コンテナを使用してNode.jsエージェントをインストール

Node.js エージェントのリライタCLI を使用する場合は、エージェントのリライタCLIの説明を参照して下さい。

アプリケーションを起動する際に、Contrastエージェントを先にロードしておく必要があります。通常は、これはDockerfileのCMD文で行いますが、package.jsonに定義したnpmスクリプトも使用できます。

例えば、通常アプリケーションを次のように起動する場合：

CMD [“node”, “app”]

次のコマンドを使用すると、Contrastを有効にしてアプリケーションを実行できます。

CMD [“node”, “--import”, “@contrast/agent”, “app”]

エージェントが起動すると、エージェントの認証キーを使用してContrastサーバへの接続を試みます。

docker run 
-e CONTRAST__API_ 
-e CONTRAST__API__API_KEY=<value> 
-e CONTRAST__API__SERVICE_KEY=<value> 
-e CONTRAST__API__USER_NAME=<value> 
-e CONTRAST__SERVER__ENVIRONMENT=<value> image_with_contrast

コンテナのログのアクティビティをチェックして、Contrastが実行されていることを確認します。

例えば、ログアクティビティは以下のようになります。

2025-01-02 10:54:46 {"level":30,"time":1735833286319,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"Starting @contrast/agent v5.23.0"}
2025-01-02 10:54:46 {"level":30,"time":1735833286319,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","config":{"_errors":[],"enable":"true","api":{"enable":"true","url":"https://teamserver-darpa-agents.contsec.com/Contrast","api_key":"contrast-redacted-api.api_key","service_key":"contrast-redacted-api.service_key","user_name":"agent_b47d608e-1971-4560-961c-a55bd4111b61@Alexstestorg","token":"contrast-redacted-api.token","proxy":{"enable":"false","url":"undefined"}},"agent":{"stack_trace_limit":"10","stack_trace_filters":"agent-,@contrast,node-agent","diagnostics":{"enable":"true","report_path":"/juice-shop"},"route_coverage":{"enable":"true"},"reporters":{"file":"undefined"},"heap_dump":{"enable":"false","path":"contrast_heap_dumps","delay_ms":"10000","window_ms":"10000","count":"5"},"polling":{"app_activity_ms":"30000","app_settings_ms":"30000","app_update_ms":"30000","server_settings_ms":"30000"},"logger":{"path":"/juice-shop/contrast.log","level":"info","append":"true","stdout":"true"},"security_logger":{"path":"/juice-shop/security.log","level":"error","stdout":"false","syslog":{"enable":"false","ip":"127.0.0.1","port":"514","facility":"19","severity_exploited":"alert","severity_blocked":"notice","severity_blocked_perimiter":"notice","severity_probed":"warning","severity_suspicious":"warning"}},"node":{"app_root":"/juice-shop","cmd_ignore_list":"","exclusive_entrypoint":"undefined","rewrite":{"enable":"true","cache":{"enable":"true","path":"/juice-shop/.contrast"}},"source_maps":{"enable":"true"},"library_usage":{"reporting":{"enable":"true","interval_ms":"100"}},"metrics":{"enable":"true","warn_ms":"5000"},"npm_path":"npm"}},"inventory":{"analyze_libraries":"true","gather_metadata_via":"undefined"},"assess":{"enable":"false","probabilistic_sampling":{"enable":"false","base_probability":"0.1","route_monitor":{"enable":"true","ttl_ms":"1800000"}},"tags":"undefined","stacktraces":"ALL","max_context_source_events":"150","max_propagation_events":"500","safe_positives":{"enable":"false"},"trust_custom_validators":"false"},"protect":{"enable":"false","probe_analysis":{"enable":"true"},"rules":{"disabled_rules":"","cmd-injection":{"mode":"off"},"cmd-injection-command-backdoors":{"mode":"off"},"cmd-injection-semantic-chained-commands":{"mode":"off"},"cmd-injection-semantic-dangerous-paths":{"mode":"off"},"crypto-bad-mac":{"mode":"off"},"crypto-bad-ciphers":{"mode":"off"},"crypto-weak-randomness":{"mode":"off"},"method-tampering":{"mode":"off"},"nosql-injection":{"mode":"off"},"nosql-injection-mongo":{"mode":"off"},"path-traversal":{"mode":"off"},"path-traversal-semantic-file-security-bypass":{"mode":"off"},"reflected-xss":{"mode":"off"},"sql-injection":{"mode":"off"},"ssjs-injection":{"mode":"off"},"ssrf":{"mode":"off"},"unsafe-code-execution":{"mode":"off"},"unsafe-file-upload":{"mode":"off"},"untrusted-deserialization":{"mode":"off"},"xxe":{"mode":"off"},"unvalidated-redirect":{"mode":"off"}}},"application":{"name":"mw-juice-slim","path":"/","group":"undefined","code":"undefined","version":"undefined","tags":"undefined","metadata":"undefined","session_id":"undefined","session_metadata":"undefined"},"server":{"name":"5d9ee61ac84f","type":"Node.js v20.15.0","environment":"undefined","tags":"undefined","version":"undefined","discover_cloud_resource":"true"}},"msg":"Agent configuration"}
