@contrast/assess 1.10.0 → 1.11.0

package/lib/dataflow/event-factory.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -44,6 +44,7 @@ module.exports = function(core) {
   require('./install/sequelize')(core);
   require('./install/JSON')(core);
   require('./install/path')(core);
+  require('./install/reg-exp-prototype-exec')(core);
 
   propagation.install = function() {
     callChildComponentMethodsSync(propagation, 'install');

package/lib/dataflow/propagation/install/JSON/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/JSON/parse-fn.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/buffer.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/add.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/number.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/ejs/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/escape-html.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/isnumeric-0.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/mongoose/common.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+module.exports = {
+  userDefinedType: 'user defined',
+};

package/lib/dataflow/propagation/install/mongoose/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,22 +15,18 @@
 
 'use strict';
 
-const c = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const component = core.assess.dataflow.propagation.mongooseInstrumentation = {
     install() {
-      c.callChildComponentMethodsSync(component, 'install');
+      callChildComponentMethodsSync(component, 'install');
     }
   };
 
-  // todo NODE-3103
-  // require('./schema-map')(core);
-
-  // todo NODE-3102
-  // require('./schema-mixed')(core);
-
   require('./schema-string')(core);
+  require('./schema-mixed')(core);
+  require('./schema-map')(core);
 
   return component;
 };

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -0,0 +1,149 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+const { patchType } = require('../../common');
+const { userDefinedType } = require('./common');
+const { traverseValues, DataflowTag, substring } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    config: { assess },
+    scopes: { sources },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+        propagation: { mongooseInstrumentation },
+      },
+    },
+  } = core;
+
+  const schemaMap = {};
+  mongooseInstrumentation.schemaMap = schemaMap;
+
+  const handleString = (strInfo, orig, value, name) => {
+    const methodName = substring(name, name.indexOf('.') + 1);
+
+    // copy because we mutate the metadata value inline
+    const history = [{ ...strInfo }];
+    const event = createPropagationEvent({
+      addedTags: [DataflowTag.CUSTOM_VALIDATED],
+      name,
+      moduleName: 'mongoose',
+      methodName,
+      history,
+      object: {
+        tracked: false,
+        value: 'mongoose.SchemaMap',
+      },
+      args: [{ tracked: true, value: strInfo.value }],
+      result: {
+        tracked: false,
+        value: undefined,
+      },
+      source: 'P0',
+      tags: {
+        ...strInfo.tags,
+        [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1],
+      },
+      target: 'P0',
+      stacktraceOpts: {
+        prependFrames: [orig],
+      },
+    });
+
+    if (!event) return;
+
+    // in case the event type changed e.g. Source->Propagation
+    for (const key of Object.keys(strInfo)) {
+      if (key === 'value' || key === 'extern') continue;
+      delete strInfo[key];
+    }
+
+    Object.assign(strInfo, event);
+  };
+
+  const mapInstrumentation = (data, name) => {
+    const { orig, args } = data;
+
+    const hasCustomValidator = data.obj.validators.some(
+      (validator) => validator.type === userDefinedType
+    );
+
+    if (!hasCustomValidator) return;
+
+    const input = args[0].toJSON();
+
+    const weakMapOfStrInfo = new WeakMap();
+    traverseValues(input, (path, type, value) => {
+      const strInfo = tracker.getData(value);
+      if (!strInfo || weakMapOfStrInfo.has(strInfo)) return;
+      weakMapOfStrInfo.set(strInfo, true);
+
+      handleString(strInfo, orig, value, name);
+    });
+  };
+
+  schemaMap.install = function () {
+    depHooks.resolve(
+      { name: 'mongoose', file: 'lib/schema/map.js', version: '>=5.0.0' },
+      (SchemaMap) => {
+        const doValidateSyncName = 'mongoose.map.prototype.doValidateSync';
+        patcher.patch(SchemaMap.prototype, 'doValidateSync', {
+          name: doValidateSyncName,
+          patchType,
+          post: (data) => {
+            if (!assess.trust_custom_validators || data.result || !sources.getStore()?.assess) return;
+
+            mapInstrumentation(data, doValidateSyncName);
+          },
+        });
+
+        // called when `Model.validate(data)` static method is used, as well as `model.validate()` instance method
+        const doValidateName = 'mongoose.map.prototype.doValidate';
+        patcher.patch(SchemaMap.prototype, 'doValidate', {
+          name: doValidateName,
+          patchType,
+          pre: (data) => {
+            if (!assess.trust_custom_validators) return;
+
+            const [value, cb] = data.args;
+            if (
+              !value ||
+              typeof cb !== 'function' ||
+              !sources.getStore()?.assess
+            ) {
+              return;
+            }
+
+            data.args[1] = patcher.patch(cb, {
+              name: doValidateName,
+              patchType,
+              pre({ args: [err] }) {
+                if (err) return;
+
+                mapInstrumentation(data, doValidateName);
+              },
+            });
+          },
+        });
+      }
+    );
+  };
+
+  return schemaMap;
+};

