Node.js - 2.14

Compatibility: v2 v3 Express
What's new? Release Notes
ID: com.castsoftware.nodejs

Description

This extension provides support for Node.js. Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine external link. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient.

CAST recommends using this extension with HTML5 and JavaScript ≥ 2.2.5 for the best results.

In what situation should you install this extension?

Regarding Front-End to Back-End connections, we do support the following cross-technology stacks:
iOS Front-End connected to Node.js/PostgreSQL Back-end iOS Front-End connected to Node.js/MSSQL Back-end AngularJS Front-End connected to Node.js/MongoDB_ Back-end

If your Web application contains Node.js source code, and you want to view these object types and their links with other objects, then you should install this extension:

  • creates a Node.js application object when an instance has been found
  • creates Node.js operations which represent entry-points of web services

Supported Node.js versions

Version Support Comment
v0.x ❌ No longer supported
v4.x ✅ LTS
v5.x ✅ Based on Javascript ES6
v6.x ✅ Based on Javascript ES6
v7.x ✅ Based on Javascript ES6
v8.x ✅
v9.x ✅
v10.x ✅
v11.x ✅
v12.x ✅
v13.x ✅
v14.x ✅
v15.x ✅
v16.x ✅
v17.x ✅
v18.x ✅
v19.x ✅
v20.x ✅
v21.x ✅
v22.x ✅
v23.x ✅
v24.x ✅
v25.x ✅

Node.js Ecosystem

Node.js comes with numerous libraries and frameworks bringing data access, web services calls, microservices architectures. This list contains all supported libraries:

Library Comment Data Access Web Service Messaging Cloud code execution Remote Process Call
AWS.DynamoDB Amazon database access ✅
AWS.S3 Amazon storage service ✅
AWS.SQS Amazon messaging service ✅
AWS Lambda Cloud code execution ✅
aws-amplify A library for AWS ✅
Axios HTTP request client ✅
Azure blobs Azure storage service ✅
Azure Service Bus Azure Queue Service ✅
Azure Event Hubs Azure Queue Service ✅
Azure Function Cloud code execution ✅
Cosmos DB Microsoft Azure NoSQL Database solution ✅
Couchdb Couchdb access ✅
Couchdb-nano Couchdb access ✅
cross-fetch Fetch API for Node ✅
elasticsearch Open-source search engine ✅
EventSource A library for the EventSource client ✅
Express Node.js application framework ✅
falcor A library for data fetching ✅
fetch Fetch API for Node ✅
GCP Bigtable GCP database access ✅
GCP Cloud Storage GCP storage service ✅
GCP Pub/Sub GCP messaging service ✅
got HTTP request client ✅
g-RPC Remote Process Call service ✅
Hapi Node.js application framework ✅
isomorphic-fetch Fetch API for Node ✅
Knex Node.js SQL query builder ✅
Koa Node.js application framework ✅
Loopback Node.js application framework ✅ ✅
Marklogic Marklogic access ✅
Memcached Storage framework ✅
Mongodb (node-mongodb-native) MongoDB access ✅
Mongo-client MongoDB access ✅
Mongoose MongoDB access ✅
MQTT Messaging library ✅
mssql MsSQL access ✅
my_connection MySQL access ✅
mysql2 MySQL2 access ✅
Node-couchdb Couchdb access ✅
oracledb Oracle Database access ✅
pg PostgreSQL access ✅
prisma MsSQL, MySQL, PostgreSQL, MongoDB accesses ✅
redis Redis access ✅
request HTTP request client ✅
request-promise HTTP request client ✅
request-promise-native HTTP request client ✅
request-promise-any HTTP request client ✅
Sails Node.js application framework ✅ ✅
Seneca Microservice toolkit ✅
sequelize Postgres, MySQL, SQLite, MsSQL, Oracle accesses ✅
sqlite3 SQLite3 access ✅
superagent HTTP request client ✅
tedious Tedious access ✅
WebSocket WebSocket request ✅
whatwg-fetch Fetch API for Node ✅
WLResourceRequest Client Security API ✅
wretch A wrapper built around fetch API ✅
XMLHttpRequest A wrapper for HTTP request client ✅

Transactions

Transaction support is derived from metamodel concepts used to build CAST Imaging Blueprint and structural transaction flows. Entry Points start transactions; Exit Points include both output/boundary concepts and Data Entities manipulated by transactions.

