@contrast/common - npm Package Compare versions

Comparing version 1.7.0 to 1.8.0

lib/constants.d.ts

@@ -10,3 +10,5 @@ export declare enum Event {
     ASSESS_RESPONSE_SCANNING_FINDING = "assess-response-scanning-findings",
+    RESPONSE_FINISH = "response-finish",
     ROUTE_COVERAGE_DISCOVERY = "route-coverage-discovery",
+    ROUTE_COVERAGE_DISCOVERY_FINISHED = "route-coverage-discovery-finished",
     ROUTE_COVERAGE_OBSERVATION = "route-coverage-observation"
@@ -77,1 +79,2 @@ }
 export declare const BLOCKING_MODES: string[];
+//# sourceMappingURL=constants.d.ts.map

lib/constants.js

@@ -28,3 +28,5 @@ "use strict";
     Event["ASSESS_RESPONSE_SCANNING_FINDING"] = "assess-response-scanning-findings";
+    Event["RESPONSE_FINISH"] = "response-finish";
     Event["ROUTE_COVERAGE_DISCOVERY"] = "route-coverage-discovery";
+    Event["ROUTE_COVERAGE_DISCOVERY_FINISHED"] = "route-coverage-discovery-finished";
     Event["ROUTE_COVERAGE_OBSERVATION"] = "route-coverage-observation";
@@ -31,0 +33,0 @@ })(Event = exports.Event || (exports.Event = {}));

lib/index.d.ts

 import { CommonRulesResultsMap, HardeningResultsMap, ResultMap, SemanticAnalysisResultsMap, ServerFeaturePreliminaryResultsMap } from './types';
 export * from './constants';
 export * from './types';
+export * from './signatures/';
 interface TraverseCallback {
@@ -39,3 +40,3 @@ (path: any[], type: 'Key' | 'Value', value: any, obj: any): unknown;
 export declare function join(arr: Array<any>, ...args: []): string;
-export declare function substring(str: string, ...args: []): string;
+export declare function substring(str: string, ...args: any[]): string;
 export declare function toLowerCase(str: string): string;
@@ -45,1 +46,2 @@ export declare function toUpperCase(str: string): string;
 export declare function trim(str: string, ...args: []): string;
+//# sourceMappingURL=index.d.ts.map

lib/index.js

@@ -35,2 +35,3 @@ "use strict";
 __exportStar(require("./types"), exports);
+__exportStar(require("./signatures/"), exports);
 /**
@@ -184,3 +185,3 @@ * Returns true if the value passed is either a primitive string or a
         const remoteValue = readerFn(remoteData);
-        if (['DEFAULT', 'ContrastUI'].includes(config._sources[name]) && remoteValue != null) {
+        if (['DEFAULT_VALUE', 'CONTRAST_UI'].includes(config._sources[name]) && remoteValue != null) {
             setterFn(targetConfig, name, remoteValue);
@@ -187,0 +188,0 @@ }

