@contrast/assess 1.1.0 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (60) hide show
  1. package/lib/index.js +3 -0
  2. package/package.json +3 -3
  3. package/coverage/lcov-report/base.css +0 -224
  4. package/coverage/lcov-report/block-navigation.js +0 -87
  5. package/coverage/lcov-report/favicon.png +0 -0
  6. package/coverage/lcov-report/index.html +0 -266
  7. package/coverage/lcov-report/lib/dataflow/common.js.html +0 -154
  8. package/coverage/lcov-report/lib/dataflow/event-factory.js.html +0 -598
  9. package/coverage/lcov-report/lib/dataflow/index.html +0 -191
  10. package/coverage/lcov-report/lib/dataflow/index.js.html +0 -190
  11. package/coverage/lcov-report/lib/dataflow/propagation/common.js.html +0 -145
  12. package/coverage/lcov-report/lib/dataflow/propagation/index.html +0 -131
  13. package/coverage/lcov-report/lib/dataflow/propagation/index.js.html +0 -190
  14. package/coverage/lcov-report/lib/dataflow/propagation/install/contrast-methods/index.html +0 -131
  15. package/coverage/lcov-report/lib/dataflow/propagation/install/contrast-methods/index.js.html +0 -184
  16. package/coverage/lcov-report/lib/dataflow/propagation/install/contrast-methods/plus.js.html +0 -397
  17. package/coverage/lcov-report/lib/dataflow/propagation/install/string/concat.js.html +0 -478
  18. package/coverage/lcov-report/lib/dataflow/propagation/install/string/index.html +0 -176
  19. package/coverage/lcov-report/lib/dataflow/propagation/install/string/index.js.html +0 -202
  20. package/coverage/lcov-report/lib/dataflow/propagation/install/string/replace.js.html +0 -496
  21. package/coverage/lcov-report/lib/dataflow/propagation/install/string/substring.js.html +0 -415
  22. package/coverage/lcov-report/lib/dataflow/propagation/install/string/trim.js.html +0 -403
  23. package/coverage/lcov-report/lib/dataflow/signatures.js.html +0 -5923
  24. package/coverage/lcov-report/lib/dataflow/sinks/common.js.html +0 -145
  25. package/coverage/lcov-report/lib/dataflow/sinks/index.html +0 -131
  26. package/coverage/lcov-report/lib/dataflow/sinks/index.js.html +0 -211
  27. package/coverage/lcov-report/lib/dataflow/sinks/install/fastify/index.html +0 -146
  28. package/coverage/lcov-report/lib/dataflow/sinks/install/fastify/index.js.html +0 -172
  29. package/coverage/lcov-report/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js.html +0 -319
  30. package/coverage/lcov-report/lib/dataflow/sinks/install/fastify/xss.js.html +0 -721
  31. package/coverage/lcov-report/lib/dataflow/sinks/install/http.js.html +0 -340
  32. package/coverage/lcov-report/lib/dataflow/sinks/install/index.html +0 -116
  33. package/coverage/lcov-report/lib/dataflow/sources/common.js.html +0 -145
  34. package/coverage/lcov-report/lib/dataflow/sources/index.html +0 -131
  35. package/coverage/lcov-report/lib/dataflow/sources/index.js.html +0 -226
  36. package/coverage/lcov-report/lib/dataflow/sources/install/fastify.js.html +0 -379
  37. package/coverage/lcov-report/lib/dataflow/sources/install/http.js.html +0 -502
  38. package/coverage/lcov-report/lib/dataflow/sources/install/index.html +0 -146
  39. package/coverage/lcov-report/lib/dataflow/sources/install/qs.js.html +0 -322
