@contrast/agent 4.33.3 → 4.35.0

package/lib/assess/policy/propagators.json

@@ -525,6 +525,12 @@
       "target": "R",
       "override": "./propagators/sequelize/sql-string-format-named-parameters.js"
     },
+    "sequelize.QueryGenerator.quoteIdentifier": {
+      "enabled": true,
+      "source": "P",
+      "target": "R",
+      "override": "./propagators/sequelize/query-generator.js"
+    },
     "validator": {
       "enabled": true,
       "override": "./propagators/validator/init-hooks.js"

package/lib/assess/policy/rules.json

@@ -726,7 +726,8 @@
                 "requiredTags": ["untrusted"]
               }
             ]
-          }
+          },
+          "stackTrustedLibs": ["i18n"]
         },
         "fs.createWriteStream": {
           "type": "dataflow",
@@ -967,7 +968,8 @@
                 "requiredTags": ["untrusted"]
               }
             ]
-          }
+          },
+          "stackTrustedLibs": ["i18n"]
         },
         "fs.mkdir": {
           "enabled": true,
@@ -1273,7 +1275,12 @@
               {
                 "index": 0,
                 "depth": 5,
-                "disallowedTags": ["string-type-checked"],
+                "disallowedTags": [
+                  "alphanum-space-hyphen",
+                  "custom-validated-nosql-injection",
+                  "limited-chars",
+                  "string-type-checked"
+                ],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1289,7 +1296,12 @@
               {
                 "index": 0,
                 "depth": 5,
-                "disallowedTags": [],
+                "disallowedTags": [
+                  "alphanum-space-hyphen",
+                  "custom-validated-nosql-injection",
+                  "limited-chars",
+                  "string-type-checked"
+                ],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1305,13 +1317,23 @@
               {
                 "index": 0,
                 "depth": 5,
-                "disallowedTags": ["string-type-checked"],
+                "disallowedTags": [
+                  "alphanum-space-hyphen",
+                  "custom-validated-nosql-injection",
+                  "limited-chars",
+                  "string-type-checked"
+                ],
                 "requiredTags": ["untrusted"]
               },
               {
                 "index": 1,
                 "depth": 5,
-                "disallowedTags": ["string-type-checked"],
+                "disallowedTags": [
+                  "alphanum-space-hyphen",
+                  "custom-validated-nosql-injection",
+                  "limited-chars",
+                  "string-type-checked"
+                ],
                 "requiredTags": ["untrusted"]
               }
             ]
@@ -1327,7 +1349,12 @@
               {
                 "index": 0,
                 "depth": 5,
-                "disallowedTags": ["string-type-checked"],
+                "disallowedTags": [
+                  "alphanum-space-hyphen",
+                  "custom-validated-nosql-injection",
+                  "limited-chars",
+                  "string-type-checked"
+                ],
                 "requiredTags": ["untrusted"]
               }
             ]

package/lib/assess/policy/signatures.json

@@ -213,6 +213,30 @@
       "methodName": "formatNamedParameters",
       "isModule": true
     },
+    "sequelize.MySQLQueryGenerator.prototype.quoteIdentifier": {
+      "moduleName": "sequelize",
+      "version": ">=5.0.0",
+      "methodName": "MySQLQueryGenerator.prototype.quoteIdentifier",
+      "isModule": true
+    },
+    "sequelize.SQLiteQueryGenerator.prototype.quoteIdentifier": {
+      "moduleName": "sequelize",
+      "version": ">=5.0.0",
+      "methodName": "SQLiteQueryGenerator.prototype.quoteIdentifier",
+      "isModule": true
+    },
+    "sequelize.MSSQLQueryGenerator.prototype.quoteIdentifier": {
+      "moduleName": "sequelize",
+      "version": ">=5.0.0",
+      "methodName": "MSSQLQueryGenerator.prototype.quoteIdentifier",
+      "isModule": true
+    },
+    "sequelize.PostgresQueryGenerator.prototype.quoteIdentifier": {
+      "moduleName": "sequelize",
+      "version": ">=5.0.0",
+      "methodName": "PostgresQueryGenerator.prototype.quoteIdentifier",
+      "isModule": true
+    },
     "mongodb.Db.prototype.eval": {
       "moduleName": "mongodb",
       "version": ">=3.3.0",

package/lib/assess/propagators/sequelize/query-generator.js

@@ -0,0 +1,74 @@
+/**
+Copyright: 2023 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const logger = require('../../../core/logger')('contrast:sequelize:propagator');
+const tracker = require('../../../tracker');
+const patcher = require('../../../hooks/patcher');
+const { PATCH_TYPES } = require('../../../constants');
+const moduleHook = require('../../../hooks/require');
+const { CallContext, PropagationEvent, Signature } = require('../../models');
+const TagRange = require('../../models/tag-range');
+const tagRangeUtil = require('../../models/tag-range/util');
+
+const DIALECTS = [
+  // 'db2',
+  // 'mariadb',
+  'mssql',
+  'mysql',
+  // 'oracle',
+  'postgres',
+  // 'snowflake',
+  'sqlite',
+];
+
+module.exports.handle = function () {
+  for (const dialect of DIALECTS) {
+    const file = `lib/dialects/${dialect}/query-generator.js`;
+
+    moduleHook.resolve(
+      { name: 'sequelize', file },
+      (_export) => {
+        logger.debug('hooking %s', file);
+
+        const name = `sequelize.${_export.name}.prototype.quoteIdentifier`;
+        patcher.patch(_export.prototype, 'quoteIdentifier', {
+          name,
+          patchType: PATCH_TYPES.ASSESS_PROPAGATOR,
+          post(data) {
+            const trackingData = tracker.getData(data.result);
+            if (!trackingData) return;
+
+            tagRangeUtil.addInPlace(
+              trackingData.tagRanges,
+              new TagRange(0, data.result.length - 1, 'sql-encoded')
+            );
+
+            const event = new PropagationEvent({
+              context: CallContext.create(data),
+              parents: [trackingData.event],
+              signature: new Signature(name),
+              source: 'P',
+              tagRanges: trackingData.tagRanges,
+              target: 'R'
+            });
+
+            trackingData.event = event;
+          }
+        });
+      }
+    );
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/agent",
-  "version": "4.33.3",
+  "version": "4.35.0",
   "description": "Node.js security instrumentation by Contrast Security",
   "keywords": [
     "security",