package/lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -0,0 +1,162 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+const { patchType } = require('../../common');
+const { userDefinedType } = require('./common');
+const { traverseValues, DataflowTag, substring } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    config: { assess },
+    scopes: { sources },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+        propagation: { mongooseInstrumentation },
+      },
+    },
+  } = core;
+
+  const schemaMixed = {};
+  mongooseInstrumentation.schemaMixed = schemaMixed;
+
+  const handleString = (strInfo, orig, value, name) => {
+    const methodName = substring(name, name.indexOf('.') + 1);
+
+    // copy because we mutate the metadata value inline
+    const history = [{ ...strInfo }];
+    const event = createPropagationEvent({
+      addedTags: [DataflowTag.CUSTOM_VALIDATED],
+      name,
+      moduleName: 'mongoose',
+      methodName,
+      history,
+      object: {
+        tracked: false,
+        value: 'mongoose.SchemaMixed',
+      },
+      args: [{ tracked: true, value: strInfo.value }],
+      result: {
+        tracked: false,
+        value: undefined,
+      },
+      source: 'P0',
+      tags: {
+        ...strInfo.tags,
+        [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1],
+      },
+      target: 'P0',
+      stacktraceOpts: {
+        prependFrames: [orig],
+      },
+    });
+
+    if (!event) return;
+
+    // in case the event type changed e.g. Source->Propagation
+    for (const key of Object.keys(strInfo)) {
+      if (key === 'value' || key === 'extern') continue;
+      delete strInfo[key];
+    }
+
+    Object.assign(strInfo, event);
+  };
+
+  const mixedInstrumentation = (data, name) => {
+    const hasCustomValidator = data.obj.validators.some(
+      (validator) => validator.type === userDefinedType
+    );
+    if (!hasCustomValidator) return;
+
+    const { orig, args } = data;
+
+    const input = args[0];
+    const inputType = typeof input;
+
+    if (inputType !== 'string' && inputType !== 'object') return;
+
+    if (inputType === 'string') {
+      const strInfo = tracker.getData(input);
+      if (!strInfo) return;
+
+      return handleString(strInfo, orig, input, name);
+    }
+
+    const weakMapOfStrInfo = new WeakMap();
+    traverseValues(input, (path, type, value) => {
+      const strInfo = tracker.getData(value);
+      if (!strInfo || weakMapOfStrInfo.has(strInfo)) return;
+      weakMapOfStrInfo.set(strInfo, true);
+
+      handleString(strInfo, orig, value, name);
+    });
+  };
+
+  schemaMixed.install = function () {
+    depHooks.resolve(
+      { name: 'mongoose', file: 'lib/schema/mixed.js', version: '>=5.0.0' },
+      (SchemaMixed) => {
+        const doValidateSyncName = 'mongoose.mixed.prototype.doValidateSync';
+        patcher.patch(SchemaMixed.prototype, 'doValidateSync', {
+          name: doValidateSyncName,
+          patchType,
+          post: (data) => {
+            if (
+              !assess.trust_custom_validators ||
+              data.result ||
+              !sources.getStore()?.assess
+            ) {
+              return;
+            }
+
+            mixedInstrumentation(data, doValidateSyncName);
+          },
+        });
+
+        // called when `Model.validate(data)` static method is used, as well as `model.validate()` instance method
+        const doValidateName = 'mongoose.mixed.prototype.doValidate';
+        patcher.patch(SchemaMixed.prototype, 'doValidate', {
+          name: doValidateName,
+          patchType,
+          pre: (data) => {
+            if (!assess.trust_custom_validators || !sources.getStore()?.assess) {
+              return;
+            }
+
+            const [value, cb] = data.args;
+            if (!value || typeof cb !== 'function') {
+              return;
+            }
+
+            data.args[1] = patcher.patch(cb, {
+              name: doValidateName,
+              patchType,
+              pre({ args: [err] }) {
+                if (err) return;
+
+                mixedInstrumentation(data, doValidateName);
+              },
+            });
+          },
+        });
+      }
+    );
+  };
+
+  return schemaMixed;
+};