  40. package/coverage/lcov-report/lib/dataflow/tag-utils.js.html +0 -418
  41. package/coverage/lcov-report/lib/dataflow/tracker.js.html +0 -466
  42. package/coverage/lcov-report/lib/dataflow/utils/index.html +0 -116
  43. package/coverage/lcov-report/lib/dataflow/utils/is-vulnerable.js.html +0 -424
  44. package/coverage/lcov-report/lib/index.html +0 -116
  45. package/coverage/lcov-report/lib/index.js.html +0 -193
  46. package/coverage/lcov-report/prettify.css +0 -1
  47. package/coverage/lcov-report/prettify.js +0 -2
  48. package/coverage/lcov-report/sort-arrow-sprite.png +0 -0
  49. package/coverage/lcov-report/sorter.js +0 -196
  50. package/coverage/lcov.info +0 -4856
  51. package/coverage/tmp/coverage-9548-1675168551025-0.json +0 -1
  52. package/coverage/tmp/coverage-9551-1675168550963-0.json +0 -1
  53. package/coverage/tmp/coverage-9552-1675168550969-0.json +0 -1
  54. package/coverage/tmp/coverage-9553-1675168550970-0.json +0 -1
  55. package/coverage/tmp/coverage-9554-1675168550962-0.json +0 -1
  56. package/coverage/tmp/coverage-9555-1675168550965-0.json +0 -1
  57. package/coverage/tmp/coverage-9556-1675168550964-0.json +0 -1
  58. package/coverage/tmp/coverage-9557-1675168550969-0.json +0 -1
  59. package/coverage/tmp/coverage-9558-1675168550964-0.json +0 -1
  60. package/coverage/tmp/coverage-9559-1675168550971-0.json +0 -1
package/coverage/lcov-report/lib/dataflow/sources/install/fastify.js.html DELETED
@@ -1,379 +0,0 @@
1
-
2
- <!doctype html>
3
- <html lang="en">
4
-
5
- <head>
6
- <title>Code coverage report for lib/dataflow/sources/install/fastify.js</title>
7
- <meta charset="utf-8" />
8
- <link rel="stylesheet" href="../../../../prettify.css" />
9
- <link rel="stylesheet" href="../../../../base.css" />
10
- <link rel="shortcut icon" type="image/x-icon" href="../../../../favicon.png" />
11
- <meta name="viewport" content="width=device-width, initial-scale=1" />
12
- <style type='text/css'>
13
- .coverage-summary .sorter {
14
- background-image: url(../../../../sort-arrow-sprite.png);
15
- }
16
- </style>
17
- </head>
18
-
19
- <body>
20
- <div class='wrapper'>
21
- <div class='pad1'>
22
- <h1><a href="../../../../index.html">All files</a> / <a href="index.html">lib/dataflow/sources/install</a> fastify.js</h1>
23
- <div class='clearfix'>
24
-
25
- <div class='fl pad1y space-right2'>
26
- <span class="strong">97.95% </span>
27
- <span class="quiet">Statements</span>
28
- <span class='fraction'>96/98</span>
29
- </div>
30
-
31
-
32
- <div class='fl pad1y space-right2'>
33
- <span class="strong">90.9% </span>
34
- <span class="quiet">Branches</span>
35
- <span class='fraction'>10/11</span>
36
- </div>
37
-
38
-
39
- <div class='fl pad1y space-right2'>
40
- <span class="strong">100% </span>
41
- <span class="quiet">Functions</span>
42
- <span class='fraction'>5/5</span>
43
- </div>
44
-
45
-
46
- <div class='fl pad1y space-right2'>
47
- <span class="strong">97.95% </span>
48
- <span class="quiet">Lines</span>
49
- <span class='fraction'>96/98</span>
50
- </div>
51
-
52
-
53
- </div>
54
- <p class="quiet">
55
- Press <em>n</em> or <em>j</em> to go to the next uncovered block, <em>b</em>, <em>p</em> or <em>k</em> for the previous block.
56
- </p>
57
- <template id="filterTemplate">
58
- <div class="quiet">
59
- Filter:
60
- <input oninput="onInput()" type="search" id="fileSearch">
61
- </div>
62
- </template>
63
- </div>
64
- <div class='status-line high'></div>
65
- <pre><table class="coverage">
66
- <tr><td class="line-count quiet"><a name='L1'></a><a href='#L1'>1</a>
67
- <a name='L2'></a><a href='#L2'>2</a>
68
- <a name='L3'></a><a href='#L3'>3</a>
69
- <a name='L4'></a><a href='#L4'>4</a>
70
- <a name='L5'></a><a href='#L5'>5</a>
71
- <a name='L6'></a><a href='#L6'>6</a>
72
- <a name='L7'></a><a href='#L7'>7</a>
73
- <a name='L8'></a><a href='#L8'>8</a>
74
- <a name='L9'></a><a href='#L9'>9</a>
75
- <a name='L10'></a><a href='#L10'>10</a>
76
- <a name='L11'></a><a href='#L11'>11</a>
77
- <a name='L12'></a><a href='#L12'>12</a>
78
- <a name='L13'></a><a href='#L13'>13</a>
79
- <a name='L14'></a><a href='#L14'>14</a>
80
- <a name='L15'></a><a href='#L15'>15</a>
81
- <a name='L16'></a><a href='#L16'>16</a>
82
- <a name='L17'></a><a href='#L17'>17</a>
83
- <a name='L18'></a><a href='#L18'>18</a>
84
- <a name='L19'></a><a href='#L19'>19</a>
85
- <a name='L20'></a><a href='#L20'>20</a>
86
- <a name='L21'></a><a href='#L21'>21</a>
87
- <a name='L22'></a><a href='#L22'>22</a>
88
- <a name='L23'></a><a href='#L23'>23</a>
89
- <a name='L24'></a><a href='#L24'>24</a>
90
- <a name='L25'></a><a href='#L25'>25</a>
91
- <a name='L26'></a><a href='#L26'>26</a>
92
- <a name='L27'></a><a href='#L27'>27</a>
93
- <a name='L28'></a><a href='#L28'>28</a>
94
- <a name='L29'></a><a href='#L29'>29</a>
95
- <a name='L30'></a><a href='#L30'>30</a>
96
- <a name='L31'></a><a href='#L31'>31</a>
97
- <a name='L32'></a><a href='#L32'>32</a>
98
- <a name='L33'></a><a href='#L33'>33</a>
99
- <a name='L34'></a><a href='#L34'>34</a>
100
- <a name='L35'></a><a href='#L35'>35</a>
101
- <a name='L36'></a><a href='#L36'>36</a>
102
- <a name='L37'></a><a href='#L37'>37</a>
103
- <a name='L38'></a><a href='#L38'>38</a>
104
- <a name='L39'></a><a href='#L39'>39</a>
105
- <a name='L40'></a><a href='#L40'>40</a>
106
- <a name='L41'></a><a href='#L41'>41</a>
107
- <a name='L42'></a><a href='#L42'>42</a>
108
- <a name='L43'></a><a href='#L43'>43</a>
109
- <a name='L44'></a><a href='#L44'>44</a>
110
- <a name='L45'></a><a href='#L45'>45</a>
111
- <a name='L46'></a><a href='#L46'>46</a>
112
- <a name='L47'></a><a href='#L47'>47</a>
113
- <a name='L48'></a><a href='#L48'>48</a>
114
- <a name='L49'></a><a href='#L49'>49</a>
115
- <a name='L50'></a><a href='#L50'>50</a>
116
- <a name='L51'></a><a href='#L51'>51</a>
117
- <a name='L52'></a><a href='#L52'>52</a>
118
- <a name='L53'></a><a href='#L53'>53</a>
119
- <a name='L54'></a><a href='#L54'>54</a>
120
- <a name='L55'></a><a href='#L55'>55</a>
121
- <a name='L56'></a><a href='#L56'>56</a>
122
- <a name='L57'></a><a href='#L57'>57</a>
123
- <a name='L58'></a><a href='#L58'>58</a>
124
- <a name='L59'></a><a href='#L59'>59</a>
125
- <a name='L60'></a><a href='#L60'>60</a>
126
- <a name='L61'></a><a href='#L61'>61</a>
127
- <a name='L62'></a><a href='#L62'>62</a>
128
- <a name='L63'></a><a href='#L63'>63</a>
129
- <a name='L64'></a><a href='#L64'>64</a>
130
- <a name='L65'></a><a href='#L65'>65</a>
131
- <a name='L66'></a><a href='#L66'>66</a>
132
- <a name='L67'></a><a href='#L67'>67</a>
133
- <a name='L68'></a><a href='#L68'>68</a>
134
- <a name='L69'></a><a href='#L69'>69</a>
135
- <a name='L70'></a><a href='#L70'>70</a>
136
- <a name='L71'></a><a href='#L71'>71</a>
137