Role Support Breakdown
Entry Point
  • Message Queue Subscriber
  • Exposed Web Services
Exit Point
  • Message Queue Publisher
  • Run Service
  • Web Services Call
Unresolved Storage
  • Data Entity
  • Data Query
Data Entities
  • Cloud FileStorage
  • Collection

Data version: 2.14.0-funcrel

ISO 5055 Structural Rules

Quality support is based on ISO 5055 structural rules available for the selected extension version.

Reliability Maintainability Security Performance Efficiency

Data version: 2.14.0-funcrel

Comparison with existing support for JavaScript

CAST AIP has provided support for analyzing JavaScript via its JEE and .NET analyzers (provided out of box in CAST AIP) for some time now. The HTML5/JavaScript extension (on which the Node.js extension depends) also provides support for JavaScript but with a focus on web applications. CAST highly recommends that you use this extension if your Application contains JavaScript and more specifically if you want to analyze a web application, however you should take note of the following:

  • You should ensure that you configure the extension to NOT analyze the back end web client part of a .NET or JEE application.
  • You should ensure that you configure the extension to ONLY analyze the front end web application built with the HTML5/JavaScript that communicates with the back end web client part of a .NET or JEE application.
  • If the back end web client part of a .NET or JEE application is analyzed with the Node.js extension and with the native .NET/JEE analyzers, then your results will reflect this - there will be duplicate objects and links (i.e. from the analyzer and from the extension) therefore impacting results and creating erroneous Function Point data.

In CAST AIP ≥ 8.3.x support for analyzing JavaScript has been withdrawn from the JEE and .NET analyzers.

Dependencies with other extensions

Some CAST extensions require the presence of other CAST extensions in order to function correctly. The Node.js extension requires that the following other CAST extensions are also installed:

Note that when using the CAST Extension Downloader to download the extension and the Manage Extensions interface in CAST Server Manager to install the extension, any dependent extensions are automatically downloaded and installed for you. You do not need to do anything.

Download and installation instructions

The extension will be automatically downloaded and installed in CAST Console. You can manage the extension using the Application - Extensions interface:

Analysis with CAST Imaging Console

CAST Imaging Console exposes the technology configuration options once a version has been accepted/imported, or an analysis has been run. Click Universal Technology (3) in the Config (1) > Analysis (2) tab to display the available options for your Node.js source code:

Then choose the relevant Analysis Unit (1) to view the configuration:

Analysis warning and error messages

Message ID Message Type Logged during Impact Remediation Action
NODEJS-001 Warning Analysis An internal issue occurred when parsing a statement in a file. A part of a file was badly analyzed. Contact external link CAST Technical Support

What results can you expect?

Node.js source code will be categorised in CAST Dashboards as “HTML5/JavaScript”.

Once the analysis/snapshot generation has completed, you can view the results in the normal manner (for example via CAST Enlighten):

Node.js application with MongoDB data storage exposing web services

Detailed analysis results per framework

See below for more details about how the extension handles each supported framework: Results.

Objects

The following specific objects are displayed in CAST Enlighten:

