@contrast/assess 1.1.0

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -0,0 +1,102 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+
+module.exports = function (core) {
+  const {
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+    patcher,
+    scopes: { sources, instrumentation },
+  } = core;
+
+  const tag = {
+    install() {
+      patcher.patch(global.ContrastMethods, 'tag', {
+        name: 'ContrastMethods.tag',
+        patchType,
+        post(data) {
+          if (
+            !data.result ||
+            !sources.getStore()?.assess ||
+            instrumentation.isLocked()
+          ) {
+            return;
+          }
+
+          const resultData = tracker.getData(data.result);
+          if (!resultData || data.result === data.args[1]) {
+            return;
+          }
+
+          const [strings, ...args] = data.args;
+          const argsData = [
+            strings.map((str) => ({
+              value: str,
+              isTracked: false,
+            })),
+          ];
+
+          const history = new Set();
+          args.forEach((arg) => {
+            const argData = tracker.getData(arg);
+            argsData.push({
+              value: argData?.value ?? arg,
+              isTracked: !!argData,
+            });
+            if (argData) history.add(argData);
+          });
+
+          Object.assign(
+            resultData,
+            createPropagationEvent({
+              name: 'ContrastMethods.tag',
+              history: Array.from(history),
+              object: {
+                value: 'ContrastMethods@0000',
+                isTracked: false,
+              },
+              args: argsData,
+              result: {
+                value: resultData.value,
+                isTracked: true,
+              },
+              tags: resultData.tags,
+              source: 'P',
+              target: 'R',
+              stacktraceOpts: {
+                constructorOpt: data.hooked,
+                prependFrames: [data.orig],
+              },
+            }),
+          );
+        },
+      });
+    },
+    uninstall() {
+      global.ContrastMethods.tag = patcher.unwrap(global.ContrastMethods.tag);
+    },
+  };
+
+  core.assess.dataflow.propagation.contrastMethodsInstrumentation.tag = tag;
+  return tag;
+};

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -0,0 +1,88 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../tag-utils');
+const { patchType, createObjectLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.decodeURIComponent = {
+    install() {
+      patcher.patch(global, 'decodeURIComponent', {
+        name: 'global.decodeURIComponent',
+        patchType,
+        post(data) {
+          const { args, result, hooked, orig } = data;
+          if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+          const argInfo = tracker.getData(args[0]);
+
+          if (!argInfo) return;
+
+          // This native method seems to create a new string instance
+          // as even when it returns the argument without any change
+          // the result is not tracked, so we don't need to check for that
+          const history = [argInfo];
+          const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+          delete newTags['url-encoded'];
+
+          if (!Object.keys(newTags).length) return;
+
+          const event = createPropagationEvent({
+            name: 'global.decodeURIComponent',
+            object: {
+              value: createObjectLabel('global'),
+              isTracked: false
+            },
+            result: {
+              value: result,
+              isTracked: true
+            },
+            args: [{ value: argInfo.value, isTracked: true }],
+            tags: newTags,
+            history,
+            removedTags: ['url-encoded'],
+            stacktraceOpts: {
+              constructorOpt: hooked,
+              prependFrames: [orig]
+            },
+          });
+
+          if (!event) return;
+
+          const { extern } = tracker.track(result, event);
+
+          if (extern) {
+            data.result = extern;
+          }
+        }
+      });
+    },
+    uninstall() {
+      global.decodeURIComponent = patcher.unwrap(global.decodeURIComponent);
+    },
+  };
+};

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../../tag-utils');
+const { patchType, createModuleLabel } = require('../../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.ejsInstrumentation.escapeXML = {
+    install() {
+      depHooks.resolve({ name: 'ejs', file: 'lib/utils.js', version: '>=2.6.2' }, (ejsUtils, version) => {
+        patcher.patch(ejsUtils, 'escapeXML', {
+          name: 'ejs.utils.escapeXML',
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            const resultInfo = tracker.getData(result);
+            const history = [argInfo];
+            const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+
+            newTags['weak-url-encoded'] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name: 'ejs.utils.escapeXML',
+              object: {
+                value: `[${createModuleLabel('ejs', version)}].utils`,
+                isTracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                isTracked: true
+              },
+              args: [{ value: argInfo.value, isTracked: true }],
+              tags: newTags,
+              addedTags: ['weak-url-encoded'],
+              history,
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            }
+
+            const { extern } = resultInfo || tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      });
+    },
+  };
+};

package/lib/dataflow/propagation/install/ejs/index.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { callChildComponentMethodsSync } = require('@contrast/common');
+
+module.exports = function(core) {
+  const ejsInstrumentation = core.assess.dataflow.propagation.ejsInstrumentation = {
+    install() {
+      callChildComponentMethodsSync(ejsInstrumentation, 'install');
+    },
+  };
+
+  require('./escape-xml')(core);
+
+  return ejsInstrumentation;
+};