- <a name='L72'></a><a href='#L72'>72</a>
138
- <a name='L73'></a><a href='#L73'>73</a>
139
- <a name='L74'></a><a href='#L74'>74</a>
140
- <a name='L75'></a><a href='#L75'>75</a>
141
- <a name='L76'></a><a href='#L76'>76</a>
142
- <a name='L77'></a><a href='#L77'>77</a>
143
- <a name='L78'></a><a href='#L78'>78</a>
144
- <a name='L79'></a><a href='#L79'>79</a>
145
- <a name='L80'></a><a href='#L80'>80</a>
146
- <a name='L81'></a><a href='#L81'>81</a>
147
- <a name='L82'></a><a href='#L82'>82</a>
148
- <a name='L83'></a><a href='#L83'>83</a>
149
- <a name='L84'></a><a href='#L84'>84</a>
150
- <a name='L85'></a><a href='#L85'>85</a>
151
- <a name='L86'></a><a href='#L86'>86</a>
152
- <a name='L87'></a><a href='#L87'>87</a>
153
- <a name='L88'></a><a href='#L88'>88</a>
154
- <a name='L89'></a><a href='#L89'>89</a>
155
- <a name='L90'></a><a href='#L90'>90</a>
156
- <a name='L91'></a><a href='#L91'>91</a>
157
- <a name='L92'></a><a href='#L92'>92</a>
158
- <a name='L93'></a><a href='#L93'>93</a>
159
- <a name='L94'></a><a href='#L94'>94</a>
160
- <a name='L95'></a><a href='#L95'>95</a>
161
- <a name='L96'></a><a href='#L96'>96</a>
162
- <a name='L97'></a><a href='#L97'>97</a>
163
- <a name='L98'></a><a href='#L98'>98</a>
164
- <a name='L99'></a><a href='#L99'>99</a></td><td class="line-coverage quiet"><span class="cline-any cline-yes">2x</span>
165
- <span class="cline-any cline-yes">2x</span>
166
- <span class="cline-any cline-yes">2x</span>
167
- <span class="cline-any cline-yes">2x</span>
168
- <span class="cline-any cline-yes">2x</span>
169
- <span class="cline-any cline-yes">2x</span>
170
- <span class="cline-any cline-yes">2x</span>
171
- <span class="cline-any cline-yes">2x</span>
172
- <span class="cline-any cline-yes">2x</span>
173
- <span class="cline-any cline-yes">2x</span>
174
- <span class="cline-any cline-yes">2x</span>
175
- <span class="cline-any cline-yes">2x</span>
176
- <span class="cline-any cline-yes">2x</span>
177
- <span class="cline-any cline-yes">2x</span>
178
- <span class="cline-any cline-yes">2x</span>
179
- <span class="cline-any cline-yes">2x</span>
180
- <span class="cline-any cline-yes">2x</span>
181
- <span class="cline-any cline-yes">2x</span>
182
- <span class="cline-any cline-yes">2x</span>
183
- <span class="cline-any cline-yes">2x</span>
184
- <span class="cline-any cline-yes">9x</span>
185
- <span class="cline-any cline-yes">9x</span>
186
- <span class="cline-any cline-yes">9x</span>
187
- <span class="cline-any cline-yes">9x</span>
188
- <span class="cline-any cline-yes">9x</span>
189
- <span class="cline-any cline-yes">9x</span>
190
- <span class="cline-any cline-yes">9x</span>
191
- <span class="cline-any cline-yes">9x</span>
192
- <span class="cline-any cline-yes">9x</span>
193
- <span class="cline-any cline-yes">9x</span>
194
- <span class="cline-any cline-yes">9x</span>
195
- <span class="cline-any cline-yes">9x</span>
196
- <span class="cline-any cline-yes">9x</span>
197
- <span class="cline-any cline-yes">9x</span>
198
- <span class="cline-any cline-yes">9x</span>
199
- <span class="cline-any cline-yes">9x</span>
200
- <span class="cline-any cline-yes">2x</span>
201
- <span class="cline-any cline-yes">9x</span>
202
- <span class="cline-any cline-yes">9x</span>
203
- <span class="cline-any cline-yes">9x</span>
204
- <span class="cline-any cline-yes">9x</span>
205
- <span class="cline-any cline-yes">9x</span>
206
- <span class="cline-any cline-yes">9x</span>
207
- <span class="cline-any cline-yes">9x</span>
208
- <span class="cline-any cline-yes">2x</span>
209
- <span class="cline-any cline-yes">2x</span>
210
- <span class="cline-any cline-yes">2x</span>
211
- <span class="cline-any cline-yes">2x</span>
212
- <span class="cline-any cline-yes">2x</span>
213
- <span class="cline-any cline-yes">2x</span>
214
- <span class="cline-any cline-yes">1x</span>
215
- <span class="cline-any cline-yes">1x</span>
216
- <span class="cline-any cline-yes">1x</span>
217
- <span class="cline-any cline-yes">1x</span>
218
- <span class="cline-any cline-yes">1x</span>
219
- <span class="cline-any cline-yes">1x</span>
220
- <span class="cline-any cline-yes">1x</span>
221
- <span class="cline-any cline-yes">1x</span>
222
- <span class="cline-any cline-yes">1x</span>
223
- <span class="cline-any cline-yes">1x</span>
224
- <span class="cline-any cline-yes">1x</span>
225
- <span class="cline-any cline-yes">1x</span>
226
- <span class="cline-any cline-yes">1x</span>
227
- <span class="cline-any cline-yes">1x</span>
228
- <span class="cline-any cline-yes">1x</span>
229
- <span class="cline-any cline-yes">1x</span>
230
- <span class="cline-any cline-yes">1x</span>
231
- <span class="cline-any cline-yes">1x</span>
232
- <span class="cline-any cline-yes">1x</span>
233
- <span class="cline-any cline-yes">1x</span>
234
- <span class="cline-any cline-no">&nbsp;</span>
235
- <span class="cline-any cline-no">&nbsp;</span>
236
- <span class="cline-any cline-yes">1x</span>
237
- <span class="cline-any cline-yes">1x</span>
238
- <span class="cline-any cline-yes">1x</span>
239
- <span class="cline-any cline-yes">2x</span>
240
- <span class="cline-any cline-yes">9x</span>
241
- <span class="cline-any cline-yes">9x</span>
242
- <span class="cline-any cline-yes">9x</span>
243
- <span class="cline-any cline-yes">9x</span>
244
- <span class="cline-any cline-yes">2x</span>
245
- <span class="cline-any cline-yes">2x</span>
246
- <span class="cline-any cline-yes">2x</span>
247
- <span class="cline-any cline-yes">2x</span>
248
- <span class="cline-any cline-yes">2x</span>
249
- <span class="cline-any cline-yes">2x</span>
250
- <span class="cline-any cline-yes">2x</span>
251
- <span class="cline-any cline-yes">2x</span>
252
- <span class="cline-any cline-yes">2x</span>
253
- <span class="cline-any cline-yes">2x</span>
254
- <span class="cline-any cline-yes">2x</span>
255
- <span class="cline-any cline-yes">2x</span>
256
- <span class="cline-any cline-yes">2x</span>
257
- <span class="cline-any cline-yes">9x</span>
258
- <span class="cline-any cline-yes">9x</span>
259
- <span class="cline-any cline-yes">9x</span>
260
- <span class="cline-any cline-yes">9x</span>
261
- <span class="cline-any cline-yes">2x</span>
262
- <span class="cline-any cline-neutral">&nbsp;</span></td><td class="text"><pre class="prettyprint lang-js">/*
263
- * Copyright: 2022 Contrast Security, Inc
264
- * Contact: support@contrastsecurity.com
265
- * License: Commercial
266
- &nbsp;
267
- * NOTICE: This Software and the patented inventions embodied within may only be
268
- * used as part of Contrast Security’s commercial offerings. Even though it is
269
- * made available through public repositories, use of this Software is subject to
270
- * the applicable End User Licensing Agreement found at
271
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
272
- * between Contrast Security and the End User. The Software may not be reverse
273
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
274
- * way not consistent with the End User License Agreement.
275
- */
276
- &nbsp;
277
- 'use strict';
278
- &nbsp;
279
- const { constants } = require('../../common.js');
280
- &nbsp;
281
- module.exports = function (core) {
282
- const {
283
- patcher,
284
- depHooks,
285
- scopes,
286
- assess: {
287
- dataflow: { tracker, sources },
288
- },
289
- messages,
290
- logger,
291
- } = core;
292
- &nbsp;
293
- /**
294
- * Fastify lifecycle hook as defined in official docs.
295
- * @param {Fastify.routeOptions} routeOptions properties of a given route
296
- */
297
- const onRoute = (routeOptions) =&gt; {
298
- messages.emit(constants.EVENTS.ON_ROUTE, routeOptions);
299
- };
300
- &nbsp;
301
- /**
302
- * Fastify lifecycle hook as defined in official docs.
303
- * @param {Fastify}
304
- */
305
- const onPreValidation = ({ hooked, orig }) =&gt; (request, reply, done) =&gt; {
306
- // do we need Assess version of protect.getSourceContext()?
307
- // currently there is a sample implementation, that should be
308
- // changed or removed if not needed
309
- const assessStore = scopes.sources.getStore()?.assess;
310
- &nbsp;
311
- if (!assessStore) {
312
- logger.debug('assessStore not available in Fastify.preValidationHook');
313
- } else {
314
- const captureStack = sources.makeCapturer({ constructorOpt: hooked, prependFrames: [orig] });
315
- &nbsp;
316
- // TODO Maybe we need a try-catch block in case of errors during tracking?
317
- // TODO Maybe do a check not to track an already tracked string?
318
- if (request.query) {
319
- for (const [key, value] of Object.entries(request.query)) {
320
- const { extern } = tracker.track(
321
- value,
322
- captureStack({
323
- inputType: 'query',
324
- name: key,
325
- tags: {
326
- untrusted: [0, value.length - 1],
327
- }
328
- })
329
- );
330
- &nbsp;
331
- if (extern) <span class="branch-0 cbranch-no" title="branch not covered" >{</span>
332
- <span class="cstat-no" title="statement not covered" > request.query[key] = extern;</span>
333
- <span class="cstat-no" title="statement not covered" > }</span>
334
- }
335
- }
336
- }
337
- done();
338
- };
339
- &nbsp;
340
- const fastifySourcesInstr = (sources.fastifySourcesInstr = {
341
- install() {
342
- depHooks.resolve({ name: 'fastify', version: '&gt;=3.0.0' }, (fastify) =&gt;
343
- patcher.patch(fastify, {
344
- name: 'fastify.build',
345
- patchType: 'assess-sources',
346
- post({ orig, hooked, result: server }) {
347
- server.addHook(
348
- 'preValidation',
349
- onPreValidation({ orig, hooked })
350
- );
351
- server.addHook('onRoute', onRoute);
352
- },
353
- })
354
- );
355
- },
356
- });
357
- &nbsp;
358
- return fastifySourcesInstr;
359
- };
360
- &nbsp;</pre></td></tr></table></pre>
361
-
362
- <div class='push'></div><!-- for sticky footer -->
363
- </div><!-- /wrapper -->
364
- <div class='footer quiet pad2 space-top1 center small'>
365
- Code coverage generated by
366
- <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
367
- at 2023-01-31T12:35:51.238Z
368
- </div>
369
- <script src="../../../../prettify.js"></script>
370
- <script>
371
- window.onload = function () {
372
- prettyPrint();
373
- };
374
- </script>
375
- <script src="../../../../sorter.js"></script>
376
- <script src="../../../../block-navigation.js"></script>
377
- </body>
378
- </html>
379
-