lib/types.d.ts

 /// <reference types="node" />
-import { Event, Rule, ProtectRuleMode } from './constants';
 import { EventEmitter } from 'events';
+import { Event, ProtectRuleMode, Rule } from './constants';
+export interface Installable {
+    install(): void | Promise<void>;
+    uninstall?(): void | Promise<void>;
+}
 export interface AppInfo {
@@ -103,2 +107,8 @@ os: {
 }
+export interface SourceInfo {
+    serverType: string;
+    port: number;
+    protocol: string;
+    time: number;
+}
 /**
@@ -115,16 +125,140 @@ * this is known as RequestStore even though, in the future, instrumentation
 export interface RequestStore {
+    sourceInfo?: SourceInfo;
     protect?: ProtectMessage;
     assess?: any;
+    route?: any;
 }
+/**
+ * Architecture Component registration event payload.
+ */
+export interface ArchitectureComponent {
+    /** The type of this component: database, ldap, or web server connection. */
+    type: 'db' | 'ldap' | 'ws';
+    /**
+     * The URL to which this component responds.
+     * @example "mysql://host:3306"
+     */
+    url: string;
+    /**
+     * Some indication of the subtype of the connection.
+     * @example "MySQL"
+     */
+    vendor?: string;
+}
+/**
+ * Library discovery event payload.
+ */
+export interface Library {
+    /**
+     * The time, in ms, that the library was last modified on the filesystem.
+     * Must be greater than 0 and less than 32503679999000 (Tuesday, 31 December 2999 23:59:59).
+     * @todo
+     */
+    externalDate: number;
+    /**
+     * The time, in ms, that the library was last modified on the filesystem.
+     * Must be greater than 0 and less than 32503679999000 (Tuesday, 31 December 2999 23:59:59).
+     * @todo
+     */
+    internalDate: number;
+    /**
+     * The version of the library.
+     * @example "2.18.1"
+     */
+    version: string;
+    /**
+     * Hash of the library. uses the provided SHA sum when present, or a generated
+     * identifer otherwise.
+     * @example "2254143855c5a8c73825e4522baf2ea021766717"
+     * @example "mysql:2.18.1"
+     */
+    hash: string;
+    /**
+     * Name of the library with version data
+     * @example "mysql-2.18.1"
+     */
+    file: string;
+    /**
+     * Homepage or source of the library.
+     * @example "https://github.com/mysqljs/mysql#readme"
+     * @example "https://registry.npmjs.org/mysql/-/mysql-2.18.1.tgz"
+     */
+    url?: string;
+    /**
+     * String describing the library, including name, description, license,
+     * dependencies and dependents.
+     */
+    manifest: string;
+    /**
+     * Library tags provided by the user to the agent.
+     */
+    tags: string;
+}
+/**
+ * Library usage update event payload.
+ */
+export interface LibraryUsage {
+    id: string;
+    names: string[];
+}
+/**
+ * Route discovery or observation event payload.
+ */
+export interface RouteInfo {
+    /**
+     * Language specific signature of the controller method.
+     * @example "Router.get('prefix/route/path', [Function])"
+     */
+    signature: string;
+    /**
+     * The HTTP method supported by the discovered route url, if one is reported.
+     * @example "get"
+     */
+    method?: string;
+    /**
+     * Normalized URL for a route.
+     * @example "prefix/route/path"
+     */
+    url: string;
+}
+/**
+ * Agent event emitter for messaging to/from external systems. Use cases are
+ * reporting agent findings and broadcasting settings updates.
+ *
+ * The final, generic, overloads for emit/on matches any calls that don't match
+ * one of the more specific definitions.
+ */
 export interface Messages extends EventEmitter {
-    addListener(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
-    addListener(event: Event.SERVER_SETTINGS_UPDATE, listener: (msg: Record<string, any>) => void): this;
+    emit(event: Event.ARCHITECTURE_COMPONENT, msg: ArchitectureComponent): boolean;
+    emit(event: Event.ASSESS_DATAFLOW_FINDING, msg: any): boolean;
+    emit(event: Event.LIBRARY, msg: Library): boolean;
+    emit(event: Event.LIBRARY_USAGE, msg: LibraryUsage): boolean;
     emit(event: Event.PROTECT, msg: RequestStore): boolean;
+    emit(event: Event.ROUTE_COVERAGE_DISCOVERY, route: RouteInfo): boolean;
+    emit(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, routes: RouteInfo[]): boolean;
+    emit(event: Event.ROUTE_COVERAGE_OBSERVATION, route: RouteInfo): boolean;
     emit(event: Event.SERVER_SETTINGS_UPDATE, msg: Record<string, any>): boolean;
-    on(event: Event.ARCHITECTURE_COMPONENT, listener: (msg: Record<string, any>) => void): this;
+    emit(event: Event, ...args: any[]): boolean;
+    on(event: Event.ARCHITECTURE_COMPONENT, listener: (msg: ArchitectureComponent) => void): this;
+    on(event: Event.ASSESS_DATAFLOW_FINDING, listenter: (msg: any) => void): this;
+    on(event: Event.LIBRARY, listener: (msg: Library) => void): this;
+    on(event: Event.LIBRARY_USAGE, listener: (msg: LibraryUsage) => void): this;
     on(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
-    on(event: Event.LIBRARY_USAGE, listener: (msg: Record<string, any>) => void): this;
+    on(event: Event.ROUTE_COVERAGE_DISCOVERY, listener: (route: RouteInfo) => void): this;
+    on(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, listener: (routes: RouteInfo[]) => void): this;
+    on(event: Event.ROUTE_COVERAGE_OBSERVATION, listener: (route: RouteInfo) => void): this;
     on(event: Event.SERVER_SETTINGS_UPDATE, listener: (msg: Record<string, any>) => void): this;
-    prependListener(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
-    prependOnceListener(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
+    on(event: Event, listener: (...args: any[]) => void): this;
 }
+/**
+ * Agent event emitter for broadcasting internal lifecycle events.
+ *
+ * The final, generic, overloads for emit/on matches any calls that don't match
+ * one of the more specific definitions.
+ */
+export interface Lifecycle extends EventEmitter {
+    emit(event: Event, ...args: any[]): boolean;
+    on(event: Event.RESPONSE_FINISH, listener: (msg: RequestStore) => void): this;
+    on(event: Event, listener: (...args: any[]) => void): this;
+}
+//# sourceMappingURL=types.d.ts.map

package.json

 {
   "name": "@contrast/common",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Shared constants and utilities for all Contrast Agent modules",
@@ -5,0 +5,0 @@ "license": "UNLICENSED",

src/constants.ts

@@ -25,4 +25,6 @@ /*
   ASSESS_RESPONSE_SCANNING_FINDING = 'assess-response-scanning-findings',
+  RESPONSE_FINISH = 'response-finish',
   ROUTE_COVERAGE_DISCOVERY = 'route-coverage-discovery',
-  ROUTE_COVERAGE_OBSERVATION = 'route-coverage-observation'
+  ROUTE_COVERAGE_DISCOVERY_FINISHED = 'route-coverage-discovery-finished',
+  ROUTE_COVERAGE_OBSERVATION = 'route-coverage-observation',
 }
@@ -29,0 +31,0 @@

src/index.ts

@@ -21,2 +21,3 @@ /*
 export * from './types';
+export * from './signatures/';
 
@@ -201,3 +202,3 @@ interface TraverseCallback {
     const remoteValue = readerFn(remoteData);
-    if (['DEFAULT', 'ContrastUI'].includes(config._sources[name]) && remoteValue != null) {
+    if (['DEFAULT_VALUE', 'CONTRAST_UI'].includes(config._sources[name]) && remoteValue != null) {
       setterFn(targetConfig, name, remoteValue);
@@ -259,3 +260,3 @@ }
 const { substring: origSubstring } = String.prototype;
-export function substring(str: string, ...args: []) {
+export function substring(str: string, ...args: any[]) {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -262,0 +263,0 @@ // @ts-ignore

src/types.ts

@@ -16,5 +16,10 @@ /*
 
-import { Event, Rule, ProtectRuleMode } from './constants';
 import { EventEmitter } from 'events';
+import { Event, ProtectRuleMode, Rule } from './constants';
 
+export interface Installable {
+  install(): void | Promise<void>;
+  uninstall?(): void | Promise<void>;
+}
+
 export interface AppInfo {
@@ -151,2 +156,9 @@ os: {
 
+export interface SourceInfo {
+  serverType: string;
+  port: number;
+  protocol: string;
+  time: number;
+}
+
 /**
@@ -163,20 +175,148 @@ * this is known as RequestStore even though, in the future, instrumentation
 export interface RequestStore {
+  // TODO: this shouldn't be optional but blows up
+  sourceInfo?: SourceInfo;
   protect?: ProtectMessage; // from protect/lib/make-source-context
-  assess?: any // TODO
+  assess?: any;
+  route?: any;
 }
 
