Use process.nextTick before wrapping Collection

exports.Collection = void 0; const collection_1 = require("./collection"); Object.defineProperty(exports, "Collection", { enumerable: true, get: function () { return collection_1.Collection; } }); For some reason the Collection is undefined in our callback, let's wait until the next tick to grab a reference to Collection.
AikidoSec · Dec 5, 2024 · 3b819b0 · 3b819b0
1 parent b453310
commit 3b819b0
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 32 deletions.
diff --git a/library/package-lock.json b/library/package-lock.json
diff --git a/library/package.json b/library/package.json
@@ -94,7 +94,7 @@
     "mongodb": "~6.9",
     "mongodb-v4": "npm:mongodb@^4.0.0",
     "mongodb-v5": "npm:mongodb@^5.0.0",
-    "mongodb-v6": "npm:mongodb@~6.9",
+    "mongodb-v6": "npm:mongodb@^6.0.0",
     "mysql": "^2.18.1",
     "mysql2": "^3.10.0",
     "needle": "^3.3.1",
@@ -110,12 +110,12 @@
     "tap": "^18.6.1",
     "type-fest": "^4.24.0",
     "typescript": "^5.3.3",
-    "xml-js": "^1.6.11",
-    "xml2js": "^0.6.2",
     "undici-v4": "npm:undici@^4.0.0",
     "undici-v5": "npm:undici@^5.0.0",
     "undici-v6": "npm:undici@^6.0.0",
-    "undici-v7": "npm:undici@^7.0.0"
+    "undici-v7": "npm:undici@^7.0.0",
+    "xml-js": "^1.6.11",
+    "xml2js": "^0.6.2"
   },
   "scripts": {
     "test": "node ../scripts/run-tap.js",

diff --git a/library/sinks/MongoDB.ts b/library/sinks/MongoDB.ts
@@ -2,6 +2,7 @@
 import type { Collection } from "mongodb-v6";
 import { Hooks } from "../agent/hooks/Hooks";
 import { InterceptorResult } from "../agent/hooks/InterceptorResult";
+import type { WrapPackageInfo } from "../agent/hooks/WrapPackageInfo";
 import { detectNoSQLInjection } from "../vulnerabilities/nosql-injection/detectNoSQLInjection";
 import { isPlainObject } from "../helpers/isPlainObject";
 import { Context, getContext } from "../agent/Context";
@@ -186,33 +187,42 @@ export class MongoDB implements Wrapper {
     return undefined;
   }
 
+  private wrapCollection(
+    exports: typeof import("mongodb-v6"),
+    pkgInfo: WrapPackageInfo
+  ) {
+    const collectionProto = exports.Collection.prototype;
+
+    OPERATIONS_WITH_FILTER.forEach((operation) => {
+      wrapExport(collectionProto, operation, pkgInfo, {
+        inspectArgs: (args, agent, collection) =>
+          this.inspectOperation(operation, args, collection as Collection),
+      });
+    });
+
+    wrapExport(collectionProto, "bulkWrite", pkgInfo, {
+      inspectArgs: (args, agent, collection) =>
+        this.inspectBulkWrite(args, collection as Collection),
+    });
+
+    wrapExport(collectionProto, "aggregate", pkgInfo, {
+      inspectArgs: (args, agent, collection) =>
+        this.inspectAggregate(args, collection as Collection),
+    });
+
+    wrapExport(collectionProto, "distinct", pkgInfo, {
+      inspectArgs: (args, agent, collection) =>
+        this.inspectDistinct(args, collection as Collection),
+    });
+  }
+
   wrap(hooks: Hooks) {
     hooks
       .addPackage("mongodb")
       .withVersion("^4.0.0 || ^5.0.0 || ^6.0.0")
       .onRequire((exports, pkgInfo) => {
-        const collectionProto = exports.Collection.prototype;
-
-        OPERATIONS_WITH_FILTER.forEach((operation) => {
-          wrapExport(collectionProto, operation, pkgInfo, {
-            inspectArgs: (args, agent, collection) =>
-              this.inspectOperation(operation, args, collection as Collection),
-          });
-        });
-
-        wrapExport(collectionProto, "bulkWrite", pkgInfo, {
-          inspectArgs: (args, agent, collection) =>
-            this.inspectBulkWrite(args, collection as Collection),
-        });
-
-        wrapExport(collectionProto, "aggregate", pkgInfo, {
-          inspectArgs: (args, agent, collection) =>
-            this.inspectAggregate(args, collection as Collection),
-        });
-
-        wrapExport(collectionProto, "distinct", pkgInfo, {
-          inspectArgs: (args, agent, collection) =>
-            this.inspectDistinct(args, collection as Collection),
+        process.nextTick(() => {
+          this.wrapCollection(exports, pkgInfo);
         });
       });
   }