@contrast/assess 1.1.0 → 1.2.0

package/lib/dataflow/sources/install/qs.js

@@ -1,88 +0,0 @@
-/*
- * Copyright: 2022 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { patchType } = require('../common');
-
-module.exports = function(core) {
-  const {
-    createSnapshot,
-    patcher,
-    depHooks,
-    scopes,
-    assess: {
-      dataflow: { tracker, sources },
-    },
-    logger
-  } = core;
-
-  function makeCapturer(opts) {
-    const snapshot = createSnapshot(opts);
-    return function(obj) {
-      obj.stack = snapshot();
-      return obj;
-    };
-  }
-
-  const qsSourcesInstr = sources.qsSourcesInstr = {
-    install() {
-      depHooks.resolve({ name: 'qs' }, (qs) => {
-        patcher.patch(qs, 'parse', {
-          name: 'qs',
-          patchType,
-          post({ args, orig, hooked, result }) {
-            if (result && Object.keys(result).length) {
-              const assessStore = scopes.sources.getStore().assess;
-
-              if (!assessStore) {
-                logger.debug('assessStore not available in `qs` hook');
-              } else {
-                const captureStack = makeCapturer({ constructorOpt: hooked, prependFrames: [orig] });
-
-                // We need to track `qs` result only when it's used as a query parser.
-                // `qs` is used also for parsing bodies, but these cases we handle individually with
-                // the respective library that's using it (e.g. `formidable`, `co-body`) because in
-                // some cases its use is optional and we cannot rely on it.
-                if (assessStore.reqData.queries === args[0]) {
-                  for (const [key, value] of Object.entries(result)) {
-                    // TODO Same as fastify - do we need a try-catch
-                    // and checks for already tracked strings
-                    const { extern } = tracker.track(
-                      value,
-                      captureStack({
-                        inputType: 'query',
-                        name: key,
-                        tags: {
-                          untrusted: [0, value.length - 1],
-                        }
-                      })
-                    );
-
-                    if (extern) {
-                      result[key] = extern;
-                    }
-                  }
-                }
-              }
-            }
-          }
-        });
-      });
-    },
-  };
-
-  return qsSourcesInstr;
-};