@contrast/route-coverage 1.5.0 → 1.7.0

package/lib/index.d.ts

@@ -17,13 +17,15 @@ import { Installable, Messages, RouteInfo } from '@contrast/common';
 import { Logger } from '@contrast/logger';
 import { Patcher } from '@contrast/patcher';
 import RequireHook from '@contrast/require-hook';
+import { Scopes } from '@contrast/scopes';
 
 export { RouteInfo };
 
 export interface RouteCoverage extends Installable {
   discover(info: RouteInfo): void;
+  delete(info: RouteInfo): void;
   discoveryFinished(): void;
-  observe(info: Pick<RouteInfo, 'method' | 'url'>): void;
+  observe(info: Pick<RouteInfo>): void;
 }
 
 export interface Core {
@@ -31,6 +33,7 @@ export interface Core {
   readonly logger: Logger;
   readonly messages: Messages;
   readonly patcher: Patcher;
+  readonly scopes: Scopes;
 }
 
 declare function init(core: Core): RouteCoverage;

package/lib/index.js

@@ -26,22 +26,27 @@ const { routeIdentifier } = require('./utils/route-info');
 module.exports = function init(core) {
   const { logger, messages, scopes } = core;
 
-  /** @type {Map<string, import('@contrast/common').RouteInfo} */
+  /** @type {Map<string, import('@contrast/common').RouteInfo>} */
   const routeInfo = new Map();
 
   core.routeCoverage = {
+
     discover(info) {
       routeInfo.set(routeIdentifier(info), info);
       messages.emit(Event.ROUTE_COVERAGE_DISCOVERY, info);
     },
 
+    delete(info) {
+      routeInfo.delete(routeIdentifier(info));
+    },
+
     discoveryFinished() {
       const routes = Array.from(routeInfo.values());
       messages.emit(Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, routes);
     },
 
     observe(info) {
-      const route = routeInfo.get(routeIdentifier(info));
+      const route = info.signature ? info : routeInfo.get(routeIdentifier(info));
 
       if (!route) {
         logger.debug(info, 'unable to observe undiscovered route');
@@ -65,6 +70,7 @@ module.exports = function init(core) {
     },
   };
 
+  require('./install/express')(core);
   require('./install/fastify')(core);
   require('./install/koa')(core);
 

package/lib/install/express.js

@@ -0,0 +1,197 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+// @ts-check
+'use strict';
+
+const METHODS = [
+  'all',
+  'get',
+  'post',
+  'put',
+  'delete',
+  'patch',
+  'options',
+  'head',
+];
+// eslint-disable-next-line node/no-extraneous-require
+const fnInspect = require('@contrast/fn-inspect');
+const { createSignature, patchType } = require('../utils/route-info');
+
+/**
+ * @param {import('..').Core & {
+ *  routeCoverage: import('..').RouteCoverage & {
+ *    express?: import('@contrast/common').Installable
+ *  }
+ * }} core
+ */
+module.exports = function init(core) {
+  const routers = new Map();
+  const signatureMap = new Map();
+  const { patcher, depHooks, routeCoverage } = core;
+
+  function formatUrl(url) {
+    if (Array.isArray(url)) {
+      return `/[${url.join(', ')}]`;
+    } else if (url instanceof RegExp) {
+      return `/{${url.toString().replace(/(^\/?)|(\/?$)/g, '')}}`;
+    } else {
+      return url;
+    }
+  }
+
+  function getLastLayer(router) {
+    if (router.stack) {
+      const len = router.stack.length;
+      return router.stack[len - 1];
+    }
+  }
+
+  function getLayerHandleMethod(layer) {
+    let methodName = 'handle';
+    const __handleData = fnInspect.funcInfo(layer.__handle);
+    if (__handleData && __handleData.file.includes('express-async-errors')) {
+      methodName = '__handle';
+    }
+    return methodName;
+  }
+
+  function patchHandler(layer, route) {
+    if (!layer) return;
+    const handle = getLayerHandleMethod(layer);
+    patcher.patch(layer, handle, {
+      name: 'express.Router.handle',
+      patchType,
+      post(data) {
+        const [req] = data.args;
+        const method = req?.method?.toLowerCase();
+        const url = `${req.baseUrl}${req._parsedUrl.pathname}`;
+        const { signature } = signatureMap.get(route.signature);
+        if (method) routeCoverage.observe({ signature, url, method });
+      }
+    });
+  }
+
+  function createRoute(url, method, id) {
+    const signature = createSignature(url, method);
+    const route = { signature, url, method, id: id || signature };
+    signatureMap.set(signature, route);
+    return route;
+  }
+
+  function discoverRoute({ signature, url, method }) {
+    routeCoverage.discover({ signature, url, method });
+  }
+
+  function instrumentRoute(router, route) {
+    if (!router) return;
+    const layer = getLastLayer(router);
+    patchHandler(layer, route);
+  }
+
+  function updateRoutes(prefix, router, updatedRouter) {
+    const routes = routers.get(router);
+    const updatedLayers = router === updatedRouter
+      ? [] : (routers.get(updatedRouter) || []);
+    if (routes) {
+      routes.forEach((route) => {
+        const { url, method, id } = route;
+        const newRoute = createRoute(`${prefix}${url}`, method, id);
+        updatedLayers.push(newRoute);
+        signatureMap.set(id, newRoute);
+      });
+      routers.set(router, updatedLayers);
+      routers.set(updatedRouter, updatedLayers);
+    }
+  }
+
+  core.routeCoverage.express = {
+    install() {
+      depHooks.resolve(
+        { name: 'express' },
+        (express) => {
+
+          patcher.patch(express.Router, 'use', {
+            name: 'express.Router.use',
+            patchType,
+            post({ args, result }) {
+              const [prefix, router] = args;
+              if (typeof prefix === 'string' && prefix !== '/') {
+                updateRoutes(prefix, router, result);
+              }
+            }
+          });
+
+          patcher.patch(express.application, 'use', {
+            name: 'express.application.use',
+            patchType,
+            post({ args }) {
+              const idx = args.length;
+              const router = args[idx - 1];
+              const routes = routers.get(router);
+              if (routes) {
+                routes.forEach((route) => {
+                  discoverRoute(route);
+                });
+              }
+            }
+          });
+
+          METHODS.forEach((method) => {
+            patcher.patch(express.application, method, {
+              name: `express.application.${method}`,
+              patchType,
+              post({ args, result }) {
+                const [url, fn] = args;
+                if (!url || !fn) return;
+                const route = createRoute(formatUrl(url), method);
+                instrumentRoute(result?._router, route);
+                discoverRoute(route);
+              }
+            });
+
+            patcher.patch(express.Router, method, {
+              name: `express.Router.${method}`,
+              patchType,
+              post({ args, obj: router }) {
+                const [url, fn] = args;
+                if (!url || !fn) return;
+                const route = createRoute(formatUrl(url), method);
+                const routes = routers.get(router) || [];
+
+                instrumentRoute(router, route);
+                routes.push(route);
+                routers.set(router, routes);
+              }
+            });
+          });
+        }
+      );
+
+      ['http', 'https', 'spdy'].forEach((name) => {
+        depHooks.resolve({ name }, (module) => {
+          patcher.patch(module.Server.prototype, 'listen', {
+            name: `${name}.Server.prototype.listen`,
+            patchType,
+            post() {
+              routeCoverage.discoveryFinished();
+            }
+          });
+        });
+      });
+    }
+  };
+
+  return core.routeCoverage.express;
+};

package/lib/utils/route-info.js

@@ -22,7 +22,7 @@ const patchType = 'route-coverage';
  * @param {string} method
  * @return {string} formatted signature
  */
-function createSignature(path, method) {
+function createSignature(path, method = '') {
   return `Router.${method}('${path}', [Function])`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -14,6 +14,6 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.9.0"
+    "@contrast/common": "1.11.0"
   }
 }