@contrast/assess 1.10.0 → 1.11.0

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -17,32 +17,23 @@
 
 const { DataflowTag, substring } = require('@contrast/common');
 const { patchType } = require('../../common');
+const { userDefinedType } = require('./common');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
+    config: {
+      assess: { trust_custom_validators },
+    },
     scopes: { sources },
     patcher,
     depHooks,
     assess: {
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent }
-      }
-    }
-  } = core;
-
-  return core.assess.dataflow.propagation.mongooseInstrumentation.schemaString = {
-    install() {
-      depHooks.resolve(
-        { name: 'mongoose', file: 'lib/schema/string.js', version: '>=6.0.0' },
-        (SchemaString) => {
-          patchEnum(SchemaString);
-          patchDoValidate(SchemaString);
-          patchDoValidateSync(SchemaString);
-        }
-      );
+        eventFactory: { createPropagationEvent },
+      },
     },
-  };
+  } = core;
 
   function patchEnum(SchemaString) {
     patcher.patch(SchemaString.prototype, 'enum', {
@@ -67,9 +58,9 @@ module.exports = function(core) {
             if (data.result) {
               tracker.untrack(data.args[0]);
             }
-          }
+          },
         });
-      }
+      },
     });
   }
 
@@ -81,16 +72,38 @@ module.exports = function(core) {
       patchType,
       pre(data) {
         const [value, cb] = data.args;
-        if (value && typeof cb === 'function' && sources.getStore()?.assess) {
-          data.args[1] = patcher.patch(cb, {
-            name,
-            patchType,
-            pre({ args: [err] }) {
-              if (!err) propagate(name, data.orig, value);
-            }
-          });
+        if (!value || typeof cb !== 'function' || !sources.getStore()?.assess) {
+          return;
         }
-      }
+
+        const hasCustomValidator = data.obj.validators.some(
+          (validator) => validator.type === userDefinedType
+        );
+
+        data.args[1] = patcher.patch(cb, {
+          name,
+          patchType,
+          pre(data) {
+            const {
+              args: [err],
+            } = data;
+
+            if (!err) {
+              propagate(
+                name,
+                data.orig,
+                value,
+                trust_custom_validators
+                  ? hasCustomValidator
+                  : false
+              );
+            }
+
+            if (err && err.kind === userDefinedType)
+              propagate(name, data.orig, value, false);
+          },
+        });
+      },
     });
   }
 
@@ -99,16 +112,34 @@ module.exports = function(core) {
     patcher.patch(SchemaString.prototype, 'doValidateSync', {
       name,
       patchType,
-      post({ orig, args: [value] }) {
-        if (value?.length) {
-          propagate(name, orig, value);
+      post(data) {
+        const {
+          args: [value],
+          result
+        } = data;
+
+        const hasCustomValidator = data.obj.validators.some(
+          (validator) => validator.type === userDefinedType
+        );
+
+        if (!result) {
+          propagate(
+            name,
+            data.orig,
+            value,
+            trust_custom_validators
+              ? hasCustomValidator
+              : false
+          );
         }
-      }
-    });
 
+        if (result && result.kind === userDefinedType)
+          propagate(name, data.orig, value, false);
+      },
+    });
   }
 
-  function propagate(name, orig, value) {
+  function propagate(name, orig, value, customValidated = false) {
     const strInfo = tracker.getData(value);
     if (!strInfo) return;
 
@@ -116,7 +147,10 @@ module.exports = function(core) {
     // copy because we mutate the metadata value inline
     const history = [{ ...strInfo }];
     const event = createPropagationEvent({
-      addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+      addedTags: [
+        DataflowTag.STRING_TYPE_CHECKED,
+        customValidated ? DataflowTag.CUSTOM_VALIDATED : null,
+      ].filter(Boolean),
       name,
       moduleName: 'mongoose',
       methodName,
@@ -134,11 +168,14 @@ module.exports = function(core) {
       tags: {
         ...strInfo.tags,
         [DataflowTag.STRING_TYPE_CHECKED]: [0, value.length - 1],
+        ...(customValidated
+          ? { [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1] }
+          : {}),
       },
       target: 'P0',
       stacktraceOpts: {
         prependFrames: [orig],
-      }
+      },
     });
 
     if (!event) {
@@ -153,4 +190,21 @@ module.exports = function(core) {
 
     Object.assign(strInfo, event);
   }
+
+  return core.assess.dataflow.propagation.mongooseInstrumentation.schemaString = {
+    install() {
+      depHooks.resolve(
+        {
+          name: 'mongoose',
+          file: 'lib/schema/string.js',
+          version: '>=6.0.0',
+        },
+        (SchemaString) => {
+          patchEnum(SchemaString);
+          patchDoValidate(SchemaString);
+          patchDoValidateSync(SchemaString);
+        }
+      );
+    },
+  };
 };

