@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/assess/propagators/validator/init-hooks.js

@@ -1,252 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const logger = require('../../../core/logger')('contrast:validator:propagator');
-const tracker = require('../../../tracker');
-const patcher = require('../../../hooks/patcher');
-const { PATCH_TYPES } = require('../../../constants');
-const moduleHook = require('../../../hooks/require');
-const TagRange = require('../../models/tag-range');
-const tagRangeUtil = require('../../models/tag-range/util');
-const { PropagationEvent, Signature, CallContext } = require('../../models');
-const agent = require('../../../agent');
-
-/**
- * this override propagator instruments each of the classes of methods
- * in 'validator-methods.js'. the three classes are:
- *
- * validators: {methodName: 'tag-to-add', ...}
- *   add the specified tag if the validation succeeds
- * untrackers: ['methodName', ...]
- *   unconditionally remove tracking
- * sanitizers: {methodName: 'tag-to-add', ...}
- *   unconditionally add the specified tag
- *
- * for additional context see:
- * https://docs.google.com/spreadsheets/d/17p5C6NOISNuWi8D-07d8gNg8byQytuwjtgBgzGpfU_w/edit#gid=0
- *
- */
-module.exports.handle = function () {
-  const {
-    validators,
-    untrackers,
-    sanitizers,
-  } = require('./validator-methods.js');
-
-  const patchType = PATCH_TYPES.ASSESS_PROPAGATOR;
-
-  /**
-   * Patch the object or function.
-   * @param {object|function} obj The object being patched
-   * @param {string} name This is used to keep track of what's been patched.
-   * @param {function} post The post-processing function to invoke
-   * @return {function|undefined} If obj was a function, the patched function
-   */
-  function patch(obj, validator, post) {
-    const name = `validator/lib/${validator}`;
-    logger.trace(`hooking ${name}`);
-
-    const patched = patcher.patch(obj, {
-      name,
-      patchType,
-      post,
-    });
-    // babel adds a self-referential default property so if present in the unpatched
-    // object update the patched object
-    if (obj === obj.default) {
-      patched.default = patched;
-    }
-    // if the object is a function then there is no object in which the original
-    // function can be replaced by the patched function. returning the function
-    // lets moduleHook.resolve() ensure that any subsequent require of the same
-    // file returns the patched function.
-    if (typeof obj === 'function') {
-      return patched;
-    }
-    // return undefined
-  }
-
-  //+
-  // for each validator that returns true, add the tag specified in validator-methods.js
-  // and remove the untrusted tag.
-  //-
-  for (const validator in validators) {
-    const signature = new Signature(`validator.${validator}`);
-    moduleHook.resolve(
-      { name: 'validator', file: `lib/${validator}` },
-      (index, meta) => {
-        function post(data) {
-          if (
-            data.result &&
-            (validator !== 'matches' ||
-              (validator === 'matches' &&
-                agent.config.assess.trust_custom_validators))
-          ) {
-            const trackingData = tracker.getData(data.args[0]);
-            if (trackingData) {
-              tagRangeUtil.addInPlace(
-                trackingData.tagRanges,
-                new TagRange(0, data.args[0].length - 1, validators[validator])
-              );
-              tagRangeUtil.removeInPlace(trackingData.tagRanges, ['untrusted']);
-
-              const context = CallContext.create(data);
-              const event = new PropagationEvent({
-                context,
-                signature,
-                tagRanges: trackingData.tagRanges,
-                source: 'O',
-                target: 'R',
-              });
-
-              event.parents.push(trackingData.event);
-              trackingData.event = event;
-            }
-          }
-        }
-
-        return patch(index, validator, post);
-      }
-    );
-  }
-
-  //+
-  // for each removeTracking add the "trusted" tag which the node agent doesn't
-  // support, so simulate it by deleting any existing tags and mark the string
-  // untracked.
-  //-
-  for (let i = 0; i < untrackers.length; i++) {
-    const name = untrackers[i];
-
-    moduleHook.resolve(
-      { name: 'validator', file: `lib/${name}` },
-      (index, meta) => {
-        function post(data) {
-          if (data.result) {
-            const trackingData = tracker.getData(data.args[0]);
-            if (trackingData) {
-              trackingData.tagRanges = [];
-              trackingData.tracked = false;
-            }
-          }
-        }
-
-        return patch(index, name, post);
-      }
-    );
-  }
-
-  //+
-  // for each sanitizer, if the input string is already tracked add the indicated
-  // tag.
-  //-
-  for (const sanitizer in sanitizers) {
-    moduleHook.resolve(
-      { name: 'validator', file: `lib/${sanitizer}` },
-      (index, meta) => {
-        function post(data) {
-          // if not tracked then it can't be untrusted, so don't start
-          // tracking this string.
-          const inputData = tracker.getData(data.args[0]);
-          if (!inputData) return;
-
-          const tag = sanitizers[sanitizer];
-
-          // are the input and output of the sanitizer the same?
-          if (data.args[0] !== data.result) {
-            let needsTag = true;
-            // the input and output strings are not the same. start tracking the output.
-            const tracked = tracker.track(data.result);
-            // copy the input tags to the result, adjusting the range.
-            if (tracked) {
-              const stop = data.result.length - 1;
-              for (let i = 0; i < inputData.tagRanges.length; i++) {
-                tracked.props.tagRanges[i] = new TagRange(
-                  0,
-                  stop,
-                  inputData.tagRanges[i].tag
-                );
-                if (inputData.tagRanges[i].tag === tag) {
-                  needsTag = false;
-                }
-              }
-              if (needsTag) {
-                tracked.props.tagRanges.push(
-                  new TagRange(0, stop, sanitizers[sanitizer])
-                );
-              }
-              data.result = tracked.str;
-            }
-          } else {
-            // the input and output strings are the same, so the output is already being
-            // tracked. if the tag is already present adjust the bounds otherwise add the
-            // tag.
-            let needsTag = true;
-            for (let i = 0; i < inputData.tagRanges.length; i++) {
-              if (inputData.tagRanges[i].tag === tag) {
-                inputData.tagRanges[i].start = 0;
-                inputData.tagRanges[i].stop = data.result.length - 1;
-                needsTag = false;
-              }
-            }
-            // if the tag wasn't present add it
-            if (needsTag) {
-              inputData.tagRanges.push(
-                new TagRange(0, data.result.length - 1, tag)
-              );
-            }
-          }
-        }
-
-        return patch(index, sanitizer, post);
-      }
-    );
-  }
-
-  moduleHook.resolve({ name: 'validator', file: 'lib/isEmail' }, (isEmail) => {
-    const signature = new Signature('validator.isEmail');
-
-    function post(data) {
-      const trackingData = tracker.getData(data.args[0]);
-      // The default options for the two fields of interest are:
-      // `{ allow_display_name: false, require_display_name: false }`
-      // so we can use an empty object as it will also yield
-      // falsy values for these two fields
-      const options = data.args[1] ? data.args[1] : {};
-      if (data.result && trackingData && !options.allow_display_name && !options.require_display_name) {
-        tagRangeUtil.addInPlace(
-          trackingData.tagRanges,
-          new TagRange(0, data.args[0].length - 1, 'limited-chars')
-        );
-        tagRangeUtil.removeInPlace(trackingData.tagRanges, ['untrusted']);
-
-        const context = CallContext.create(data);
-        const event = new PropagationEvent({
-          context,
-          signature,
-          tagRanges: trackingData.tagRanges,
-          source: 'O',
-          target: 'R',
-        });
-
-        event.parents.push(trackingData.event);
-        trackingData.event = event;
-      }
-    }
-
-    return patch(isEmail, 'isEmail', post);
-  });
-};

