@contrast/protect 1.77.1 → 1.78.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/lib/input-analysis/install/fastify.js +43 -37
  2. package/lib/input-tracing/install/mongodb.js +1 -1
  3. package/lib/input-tracing/install/sqlite3.js +14 -7
  4. package/package.json +11 -11
package/lib/input-analysis/install/fastify.js CHANGED
@@ -36,49 +36,55 @@ module.exports = (core) => {
36
36
  * registers a depHook for fastify module instrumentation
37
37
  */
38
38
  function install() {
39
- depHooks.resolve({ name: 'fastify', version: '>=4 <6' }, (fastify) => patcher.patch(fastify, {
40
- name: 'fastify.build',
41
- patchType,
42
- post({ result: server, funcKey }) {
43
- server.addHook('preValidation', function (request, reply, done) {
44
- // todo(NODE-3793): support for @fastify/websocket
45
- if (request.constructor.name == 'WebSocket') return;
39
+ depHooks.resolve({ name: 'fastify', version: '>=4 <6' }, (fastify) => {
40
+ const patched = patcher.patch(fastify, {
41
+ name: 'fastify.build',
42
+ patchType,
43
+ post({ result: server, funcKey }) {
44
+ server.addHook('preValidation', function (request, reply, done) {
45
+ // todo(NODE-3793): support for @fastify/websocket
46
+ if (request.constructor.name == 'WebSocket') return;
46
47
 
47
- let securityException;
48
- const sourceContext = protect.getSourceContext();
48
+ let securityException;
49
+ const sourceContext = protect.getSourceContext();
49
50
 
50
- if (sourceContext) {
51
- try {
52
- if (request.params) {
53
- sourceContext.parsedParams = request.params;
54
- inputAnalysis.handleUrlParams(sourceContext, request.params);
55
- }
56
- if (request.cookies) {
57
- sourceContext.parsedCookies = request.cookies;
58
- inputAnalysis.handleCookies(sourceContext, request.cookies);
59
- }
60
- if (request.body) {
61
- sourceContext.parsedBody = request.body;
62
- inputAnalysis.handleParsedBody(sourceContext, request.body);
63
- }
51
+ if (sourceContext) {
52
+ try {
53
+ if (request.params) {
54
+ sourceContext.parsedParams = request.params;
55
+ inputAnalysis.handleUrlParams(sourceContext, request.params);
56
+ }
57
+ if (request.cookies) {
58
+ sourceContext.parsedCookies = request.cookies;
59
+ inputAnalysis.handleCookies(sourceContext, request.cookies);
60
+ }
61
+ if (request.body) {
62
+ sourceContext.parsedBody = request.body;
63
+ inputAnalysis.handleParsedBody(sourceContext, request.body);
64
+ }
64
65
 
65
- if (request.query) {
66
- sourceContext.parsedQuery = request.query;
67
- inputAnalysis.handleQueryParams(sourceContext, request.query);
68
- }
69
- } catch (err) {
70
- if (isSecurityException(err)) {
71
- securityException = err;
72
- } else {
73
- logger.error({ err, funcKey }, 'Unexpected error during input analysis');
66
+ if (request.query) {
67
+ sourceContext.parsedQuery = request.query;
68
+ inputAnalysis.handleQueryParams(sourceContext, request.query);
69
+ }
70
+ } catch (err) {
71
+ if (isSecurityException(err)) {
72
+ securityException = err;
73
+ } else {
74
+ logger.error({ err, funcKey }, 'Unexpected error during input analysis');
75
+ }
74
76
  }
75
77
  }
76
- }
77
78
 
78
- done(securityException);
79
- });
80
- },
81
- }));
79
+ done(securityException);
80
+ });
81
+ },
82
+ });
83
+ fastify.fastify = patched;
84
+ fastify.default = patched;
85
+
86
+ return patched;
87
+ });
82
88
  }
83
89
 
84
90
  return inputAnalysis.fastifyInstrumentation = {
package/lib/input-tracing/install/mongodb.js CHANGED
@@ -158,7 +158,7 @@ module.exports = function(core) {
158
158
  }
159
159
 
160
160
  instr.install = function() {
161
- depHooks.resolve({ name: 'mongodb', version: '<7' }, (mongodb, meta) => {
161
+ depHooks.resolve({ name: 'mongodb', version: '<8' }, (mongodb, meta) => {
162
162
  if (!mongodb.Collection || !mongodb.Db) {
163
163
  meta.rerun();
164
164
  return;
package/lib/input-tracing/install/sqlite3.js CHANGED
@@ -32,18 +32,25 @@ module.exports = function(core) {
32
32
  {
33
33
  moduleName: 'sqlite3',
34
34
  version: '<6',
35
- methods: ['all', 'run', 'get', 'each', 'exec', 'prepare']
35
+ methods: ['all', 'run', 'get', 'each', 'exec', 'prepare'],
36
+ target: 'Database'
36
37
  },
37
38
  {
38
39
  moduleName: 'better-sqlite3',
39
40
  version: '<13',
40
- methods: ['exec', 'prepare']
41
+ methods: ['exec', 'prepare'],
42
+ },
43
+ {
44
+ moduleName: 'node:sqlite',
45
+ version: '*',
46
+ methods: ['exec', 'prepare'],
47
+ target: 'DatabaseSync'
41
48
  }
42
- ].forEach(({ moduleName, version, methods }) => {
49
+ ].forEach(({ moduleName, version, methods, target }) => {
43
50
  depHooks.resolve({ name: moduleName, version }, module => {
44
51
  methods.forEach((method) => {
45
- const name = `${moduleName}.Database.prototype.${method}`;
46
- patcher.patch(moduleName == 'sqlite3' ? module.Database.prototype : module.prototype, method, {
52
+ const name = `${moduleName + (target ? `.${target}` : '')}.prototype.${method}`;
53
+ patcher.patch(target ? module[target].prototype : module.prototype, method, {
47
54
  name,
48
55
  patchType,
49
56
  pre({ args, hooked, name, orig }) {
@@ -64,9 +71,9 @@ module.exports = function(core) {
64
71
  inputTracing.handleSqlInjection(sourceContext, sinkContext);
65
72
  }
66
73
  });
67
- })
74
+ });
68
75
  });
69
- })
76
+ });
70
77
  }
71
78
 
72
79
  const sqlite3Instrumentation = inputTracing.sqlite3Instrumentation = { install };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@contrast/protect",
3
- "version": "1.77.1",
3
+ "version": "1.78.0",
4
4
  "description": "Contrast service providing framework-agnostic Protect support",
5
5
  "license": "SEE LICENSE IN LICENSE",
6
6
  "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -22,16 +22,16 @@
22
22
  "dependencies": {
23
23
  "@contrast/agent-lib": "9.2.0",
24
24
  "@contrast/common": "1.41.1",
25
- "@contrast/config": "1.58.3",
26
- "@contrast/core": "1.63.3",
27
- "@contrast/dep-hooks": "1.32.3",
28
- "@contrast/esm-hooks": "2.38.5",
29
- "@contrast/instrumentation": "1.42.3",
30
- "@contrast/logger": "1.36.3",
31
- "@contrast/patcher": "1.35.3",
32
- "@contrast/rewriter": "1.40.4",
33
- "@contrast/scopes": "1.33.3",
34
- "@contrast/stack-trace-factory": "1.4.1",
25
+ "@contrast/config": "1.59.0",
26
+ "@contrast/core": "1.64.0",
27
+ "@contrast/dep-hooks": "1.33.0",
28
+ "@contrast/esm-hooks": "2.39.0",
29
+ "@contrast/instrumentation": "1.43.0",
30
+ "@contrast/logger": "1.37.0",
31
+ "@contrast/patcher": "1.36.0",
32
+ "@contrast/rewriter": "1.41.0",
33
+ "@contrast/scopes": "1.34.0",
34
+ "@contrast/stack-trace-factory": "1.5.0",
35
35
  "async-hook-domain": "4.0.1",
36
36
  "ipaddr.js": "2.0.1",
37
37
  "on-finished": "2.4.1",