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/parse-int.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/basename.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/normalize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/pug/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/querystring/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -0,0 +1,182 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { inspect } = require('@contrast/common');
+const { createSubsetTags } = require('../../tag-utils');
+const { patchType } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  function createPropagationEventForMatch({
+    strInfo,
+    startIdx,
+    match,
+    untrackedResult,
+    metadata,
+  }) {
+    const tags = createSubsetTags(strInfo.tags, startIdx, match.length);
+    const { name, obj, hooked, orig } = metadata;
+
+    return createPropagationEvent({
+      name,
+      moduleName: 'RegExp',
+      methodName: 'prototype.exec',
+      context: `'${obj}'.exec('${strInfo.value}')`,
+      history: [strInfo],
+      object: {
+        value: obj,
+        tracked: false,
+      },
+      args: [
+        {
+          value: strInfo.value,
+          tracked: true,
+        },
+      ],
+      tags,
+      result: {
+        value: inspect(untrackedResult),
+        tracked: false,
+      },
+      stacktraceOpts: {
+        constructorOpt: hooked,
+        prependFrames: [orig],
+      },
+      source: 'P',
+      target: 'R',
+    });
+  }
+
+  return (core.assess.dataflow.propagation.regExpExec = {
+    install() {
+      const name = 'RegExp.prototype.exec';
+
+      patcher.patch(RegExp.prototype, 'exec', {
+        name,
+        patchType,
+        post(data) {
+          const { args, obj, result, hooked, orig } = data;
+
+          if (
+            !obj ||
+            !args[0] ||
+            !result?.length ||
+            !sources.getStore()?.assess ||
+            instrumentation.isLocked()
+          )
+            return;
+
+          const strInfo = tracker.getData(args[0]);
+
+          if (!strInfo) return;
+
+          const untrackedResult = [...result];
+          untrackedResult.groups = result.groups && { ...result.groups };
+          untrackedResult.input = strInfo.value;
+          untrackedResult.index = result.index;
+          result.indices && (untrackedResult.indices = result.indices);
+
+          let searchIdx = result.index;
+          const metadata = { name, obj, hooked, orig };
+
+          for (let i = 0; i < result.length; i++) {
+            let match = result[i];
+
+            if (!match) continue;
+
+            if (match === args[0]) {
+              // There is a case where the match
+              // is the whole original string in which case the value here is
+              // externalized and we need to make sure to track
+              // the non-exterrnalized one
+              match = strInfo.value;
+            }
+
+            const startIdx = strInfo.value.indexOf(match, searchIdx);
+            const event = createPropagationEventForMatch({
+              strInfo,
+              startIdx,
+              match,
+              untrackedResult,
+              metadata
+            });
+
+            if (i > 0) {
+              // The first match is the full match of the regex so we cannot
+              // increment the search index.
+              // Every match after the first will occur in order of appearance
+              // in the original string so we should increment the search index
+              searchIdx = startIdx + match.length;
+            }
+
+            if (!event) continue;
+
+            const { extern } = tracker.track(match, event);
+
+            if (extern) {
+              result[i] = extern;
+            }
+          }
+
+          if (result.groups) {
+            Object.keys(result.groups).forEach((key) => {
+              let res = result.groups[key];
+
+              if (!res) return;
+
+              if (res === args[0]) {
+                // There is a case where the match
+                // is the whole original string in which case the value here is
+                // externalized and we need to make sure to track
+                // the non-exterrnalized one
+                res = strInfo.value;
+              }
+
+              const startIdx = strInfo.value.indexOf(res, result.index);
+              const event = createPropagationEventForMatch({
+                strInfo,
+                startIdx,
+                match: res,
+                untrackedResult,
+                metadata
+              });
+
+              if (event) {
+                const { extern } = tracker.track(res, event);
+                if (extern) {
+                  result.groups[key] = extern;
+                }
+              }
+            });
+          }
+        },
+      });
+    },
+    uninstall() {
+      RegExp.prototype.exec = patcher.unwrap(RegExp.prototype.exec);
+    },
+  });
+};

package/lib/dataflow/propagation/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/concat.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -16,21 +16,85 @@
 'use strict';
 
 const { callChildComponentMethodsSync } = require('@contrast/common');
+const { inspect, split } = require('@contrast/common');
 
 module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
   const stringInstrumentation = core.assess.dataflow.propagation.stringInstrumentation = {
     install() {
       callChildComponentMethodsSync(stringInstrumentation, 'install');
     },
     uninstall() {
       callChildComponentMethodsSync(stringInstrumentation, 'uninstall');
+    },
+    utils: {
+      patchCustomMatcher
     }
   };
 
+  function patchCustomMatcher(matcherFn, objInfo, methodArg, name, patchType) {
+    const [, , methodName] = split(name, '.');
+
+    return patcher.patch(matcherFn, {
+      name,
+      patchType,
+      pre(data) {
+        const { args: origArgs, hooked, orig } = data;
+        if (
+          !origArgs.length ||
+          typeof origArgs[0] !== 'string' ||
+          !sources.getStore()?.assess ||
+          instrumentation.isLocked()
+        ) return;
+
+        const args = [{
+          value: inspect(methodArg),
+          tracked: false
+        }];
+
+        const event = createPropagationEvent({
+          name,
+          moduleName: 'String',
+          methodName: `prototype.${methodName}`,
+          context: `'${objInfo.value}'.${methodName}(${args[0].value})`,
+          history: [objInfo],
+          object: {
+            value: objInfo.value,
+            tracked: true,
+          },
+          args,
+          tags: objInfo.tags,
+          result: undefined,
+          stacktraceOpts: {
+            constructorOpt: hooked,
+            prependFrames: [orig]
+          },
+          source: 'P',
+          target: 'P'
+        });
+
+        if (!event) return;
+
+        const { extern } = tracker.track(objInfo.value, event);
+
+        if (extern) {
+          origArgs[0] = extern;
+        }
+      }
+    });
+  }
+
   require('./concat')(core);
   require('./format-methods')(core);
   require('./html-methods')(core);
   require('./match')(core);
+  require('./match-all')(core);
   require('./replace')(core);
   require('./split')(core);
   require('./slice')(core);