@datadog/native-iast-rewriter - npm Package Compare versions

Comparing version 2.2.1 to 2.2.2

index.d.ts

@@ -18,6 +18,13 @@ /* tslint:disable */
 }
-export interface ResultWithoutMetrics {
+export interface Result {
   content: string
+  metrics?: Metrics
   literalsResult?: LiteralsResult
 }
+export interface Metrics {
+  status: string
+  instrumentedPropagation: number
+  file: string
+  propagationDebug?: Record<string, number>
+}
 export interface LiteralsResult {
@@ -38,4 +45,4 @@ file: string
   constructor(config?: RewriterConfig | undefined | null)
-  rewrite(code: string, file: string): ResultWithoutMetrics
+  rewrite(code: string, file: string): Result
   csiMethods(): Array<string>
 }

js/source-map/index.js

@@ -17,5 +17,9 @@ 'use strict'
   let rawSourceMap
+
+  // all rewritten source files have the sourceMap inlined
   if (lastLine.indexOf(SOURCE_MAP_INLINE_LINE_START) === 0) {
     const sourceMapInBase64 = lastLine.substring(SOURCE_MAP_INLINE_LINE_START.length)
     rawSourceMap = Buffer.from(sourceMapInBase64, 'base64').toString('utf8')
+
+    // unmodified source files could originally point to a sourceMap file but it could not exist
   } else if (lastLine.indexOf(SOURCE_MAP_LINE_START) === 0) {
@@ -34,4 +38,6 @@ let sourceMappingURL = lastLine.substring(SOURCE_MAP_LINE_START.length)
 function cacheRewrittenSourceMap (filename, fileContent) {
-  const sm = generateSourceMapFromFileContent(fileContent, getFilePathFromName(filename))
-  rewrittenSourceMapsCache.set(filename, sm)
+  if (fileContent) {
+    const sm = generateSourceMapFromFileContent(fileContent, getFilePathFromName(filename))
+    rewrittenSourceMapsCache.set(filename, sm)
+  }
 }
@@ -38,0 +44,0 @@

main.js

@@ -34,3 +34,12 @@ /**
     const response = this.nativeRewriter.rewrite(code, file)
-    cacheRewrittenSourceMap(file, response.content)
+
+    try {
+      const { metrics, content } = response
+      if (metrics?.status === 'modified') {
+        cacheRewrittenSourceMap(file, content)
+      }
+    } catch (e) {
+      this.logError(e)
+    }
+
     return response
@@ -45,13 +54,15 @@ }
     if (config && (config.logger || config.logLevel)) {
-      const logger = config.logger || console
+      this.logger = config.logger || console
       const logLevel = config.logLevel || 'ERROR'
       try {
-        this.nativeRewriter.setLogger(logger, logLevel)
+        this.nativeRewriter.setLogger(this.logger, logLevel)
       } catch (e) {
-        if (logger && logger.error) {
-          logger.error(e)
-        }
+        this.logError(e)
       }
     }
   }
+
+  logError (e) {
+    this.logger?.error?.(e)
+  }
 }
@@ -58,0 +69,0 @@

package.json

 {
   "name": "@datadog/native-iast-rewriter",
   "homepage": "https://github.com/DataDog/dd-native-iast-rewriter-js/blob/main/README.md",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Datadog IAST instrumentation addon for NodeJS",
@@ -6,0 +6,0 @@ "main": "main.js",

wasm/wasm_iast_rewriter.js

 let imports = {};
 imports['__wbindgen_placeholder__'] = module.exports;
 let wasm;
-const { log, setLogger } = require(String.raw`./snippets/native-iast-rewriter-d4af0a093d9a922d/tracer_logger.js`);
+const { log, setLogger } = require(String.raw`./snippets/native-iast-rewriter-51c2417ebcd326ca/tracer_logger.js`);
 const { readFileSync } = require(`fs`);
@@ -343,12 +343,7 @@ const { dirname } = require(`path`);
 
-module.exports.__wbg_readFileSync_9d2ac046a6c252fc = function() { return handleError(function (arg0, arg1) {
-    const ret = readFileSync(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-}, arguments) };
+module.exports.__wbindgen_is_string = function(arg0) {
+    const ret = typeof(getObject(arg0)) === 'string';
+    return ret;
+};
 
-module.exports.__wbg_dirname_6cd5079dafdc58b3 = function() { return handleError(function (arg0, arg1) {
-    const ret = dirname(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-}, arguments) };
-
 module.exports.__wbindgen_error_new = function(arg0, arg1) {
@@ -359,7 +354,2 @@ const ret = new Error(getStringFromWasm0(arg0, arg1));
 
-module.exports.__wbindgen_is_string = function(arg0) {
-    const ret = typeof(getObject(arg0)) === 'string';
-    return ret;
-};
-
 module.exports.__wbindgen_string_new = function(arg0, arg1) {
@@ -370,3 +360,3 @@ const ret = getStringFromWasm0(arg0, arg1);
 
-module.exports.__wbg_log_06c5d79c57195b2e = function() { return handleError(function (arg0, arg1) {
+module.exports.__wbg_log_33ab91ba6d7a49e8 = function() { return handleError(function (arg0, arg1) {
     const ret = log(getObject(arg0), getObject(arg1));
@@ -376,3 +366,13 @@ return addHeapObject(ret);
 
-module.exports.__wbg_setLogger_ed9ea880ce74511a = function() { return handleError(function (arg0) {
+module.exports.__wbg_readFileSync_21fc18548ce041cc = function() { return handleError(function (arg0, arg1) {
+    const ret = readFileSync(getStringFromWasm0(arg0, arg1));
+    return addHeapObject(ret);
+}, arguments) };
+
+module.exports.__wbg_dirname_1da2c21f1f811ed3 = function() { return handleError(function (arg0, arg1) {
+    const ret = dirname(getStringFromWasm0(arg0, arg1));
+    return addHeapObject(ret);
+}, arguments) };
+
+module.exports.__wbg_setLogger_6f2ba6334e64e862 = function() { return handleError(function (arg0) {
     const ret = setLogger(getObject(arg0));
@@ -379,0 +379,0 @@ return addHeapObject(ret);

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2286196

increased by0.7%

Lines of code

1221

increased by1.58%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes