@contrast/assess 1.1.0

package/lib/dataflow/utils/is-vulnerable.js

@@ -0,0 +1,113 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+function mergeOverlapRange(overlapTags) {
+  if (overlapTags.length <= 1) return overlapTags;
+
+  const tagsInTuple = [];
+  for (const overTagsCurr of overlapTags) {
+    for (let idx2 = 0; idx2 < overTagsCurr.length - 1; idx2 += 2) {
+      const start = overTagsCurr[idx2];
+      const end = overTagsCurr[idx2 + 1];
+
+      tagsInTuple.push([start, end]);
+    }
+  }
+
+  const { result } = tagsInTuple
+    .sort((a, b) => a[0] - b[0])
+    .reduce(
+      (acc, value, index, array) => {
+        if (!acc.current) {
+          acc.current = value;
+        }
+
+        const [startCurrent, endCurrent] = acc.current;
+        const [startIncoming, endIncoming] = value;
+        const isLastIteration = array.length - 1 === index;
+
+        if (
+          startIncoming >= startCurrent &&
+          (startIncoming <= endCurrent || startIncoming - 1 === endCurrent)
+        ) {
+          if (endIncoming > endCurrent) {
+            acc.current[1] = endIncoming;
+          }
+
+          if (isLastIteration) {
+            acc.result.push(acc.current);
+          }
+        } else {
+          acc.result.push(acc.current);
+
+          if (isLastIteration) {
+            acc.result.push(value);
+          }
+
+          acc.current = value;
+        }
+
+        return acc;
+      },
+      { current: null, result: [] }
+    );
+
+  return result;
+}
+
+function isVulnerable(targetName, overlapNames, tags) {
+  const targetTags = tags[targetName];
+  const overlapTags = overlapNames.reduce((acc, name) => {
+    if (tags[name]) {
+      acc.push(tags[name]);
+    }
+    return acc;
+  }, []);
+
+  if (!targetTags) {
+    return false;
+  }
+
+  if (!overlapTags.length) {
+    return true;
+  }
+
+  const safeRange = mergeOverlapRange(overlapTags);
+
+  for (let idx = 0; idx < targetTags.length - 1; idx += 2) {
+    const targetStart = targetTags[idx];
+    const targetStop = targetTags[idx + 1];
+    let overlapFound;
+
+    for (const [safeStart, safeStop] of safeRange) {
+      if (safeStart <= targetStart && safeStop >= targetStop) {
+        overlapFound = true;
+        break;
+      }
+    }
+
+    if (!overlapFound) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+module.exports = {
+  isVulnerable,
+  mergeOverlapRange
+};

package/lib/index.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const dataflow = require('./dataflow');
+
+module.exports = function assess(core) {
+  const assess = core.assess = {};
+
+  // Does this order matter? Probably not
+  // 1. dataflow
+  dataflow(core);
+
+  // response-scanning
+  // crypto
+  // static (in coordination with rewriter)
+
+  assess.install = function() {
+    core.assess.dataflow.install();
+  };
+
+  return assess;
+};

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@contrast/assess",
+  "version": "1.1.0",
+  "description": "",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "../scripts/test.sh"
+  },
+  "author": "",
+  "license": "ISC",
+  "engines": {
+    "npm": ">=6.13.7 <7 || >= 8.3.1",
+    "node": ">= 14.15.0"
+  },
+  "dependencies": {
+    "@contrast/distringuish": "^4.1.0",
+    "@contrast/scopes": "1.3.0",
+    "@contrast/common": "1.4.0",
+    "parseurl": "^1.3.3"
+  }
+}