Node.js release notes 2020

Certain types of XML uploads result in an XXE false negative. (SUP-2287)

Input exclusions for Assess are supported. You can exclude findings based on input type or name.

Optimized performance when sourcemaps is enabled.

Flowmaps now have better accuracy in reporting architectural components.

Node.js 14 is now supported.

Improved accuracy of line number reporting for vulnerabilities with source mapping.

Agent fails to instrument in Node 14 running on Windows. (SUP-2230)

Added support for sequelize sql-string format methods.

Found false negative with Node.js loopback in Protect mode. (SUP-2009)

Need to add support for fs.createWriteStream as a Protect sink. (SUP-2013)

Restify 8 framework support is now available.

An Insecure Encryption Algorithm finding reports an incorrect code location. (SUP-1852)

FastifyFramework did not emit all headers in 'send' event.

The 3.X version of the agent sets the default behavior to communicate and report to Contrast using the Contrast service.

The new rewrite_cache property will cache the app code rewritten by Contrast on startup and can improve subsequent startup time. This property is disabled by default but can be enabled.

With the 3.X version of the Node.js agent, the Contrast service is enabled by default but can still be disabled. Because of this, you will need to download the new 3.X agent binary through npm (recommended) or through Contrast.. Please contact Support if you have any questions about this change.

Tracking strings which include the + operator create a performance issue. (SUP-1975)

This release sets default behavior of the Node.js agent to communicate and report to Contrast directly, without using the Contrast Service. This undoes a breaking change that was introduced in the 2.x.x branch back in February of 2020.

New performance diagnostic features are now available for Contrast Customer Success to help diagnose performance issues.

Added the capability to track untrusted data through the node.js url.domainToASCII and url.domainToUnicode functions.

The agent.node.unsafe.deadzones option will now trim whitespace around each option.

This version marks the last new release for the 2.x.x branch. Only patch releases will be provided going forward for the 2.18.x branch.

Customers will be required to upgrade to version 3.x.x (available September 2020) to gain additional capabilities in the Node.js agent. Version 3.0.0 of the Contrast Node.js agent will have potentially impactful changes which should be assessed by each customer for their specific application.

The server.path config option is not being passed to Contrast when using the Contrast service for communication. (SUP-1838)

Node agent Lodash dependency updated to 4.17.20 to resolve CVE-2020-8203. (SUP-1883)

Resolve TypeError: replacer.replace is not a function. (SUP-1888)

Agent breaks expected express-async-errors behavior. (SUP-1801)

Added multiple architecture changes and fixes that improve Assess performance.

Added support for URL Exclusions when using Assess. In Contrast, you can designate URLs that ignore selected rules or all rules. The agent now respects these settings for Assess rules in the Node.js agent.

Protect rule modes now default to OFF for best backward and forward compatibility.

Improved Fastify support to work better with GraphQL and Apollo Server.

Removed support for Protect Cross-site Request Forgery (CSRF).

Updated the version of Lodash used by the Node.js agent to 4.17.19 in response to a CVE for Lodash 4.17.15.

Version 3.0.0 of the Node.js agent will be released at the end of August and will introduce these changes:

All new features will only be available for 3.0.0 and higher. Version 2.18.0 will also be released at the end of August and will be the final version that doesn't require the Contrast service. This version will continue to be supported for patch releases.

There are two optional features that may be useful to some customers. Contact your Customer Success Representative if you would like to know more about these:

Node.js agent failed to initialize. Missing gRPC framework was resolved.

An exception occurred because of a syntax error for Fastify. This was fixed.

Crash when requiring the aws-s3 module was resolved.

Multiple architecture and performance improvements.

New gRPC communication protocol between the agent service improves performance.

Removed name and value cookie sources for reflected XXS per updated guidance for both Assess and Protect.

Added a sensor for SQLite for Protect.

Added support for Koa version 2.12.

Reflected XSS is now not reported if Content-Type is allowlisted as safe.

A major version release for the Node.js agent is planned for late July or August 2020. Node.js agent version 3.0.0 will introduce breaking changes for customers using the 2.x.x version of the agent and service.

Implemented multiple bug fixes due to the introduction of the gRPC communication protocol between the JavaScript agent and the agent service

Implemented fixes to resolve route coverage issues that surface when using graphQL, Apollo Server, and Fastify

Resolved a false positive issue when correctly using Sequelize to escape strings.

Resolved exception when fastify.route is called with an uppercase verb.

Resolved an issue that manifested as reporting duplicate routes when using the Express framework.

New recommendations for installing and running the Node.js agent have been released.

The customer application would fail to start when all Assess rules were disabled. This is fixed now.

The customer application would fail to start because worker threads would hang and generate multiple processes with the same pid. This is fixed now.

The agent would not output the security log to stdout (or stderr). This is fixed now.

Duplicated vulnerabilities were being reported for unique routes. This is fixed so that TeamServer displays distinct findings for each request uri.

An out-of-memory error caused by a regex match resulted in an infinite loop. This has been fixed.

Node.js agent’s migration to npm and incorrectly bundled modules made it seem like the agent was missing two dependencies. This has been resolved.

Fastify framework support: Fastify 2.x is now a supported framework for the Contrast Node.js agent

NPM availability: The Contrast Node.js agent can now be installed directly from the Contrast Security public NPM repository

Pre-load capabilities: The Node.js agent can now be run as a pre-load module using the -r flag. This is also now the recommended method of running the Contrast Node.js agent.

Running the node agent as a runner will now generate a deprecation message. This is the deprecated syntax:

node-contrast<app-main>

The agent will continue to function when executed as a runner. However, we encourage customers to migrate to the new method of running the Contrast Node.js agent as this is no longer recommended.

After architecture improvements were made to the agent, some applications were prevented from starting with the agent. This has been resolved and users should no longer receive error messages like these:

cls.run(() => {
    ^
TypeError: Cannot read property 'run' of undefined

OR

/usr/src/app/node_modules/node_contrast/lib.asar/AsyncStorage/index.js:188
    if (ns.active) {

TypeError: Cannot read property 'active' of undefined