+/**
+ * Architecture Component registration event payload.
+ */
+export interface ArchitectureComponent {
+  /** The type of this component: database, ldap, or web server connection. */
+  type: 'db' | 'ldap' | 'ws',
+  /**
+   * The URL to which this component responds.
+   * @example "mysql://host:3306"
+   */
+  url: string;
+  /**
+   * Some indication of the subtype of the connection.
+   * @example "MySQL"
+   */
+  vendor?: string;
+}
+
+/**
+ * Library discovery event payload.
+ */
+export interface Library {
+  /**
+   * The time, in ms, that the library was last modified on the filesystem.
+   * Must be greater than 0 and less than 32503679999000 (Tuesday, 31 December 2999 23:59:59).
+   * @todo
+   */
+  externalDate: number;
+  /**
+   * The time, in ms, that the library was last modified on the filesystem.
+   * Must be greater than 0 and less than 32503679999000 (Tuesday, 31 December 2999 23:59:59).
+   * @todo
+   */
+  internalDate: number;
+  /**
+   * The version of the library.
+   * @example "2.18.1"
+   */
+  version: string;
+  /**
+   * Hash of the library. uses the provided SHA sum when present, or a generated
+   * identifer otherwise.
+   * @example "2254143855c5a8c73825e4522baf2ea021766717"
+   * @example "mysql:2.18.1"
+   */
+  hash: string;
+  /**
+   * Name of the library with version data
+   * @example "mysql-2.18.1"
+   */
+  file: string;
+  /**
+   * Homepage or source of the library.
+   * @example "https://github.com/mysqljs/mysql#readme"
+   * @example "https://registry.npmjs.org/mysql/-/mysql-2.18.1.tgz"
+   */
+  url?: string;
+  /**
+   * String describing the library, including name, description, license,
+   * dependencies and dependents.
+   */
+  manifest: string;
+  /**
+   * Library tags provided by the user to the agent.
+   */
+  tags: string;
+}
+
+/**
+ * Library usage update event payload.
+ */
+export interface LibraryUsage {
+  id: string;
+  names: string[];
+}
+
+/**
+ * Route discovery or observation event payload.
+ */
+export interface RouteInfo {
+  /**
+   * Language specific signature of the controller method.
+   * @example "Router.get('prefix/route/path', [Function])"
+   */
+  signature: string;
+  /**
+   * The HTTP method supported by the discovered route url, if one is reported.
+   * @example "get"
+   */
+  method?: string;
+  /**
+   * Normalized URL for a route.
+   * @example "prefix/route/path"
+   */
+  url: string;
+}
+
+/**
+ * Agent event emitter for messaging to/from external systems. Use cases are
+ * reporting agent findings and broadcasting settings updates.
+ *
+ * The final, generic, overloads for emit/on matches any calls that don't match
+ * one of the more specific definitions.
+ */
 export interface Messages extends EventEmitter {
-  addListener(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
-  addListener(event: Event.SERVER_SETTINGS_UPDATE, listener: (msg: Record<string, any>) => void): this;
-
+  emit(event: Event.ARCHITECTURE_COMPONENT, msg: ArchitectureComponent): boolean;
+  emit(event: Event.ASSESS_DATAFLOW_FINDING, msg: any): boolean;
+  emit(event: Event.LIBRARY, msg: Library): boolean;
+  emit(event: Event.LIBRARY_USAGE, msg: LibraryUsage): boolean;
   emit(event: Event.PROTECT, msg: RequestStore): boolean;
+  emit(event: Event.ROUTE_COVERAGE_DISCOVERY, route: RouteInfo): boolean;
+  emit(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, routes: RouteInfo[]): boolean;
+  emit(event: Event.ROUTE_COVERAGE_OBSERVATION, route: RouteInfo): boolean;
   emit(event: Event.SERVER_SETTINGS_UPDATE, msg: Record<string, any>): boolean;
+  emit(event: Event, ...args: any[]): boolean;
 
-  on(event: Event.ARCHITECTURE_COMPONENT, listener: (msg: Record<string, any>) => void): this;
+  on(event: Event.ARCHITECTURE_COMPONENT, listener: (msg: ArchitectureComponent) => void): this;
+  on(event: Event.ASSESS_DATAFLOW_FINDING, listenter: (msg: any) => void): this;
+  on(event: Event.LIBRARY, listener: (msg: Library) => void): this;
+  on(event: Event.LIBRARY_USAGE, listener: (msg: LibraryUsage) => void): this;
   on(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
-  on(event: Event.LIBRARY_USAGE, listener: (msg: Record<string, any>) => void): this
+  on(event: Event.ROUTE_COVERAGE_DISCOVERY, listener: (route: RouteInfo) => void): this;
+  on(event: Event.ROUTE_COVERAGE_DISCOVERY_FINISHED, listener: (routes: RouteInfo[]) => void): this;
+  on(event: Event.ROUTE_COVERAGE_OBSERVATION, listener: (route: RouteInfo) => void): this;
   on(event: Event.SERVER_SETTINGS_UPDATE, listener: (msg: Record<string, any>) => void): this;
+  on(event: Event, listener: (...args: any[]) => void): this;
+}
 
-  prependListener(event: Event.PROTECT, listener: (msg: RequestStore) => void,): this;
-  prependOnceListener(event: Event.PROTECT, listener: (msg: RequestStore) => void): this;
+/**
+ * Agent event emitter for broadcasting internal lifecycle events.
+ *
+ * The final, generic, overloads for emit/on matches any calls that don't match
+ * one of the more specific definitions.
+ */
+export interface Lifecycle extends EventEmitter {
+  emit(event: Event, ...args: any[]): boolean;
+
+  on(event: Event.RESPONSE_FINISH, listener: (msg: RequestStore) => void): this;
+  on(event: Event, listener: (...args: any[]) => void): this;
 }

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

211111

270.79%

Number of package files

26

100%

Lines of code

6319

466.22%

Worsened metrics

Number of low supply chain risk alerts

2

100%

Number of medium supply chain risk alerts

1

Infinity%

No dependency changes