@contrast/route-coverage 1.53.2 → 1.55.0

package/lib/install/express.js

@@ -31,6 +31,7 @@ const {
 } = require('@contrast/common');
 const Core = require('@contrast/core/lib/ioc/core');
 
+const MAX_REPEATED_TRAVERSALS = 10;
 const METHODS = [
   'all',
   'get',
@@ -260,8 +261,25 @@ class ExpressInstrumentation {
       post(data) {
         const { result } = data;
         if (!result || !data._store || !data[kMetaKey]?.template) return;
+
         // if the layer matches, we know to push corresponding path to store's template segments.
         // we pop this value from the array in hook to all `next` callbacks below.
+
+        // special case if the layer has a route instance (.use wasn't called to create layer)
+        if (data.obj.route) {
+          // the layer might match the path, but the route might not support the method.
+          // in this case don't capture the current template segment.
+          const store = core.scopes.sources.getStore();
+          if (
+            store.sourceInfo?.method &&
+            data.obj.route?.methods &&
+            !data.obj.route.methods[store.sourceInfo.method] &&
+            !data.obj.route.methods._all
+          ) {
+            return;
+          }
+        }
+
         data._store.templateSegments.push(data[kMetaKey].template);
       }
     });
@@ -423,17 +441,24 @@ class ExpressInstrumentation {
 
       // only visit Layer instances
       const maybeLayer = target[key];
-      if (
-        maybeLayer?.constructor?.name == 'Layer' &&
-        !maybeLayer?.stack?.length
-      ) {
-        let _data = data.get(maybeLayer);
-
-        if (!_data) {
-          _data = { paths: [] };
-          data.set(maybeLayer, _data);
-        }
 
+      const _data = data.get(maybeLayer) ?? { paths: [], visitCount: 0 };
+      data.set(maybeLayer, _data);
+
+      // track number of times we've visited a certain member across all paths.
+      _data.visitCount++;
+      _data.paths.push([...path]); // copy because path argument mutates
+
+      // if we've exceeded a "reasonable" number of visits to a certain member
+      // it's likely we've encountered circular references and should stop
+      // traversing that path to prevent a stack overflow.
+      if (_data.visitCount > MAX_REPEATED_TRAVERSALS) {
+        path.pop();
+        continue loopKeys;
+      }
+
+      // Only execute the callback on valid Layer objects.
+      if (maybeLayer?.constructor?.name == 'Layer' && !maybeLayer?.stack?.length) {
         // you can mount a router on itself
         // prevent infinitely recursing into self-mounted routers
         for (const visitedPath of _data.paths) {
@@ -447,8 +472,6 @@ class ExpressInstrumentation {
           }
         }
 
-        _data.paths.push([...path]); // copy because path argument mutates
-
         const halt = cb(path, key, maybeLayer, target) === false;
         if (halt) return;
       }

package/lib/install/fastify/fastify.js

@@ -123,7 +123,7 @@ module.exports = function init(core) {
        *    and prepareRoute({ options: { method, url, options, handler }})
        */
       [
-        { version: '>=3 <4.1.0', routeObj: false },
+        { version: '>=4 <4.1.0', routeObj: false },
         { version: '>=4.1.0 <6', routeObj: true },
       ].forEach(({ version, routeObj }) => {
         // See ../utils/methods

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.53.2",
+  "version": "1.55.0",
   "description": "Handles route discovery and observation",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,15 +20,15 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.39.1",
-    "@contrast/config": "1.55.1",
-    "@contrast/core": "1.60.1",
-    "@contrast/dep-hooks": "1.29.1",
+    "@contrast/common": "1.41.0",
+    "@contrast/config": "1.57.0",
+    "@contrast/core": "1.62.0",
+    "@contrast/dep-hooks": "1.31.0",
     "@contrast/fn-inspect": "^5.0.2",
-    "@contrast/logger": "1.33.1",
-    "@contrast/patcher": "1.32.1",
-    "@contrast/rewriter": "1.37.2",
-    "@contrast/scopes": "1.30.1",
+    "@contrast/logger": "1.35.0",
+    "@contrast/patcher": "1.34.0",
+    "@contrast/rewriter": "1.39.0",
+    "@contrast/scopes": "1.32.0",
     "semver": "^7.6.0"
   }
 }