package/lib/assess/propagators/validator/validator-methods.js

@@ -1,98 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * for additional context see:
- * https://docs.google.com/spreadsheets/d/17p5C6NOISNuWi8D-07d8gNg8byQytuwjtgBgzGpfU_w/edit#gid=0
- */
-
-module.exports = {
-  validators: {
-    isAfter: 'alphanum-space-hyphen',
-    isAlpha: 'alphanum-space-hyphen',
-    isAlphanumeric: 'alphanum-space-hyphen',
-    isBase32: 'alphanum-space-hyphen',
-    isBase58: 'alphanum-space-hyphen',
-    isBase64: 'alphanum-space-hyphen',
-    isBefore: 'alphanum-space-hyphen',
-    isBIC: 'alphanum-space-hyphen',
-    isBoolean: 'limited-chars',
-    isBtcAddress: 'alphanum-space-hyphen',
-    isCreditCard: 'limited-chars',
-    isDate: 'limited-chars',
-    isDecimal: 'limited-chars',
-    // calls toFloat() which calls isFloat() so no need to hook.
-    //isDivisibleBy: 'limited-chars',
-    isEAN: 'limited-chars',
-    isEthereumAddress: 'alphanum-space-hyphen',
-    // this is used by toFloat, so no need to check toFloat as well.
-    isFloat: 'limited-chars',
-    isHash: 'alphanum-space-hyphen',
-    isHexadecimal: 'alphanum-space-hyphen',
-    isHexColor: 'alphanum-space-hyphen',
-    isHSL: 'alphanum-space-hyphen',
-    isIBAN: 'limited-chars',
-    isIdentityCard: 'alphanum-space-hyphen',
-    isIMEI: 'limited-chars',
-    isInt: 'limited-chars',
-    isIP: 'limited-chars',
-    isIPRange: 'limited-chars',
-    isISBN: 'limited-chars',
-    isISIN: 'limited-chars',
-    isISO8601: 'alphanum-space-hyphen',
-    isISO31661Alpha2: 'alphanum-space-hyphen',
-    isISO31661Alpha3: 'alphanum-space-hyphen',
-    isISRC: 'alphanum-space-hyphen',
-    isISSN: 'limited-chars',
-    isJWT: 'alphanum-space-hyphen',
-    isLatLong: 'limited-chars',
-    isLicensePlate: 'alphanum-space-hyphen',
-    isMACAddress: 'alphanum-space-hyphen',
-    isMagnetURI: 'alphanum-space-hyphen',
-    isMD5: 'alphanum-space-hyphen',
-    isMobilePhone: 'limited-chars',
-    isNumeric: 'limited-chars',
-    isOctal: 'alphanum-space-hyphen',
-    isPassportNumber: 'limited-chars',
-    // limits to 65535 but uses isInt internally
-    //isPort: 'limited-chars',
-    isPostalCode: 'limited-chars',
-    isSemVer: 'limited-chars',
-    isTaxID: 'limited-chars',
-    isUUID: 'alphanum-space-hyphen',
-    isVAT: 'alphanum-space-hyphen',
-    matches: 'string-type-checked'
-  },
-  untrackers: [
-    // these methods have the tag 'trusted' which the node-agent doesn't support.
-    // the validator propagator interprets it as "remove any existing tags and set
-    // tracking false".
-    'isIn',
-    'isMimeType',
-    'isRFC3339',
-    'equals'
-  ],
-  sanitizers: {
-    escape: 'html-encoded'
-    // toFloat uses isFloat which is hooked, so no need to do so again
-    // toFloat: 'limited-chars'
-  },
-  customLogic: {
-    // this value is not used and it's added just for storing the information
-    // about what's patched in one place
-    isEmail: 'limited-chars'
-  }
-};

package/lib/assess/response-scanning/app-activity.js

@@ -1,33 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { get } = require('lodash');
-const agentEmitter = require('../../agent-emitter');
-
-exports.handle = function(agent) {
-  // activity: browsers
-  agentEmitter.on('http.incomingRequest', function(req) {
-    if (
-      get(agent, 'config.inventory.enable') &&
-      get(req, ['headers', 'user-agent'])
-    ) {
-      const update = {
-        browsers: req.headers['user-agent']
-      };
-      agentEmitter.emit('inventory', update);
-    }
-  });
-};

package/lib/assess/response-scanning/autocomplete-missing.js

@@ -1,66 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const _ = require('lodash');
-const agentEmitter = require('../../agent-emitter');
-const htmlUtil = require('../../util/html-util');
-const htmlCommon = require('./common');
-
-const ruleId = 'autocomplete-missing';
-
-module.exports = ({ common }) => {
-  const rule = {};
-
-  rule.check = function(body, bodyLC, responseHeaders) {
-    // look for form tag with missing action attribute.
-    // ex: <form method="post">..
-
-    if (!htmlCommon.isHtmlContent(responseHeaders)) {
-      return;
-    }
-
-    const elements = htmlUtil.getElements('form', bodyLC);
-
-    for (let i = 0; i < elements.length; i++) {
-      const autocomplete = htmlUtil.getAttribute('autocomplete', elements[i]);
-      if (autocomplete !== 'off') {
-        return {
-          attribute: autocomplete,
-          html: elements[i],
-          start: 0,
-          end: elements[i].length
-        };
-      }
-    }
-  };
-
-  rule.handle = function() {
-    require('./parseable-response-emitter').hook();
-    agentEmitter.on('parseableResponse', function({
-      request,
-      responseHeaders,
-      body,
-      bodyLC
-    }) {
-      const vulnerableElement = rule.check(body, bodyLC, responseHeaders);
-      if (vulnerableElement) {
-        vulnerableElement.html = _.escape(vulnerableElement.html);
-        common.emitFinding({ ruleId, request, props: vulnerableElement });
-      }
-    });
-  };
-
-  return rule;
-};

