@contrast/assess 1.10.0 → 1.12.0

package/lib/dataflow/propagation/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -27,10 +27,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/concat.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -22,7 +22,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -36,7 +36,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
   function adjustTags(method, objTags, argLength, argTags = null) {

package/lib/dataflow/propagation/install/string/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -16,21 +16,86 @@
 'use strict';
 
 const { callChildComponentMethodsSync } = require('@contrast/common');
+const { inspect, split } = require('@contrast/common');
 
 module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
   const stringInstrumentation = core.assess.dataflow.propagation.stringInstrumentation = {
     install() {
       callChildComponentMethodsSync(stringInstrumentation, 'install');
     },
     uninstall() {
       callChildComponentMethodsSync(stringInstrumentation, 'uninstall');
+    },
+    utils: {
+      patchCustomMatcher
     }
   };
 
+  function patchCustomMatcher(matcherFn, objInfo, methodArg, name, patchType) {
+    const [, , methodName] = split(name, '.');
+
+    return patcher.patch(matcherFn, {
+      name,
+      patchType,
+      pre(data) {
+        const { args: origArgs, hooked, orig } = data;
+        if (
+          !origArgs.length ||
+          typeof origArgs[0] !== 'string' ||
+          !sources.getStore()?.assess ||
+          instrumentation.isLocked()
+        ) return;
+
+        const args = [{
+          value: inspect(methodArg),
+          tracked: false
+        }];
+
+        const event = createPropagationEvent({
+          name,
+          moduleName: 'String',
+          methodName: `prototype.${methodName}`,
+          context: `'${objInfo.value}'.${methodName}(${args[0].value})`,
+          history: [objInfo],
+          object: {
+            value: objInfo.value,
+            tracked: true,
+          },
+          args,
+          tags: objInfo.tags,
+          result: undefined,
+          stacktraceOpts: {
+            constructorOpt: hooked,
+            prependFrames: [orig]
+          },
+          source: 'P',
+          target: 'P'
+        });
+
+        if (!event) return;
+
+        const { extern } = tracker.track(objInfo.value, event);
+
+        if (extern) {
+          origArgs[0] = extern;
+        }
+      }
+    });
+  }
+
   require('./concat')(core);
   require('./format-methods')(core);
   require('./html-methods')(core);
   require('./match')(core);
+  require('./match-all')(core);
   require('./replace')(core);
   require('./split')(core);
   require('./slice')(core);

package/lib/dataflow/propagation/install/string/match-all.js

@@ -0,0 +1,236 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { inspect } = require('@contrast/common');
+const { patchType } = require('../../common');
+const { createSubsetTags } = require('../../../tag-utils');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: {
+        tracker,
+        propagation: { stringInstrumentation },
+      },
+    },
+  } = core;
+  const name = 'String.prototype.matchAll';
+
+  function createPropagationEventForMatch({
+    objInfo,
+    startIdx,
+    match,
+    untrackedResult,
+    metadata,
+  }) {
+    const tags = createSubsetTags(objInfo.tags, startIdx, match.length);
+
+    if (!tags) return;
+
+    const { arg, hooked, orig } = metadata;
+
+    return createPropagationEvent({
+      name,
+      moduleName: 'String',
+      methodName: 'prototype.matchAll',
+      context: `'${objInfo.value}'.matcAll(${arg})`,
+      history: [objInfo],
+      object: {
+        value: objInfo.value,
+        tracked: true,
+      },
+      args: [
+        {
+          value: arg,
+          tracked: false,
+        },
+      ],
+      tags,
+      result: {
+        value: inspect(untrackedResult),
+        tracked: false,
+      },
+      stacktraceOpts: {
+        constructorOpt: hooked,
+        prependFrames: [orig],
+      },
+      source: 'O',
+      target: 'R',
+    });
+  }
+
+  return (stringInstrumentation.matchAll = {
+    install() {
+      patcher.patch(String.prototype, 'matchAll', {
+        name,
+        patchType,
+        around(origFn, data) {
+          const { args, obj, hooked, orig } = data;
+
+          if (
+            !obj ||
+            !args[0] ||
+            typeof obj !== 'string' ||
+            !sources.getStore()?.assess ||
+            instrumentation.isLocked()
+          )
+            return origFn();
+
+          const objInfo = tracker.getData(obj);
+
+          if (!objInfo) return origFn();
+
+          if (
+            !(args[0] instanceof RegExp) &&
+            typeof args[0][Symbol.matchAll] === 'function'
+          ) {
+            args[0][Symbol.matchAll] =
+              stringInstrumentation.utils.patchCustomMatcher(
+                args[0][Symbol.matchAll],
+                objInfo,
+                args[0],
+                name,
+                patchType
+              );
+
+            return origFn();
+          }
+
+          const result = origFn();
+          const newResult = {};
+
+          function next() {
+            const origRes = core.scopes.instrumentation.run(
+              { lock: true },
+              () => result.next()
+            );
+
+            if (!origRes?.value) return { done: true };
+
+            const resValue = origRes.value;
+            const untrackedResult = [...resValue];
+            untrackedResult.groups = resValue.groups && { ...resValue.groups };
+            untrackedResult.input = objInfo.value;
+            untrackedResult.index = resValue.index;
+            resValue.indices && (untrackedResult.indices = resValue.indices);
+
+            let searchIdx = resValue.index;
+            const metadata = { arg: inspect(args[0]), hooked, orig };
+
+            for (let i = 0; i < resValue.length; i++) {
+              let match = resValue[i];
+
+              if (!match) continue;
+
+              if (match === obj) {
+                // There is a case where the match
+                // is the whole original string in which case the value here is
+                // externalized and we need to make sure to track
+                // the non-exterrnalized one
+                match = objInfo.value;
+              }
+
+              const startIdx = objInfo.value.indexOf(match, searchIdx);
+              const event = createPropagationEventForMatch({
+                objInfo,
+                startIdx,
+                match,
+                untrackedResult,
+                metadata,
+              });
+
+              if (i > 0) {
+                searchIdx = startIdx + match.length;
+              }
+
+              if (!event) continue;
+
+              const { extern } = tracker.track(match, event);
+
+              if (extern) {
+                resValue[i] = extern;
+              }
+            }
+
+            if (resValue.groups) {
+              Object.keys(resValue.groups).forEach((key) => {
+                let res = resValue.groups[key];
+                let event;
+
+                if (!res) return;
+
+                if (res === obj) {
+                  res = objInfo.value;
+                  event = createPropagationEventForMatch({
+                    objInfo,
+                    startIdx: 0,
+                    match: res,
+                    untrackedResult,
+                    metadata,
+                  });
+                } else {
+                  const startIdx = objInfo.value.indexOf(res, resValue.index);
+                  event = createPropagationEventForMatch({
+                    objInfo,
+                    startIdx,
+                    match: res,
+                    untrackedResult,
+                    metadata,
+                  });
+                }
+
+                if (event) {
+                  const { extern } = tracker.track(res, event);
+                  if (extern) {
+                    resValue.groups[key] = extern;
+                  }
+                }
+              });
+            }
+
+            return { value: resValue, done: origRes.done };
+          }
+
+          Object.defineProperty(newResult, Symbol.iterator, {
+            enumerable: false,
+            value() {
+              return {
+                next,
+              };
+            },
+          });
+          Object.defineProperty(newResult, Symbol.toStringTag, {
+            enumerable: false,
+            value: 'RegExp String Iterator',
+          });
+
+          Object.setPrototypeOf(newResult, {
+            ...Object.getPrototypeOf(result),
+            next,
+          });
+
+          return newResult;
+        },
+      });
+    },
+    uninstall() {
+      String.prototype.matchAll = patcher.unwrap(String.prototype.matchAll);
+    },
+  });
+};

package/lib/dataflow/propagation/install/string/match.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -23,28 +23,32 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
-    }
+      eventFactory: { createPropagationEvent },
+      dataflow: {
+        tracker,
+        propagation: { stringInstrumentation },
+      },
+    },
   } = core;
+  const name = 'String.prototype.match';
 
   function getPropagationEvent(data, res, objInfo, start) {
-    const { name, args: origArgs, result, hooked, orig } = data;
+    const { args: origArgs, result, hooked, orig } = data;
     const tags = createSubsetTags(objInfo.tags, start, res.length);
     if (!tags) return;
 
-    const args = origArgs.map((arg) => {
-      const argInfo = tracker.getData(arg);
-      return {
-        value: argInfo ? argInfo.value : inspect(arg),
-        tracked: !!argInfo
-      };
-    });
+    const args = [
+      {
+        value: inspect(origArgs[0]),
+        tracked: false,
+      },
+    ];
 
     return createPropagationEvent({
       name,
       moduleName: 'String',
       methodName: 'prototype.match',
-      context: `'${objInfo.value}'.match(${join(args.map(a => a.value), ', ')})`,
+      context: `'${objInfo.value}'.match(${args[0].value})`,
       history: [objInfo],
       object: {
         value: objInfo.value,
@@ -54,48 +58,79 @@ module.exports = function(core) {
       tags,
       result: {
         value: join(result),
-        tracked: false
+        tracked: false,
       },
       stacktraceOpts: {
         constructorOpt: hooked,
-        prependFrames: [orig]
+        prependFrames: [orig],
       },
       source: 'O',
-      target: 'R'
+      target: 'R',
     });
   }
 
-  return core.assess.dataflow.propagation.stringInstrumentation.match = {
+  return (stringInstrumentation.match = {
     install() {
-      const name = 'String.prototype.match';
-
       patcher.patch(String.prototype, 'match', {
         name,
         patchType,
-        post(data) {
-          const { args, obj, result } = data;
+        around(origFn, data) {
+          const { args, obj } = data;
           if (
             !obj ||
-            !result ||
-            args.length === 0 ||
-            result.length === 0 ||
-            !sources.getStore() ||
+            !args.length ||
+            !sources.getStore()?.assess ||
             typeof obj !== 'string' ||
             instrumentation.isLocked() ||
-            (args.length === 1 && args[0] == null)
-          ) return;
+            (args.length === 1 && !args[0])
+          )
+            return origFn();
 
           const objInfo = tracker.getData(obj);
-          if (!objInfo) return;
+
+          if (!objInfo) return origFn();
+
+          if (
+            !(args[0] instanceof RegExp) &&
+            typeof args[0][Symbol.match] === 'function'
+          ) {
+            args[0][Symbol.match] =
+              stringInstrumentation.utils.patchCustomMatcher(
+                args[0][Symbol.match],
+                objInfo,
+                args[0],
+                name,
+                patchType
+              );
+
+            return origFn();
+          }
+
+          const result = (data.result = core.scopes.instrumentation.run(
+            { lock: true },
+            () => origFn()
+          ));
+
+          if (!result) return result;
 
           let idx = 0;
           const hasCaptureGroups = 'groups' in result;
           for (let i = 0; i < result.length; i++) {
-            const res = result[i];
-            if (!res || res === obj) continue;
-            const start = obj.indexOf(res, idx);
-            idx += hasCaptureGroups ? 0 : start + res.length;
-            const event = getPropagationEvent(data, res, objInfo, start);
+            let res = result[i];
+            let event;
+
+            if (!res) continue;
+
+            if (res === obj) {
+              res = objInfo.value;
+              event = getPropagationEvent(data, res, objInfo, 0);
+            } else {
+              const start = obj.indexOf(res, idx);
+              idx += hasCaptureGroups && i === 0 ? 0 : res.length;
+
+              event = getPropagationEvent(data, res, objInfo, start);
+            }
+
             if (event) {
               const { extern } = tracker.track(res, event);
               if (extern) {
@@ -105,10 +140,19 @@ module.exports = function(core) {
           }
           if (hasCaptureGroups && result.groups) {
             Object.keys(result.groups).forEach((key) => {
-              const res = result.groups[key];
-              if (!res || res === obj) return;
-              const start = obj.indexOf(res);
-              const event = getPropagationEvent(data, res, objInfo, start);
+              let res = result.groups[key];
+              let event;
+
+              if (!res) return;
+
+              if (res === obj) {
+                res = objInfo.value;
+                event = getPropagationEvent(data, res, objInfo, 0);
+              } else {
+                const start = obj.indexOf(res);
+                event = getPropagationEvent(data, res, objInfo, start);
+              }
+
               if (event) {
                 const { extern } = tracker.track(res, event);
                 if (extern) {
@@ -117,11 +161,13 @@ module.exports = function(core) {
               }
             });
           }
+
+          return data.result;
         },
       });
     },
     uninstall() {
       String.prototype.match = patcher.unwrap(String.prototype.match);
     },
-  };
+  });
 };

package/lib/dataflow/propagation/install/string/replace.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,7 +28,8 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     },
     scopes: { sources, instrumentation }
   } = core;
@@ -101,7 +102,7 @@ module.exports = function(core) {
     replacement = replaceSpecialCharacters(String(replacement), parsedArgs, data._replacementType);
 
     data._replacementInfo = tracker.getData(replacement);
-    if (data._replacement) {
+    if (data._replacementInfo) {
       data._history.add(data._replacementInfo);
     }
     return { replacement, replacementInfo: data._replacementInfo };

package/lib/dataflow/propagation/install/string/slice.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -22,7 +22,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/split.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -25,7 +25,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/substring.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -24,7 +24,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;