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -0,0 +1,87 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../tag-utils');
+const { patchType, createObjectLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.encodeURIComponent = {
+    install() {
+      patcher.patch(global, 'encodeURIComponent', {
+        name: 'global.encodeURIComponent',
+        patchType,
+        post(data) {
+          const { args, result, hooked, orig } = data;
+          if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+          const argInfo = tracker.getData(args[0]);
+
+          if (!argInfo) return;
+
+          // This native method seems to create a new string instance
+          // as even when it returns the argument without any change
+          // the result is not tracked, so we don't need to check for that
+          const history = [argInfo];
+          const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+
+          newTags['url-encoded'] = [0, result.length - 1];
+
+          const event = createPropagationEvent({
+            name: 'global.encodeURIComponent',
+            object: {
+              value: createObjectLabel('global'),
+              isTracked: false
+            },
+            result: {
+              value: result,
+              isTracked: true
+            },
+            args: [{ value: argInfo.value, isTracked: true }],
+            tags: newTags,
+            history,
+            addedTags: ['url-encoded'],
+            stacktraceOpts: {
+              constructorOpt: hooked,
+              prependFrames: [orig]
+            },
+          });
+
+          if (!event) return;
+
+          const { extern } = tracker.track(result, event);
+
+          if (extern) {
+            data.result = extern;
+          }
+        }
+      });
+    },
+    uninstall() {
+      global.encodeURIComponent = patcher.unwrap(global.encodeURIComponent);
+    },
+  };
+};

package/lib/dataflow/propagation/install/escape-html.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../tag-utils');
+const { patchType, createModuleLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.escapeHtml = {
+    install() {
+      depHooks.resolve({ name: 'escape-html' }, (escapeHtml, version) =>
+        patcher.patch(escapeHtml, {
+          name: 'escape-html',
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            const resultInfo = tracker.getData(result);
+            const history = [argInfo];
+            const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+
+            newTags['html-encoded'] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name: 'escape-html',
+              object: {
+                value: createModuleLabel('escape-html', version),
+                isTracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                isTracked: true
+              },
+              args: [{ value: argInfo.value, isTracked: true }],
+              tags: newTags,
+              history,
+              addedTags: ['html-encoded'],
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            }
+
+            const { extern } = resultInfo || tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        })
+      );
+    },
+  };
+};

package/lib/dataflow/propagation/install/escape.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../tag-utils');
+const { patchType, createObjectLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.escape = {
+    install() {
+      patcher.patch(global, 'escape', {
+        name: 'global.escape',
+        patchType,
+        post(data) {
+          const { args, result, hooked, orig } = data;
+          if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+          const argInfo = tracker.getData(args[0]);
+
+          if (!argInfo) return;
+
+          const resultInfo = tracker.getData(result);
+          const history = [argInfo];
+          const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+
+          newTags['weak-url-encoded'] = [0, result.length - 1];
+
+          const event = createPropagationEvent({
+            name: 'global.escape',
+            object: {
+              value: createObjectLabel('global'),
+              isTracked: false
+            },
+            result: {
+              value: resultInfo ? resultInfo.value : result,
+              isTracked: true
+            },
+            args: [{ value: argInfo.value, isTracked: true }],
+            tags: newTags,
+            history,
+            addedTags: ['weak-url-encoded'],
+            stacktraceOpts: {
+              constructorOpt: hooked,
+              prependFrames: [orig]
+            },
+          });
+
+          if (!event) return;
+
+          if (resultInfo) {
+            Object.assign(resultInfo, event);
+          }
+
+          const { extern } = resultInfo || tracker.track(result, event);
+
+          if (extern) {
+            data.result = extern;
+          }
+        }
+      });
+    },
+    uninstall() {
+      global.escape = patcher.unwrap(global.escape);
+    },
+  };
+};

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  createFullLengthCopyTags
+} = require('../../tag-utils');
+const { patchType, createModuleLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.handlebarsEscapeExpression = {
+    install() {
+      depHooks.resolve({ name: 'handlebars', version: '>=4.0.0' }, (handlebars, version) => {
+        patcher.patch(handlebars.Utils, 'escapeExpression', {
+          name: 'handlebars.Utils.escapeExpression',
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            const resultInfo = tracker.getData(result);
+            const history = [argInfo];
+            const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+
+            newTags['html-encoded'] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name: 'handlebars.Utils.escapeExpression',
+              object: {
+                value: `[${createModuleLabel('handlebars', version)}].Utils`,
+                isTracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                isTracked: true
+              },
+              args: [{ value: argInfo.value, isTracked: true }],
+              tags: newTags,
+              addedTags: ['html-encoded'],
+              history,
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            }
+
+            const { extern } = resultInfo || tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      });
+    },
+  };
+};