@contrast/protect

Runtime application protection for the Contrast Node.js agent. Enabled by the protect.enable configuration option. Attacks that Protect detects are blocked through @contrast/blocking.

Sub-Components

Policy

lib/policy.js resolves which rules are active and in which mode, from protect.rules.<rule_id>.mode, protect.rules.disabled_rules, and Contrast UI settings. Per-request exclusions narrow the active rules further.

Request Correlation

lib/make-source-context.js and lib/get-source-context.js create and look up the per-request context that the other sub-components share.

Input Analysis

lib/input-analysis/ inspects request inputs (headers, query strings, cookies, bodies, uploads) as each web framework or body parser produces them, with one installer per library in lib/input-analysis/install/. It also handles IP allow and deny lists and virtual patches.

Input Tracing

lib/input-tracing/ checks whether untrusted input reaches dangerous sinks: child_process, eval, Function, vm, fs, outbound HTTP, and database drivers such as mongodb, mysql, postgres, mssql, sqlite3, and sequelize.

Semantic Analysis

lib/semantic-analysis/ analyzes the structure of operations rather than only their inputs, e.g. XML parsing with libxmljs.

Hardening

lib/hardening/ protects inherently unsafe library calls, e.g. node-serialize deserialization.