Type Name Description
NodeJS Application NodeJS Application Represents an application-level entry point or application container detected in Node.js code.
NodeJS AWS S3 Bucket NodeJS S3 Bucket Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS AWS Unknown S3 Bucket NodeJS S3 Unknown Bucket Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS Azure Blob Container NodeJS Azure Blob Container Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS Azure Unknown Blob Container NodeJS Azure Unknown Blob Container Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS GCP Cloud Storage Bucket NodeJS GCP Cloud Storage Bucket Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS GCP Unknown Cloud Storage Bucket NodeJS GCP Unknown Cloud Storage Bucket Represents a cloud storage bucket or blob container used by the Node.js application.
NodeJS Azure Function NodeJS Azure Function Represents a serverless cloud function detected from Node.js or cloud infrastructure code.
NodeJS Call to AWS Lambda Function NodeJS AWS call to Lambda Function Represents a call from Node.js code to a serverless cloud function.
NodeJS Call to AWS Unknown Lambda Function NodeJS AWS call to unknown Lambda Function Represents a call from Node.js code to a serverless cloud function.
NodeJS Call to Azure Function NodeJS Call to Azure Function Represents a call from Node.js code to a serverless cloud function.
NodeJS Call to Unknown Azure Function NodeJS Call to Unknown Azure Function Represents a call from Node.js code to a serverless cloud function.
NodeJS AWS DynamoDB Table NodeJS AWS DynamoDB Table Represents a database table, collection, index, or equivalent persisted data container.
NodeJS collection NodeJS Collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS CosmosDB Collection NodeJS CosmosDB Collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS CosmosDB Unknown Collection NodeJS CosmosDB Unknown Collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Elasticsearch Index NodeJS Elasticsearch Index Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Elasticsearch Unknown Index NodeJS Elasticsearch Unknown Index Represents a database table, collection, index, or equivalent persisted data container.
NodeJS GCP Bigtable table NodeJS GCP Bigtable table Represents a database table, collection, index, or equivalent persisted data container.
NodeJS GCP Unknown Bigtable table NodeJS GCP Unknown Bigtable table Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Marklogic collection NodeJS Marklogic collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Memcached Value NodeJS Memcached Value Represents a database table, collection, index, or equivalent persisted data container.
NodeJS MongoDB collection NodeJS MongoDB collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Redis Collection NodeJS Redis Collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Unknown Database Table NodeJS Unknown Database Table Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Unknown MongoDB collection NodeJS Unknown MongoDB collection Represents a database table, collection, index, or equivalent persisted data container.
NodeJS Port NodeJS Port Represents a configuration object or runtime setting detected for the Node.js application.
Prisma Configuration Prisma Configuration Represents a configuration object or runtime setting detected for the Node.js application.
NodeJS Express Controller NodeJS Express Controller Represents a controller component that handles application routing or request dispatching.
NodeJS Entity NodeJS Entity Represents an entity or entity operation detected in Node.js data access code.
NodeJS Entity Operation NodeJS Entity Operation Represents an entity or entity operation detected in Node.js data access code.
NodeJS SQL Query NodeJS SQL Query Represents a SQL query detected in Node.js code.
NodeJS GCP Pub/Sub Subscription NodeJS GCP Pub/Sub Subscription Represents a messaging resource used by the Node.js application.
NodeJS AWS Kinesis Producer NodeJS AWS Kinesis Producer Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS SNS Publisher NodeJS AWS SNS Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS SQS Publisher NodeJS AWS SQS Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS Unknown Kinesis Producer NodeJS AWS Unknown Kinesis Producer Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS Unknown SNS Publisher NodeJS AWS SNS Unknown Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS Unknown SQS Publisher NodeJS AWS SQS Unknown Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS Azure Event Hub Publisher NodeJS Azure Event Hub Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS Azure Service Bus Publisher NodeJS Azure Service Bus Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS Azure Unknown Event Hub Publisher NodeJS Azure Unknown Event Hub Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS Azure Unknown Service Bus Publisher NodeJS Azure Unknown Service Bus Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS GCP Pub/Sub Publisher NodeJS GCP Pub/Sub Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS GCP Unknown Pub/Sub Publisher NodeJS GCP Unknown Pub/Sub Publisher Represents a message publishing operation to a queue, topic, stream, or event bus.
