher.patch(Service.prototype, 'dispatch', {
+          name: '@sap/cds.Service.prototype.dispatch',
+          patchType,
+          pre(data) {
+            const req = data.args[0];
+
+            const sourceContext = protect.getSourceContext();
+            if (!sourceContext || sourceContext.parsedCdsKeyParams) return;
+            sourceContext.parsedCdsKeyParams = true;
+
+            const params = req?.params?.length ? req.params : [];
+            const queries = Array.isArray(req?.query)
+              ? req.query
+              : req?.query ? [req.query] : [];
+
+            for (const cqn of queries) {
+              if (!cqn || typeof cqn !== 'object') continue;
+
+              traverseValues(cqn, (path, _type, value, parent) => {
+                const lastKey = path[path.length - 1];
+                if (!Array.isArray(parent) && (lastKey === 'val' || lastKey === 'ref')) {
+                  params.push(value);
+                }
+              });
+            }
+
+            if (params.length) {
+              inputAnalysis.handleUrlParams(sourceContext, params);
+            }
+          }
+        });
+      }
+    );
+  }
+
+  const sapInstrumentation = inputAnalysis.sapInstrumentation = {
+    install
+  };
+
+  return sapInstrumentation;
+};

package/lib/input-analysis/install/express.js

@@ -39,7 +39,7 @@ module.exports = (core) => {
       // we can exit early if
       //  the layer doesn't match the request or
       //  the layer doesn't recognize any parameters
-      if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route?.path === '*') {
+      if (!data.result || !layer.keys || layer.keys.length === 0 || layer.route?.path === '*' || layer.route?.path === '{*splat}') {
         return;
       }
 

package/lib/input-analysis/install/{multer1.js → multer.js}

@@ -30,7 +30,7 @@ module.exports = (core) => {
 
   // Patch `multer`
   function install() {
-    depHooks.resolve({ name: 'multer', version: '<2', file: 'lib/make-middleware.js' }, (multerMakeMiddleware) => patcher.patch(multerMakeMiddleware, {
+    depHooks.resolve({ name: 'multer', version: '<3', file: 'lib/make-middleware.js' }, (multerMakeMiddleware) => patcher.patch(multerMakeMiddleware, {
       name: 'multer.make-middleware',
       patchType,
       post(data) {
@@ -104,9 +104,9 @@ module.exports = (core) => {
     }));
   }
 
-  const multer1Instrumentation = inputAnalysis.multer1Instrumentation = {
+  const multerInstrumentation = inputAnalysis.multerInstrumentation = {
     install
   };
 
-  return multer1Instrumentation;
+  return multerInstrumentation;
 };

package/lib/input-tracing/install/sqlite3.js

@@ -28,32 +28,45 @@ module.exports = function(core) {
   } = core;
 
   function install() {
-    depHooks.resolve({ name: 'sqlite3', version: '<6' }, sqlite3 => {
-      ['all', 'run', 'get', 'each', 'exec', 'prepare'].forEach((method) => {
-        const name = `sqlite3.Database.prototype.${method}`;
-        patcher.patch(sqlite3.Database.prototype, method, {
-          name,
-          patchType,
-          pre({ args, hooked, name, orig }) {
-            if (instrumentation.isLocked()) return;
-
-            const sourceContext = protect.getSourceContext();
-            if (!sourceContext) return;
-
-            const value = args[0];
-            if (!value || !isString(value)) return;
-
-            const sinkContext = {
-              name,
-              value,
-              stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
-            };
-
-            inputTracing.handleSqlInjection(sourceContext, sinkContext);
-          }
-        });
+    [
+      {
+        moduleName: 'sqlite3',
+        version: '<6',
+        methods: ['all', 'run', 'get', 'each', 'exec', 'prepare']
+      },
+      {
+        moduleName: 'better-sqlite3',
+        version: '<13',
+        methods: ['exec', 'prepare']
+      }
+    ].forEach(({ moduleName, version, methods }) => {
+      depHooks.resolve({ name: moduleName, version }, module => {
+        methods.forEach((method) => {
+          const name = `${moduleName}.Database.prototype.${method}`;
+          patcher.patch(moduleName == 'sqlite3' ? module.Database.prototype : module.prototype, method, {
+            name,
+            patchType,
+            pre({ args, hooked, name, orig }) {
+              if (instrumentation.isLocked()) return;
+
+              const sourceContext = protect.getSourceContext();
+              if (!sourceContext) return;
+
+              const value = args[0];
+              if (!value || !isString(value)) return;
+
+              const sinkContext = {
+                name,
+                value,
+                stacktraceOpts: { constructorOpt: hooked, prependFrames: [orig] },
+              };
+
+              inputTracing.handleSqlInjection(sourceContext, sinkContext);
+            }
+          });
+        })
       });
-    });
+    })
   }
 
   const sqlite3Instrumentation = inputTracing.sqlite3Instrumentation = { install };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.75.5",
+  "version": "1.77.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -31,7 +31,7 @@
     "@contrast/patcher": "1.35.2",
     "@contrast/rewriter": "1.40.3",
     "@contrast/scopes": "1.33.2",
-    "@contrast/stack-trace-factory": "1.3.3",
+    "@contrast/stack-trace-factory": "1.4.0",
     "async-hook-domain": "4.0.1",
     "ipaddr.js": "2.0.1",
     "on-finished": "2.4.1",