package/lib/assess/response-scanning/cache-controls-missing.js

@@ -1,205 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const agentEmitter = require('../../agent-emitter');
-const htmlUtil = require('../../util/html-util');
-const httpCommon = require('./common');
-
-const ruleId = 'cache-controls-missing';
-
-/**
- * Checks if http-equiv is one of the following
- * below
- *
- * @param {String} httpequiv value of http-equiv meta attr
- */
-function applicableHttpEquiv(httpequiv) {
-  return (
-    httpequiv == 'cache-control' ||
-    httpequiv == 'pragma' ||
-    httpequiv == 'expires'
-  );
-}
-/**
- * Checks every meta html tag from body for http-equiv attributes.
- * If attr exists it will check the content attr if http-equiv is cache-control
- * Otherwise it will add value of attr if cache-control, pragma or expires
- */
-function checkMetaTags({ body, cacheControlHeader, instructions }) {
-  const metaTags = htmlUtil.getElements('meta', body);
-  metaTags.forEach((tag) => {
-    const httpequiv = htmlUtil.getAttribute('http-equiv', tag);
-    if (httpequiv) {
-      const content = htmlUtil.getAttribute('content', tag);
-      if (httpequiv == 'cache-control') {
-        const [
-          containsMetaNoCache,
-          containsMetaNoStore
-        ] = checkCacheControlValue(content);
-        if (containsMetaNoCache && containsMetaNoStore) {
-          return;
-        }
-
-        const [containsNoCache, containsNoStore] = checkCacheControlValue(
-          cacheControlHeader
-        );
-
-        // got no-store from headers and no-cache from meta
-        // or no-cache from headers and no-store from meta
-        if (
-          (containsNoStore && containsMetaNoCache) ||
-          (containsNoCache && containsMetaNoStore)
-        ) {
-          return;
-        }
-      }
-
-      // if we make it this far push the values into instructions
-      if (applicableHttpEquiv(httpequiv)) {
-        instructions.push({
-          type: 'META tag',
-          name: httpequiv,
-          value: tag
-        });
-      }
-    }
-  });
-}
-
-/**
- * Checks the value of cache-control
- * either header or meta content attr value
- * for if it contains no-cache or no-store
- *
- * @param {String} value value of cache-control
- * @return {Array} [no-cache present, no-store present]
- */
-function checkCacheControlValue(value = '') {
-  if (Array.isArray(value)) {
-    let noCache = false;
-    let noStore = false;
-
-    value.forEach((directive) => {
-      if (directive.toLowerCase().includes('no-cache')) {
-        noCache = true;
-      }
-      if (directive.toLowerCase().includes('no-store')) {
-        noStore = true;
-      }
-    });
-    return [noCache, noStore];
-  } else {
-    value = value.toLowerCase();
-    return [value.includes('no-cache'), value.includes('no-store')];
-  }
-}
-
-module.exports = ({ common }) => {
-  const httpRule = {};
-  /**
-   * Checks the cache-control header or content attribute of a meta
-   * tag in HTML body if http-equiv is cache-control for the presence
-   * of both no-cache and no-store
-   *
-   * @param {Object} responseHeaders the headers of response
-   * @param {String} body HTML body
-   */
-  httpRule.check = function(responseHeaders, body) {
-    const instructions = [];
-
-    // de-dupe; this will be re-emitted for parseableBody handlers anyway
-    if (httpCommon.isParseableResponse(responseHeaders) && !body) {
-      return;
-    }
-    const cacheControlHeader = responseHeaders['cache-control'];
-
-    // save the Pragma Header
-    if (responseHeaders['pragma']) {
-      instructions.push({
-        type: 'Header',
-        name: 'pragma',
-        value: responseHeaders['pragma']
-      });
-    }
-
-    if (cacheControlHeader) {
-      const [containsNoCache, containsNoStore] = checkCacheControlValue(
-        cacheControlHeader
-      );
-
-      // got everything from header so we don't care about meta tags
-      if (containsNoCache && containsNoStore) {
-        return;
-      } else {
-        // save the instructions in case meta tags are missing
-        instructions.push({
-          type: 'Header',
-          name: 'cache-control',
-          value: cacheControlHeader
-        });
-      }
-    }
-
-    // we checked the headers now time to check the HTML content
-    checkMetaTags({ body, cacheControlHeader, instructions });
-
-    if (instructions.length) {
-      return {
-        data: JSON.stringify(instructions)
-      };
-    }
-  };
-
-  /**
-   * Sets up listeners for parseableResponse and send.
-   * Once events emitted, it will check the headers/html
-   * content and emit finding if logic in httpRule.check is
-   * truthy
-   *
-   * @param {Object} rule rule policy
-   *
-   */
-  httpRule.handle = function(rule) {
-    require('./parseable-response-emitter').hook();
-
-    // on could add the event name to the policy node for this rule
-    // so that we don't have to manually
-    // I should just do this inline
-    agentEmitter.on(
-      'parseableResponse',
-      function({ request, responseHeaders, bodyLC }) {
-        const trigger = httpRule.check(responseHeaders, bodyLC);
-        if (trigger) {
-          common.emitFinding({ ruleId, request, props: trigger });
-        }
-      },
-      rule
-    );
-
-    agentEmitter.on(
-      'send',
-      function({ request, responseHeaders }) {
-        const trigger = httpRule.check(responseHeaders);
-        if (trigger) {
-          common.emitFinding({ ruleId, request, props: trigger });
-        }
-      },
-      rule
-    );
-  };
-
-  return httpRule;
-};