@contrast/agent 4.32.18 → 4.32.19

package/lib/assess/sinks/ssrf-url.js

@@ -20,6 +20,7 @@ Copyright: 2023 Contrast Security, Inc
  * We will parse the url and only check the protocol, host, path
  */
 
+const logger = require('../../core/logger')('contrast:hooks:ssrf-url');
 const { isString } = require('../../util/is-string');
 const tracker = require('../../tracker');
 const { URL } = require('url');
@@ -42,7 +43,7 @@ module.exports = ({ common: { isVulnerable } }) => {
    * @param {string} params.name name of tag to add
    * @return {TagRange[]} params.list of TagRanges including the new tag
    */
-  ssrfUrl.addTag = function({ tags, start, stop, name }) {
+  ssrfUrl.addTag = function ({ tags, start, stop, name }) {
     const tagRange = new TagRange(start, stop, name);
 
     return tagRangeUtil.add(tags, tagRange);
@@ -57,7 +58,7 @@ module.exports = ({ common: { isVulnerable } }) => {
    * @param {Object} disallowedTags for sink
    * @return {Boolean} if input is vulnerable or not
    */
-  ssrfUrl.handle = function({ input, requiredTags, disallowedTags }) {
+  ssrfUrl.handle = function ({ input, requiredTags, disallowedTags }) {
     if (!isString(input)) {
       return false;
     }
@@ -68,27 +69,36 @@ module.exports = ({ common: { isVulnerable } }) => {
       return false;
     }
 
-    const url = new URL(input);
-    const qpIndex = url.search ? input.indexOf(url.search) : -1;
-    // start search after protocol + // so it doesn't match `/` as first in the http://
-    const pathIndex = input.indexOf(url.pathname, url.protocol.length + 2);
+    try {
+      // we define a default base here so that `input` can be a relative path
+      const url = new URL(input, 'abc://xyz');
+      const qpIndex = url.search ? input.indexOf(url.search) : -1;
+      const pathIndex = url.pathname ? input.indexOf(
+        url.pathname,
+        // start search after protocol + // so it doesn't match `/` as first in the http://
+        // if our generated base is used, protocol will be `abc` and won't be present in the input
+        url.protocol === 'abc:' ? 0 : url.protocol.length + 2
+      ) : -1;
 
-    if (pathIndex >= 0) {
-      contrastProps.tagRanges = ssrfUrl.addTag({
-        tags: contrastProps.tagRanges,
-        start: pathIndex,
-        stop: pathIndex + url.pathname.length - 1,
-        name: PATH_TAG
-      });
-    }
+      if (pathIndex >= 0) {
+        contrastProps.tagRanges = ssrfUrl.addTag({
+          tags: contrastProps.tagRanges,
+          start: pathIndex,
+          stop: pathIndex + url.pathname.length - 1,
+          name: PATH_TAG
+        });
+      }
 
-    if (qpIndex >= 0) {
-      contrastProps.tagRanges = ssrfUrl.addTag({
-        tags: contrastProps.tagRanges,
-        start: qpIndex,
-        stop: qpIndex + url.search.length - 1,
-        name: QUERY_TAG
-      });
+      if (qpIndex >= 0) {
+        contrastProps.tagRanges = ssrfUrl.addTag({
+          tags: contrastProps.tagRanges,
+          start: qpIndex,
+          stop: qpIndex + url.search.length - 1,
+          name: QUERY_TAG
+        });
+      }
+    } catch (err) {
+      logger.warn('Unable to parse url %s, err: %o', err);
     }
 
     return isVulnerable({ input, requiredTags, disallowedTags });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.32.18",
+  "version": "4.32.19",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",