@contrast/assess 1.10.0 → 1.11.0

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -0,0 +1,133 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+const { inspect, isString } = require('@contrast/common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  function getPropagationEvent(params, paramInfo, data) {
+    return createPropagationEvent({
+      name: 'url.URLSearchParams',
+      moduleName: 'url',
+      methodName: 'URLSearchParams',
+      context: `url.URLSearchParams('${inspect(params)}')`,
+      object: {
+        value: 'url',
+        tracked: false
+      },
+      result: {
+        value: inspect(data.result),
+        tracked: true
+      },
+      args: [{ value: inspect(params), tracked: false }],
+      tags: paramInfo.tags,
+      history: [paramInfo],
+      source: 'P',
+      target: 'R',
+      stacktraceOpts: {
+        constructorOpt: data.hooked,
+        prependFrames: [data.orig]
+      },
+    });
+  }
+
+  return core.assess.dataflow.propagation.urlInstrumentation.searchParams = {
+    install() {
+      depHooks.resolve({ name: 'url' }, (url) => {
+
+        const name = 'url.URLSearchParams';
+
+        patcher.patch(url, 'URLSearchParams', {
+          name,
+          patchType,
+          post(data) {
+            const { args, obj, result } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const [params] = args;
+
+            if (isString(params)) {
+              params.split('&').forEach((query) => {
+                const startIdx = query.indexOf('?') + 1;
+                const endIdx = query.indexOf('=');
+                const key = query.substring(startIdx, endIdx);
+                const param = query.substring(endIdx + 1, query.length);
+                const paramInfo = tracker.getData(param);
+                if (!paramInfo) return;
+
+                const event = getPropagationEvent(params, paramInfo, data);
+                if (!event);
+
+                Object.assign(paramInfo, event);
+                const { extern } = paramInfo || tracker.track(param, event);
+
+                if (extern) {
+                  result.set(key, extern);
+                }
+              });
+            }
+
+            if (typeof params === 'object') {
+              Object.keys(params).forEach((key) => {
+                const paramInfo = tracker.getData(params[key]);
+                if (!paramInfo) return;
+
+                const event = getPropagationEvent(params, paramInfo, data);
+                if (!event) return;
+
+                Object.assign(paramInfo, event);
+                const { extern } = paramInfo || tracker.track(params[key], event);
+
+                if (extern) {
+                  result.set(key, extern);
+                }
+              });
+            }
+
+            patcher.patch(obj.prototype, 'toString', {
+              name: 'url.URLSearchParams.toString',
+              patchType,
+              post(data) {
+                const { obj: params } = data;
+                let i = 0;
+                let str = '';
+                params.forEach((val, key) => {
+                  if (i === 0) {
+                    str = key.concat('=', val);
+                  } else {
+                    str = str.concat('&', key, '=', val);
+                  }
+                  i++;
+                });
+                data.result = str;
+              }
+            });
+          }
+        });
+      });
+    },
+  };
+};

package/lib/dataflow/propagation/install/url/url.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -42,7 +42,6 @@ module.exports = function(core) {
       ],
       'pathname',
       'search',
-      'searchParams',
       'hash'
     ]
   ];
@@ -84,6 +83,7 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.urlInstrumentation.url = {
     install() {
       depHooks.resolve({ name: 'url' }, (url) => {
+        const { URLSearchParams } = url;
         const name = 'url.URL';
         patcher.patch(url, 'URL', {
           name,
@@ -116,33 +116,11 @@ module.exports = function(core) {
             const strInfo = tracker.getData(url);
             if (!strInfo) return;
 
