@contrast/route-coverage 1.4.0 → 1.6.0

package/lib/index.d.ts

@@ -17,11 +17,13 @@ import { Installable, Messages, RouteInfo } from '@contrast/common';
 import { Logger } from '@contrast/logger';
 import { Patcher } from '@contrast/patcher';
 import RequireHook from '@contrast/require-hook';
+import { Scopes } from '@contrast/scopes';
 
 export { RouteInfo };
 
 export interface RouteCoverage extends Installable {
   discover(info: RouteInfo): void;
+  delete(info: RouteInfo): void;
   discoveryFinished(): void;
   observe(info: Pick<RouteInfo, 'method' | 'url'>): void;
 }
@@ -31,6 +33,7 @@ export interface Core {
   readonly logger: Logger;
   readonly messages: Messages;
   readonly patcher: Patcher;
+  readonly scopes: Scopes;
 }
 
 declare function init(core: Core): RouteCoverage;

package/lib/index.js

@@ -26,15 +26,20 @@ const { routeIdentifier } = require('./utils/route-info');
 module.exports = function init(core) {
   const { logger, messages, scopes } = core;
 
-  /** @type {Map<string, import('@contrast/common').RouteInfo} */
+  /** @type {Map<string, import('@contrast/common').RouteInfo>} */
   const routeInfo = new Map();
 
   core.routeCoverage = {
+
     discover(info) {
       routeInfo.set(routeIdentifier(info), info);
       messages.emit(Event.ROUTE_COVERAGE_DISCOVERY, info);
     },
 
+    delete(info) {
+      routeInfo.delete(routeIdentifier(info));
+    },
+
     discoveryFinished() {
       const routes = Array.from(routeInfo.values());
       messages.emit(Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, routes);
@@ -52,6 +57,7 @@ module.exports = function init(core) {
       if (store && !store.route) {
         store.route = route;
       }
+
       // these events need source correlation
       messages.emit(Event.ROUTE_COVERAGE_OBSERVATION, {
         ...route,
@@ -64,6 +70,7 @@ module.exports = function init(core) {
     },
   };
 
+  require('./install/express')(core);
   require('./install/fastify')(core);
   require('./install/koa')(core);
 

package/lib/install/express.js

@@ -0,0 +1,138 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+// @ts-check
+'use strict';
+
+const METHODS = [
+  'all',
+  'get',
+  'post',
+  'put',
+  'delete',
+  'patch',
+  'options',
+  'head',
+];
+
+const { createSignature, patchType } = require('./../utils/route-info');
+
+/**
+ * @param {import('..').Core & {
+ *  routeCoverage: import('..').RouteCoverage & {
+ *    express?: import('@contrast/common').Installable
+ *  }
+ * }} core
+ */
+module.exports = function init(core) {
+  const routers = new Map();
+  const { patcher, depHooks, routeCoverage } = core;
+
+  function emitRouteCoverage(router, url, method) {
+    const event = { signature: createSignature(url, method), url, method };
+    const layers = routers.get(router) || [];
+    layers.push(event);
+    routers.set(router, layers);
+    routeCoverage.discover(event);
+  }
+
+  function handleRouteDiscovery(data, method) {
+    const [url, fn] = data.args;
+    if (!url || !fn) {
+      return;
+    }
+    if (Array.isArray(url)) {
+      url.forEach((path) => {
+        emitRouteCoverage(data.result, path, method);
+      });
+    } else {
+      emitRouteCoverage(data.result, url, method);
+    }
+  }
+
+  core.routeCoverage.express = {
+    install() {
+      depHooks.resolve(
+        { name: 'express' },
+        (express) => {
+          patcher.patch(express.Router, 'handle', {
+            name: 'express.Router.handle',
+            patchType,
+            post(data) {
+              // TODO: Can this handle all route observation?
+              const [req] = data.args;
+              const method = req?.method?.toLowerCase();
+              const url = `${req.baseUrl}${req._parsedUrl.pathname}`;
+              if (method) routeCoverage.observe({ url, method });
+            }
+          });
+
+          patcher.patch(express.Router, 'use', {
+            name: 'express.Router.use',
+            patchType,
+            post({ args, result }) {
+              const [prefix, router] = args;
+              const layers = routers.get(router);
+              const updatedLayers = [];
+              if (layers) {
+                layers.forEach((layer) => {
+                  const { url, method } = layer;
+                  const updatedUrl = `${prefix}${url}`;
+                  const event = { signature: createSignature(updatedUrl, method), url: updatedUrl, method };
+                  updatedLayers.push(event);
+                  routeCoverage.delete(layer);
+                  routeCoverage.discover(event);
+                });
+                routers.delete(router);
+                routers.set(result, updatedLayers);
+              }
+            }
+          });
+
+          METHODS.forEach((method) => {
+            patcher.patch(express.application, method, {
+              name: `express.application.${method}`,
+              patchType,
+              post(data) {
+                handleRouteDiscovery(data, method);
+              }
+            });
+
+            patcher.patch(express.Router, method, {
+              name: `express.Router.${method}`,
+              patchType,
+              post(data) {
+                handleRouteDiscovery(data, method);
+              }
+            });
+          });
+        }
+      );
+
+      ['http', 'https', 'spdy'].forEach((name) => {
+        depHooks.resolve({ name }, (module) => {
+          patcher.patch(module.Server.prototype, 'listen', {
+            name: `${name}.Server.prototype.listen`,
+            patchType,
+            post() {
+              routeCoverage.discoveryFinished();
+            }
+          });
+        });
+      });
+    }
+  };
+
+  return core.routeCoverage.express;
+};

package/lib/install/koa.js

@@ -17,33 +17,24 @@
 const { createSignature, patchType } = require('./../utils/route-info');
 
 module.exports = function init(core) {
-  const { patcher, depHooks, routeCoverage, logger } = core;
+  const { patcher, depHooks, routeCoverage } = core;
 
   function emitRouteCoverage(url, method) {
     const event = { signature: createSignature(url, method), url, method };
     routeCoverage.discover(event);
   }
 
-  function emitObservation(url, method) {
-    routeCoverage.observe({ method, url });
-  }
-
-  async function routeObservationMiddleware(ctx, next) {
-    const req = ctx.request;
+  const routeObservationPathClosure = ({ path }) =>
+    async function routeObservationMiddleware(ctx, next) {
+      const req = ctx.request;
 
-    if (req) {
-      const { url, method } = req;
-      try {
-        // Arbitrary basename needed to parse out path
-        const parsedUrl = new URL(url, 'file://').pathname;
-        emitObservation(parsedUrl, method.toLowerCase());
-      } catch (err) {
-        logger.error({ err, url }, 'failed to parse route');
+      if (req) {
+        const { method } = req;
+        routeCoverage.observe({ url: path, method: method.toLowerCase() });
       }
-    }
 
-    await next();
-  }
+      await next();
+    };
 
   function registerRouteHandler(Router) {
     patcher.patch(Router.prototype, 'register', {
@@ -63,7 +54,7 @@ module.exports = function init(core) {
           });
         }
 
-        layer.stack.unshift(routeObservationMiddleware.bind(this));
+        layer.stack.unshift(routeObservationPathClosure({ path }).bind(this));
       }
     });
 

package/lib/utils/route-info.js

@@ -22,7 +22,7 @@ const patchType = 'route-coverage';
  * @param {string} method
  * @return {string} formatted signature
  */
-function createSignature(path, method) {
+function createSignature(path, method = '') {
   return `Router.${method}('${path}', [Function])`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,6 +14,6 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.8.0"
+    "@contrast/common": "1.10.0"
   }
 }