2025-01-02 10:54:46 {"level":30,"time":1735833286328,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","strategy":1,"msg":"updating assess sampler"}
2025-01-02 10:54:48 {"level":30,"time":1735833287906,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"Received new log level: debug from server-features"}
2025-01-02 10:54:48 {"level":30,"time":1735833287907,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"assess sampling disabled"}
2025-01-02 10:54:48 {"level":30,"time":1735833287907,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","enabledRules":["bot-blocker","cmd-injection","cmd-injection-command-backdoors","cmd-injection-semantic-chained-commands","cmd-injection-semantic-dangerous-paths","crypto-bad-mac","crypto-bad-ciphers","crypto-weak-randomness","ip-denylist","method-tampering","nosql-injection","nosql-injection-mongo","path-traversal","path-traversal-semantic-file-security-bypass","reflected-xss","sql-injection","ssjs-injection","ssrf","unsafe-code-execution","unsafe-file-upload","untrusted-deserialization","virtual-patch","xxe","unvalidated-redirect","autocomplete-missing","cache-controls-missing","clickjacking-control-missing","parameter-pollution","csp-header-missing","csp-header-insecure","hsts-header-missing","x-powered-by-header","xcontenttype-header-missing","xxssprotection-header-disabled","httponly","secure-flag-missing"],"msg":"Assess policy enabled rules updated"}
2025-01-02 10:54:48 {"level":30,"time":1735833287907,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","policy":{"exclusions":{"url":[],"querystring":[],"header":[],"body":[],"cookie":[],"parameter":[]},"bot-blocker":"block_at_perimeter","cmd-injection":"monitor","cmd-injection-command-backdoors":"monitor","cmd-injection-semantic-chained-commands":"monitor","cmd-injection-semantic-dangerous-paths":"monitor","crypto-bad-mac":"off","crypto-bad-ciphers":"off","crypto-weak-randomness":"off","ip-denylist":"off","method-tampering":"monitor","nosql-injection":"monitor","nosql-injection-mongo":"monitor","path-traversal":"monitor","path-traversal-semantic-file-security-bypass":"monitor","reflected-xss":"monitor","sql-injection":"monitor","ssjs-injection":"monitor","ssrf":"off","unsafe-code-execution":"off","unsafe-file-upload":"off","untrusted-deserialization":"monitor","virtual-patch":"off","xxe":"monitor","unvalidated-redirect":"off","rulesMask":510},"msg":"Protect policy updated"}
2025-01-02 10:54:53 {"level":30,"time":1735833293571,"tid":2,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"Received new log level: debug from server-features"}
2025-01-02 10:54:53 {"level":30,"time":1735833293437,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"The Contrast Node Agent collects usage data in order to help us improve compatibility and security coverage.\nThe data is anonymous and does not contain application data. It is collected by Contrast and is never shared.\nYou can opt-out of telemetry by setting the CONTRAST_AGENT_TELEMETRY_OPTOUT environment variable to '1' or 'true'.\n"}
2025-01-02 10:54:53 {"level":20,"time":1735833293504,"tid":0,"pid":1,"hostname":"5d9ee61ac84f","name":"contrast","msg":"deploying function toString patch"}
2025-01-02 10:55:00 info: Detected Node.js version v20.15.0 (OK)
2025-01-02 10:55:00 info: Detected OS linux (OK)
2025-01-02 10:55:00 info: Detected CPU arm64 (OK)
....