-            const searchParamsProxy = new Proxy(data.result.searchParams, {
-              set(obj, prop, value) {
-                return Reflect.set(obj, prop, value);
-              },
-              get(obj, prop, receiver) {
-                const val = obj[prop];
-                if (val instanceof Function) {
-                  return function (query) {
-                    if (typeof query === 'string') {
-                      const trackedProp = Reflect.get(obj, `_contrast_${query}`);
-                      if (trackedProp) return trackedProp;
-                    }
-                    return val.apply(this === receiver ? obj : this, query);
-                  };
-                }
-                return Reflect.get(obj, prop, receiver);
-              }
-            });
-
             const proxy = new Proxy(data.result, {
               set(obj, prop, value) {
                 return Reflect.set(obj, prop, value);
               },
               get(obj, prop) {
-                if (prop === 'searchParams') {
-                  return searchParamsProxy;
-                }
                 if (prop === 'toString' || prop === 'toJSON') {
                   return function() {
                     return Reflect.get(obj, '_contrast_href');
@@ -159,7 +137,7 @@ module.exports = function(core) {
             const traverse = function(href, url, keys, idx = 0) {
               let substr = href;
               keys.forEach((key) => {
-                if (typeof key === 'string' && key !== 'searchParams') {
+                if (typeof key === 'string') {
                   const part = url[key];
                   if (part !== 'null') {
 
@@ -180,38 +158,13 @@ module.exports = function(core) {
                     const event = getPropagationEvent(strInfo, partInfo, data);
                     if (!event) return;
 
-                    if (partInfo) {
-                      Object.assign(partInfo, event);
-                    }
-                    const { extern } = partInfo || tracker.track(part, event);
+                    Object.assign(partInfo, event);
+                    const { extern } = tracker.track(part, event);
 
                     if (extern) {
                       proxy[`_contrast_${key}`] = extern;
                     }
                   }
-                } else if (key === 'searchParams') {
-                  const queries = proxy.search.split('&');
-                  queries.forEach((query) => {
-                    const startIdx = query.indexOf('?') + 1;
-                    const endIdx = query.indexOf('=');
-                    const queryName = query.substring(startIdx, endIdx);
-                    const queryString = query.substring(endIdx + 1, query.length);
-                    const queryStringInfo = tracker.getData(queryString);
-                    if (!queryStringInfo) return;
-
-                    const event = getPropagationEvent(strInfo, queryStringInfo, data);
-
-                    if (!event) return;
-
-                    if (queryStringInfo) {
-                      Object.assign(queryStringInfo, event);
-                    }
-                    const { extern } = queryStringInfo || tracker.track(queryString, event);
-
-                    if (extern) {
-                      searchParamsProxy[`_contrast_${queryName}`] = extern;
-                    }
-                  });
                 } else {
                   traverse(substr, url, key, 0);
                 }
@@ -219,6 +172,10 @@ module.exports = function(core) {
             };
 
             traverse(url, result, keys, 0);
+
+            if (proxy.search) {
+              proxy._contrast_searchParams = new URLSearchParams(proxy.search);
+            }
             data.result = proxy;
           }
         });

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/validator/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/validator/methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/child-process.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/eval.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/express/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/fastify/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/fs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/function.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/http/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/http/request.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/http/server-response.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/koa/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/marsdb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/mongodb.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -85,16 +85,16 @@ module.exports = function(core) {
   const instr = core.assess.dataflow.sinks.mongodb = {};
 
   instr.getQueryVulnerabilityInfo = function getQueryVulnerabilityInfo(query) {
+    const reportSafe = [];
     let vulnInfo = null;
-    let reportSafe = null;
 
     if (isString(query)) {
       const strInfo = tracker.getData(query);
       if (strInfo) {
         if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
           vulnInfo = { strInfo };
-        } else {
-          reportSafe = { strInfo };
+        } else if (config.assess.safe_positives.enable) {
+          reportSafe.push({ strInfo });
         }
       }
 
@@ -109,8 +109,8 @@ module.exports = function(core) {
         if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
           vulnInfo = { path: [...path], strInfo };
           return true; // halts traversal
-        } else {
-          reportSafe = { path: [...path], strInfo };
+        } else if (config.assess.safe_positives.enable) {
+          reportSafe.push({ path: [...path], strInfo });
         }
       }
     });
@@ -119,8 +119,8 @@ module.exports = function(core) {
   };
 
   instr.getAggregateVulnerabilityInfo = function getAggregateVulnerabilityInfo(aggregation) {
+    const reportSafe = [];
     let vulnInfo = null;
-    let reportSafe = null;
 
     if (!isNonEmptyObject(aggregation)) return { vulnInfo, reportSafe };
 
@@ -141,8 +141,8 @@ module.exports = function(core) {
           if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
             vulnInfo = { path: [...path], strInfo };
             return true; // halts traversal
-          } else {
-            reportSafe = { path: [...path], strInfo };
+          } else if (config.assess.safe_positives.enable) {
+            reportSafe.push({ path: [...path], strInfo });
           }
         }
       }
@@ -152,16 +152,16 @@ module.exports = function(core) {
   };
 
   instr.getMapReduceVulnerabilityInfo = function getMapReduceVulnerabilityInfo(argToCheck, argIdx) {
+    const reportSafe = [];
     let vulnInfo = null;
-    let reportSafe = null;
 
     if (argIdx !== 2 && isString(argToCheck)) {
       const strInfo = tracker.getData(argToCheck);
       if (strInfo) {
         if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
           vulnInfo = { strInfo };
-        } else {
-          reportSafe = { strInfo };
+        } else if (config.assess.safe_positives.enable) {
+          reportSafe.push({ strInfo });
         }
       }
 
@@ -181,8 +181,8 @@ module.exports = function(core) {
           if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
             vulnInfo = { path: [...path], strInfo };
             return true; // halts traversal
-          } else {
-            reportSafe = { path: [...path], strInfo };
+          } else if (config.assess.safe_positives.enable) {
+            reportSafe.push({ path: [...path], strInfo });
           }
         }
       }
@@ -192,16 +192,16 @@ module.exports = function(core) {
   };
 
   instr.getGroupVulnerabilityInfo = function getGroupVulnerabilityInfo(argToCheck, argIdx) {
+    const reportSafe = [];
     let vulnInfo = null;
-    let reportSafe = null;
 
     if (argIdx !== 1 && isString(argToCheck)) {
       const strInfo = tracker.getData(argToCheck);
       if (strInfo) {
         if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
           vulnInfo = { strInfo };
-        } else {
-          reportSafe = { strInfo };
+        } else if (config.assess.safe_positives.enable) {
+          reportSafe.push({ strInfo });
         }
       }
 
@@ -216,8 +216,8 @@ module.exports = function(core) {
         if (isVulnerable(UNTRUSTED, querySafeTags, strInfo.tags)) {
           vulnInfo = { path: [...path], strInfo };
           return true; // halts traversal
-        } else {
-          reportSafe = { path: [...path], strInfo };
+        } else if (config.assess.safe_positives.enable) {
+          reportSafe.push({ path: [...path], strInfo });
         }
       }
     });
@@ -248,12 +248,19 @@ module.exports = function(core) {
             vulnArgIdx = argIdx;
             break;
           }
-          if (reportSafe) safeReports.push({ ...reportSafe, argIdx });
+
+          if (config.assess.safe_positives.enable && reportSafe.length) {
+            reportSafe.forEach(el => safeReports.push({ ...el, argIdx }));
+          }
         }
 
         if (!vulnInfo) {
           if (safeReports.length && config.assess.safe_positives.enable) {
-            const safeTags = safeReports.map((report) => filterSafeTags(querySafeTags, report.strInfo));
+            const safeTags = safeReports
+              .map((report) => filterSafeTags(querySafeTags, report.strInfo))
+              .flat()
+              .filter((value, index, self) => index === self.indexOf(value));
+
             const strInfo = safeReports.map((report) => {
               const tags = report.path ? utils.createAdjustedQueryTags(report.path, report.strInfo.tags, report.strInfo.value, inspect(origArgs[report.argIdx], { depth: 4 })) : report.strInfo?.tags;
 
@@ -266,7 +273,7 @@ module.exports = function(core) {
             reportSafePositive({
               name,
               ruleId: NOSQL_INJECTION_MONGO,
-              safeTags: safeTags.length === 1 ? safeTags[0] : safeTags,
+              safeTags,
               strInfo: strInfo.length === 1 ? strInfo[0] : strInfo
             });
           }
@@ -323,8 +330,6 @@ module.exports = function(core) {
     });
   };
 
-  return instr;
-
   function patchCollection(mongodb, version) {
     for (const method of collectionMethods) {
       const proto = mongodb.Collection.prototype;
@@ -400,4 +405,6 @@ module.exports = function(core) {
 
     return name;
   }
+
+  return instr;
 };

package/lib/dataflow/sinks/install/mssql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/mysql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/postgres.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/sqlite3.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/vm.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/handler.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/body-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/busboy1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sources/install/cookie-parser1.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial