Socket
Socket
Sign inDemoInstall

@contrast/assess

Package Overview
Dependencies
Maintainers
0
Versions
49
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@contrast/assess - npm Package Compare versions

Comparing version 1.32.0 to 1.33.0

9

lib/dataflow/tracker.js

@@ -19,3 +19,3 @@ /*

const distringuish = require('@contrast/distringuish');
const { isString } = require('@contrast/common');
const { BufferPrototypeToString, BufferFrom, isString } = require('@contrast/common');

@@ -62,2 +62,7 @@ module.exports = function tracker(core) {

if (typeof value === 'string') {
// todo: don't track string representations of numbers
// if (!isNaN(+value)) {
// return { extern: null };
// }
if (distringuish.getProperties(value)) {

@@ -73,3 +78,3 @@ const err = new Error();

// Try work-around for some wrong/unknown encoding
extern = distringuish.externalize(Buffer.from(value).toString());
extern = distringuish.externalize(BufferPrototypeToString.call(BufferFrom(value)));
}

@@ -76,0 +81,0 @@

@@ -40,5 +40,14 @@ /*

const ctx = sources.getStore()?.assess;
// <unsafe>
// This method is expected to be called by all Assess instrumentation components prior to doing work.
// Until we check policy, and whether instrumentation is locked, any instrumentation that is called before
// the </unsafe> section below will result in infinite recursion.
//
// E.g. Uncommenting any line below will cause a stack overflow:
// 'asdf'.concat()
// console.log() // even though this is deadzoned, we haven't checked whether instrumentation is locked yet
//
// policy will not exist if assess is altogether disabled for the active request e.g. url exclusion
if (!ctx?.policy || instrumentation.isLocked()) return null;
// </unsafe> but still be careful

@@ -45,0 +54,0 @@ switch (type) {

{
"name": "@contrast/assess",
"version": "1.32.0",
"version": "1.33.0",
"description": "Contrast service providing framework-agnostic Assess support",

@@ -20,3 +20,3 @@ "license": "SEE LICENSE IN LICENSE",

"dependencies": {
"@contrast/common": "1.23.0",
"@contrast/common": "1.24.0",
"@contrast/distringuish": "^5.0.0",

@@ -23,0 +23,0 @@ "@contrast/scopes": "1.4.1"

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc