@contrast/assess 1.10.0 → 1.12.0

package/lib/dataflow/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -20,7 +20,6 @@ const { callChildComponentMethodsSync } = require('@contrast/common');
 module.exports = function(core) {
   const dataflow = core.assess.dataflow = {};
 
-  require('./event-factory')(core);
   require('./tracker')(core);
   require('./sources')(core);
   require('./propagation')(core);

package/lib/dataflow/propagation/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -44,6 +44,7 @@ module.exports = function(core) {
   require('./install/sequelize')(core);
   require('./install/JSON')(core);
   require('./install/path')(core);
+  require('./install/reg-exp-prototype-exec')(core);
 
   propagation.install = function() {
     callChildComponentMethodsSync(propagation, 'install');

package/lib/dataflow/propagation/install/JSON/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/JSON/parse-fn.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -52,10 +52,8 @@ module.exports = function (core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -76,7 +76,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/buffer.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -19,10 +19,8 @@ const { patchType } = require('../common');
 module.exports = function(core) {
   const {
     assess: {
-      dataflow: {
-        eventFactory,
-        tracker
-      }
+      eventFactory,
+      dataflow: { tracker }
     },
     patcher,
   } = core;

package/lib/dataflow/propagation/install/contrast-methods/add.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,8 @@ module.exports = function(core) {
     scopes: { instrumentation, sources },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/contrast-methods/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/number.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -32,10 +32,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     }
   } = core;
 

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -20,10 +20,8 @@ const { patchType } = require('../../common');
 module.exports = function(core) {
   const {
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
     patcher,
     scopes: { sources, instrumentation },

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,7 +28,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -29,7 +29,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/ejs/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,7 +28,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/escape-html.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -29,7 +29,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,7 +28,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -29,7 +29,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/isnumeric-0.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/mongoose/common.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+module.exports = {
+  userDefinedType: 'user defined',
+};

package/lib/dataflow/propagation/install/mongoose/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,22 +15,18 @@
 
 'use strict';
 
-const c = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
   const component = core.assess.dataflow.propagation.mongooseInstrumentation = {
     install() {
-      c.callChildComponentMethodsSync(component, 'install');
+      callChildComponentMethodsSync(component, 'install');
     }
   };
 
-  // todo NODE-3103
-  // require('./schema-map')(core);
-
-  // todo NODE-3102
-  // require('./schema-mixed')(core);
-
   require('./schema-string')(core);
+  require('./schema-mixed')(core);
+  require('./schema-map')(core);
 
   return component;
 };

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -0,0 +1,149 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+const { patchType } = require('../../common');
+const { userDefinedType } = require('./common');
+const { traverseValues, DataflowTag, substring } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    config: { assess },
+    scopes: { sources },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: {
+        tracker,
+        propagation: { mongooseInstrumentation },
+      },
+    },
+  } = core;
+
+  const schemaMap = {};
+  mongooseInstrumentation.schemaMap = schemaMap;
+
+  const handleString = (strInfo, orig, value, name) => {
+    const methodName = substring(name, name.indexOf('.') + 1);
+
+    // copy because we mutate the metadata value inline
+    const history = [{ ...strInfo }];
+    const event = createPropagationEvent({
+      addedTags: [DataflowTag.CUSTOM_VALIDATED],
+      name,
+      moduleName: 'mongoose',
+      methodName,
+      history,
+      object: {
+        tracked: false,
+        value: 'mongoose.SchemaMap',
+      },
+      args: [{ tracked: true, value: strInfo.value }],
+      result: {
+        tracked: false,
+        value: undefined,
+      },
+      source: 'P0',
+      tags: {
+        ...strInfo.tags,
+        [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1],
+      },
+      target: 'P0',
+      stacktraceOpts: {
+        prependFrames: [orig],
+      },
+    });
+
+    if (!event) return;
+
+    // in case the event type changed e.g. Source->Propagation
+    for (const key of Object.keys(strInfo)) {
+      if (key === 'value' || key === 'extern') continue;
+      delete strInfo[key];
+    }
+
+    Object.assign(strInfo, event);
+  };
+
+  const mapInstrumentation = (data, name) => {
+    const { orig, args } = data;
+
+    const hasCustomValidator = data.obj.validators.some(
+      (validator) => validator.type === userDefinedType
+    );
+
+    if (!hasCustomValidator) return;
+
+    const input = args[0].toJSON();
+
+    const weakMapOfStrInfo = new WeakMap();
+    traverseValues(input, (path, type, value) => {
+      const strInfo = tracker.getData(value);
+      if (!strInfo || weakMapOfStrInfo.has(strInfo)) return;
+      weakMapOfStrInfo.set(strInfo, true);
+
+      handleString(strInfo, orig, value, name);
+    });
+  };
+
+  schemaMap.install = function () {
+    depHooks.resolve(
+      { name: 'mongoose', file: 'lib/schema/map.js', version: '>=5.0.0' },
+      (SchemaMap) => {
+        const doValidateSyncName = 'mongoose.map.prototype.doValidateSync';
+        patcher.patch(SchemaMap.prototype, 'doValidateSync', {
+          name: doValidateSyncName,
+          patchType,
+          post: (data) => {
+            if (!assess.trust_custom_validators || data.result || !sources.getStore()?.assess) return;
+
+            mapInstrumentation(data, doValidateSyncName);
+          },
+        });
+
+        // called when `Model.validate(data)` static method is used, as well as `model.validate()` instance method
+        const doValidateName = 'mongoose.map.prototype.doValidate';
+        patcher.patch(SchemaMap.prototype, 'doValidate', {
+          name: doValidateName,
+          patchType,
+          pre: (data) => {
+            if (!assess.trust_custom_validators) return;
+
+            const [value, cb] = data.args;
+            if (
+              !value ||
+              typeof cb !== 'function' ||
+              !sources.getStore()?.assess
+            ) {
+              return;
+            }
+
+            data.args[1] = patcher.patch(cb, {
+              name: doValidateName,
+              patchType,
+              pre({ args: [err] }) {
+                if (err) return;
+
+                mapInstrumentation(data, doValidateName);
+              },
+            });
+          },
+        });
+      }
+    );
+  };
+
+  return schemaMap;
+};