@contrast/protect 1.8.0 → 1.9.0

package/lib/error-handlers/install/express4.js

@@ -44,7 +44,7 @@ module.exports = function(core) {
               const isSecurityException = SecurityException.isSecurityException(err);
 
               if (isSecurityException && sourceContext) {
-                const blockInfo = sourceContext.findings.securityException;
+                const blockInfo = sourceContext.securityException;
 
                 sourceContext.block(...blockInfo);
                 return;
@@ -70,7 +70,7 @@ module.exports = function(core) {
           const isSecurityException = SecurityException.isSecurityException(err);
 
           if (isSecurityException && sourceContext) {
-            const blockInfo = sourceContext.findings.securityException;
+            const blockInfo = sourceContext.securityException;
 
             sourceContext.block(...blockInfo);
             return;
@@ -123,7 +123,7 @@ module.exports = function(core) {
               const isSecurityException = SecurityException.isSecurityException(err);
 
               if (isSecurityException && sourceContext) {
-                const blockInfo = sourceContext.findings.securityException;
+                const blockInfo = sourceContext.securityException;
 
                 sourceContext.block(...blockInfo);
                 return;

package/lib/error-handlers/install/fastify.js

@@ -62,7 +62,7 @@ module.exports = function(core) {
       if (!sourceContext) {
         normalHandler.call(this, err, request, reply);
       } else {
-        const blockInfo = sourceContext.findings.securityException;
+        const blockInfo = sourceContext.securityException;
         sourceContext.block(...blockInfo);
       }
     } else {

package/lib/error-handlers/install/hapi.js

@@ -39,7 +39,7 @@ module.exports = function (core) {
         const isSecurityException = SecurityException.isSecurityException(err);
 
         if (isSecurityException && sourceContext && err.output.statusCode !== 403) {
-          const [mode, ruleId] = sourceContext.findings.securityException;
+          const [mode, ruleId] = sourceContext.securityException;
 
           err.output.statusCode = 403;
           err.reformat();

package/lib/error-handlers/install/koa2.js

@@ -46,7 +46,7 @@ module.exports = function(core) {
 
               if (isSecurityException && sourceContext) {
                 data.obj.body = '';
-                const blockInfo = sourceContext.findings.securityException;
+                const blockInfo = sourceContext.securityException;
                 sourceContext.block(...blockInfo);
                 return;
               }

package/lib/hardening/handlers.js

@@ -24,13 +24,14 @@ module.exports = function(core) {
     protect: {
       hardening,
       throwSecurityException,
-    }
+    },
+    captureStacktrace,
   } = core;
 
   function getResults(sourceContext, ruleId) {
-    let results = sourceContext.findings.hardeningResultsMap[ruleId];
+    let results = sourceContext.resultsMap[ruleId];
     if (!results) {
-      results = sourceContext.findings.hardeningResultsMap[ruleId] = [];
+      results = sourceContext.resultsMap[ruleId] = [];
     }
     return results;
   }
@@ -38,7 +39,7 @@ module.exports = function(core) {
   hardening.handleUntrustedDeserialization = function(sourceContext, sinkContext) {
     const ruleId = 'untrusted-deserialization';
     const mode = sourceContext.policy[ruleId];
-    const { name, value } = sinkContext;
+    const { name, value, stacktraceData } = sinkContext;
 
     if (mode === 'off') return;
 
@@ -48,14 +49,16 @@ module.exports = function(core) {
       const blocked = BLOCKING_MODES.includes(mode);
       const results = getResults(sourceContext, ruleId);
 
+      captureStacktrace(sinkContext, stacktraceData);
       results.push({
+        value: sinkContext.value,
         blocked,
-        findings: { deserializer: name, command: false },
+        exploitMetadata: [{ deserializer: name, command: false }],
         sinkContext,
       });
 
       if (blocked) {
-        sourceContext.findings.securityException = [mode, ruleId];
+        sourceContext.securityException = [mode, ruleId];
         throwSecurityException(sourceContext);
       }
     }

package/lib/hardening/install/node-serialize0.js

@@ -21,7 +21,6 @@ module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    captureStacktrace,
     protect,
     protect: {
       hardening
@@ -43,10 +42,11 @@ module.exports = function(core) {
 
             if (!sourceContext || !value) return;
 
-            const sinkContext = captureStacktrace(
-              { name: `${name}.${method}`, value },
-              { constructorOpt: hooked, prependFrames: [orig] },
-            );
+            const sinkContext = {
+              name: `${name}.${method}`,
+              value,
+              stacktraceData: { constructorOpt: hooked, prependFrames: [orig] },
+            };
             hardening.handleUntrustedDeserialization(sourceContext, sinkContext);
           },
         });

package/lib/index.d.ts

@@ -16,7 +16,7 @@
 import { Logger } from '@contrast/logger';
 import { Sources } from '@contrast/scopes';
 import RequireHook from '@contrast/require-hook';
-import { RulesConfig, Messages, ReqData, ProtectMessage, Findings } from '@contrast/common';
+import { RulesConfig, Messages, ReqData, ProtectMessage, ResultMap, ProtectRuleMode } from '@contrast/common';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { Config } from '@contrast/config';
 import * as http from 'node:http';
@@ -58,7 +58,10 @@ export interface ProtectRequestStore {
   };
   exclusions: any[]; // TODO
   virtualPatches: any[]; // TODO
-  findings: Findings;
+  trackRequest: boolean;
+  securityException?: [mode: ProtectRuleMode, ruleId: string];
+  bodyType?: 'json' | 'urlencoded';
+  resultsMap: Partial<ResultMap>
 }
 
 export interface ConnectInputs {

package/lib/index.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const agentLib = require('@contrast/agent-lib');
-const { installChildComponentsSync } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const protect = core.protect = {
@@ -35,7 +35,7 @@ module.exports = function(core) {
   require('./error-handlers')(core);
 
   protect.install = function() {
-    installChildComponentsSync(protect);
+    callChildComponentMethodsSync(protect, 'install');
   };
 
   return protect;

package/lib/input-analysis/handlers.js

@@ -17,7 +17,8 @@
 
 const {
   BLOCKING_MODES,
-  simpleTraverse,
+  traverseKeysAndValues,
+  traverseValues,
   Rule,
   isString,
   ProtectRuleMode: { OFF },
@@ -199,7 +200,7 @@ module.exports = function(core) {
     const resultsList = [];
     const { UrlParameter } = agentLib.InputType;
 
-    simpleTraverse(urlParams, function(path, type, value) {
+    traverseValues(urlParams, function(path, type, value) {
       // url param names are not checked.
       if (type !== 'Value') {
         return;
@@ -306,7 +307,7 @@ module.exports = function(core) {
 
     const block = commonObjectAnalyzer(sourceContext, parsedBody, inputTypes);
 
-    sourceContext.findings.bodyType = bodyType;
+    sourceContext.bodyType = bodyType;
 
     if (block) {
       core.protect.throwSecurityException(sourceContext);
@@ -373,14 +374,14 @@ module.exports = function(core) {
           const { name, uuid } = vpEvaluators.get('metadata');
 
           if (vpEvaluators.size === 1 && uuid) {
-            if (!sourceContext.findings.serverFeaturesResultsMap[ruleId]) {
-              sourceContext.findings.serverFeaturesResultsMap[ruleId] = [];
+            if (!sourceContext.resultsMap[ruleId]) {
+              sourceContext.resultsMap[ruleId] = [];
             }
-            sourceContext.findings.serverFeaturesResultsMap[ruleId].push({
+            sourceContext.resultsMap[ruleId].push({
               name,
               uuid
             });
-            sourceContext.findings.securityException = ['block', ruleId];
+            sourceContext.securityException = ['block', ruleId];
             core.protect.throwSecurityException(sourceContext);
           }
         }
@@ -412,11 +413,11 @@ module.exports = function(core) {
 
     if (match) {
       logger.info(match, 'Found a matching IP to an entry in ipDeny list');
-      if (!sourceContext.findings.serverFeaturesResultsMap[ruleId]) {
-        sourceContext.findings.serverFeaturesResultsMap[ruleId] = [];
+      if (!sourceContext.resultsMap[ruleId]) {
+        sourceContext.resultsMap[ruleId] = [];
       }
 
-      sourceContext.findings.serverFeaturesResultsMap[ruleId].push({
+      sourceContext.resultsMap[ruleId].push({
         ip: match.matchedIp,
         uuid: match.uuid,
       });
@@ -434,7 +435,7 @@ module.exports = function(core) {
   inputAnalysis.handleRequestEnd = function handleRequestEnd(sourceContext) {
     if (!config.protect.probe_analysis.enable || sourceContext.allowed) return;
 
-    const { resultsMap } = sourceContext.findings;
+    const { resultsMap } = sourceContext;
     const probesRules = [Rule.CMD_INJECTION, Rule.PATH_TRAVERSAL, Rule.SQL_INJECTION, Rule.XXE];
     const props = {};
 
@@ -444,11 +445,11 @@ module.exports = function(core) {
         const {
           ruleId,
           blocked,
-          details,
+          exploitMetadata,
           value,
           inputType
         } = resultByRuleId;
-        if (blocked || !blocked && details.length > 0 || !probesRules.some(rule => rule === ruleId)) return;
+        if (blocked || !blocked && exploitMetadata.length > 0 || !probesRules.some(rule => rule === ruleId)) return;
 
         const { policy: { rulesMask } } = sourceContext;
 
@@ -514,19 +515,19 @@ module.exports = function(core) {
 
     // it's possible to optimize this if qs (or a similar package) is not loaded
     // or if none of the values of queryParams are objects. a quick '.includes()'
-    // could be used to determine that. if none are objects then simpleTraverse()
+    // could be used to determine that. if none are objects then traverseKeysAndValues()
     // wouldn't be used, just a simple "for (const key in queryParams) {...}" to
     // check each key and value associated with the key.
     //
     // otoh, it's a fair amount of additional logic and the gain is likely to be
     // small, so it probably only makes sense to check if qs (or similar) is actually
-    // in use. a benchmark of "for (const key in queryParams) {...}" vs simpleTraverse
+    // in use. a benchmark of "for (const key in queryParams) {...}" vs traverseKeysAndValues
     // should be created to see if, and in what cases, it makes sense.
     //
     // another day.
 
     /* eslint-disable-next-line complexity */
-    simpleTraverse(object, function(path, type, value) {
+    traverseKeysAndValues(object, function(path, type, value) {
       let itemType;
       let isMongoQueryType;
       // this is a bit awkward now because nosql-injection-mongo is not integrated
@@ -708,10 +709,10 @@ function isResultExcluded(sourceContext, result) {
  * @returns {undefined|[String]} undefined to permit else [mode, rule] to block.
  */
 function mergeFindings(sourceContext, newFindings) {
-  const { findings, policy } = sourceContext;
+  const { policy, securityException, resultsMap } = sourceContext;
 
   if (!newFindings.trackRequest) {
-    return findings.securityException;
+    return securityException;
   }
 
   newFindings.resultsList = newFindings.resultsList.filter(
@@ -720,18 +721,18 @@ function mergeFindings(sourceContext, newFindings) {
 
   normalizeFindings(policy, newFindings);
 
-  findings.trackRequest = findings.trackRequest || newFindings.trackRequest;
-  findings.securityException = findings.securityException || newFindings.securityException;
+  sourceContext.trackRequest = sourceContext.trackRequest || newFindings.trackRequest;
+  sourceContext.securityException = sourceContext.securityException || newFindings.securityException;
 
   // merge them into a ruleId-indexed map (pojo)
   for (const result of newFindings.resultsList) {
-    if (!findings.resultsMap[result.ruleId]) {
-      findings.resultsMap[result.ruleId] = [];
+    if (!resultsMap[result.ruleId]) {
+      resultsMap[result.ruleId] = [];
     }
-    findings.resultsMap[result.ruleId].push(result);
+    resultsMap[result.ruleId].push(result);
   }
 
-  return findings.securityException;
+  return sourceContext.securityException;
 }
 
 //
@@ -749,7 +750,7 @@ function normalizeFindings(policy, findings) {
     r.blocked = false;
 
     // sink analysis will add findings here
-    r.details = [];
+    r.exploitMetadata = [];
 
     // apply exclusions here.
     //

package/lib/input-analysis/index.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { installChildComponentsSync } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const inputAnalysis = core.protect.inputAnalysis = {};
@@ -47,7 +47,7 @@ module.exports = function(core) {
   require('./ip-analysis')(core);
 
   inputAnalysis.install = function() {
-    installChildComponentsSync(inputAnalysis);
+    callChildComponentMethodsSync(inputAnalysis, 'install');
   };
 
   return inputAnalysis;

package/lib/input-analysis/install/http.js

@@ -214,12 +214,6 @@ class HttpInstrumentation {
         method: reqData.method,
       };
 
-      // only add queries if it's known that 'qs' or equivalent won't be used.
-      /* c8 ignore next 3 */
-      if (reqData.standardUrlParsing) {
-        connectInputs.queries = reqData.queries;
-      }
-
       if (inputAnalysis.virtualPatchesEvaluators?.length) {
         store.protect.virtualPatchesEvaluators.push(...inputAnalysis.virtualPatchesEvaluators.map((e) => new Map(e)));
       }

package/lib/input-tracing/handlers/index.js

@@ -20,21 +20,31 @@ const {
   ProtectRuleMode: { OFF },
   BLOCKING_MODES,
   isString,
-  simpleTraverse
+  traverseKeys,
+  traverseKeysAndValues,
 } = require('@contrast/common');
 
 module.exports = function(core) {
-  const { protect: { agentLib, inputTracing, throwSecurityException } } = core;
+  const {
+    protect: {
+      agentLib,
+      inputTracing,
+      throwSecurityException
+    },
+    captureStacktrace,
+  } = core;
 
   function handleFindings(sourceContext, sinkContext, ruleId, result, findings) {
-    result.details.push({ sinkContext, findings });
+    const { stacktraceData } = sinkContext;
+    captureStacktrace(sinkContext, stacktraceData);
+    result.exploitMetadata.push({ sinkContext, findings });
 
     const mode = sourceContext.policy[ruleId];
 
     if (BLOCKING_MODES.includes(mode)) {
       result.blocked = true;
       const blockInfo = [mode, ruleId];
-      sourceContext.findings.securityException = blockInfo;
+      sourceContext.securityException = blockInfo;
       throwSecurityException(sourceContext);
     }
   }
@@ -137,10 +147,13 @@ module.exports = function(core) {
 
       for (const result of stringInjectionResults) {
         if (typeof sinkContext.value === 'object') {
-          simpleTraverse(sinkContext.value, function(path, type, value) {
+          traverseKeysAndValues(sinkContext.value, function(path, type, value) {
             if (type !== 'Key' && !agentLib.isMongoQueryType(value)) return;
 
             stringFindings = handleStringValue(result, sinkContext.value[value], agentLib);
+
+            // halt traversal
+            return true;
           });
         } else if (typeof sinkContext.value === 'string') {
           stringFindings = handleStringValue(result, sinkContext.value, agentLib);
@@ -149,11 +162,11 @@ module.exports = function(core) {
         if (stringFindings) {
           const nosqlInjectionResult = { ...result, ruleId, mappedId: ruleId };
 
-          const nosqlInjectionResults = sourceContext.findings.resultsMap[ruleId];
+          const nosqlInjectionResults = sourceContext.resultsMap[ruleId];
           if (Array.isArray(nosqlInjectionResults)) {
             nosqlInjectionResults.push(nosqlInjectionResult);
           } else {
-            sourceContext.findings.resultsMap[ruleId] = [nosqlInjectionResult];
+            sourceContext.resultsMap[ruleId] = [nosqlInjectionResult];
           }
 
           handleFindings(sourceContext, sinkContext, ruleId, nosqlInjectionResult, stringFindings);
@@ -222,7 +235,7 @@ module.exports = function(core) {
       const findings = idx !== -1 ? { value: sinkContext.value } : null;
 
       if (findings) {
-        result.details.push({ sinkContext, findings });
+        result.exploitMetadata.push({ sinkContext, findings });
       }
     }
   };
@@ -241,18 +254,13 @@ function getResultsByRuleId(ruleId, context) {
   if (context.policy[ruleId] === OFF) {
     return;
   }
-  return context.findings.resultsMap[ruleId];
+  return context.resultsMap[ruleId];
 }
 
 function handleObjectValue(result, object) {
-  if (typeof object !== 'object') {
-    return null;
-  }
   let findings = null;
-  simpleTraverse(object, function(path, type, value) {
-    if (type !== 'Key' || findings) {
-      return;
-    }
+
+  traverseKeys(object, function(path, type, value) {
     // the result value is the key that was found
     if (result.key === value) {
       // does the object at this path equal the user input?
@@ -267,6 +275,9 @@ function handleObjectValue(result, object) {
         const end = start + value.length;
         const inputBoundaryIndex = 0;
         findings = { start, end, boundaryOverrunIndex: start, inputBoundaryIndex };
+
+        // halt traversal
+        return true;
       }
     }
   });

package/lib/input-tracing/index.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { installChildComponentsSync } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const inputTracing = core.protect.inputTracing = {};
@@ -38,7 +38,7 @@ module.exports = function(core) {
   // TODO: NODE-2360 (oracledb)
 
   inputTracing.install = function() {
-    installChildComponentsSync(inputTracing);
+    callChildComponentMethodsSync(inputTracing, 'install');
   };
 
   return inputTracing;

package/lib/input-tracing/install/child-process.js

@@ -23,11 +23,31 @@ module.exports = function(core) {
     scopes: { instrumentation },
     patcher,
     depHooks,
-    captureStacktrace,
-    protect,
-    protect: { inputTracing }
+    protect: { getSourceContext, inputTracing }
   } = core;
 
+  function pre({ args, name, hooked, orig }) {
+    if (instrumentation.isLocked()) return;
+
+    const sourceContext = getSourceContext('child_process');
+    const value = args[0];
+
+    if (!sourceContext || !value || !isString(value)) return;
+
+    const sinkContext = {
+      name,
+      value,
+      stacktraceData: { constructorOpt: hooked, prependFrames: [orig] },
+    };
+
+    inputTracing.handleCommandInjection(sourceContext, sinkContext);
+    core.protect.semanticAnalysis.handleCommandInjectionCommandBackdoors(sourceContext, sinkContext);
+    core.protect.semanticAnalysis.handleCmdInjectionSemanticChainedCommands(sourceContext, sinkContext);
+    core.protect.semanticAnalysis.handleCmdInjectionSemanticDangerous(sourceContext, sinkContext);
+    core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(sourceContext, sinkContext);
+  }
+
+
   function install() {
     depHooks.resolve({ name: 'child_process' }, cp => {
       ['exec', 'execSync'].forEach((method) => {
@@ -35,27 +55,7 @@ module.exports = function(core) {
         patcher.patch(cp, method, {
           name,
           patchType,
-          pre({ args, hooked, orig }) {
-            if (instrumentation.isLocked()) return;
-
-            const sourceContext = protect.getSourceContext('child_process');
-            const value = args[0];
-
-            if (!sourceContext || !value || !isString(value)) return;
-
-            const sinkContext = captureStacktrace(
-              { name, value },
-              { constructorOpt: hooked, prependFrames: [orig] }
-            );
-
-            inputTracing.handleCommandInjection(sourceContext, sinkContext);
-            // To evade code duplication we are using these INPUT TRACING instrumentation
-            // to do the checks for SEMANTIC ANALYSIS too
-            core.protect.semanticAnalysis.handleCommandInjectionCommandBackdoors(sourceContext, sinkContext);
-            core.protect.semanticAnalysis.handleCmdInjectionSemanticChainedCommands(sourceContext, sinkContext);
-            core.protect.semanticAnalysis.handleCmdInjectionSemanticDangerous(sourceContext, sinkContext);
-            core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(sourceContext, sinkContext);
-          }
+          pre
         });
       });
     });

package/lib/input-tracing/install/eval.js

@@ -23,7 +23,6 @@ module.exports = function(core) {
     logger,
     scopes: { instrumentation },
     patcher,
-    captureStacktrace,
     protect,
     protect: { inputTracing }
   } = core;
@@ -45,10 +44,11 @@ module.exports = function(core) {
 
         if (!sourceContext || !value || !isString(value)) return;
 
-        const sinkContext = captureStacktrace(
-          { name: 'eval', value },
-          { constructorOpt: hooked, prependFrames: [orig] }
-        );
+        const sinkContext = {
+          name: 'eval',
+          value,
+          stacktraceData: { constructorOpt: hooked, prependFrames: [orig] },
+        };
         inputTracing.ssjsInjection(sourceContext, sinkContext);
       }
     });

package/lib/input-tracing/install/fs.js

@@ -64,7 +64,6 @@ module.exports = function(core) {
     scopes: { instrumentation },
     patcher,
     depHooks,
-    captureStacktrace,
     protect,
     protect: { inputTracing }
   } = core;
@@ -101,10 +100,11 @@ module.exports = function(core) {
             // don't need to necessarily need to lock it here - there are no
             // lower-level calls that we instrument
             for (const value of values) {
-              const sinkContext = captureStacktrace(
-                { name, value },
-                { constructorOpt: hooked, prependFrames: [orig] }
-              );
+              const sinkContext = {
+                name,
+                value,
+                stacktraceData: { constructorOpt: hooked, prependFrames: [orig] },
+              };
               inputTracing.handlePathTraversal(sourceContext, sinkContext);
               core.protect.semanticAnalysis.handlePathTraversalFileSecurityBypass(sourceContext, sinkContext);
             }

package/lib/input-tracing/install/function.js

@@ -23,7 +23,6 @@ module.exports = function(core) {
     logger,
     scopes: { instrumentation },
     patcher,
-    captureStacktrace,
     protect,
     protect: { inputTracing }
   } = core;
@@ -46,10 +45,12 @@ module.exports = function(core) {
 
           if (!sourceContext || !fnBody || !isString(fnBody)) return;
 
-          const sinkContext = captureStacktrace(
-            { name: 'Function', value: fnBody },
-            { constructorOpt: hooked, prependFrames: [orig] }
-          );
+          const sinkContext = {
+            name: 'Function',
+            value: fnBody,
+            stacktraceData: { constructorOpt: hooked, prependFrames: [orig] },
+          };
+
           inputTracing.ssjsInjection(sourceContext, sinkContext);
         }
       })

package/lib/input-tracing/install/http.js

@@ -22,7 +22,6 @@ module.exports = function(core) {
     scopes: { instrumentation },
     patcher,
     depHooks,
-    captureStacktrace,
     protect,
     protect: { inputTracing }
   } = core;
@@ -44,10 +43,11 @@ module.exports = function(core) {
             const value = data.args[0]?.toString();
             if (!value) return;
 
-            const sinkContext = captureStacktrace(
-              { name, value },
-              { constructorOpt: data.hooked }
-            );
+            const sinkContext = {
+              name,
+              value,
+              stacktraceData: { constructorOpt: data.hooked },
+            };
             inputTracing.handleReflectedXss(sourceContext, sinkContext);
           }
         });