NodeJS AWS Kinesis Consumer NodeJS AWS Kinesis Consumer Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS AWS SNS Subscriber NodeJS AWS SNS Subscriber Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS AWS SQS Receiver NodeJS AWS SQS Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS AWS Unknown Kinesis Consumer NodeJS AWS Unknown Kinesis Consumer Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS AWS Unknown SNS Subscriber NodeJS AWS SNS Unknown Subscriber Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS AWS Unknown SQS Receiver NodeJS AWS SQS Unknown Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS Azure Event Hub Receiver NodeJS Azure Event Hub Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS Azure Service Bus Receiver NodeJS Azure Service Bus Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS Azure Unknown Event Hub Receiver NodeJS Azure Unknown Event Hub Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS Azure Unknown Service Bus Receiver NodeJS Azure Unknown Service Bus Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS GCP Pub/Sub Receiver NodeJS GCP Pub/Sub Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS GCP Unknown Pub/Sub Receiver NodeJS GCP Unknown Pub/Sub Receiver Represents a message receiving, consuming, or subscribing operation from a queue, topic, stream, or event bus.
NodeJS Call to Generic Program NodeJS Call to Generic Program Represents a call from Node.js code to an external program or runtime service.
NodeJS Call to Java Program NodeJS Call to Java Program Represents a call from Node.js code to an external program or runtime service.
NodeJS gRPC service method NodeJS gRPC service method Represents an exposed service API method detected in Node.js code.
NodeJS SignalR Hub Method NodeJS SignalR Hub Method Represents an exposed service API method detected in Node.js code.
NodeJS call to gRPC service method NodeJS Call to gRPC service method Represents a call from Node.js code to an external or framework service method.
NodeJS SignalR Call to Hub Method NodeJS SignalR Call to Hub Method Represents a call from Node.js code to an external or framework service method.
NodeJS SignalR Call to Unknown Hub Method NodeJS SignalR Call to Unknown Hub Method Represents a call from Node.js code to an external or framework service method.
NodeJS Memcached Connection NodeJS Memcached Connection Represents a connection to a storage, cache, database, or external data service.
NodeJS MongoDB connection NodeJS MongoDB connection Represents a connection to a storage, cache, database, or external data service.
NodeJS Unknown MongoDB connection NodeJS Unknown MongoDB connection Represents a connection to a storage, cache, database, or external data service.
NodeJS Service NodeJS Service Represents a web service endpoint exposed by the Node.js application.
NodeJS Delete Operation NodeJS Delete Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
NodeJS Get Operation NodeJS Get Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
NodeJS Patch Operation NodeJS Patch Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
NodeJS Post Operation NodeJS Post Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
NodeJS Put Operation NodeJS Put Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
Restify DELETE Operation Restify DELETE Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
Restify GET Operation Restify GET Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
Restify POST Operation Restify POST Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
Restify PUT Operation Restify PUT Operation Represents an exposed web service operation detected in Node.js routing or API definitions.
NodeJS Delete HttpRequest service NodeJS Delete HttpRequest service Represents an outbound HTTP request or web service call made from Node.js code.
NodeJS Get HttpRequest service NodeJS Get HttpRequest service Represents an outbound HTTP request or web service call made from Node.js code.
NodeJS Patch HttpRequest service NodeJS Patch HttpRequest service Represents an outbound HTTP request or web service call made from Node.js code.
NodeJS Post HttpRequest service NodeJS Post HttpRequest service Represents an outbound HTTP request or web service call made from Node.js code.
NodeJS Put HttpRequest service NodeJS Put HttpRequest service Represents an outbound HTTP request or web service call made from Node.js code.
Restify PATCH Operation Restify PATCH Operation Represents an outbound HTTP request or web service call made from Node.js code.

Behaviour is different depending on the version of CAST AIP you are using the extension with:

  • From 7.3.6, SQL queries are sent to the external links exactly like standard CAST AIP analyzers.
  • From 7.3.4 and before 7.3.6, a degraded mode takes place: The Node.js extension analyzes the FROM clause to retrieve table names, then sends the table names only to external links.
  • For all other versions, if no links are found via external links and the com.castsoftware.nodejs.missingtable extension is installed, unresolved objects are created (with type CAST_NodeJS_Unknown_Database_Table).

Data sensitivity

This extension is capable of setting a property on NoSQL collection and Cloud File storage objects for the following:

  • custom sensitivity
  • GDPR
  • PCI-DSS

See Data Sensitivity for more information.

Quality Rules

Known Limitations

In this section we list the most significant functional limitations that may affect the analysis of applications using Node.js: