@contrast/assess 1.10.0 → 1.12.0

package/lib/dataflow/propagation/install/string/trim.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -25,7 +25,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/unescape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,7 +28,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -26,7 +26,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/url/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -28,6 +28,8 @@ module.exports = function(core) {
   };
 
   require('./domain-parsers')(core);
+  require('./parse')(core);
+  require('./searchParams')(core);
   require('./url')(core);
 
   return urlInstrumentation;

package/lib/dataflow/propagation/install/url/parse.js

@@ -0,0 +1,132 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+const { inspect } = require('@contrast/common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  const keys = [
+    'href',
+    [
+      'protocol',
+      'auth',
+      'host',
+      [
+        'hostname',
+        'port'
+      ],
+      'path',
+      [
+        'pathname',
+        'search',
+        [
+          'query'
+        ]
+      ],
+      'hash'
+    ]
+  ];
+
+
+  return core.assess.dataflow.propagation.urlInstrumentation.parse = {
+    install() {
+      depHooks.resolve({ name: 'url' }, (url) => {
+
+        const name = 'url.parse';
+
+        patcher.patch(url, 'parse', {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const url = args[0];
+            const argInfo = tracker.getData(url);
+
+            if (!argInfo) return;
+
+            const traverse = function(href, url, keys, idx = 0) {
+              let substr = href;
+              keys.forEach((key) => {
+                if (typeof key === 'string') {
+                  const part = result[key];
+                  if (part) {
+                    const index = href.indexOf(part, idx - 1);
+                    substr = href.substring(index, index + part.length);
+                    idx += part.length;
+
+                    const partInfo = tracker.getData(substr);
+                    if (!partInfo) return;
+
+                    const event = createPropagationEvent({
+                      name,
+                      moduleName: 'url',
+                      methodName: 'parse',
+                      context: `url.parse('${argInfo.value}')`,
+                      object: {
+                        value: 'url',
+                        tracked: false
+                      },
+                      result: {
+                        value: inspect(result),
+                        tracked: true
+                      },
+                      args: [{ value: partInfo.value, tracked: true }],
+                      tags: partInfo.tags,
+                      history: [partInfo],
+                      source: 'P',
+                      target: 'R',
+                      stacktraceOpts: {
+                        constructorOpt: hooked,
+                        prependFrames: [orig]
+                      },
+                    });
+                    if (!event) return;
+
+                    if (partInfo) {
+                      Object.assign(partInfo, event);
+                    }
+                    const { extern } = partInfo || tracker.track(part, event);
+
+                    if (extern) {
+                      result[key] = extern;
+                    }
+                  }
+                } else {
+                  traverse(substr, url, key, 0);
+                }
+              });
+            };
+
+            traverse(url, result, keys, 0);
+          }
+        });
+      });
+    },
+  };
+};

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -0,0 +1,140 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+const { inspect, isString } = require('@contrast/common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  function getPropagationEvent(params, paramInfo, data) {
+    return createPropagationEvent({
+      name: 'url.URLSearchParams',
+      moduleName: 'url',
+      methodName: 'URLSearchParams',
+      context: `url.URLSearchParams('${inspect(params)}')`,
+      object: {
+        value: 'url',
+        tracked: false
+      },
+      result: {
+        value: inspect(data.result),
+        tracked: true
+      },
+      args: [{ value: inspect(params), tracked: false }],
+      tags: paramInfo.tags,
+      history: [paramInfo],
+      source: 'P',
+      target: 'R',
+      stacktraceOpts: {
+        constructorOpt: data.hooked,
+        prependFrames: [data.orig]
+      },
+    });
+  }
+
+  return core.assess.dataflow.propagation.urlInstrumentation.searchParams = {
+    install() {
+      depHooks.resolve({ name: 'url' }, (url) => {
+
+        const name = 'url.URLSearchParams';
+
+        patcher.patch(url, 'URLSearchParams', {
+          name,
+          patchType,
+          post(data) {
+            const { args, obj, result } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const [params] = args;
+
+            if (isString(params)) {
+              params.split('&').forEach((query) => {
+                const startIdx = query.indexOf('?') + 1;
+                const endIdx = query.indexOf('=');
+                const key = query.substring(startIdx, endIdx);
+                const param = query.substring(endIdx + 1, query.length);
+
+                const keyInfo = tracker.getData(key);
+                const paramInfo = tracker.getData(param);
+
+                if (keyInfo) {
+                  const event = getPropagationEvent(params, keyInfo, data);
+                  if (event) Object.assign(keyInfo, event);
+                }
+
+                if (paramInfo) {
+                  const event = getPropagationEvent(params, paramInfo, data);
+                  if (event) Object.assign(paramInfo, event);
+                }
+
+                const trackedKey = keyInfo?.extern;
+                const trackedParam = paramInfo?.extern;
+                if (trackedKey) result.delete(key);
+                result.set(trackedKey || key, trackedParam || param);
+              });
+            }
+
+            if (typeof params === 'object') {
+              Object.keys(params).forEach((key) => {
+                const paramInfo = tracker.getData(params[key]);
+                if (!paramInfo) return;
+
+                const event = getPropagationEvent(params, paramInfo, data);
+                if (!event) return;
+
+                Object.assign(paramInfo, event);
+                const { extern } = paramInfo || tracker.track(params[key], event);
+
+                if (extern) {
+                  result.set(key, extern);
+                }
+              });
+            }
+
+            patcher.patch(obj.prototype, 'toString', {
+              name: 'url.URLSearchParams.toString',
+              patchType,
+              post(data) {
+                const { obj: params } = data;
+                let i = 0;
+                let str = '';
+                params.forEach((val, key) => {
+                  if (i === 0) {
+                    str = key.concat('=', val);
+                  } else {
+                    str = str.concat('&', key, '=', val);
+                  }
+                  i++;
+                });
+                data.result = str;
+              }
+            });
+          }
+        });
+      });
+    },
+  };
+};

package/lib/dataflow/propagation/install/url/url.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -24,7 +24,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 
@@ -42,7 +43,6 @@ module.exports = function(core) {
       ],
       'pathname',
       'search',
-      'searchParams',
       'hash'
     ]
   ];
@@ -84,6 +84,7 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.urlInstrumentation.url = {
     install() {
       depHooks.resolve({ name: 'url' }, (url) => {
+        const { URLSearchParams } = url;
         const name = 'url.URL';
         patcher.patch(url, 'URL', {
           name,
@@ -116,33 +117,11 @@ module.exports = function(core) {
             const strInfo = tracker.getData(url);
             if (!strInfo) return;
 
-            const searchParamsProxy = new Proxy(data.result.searchParams, {
-              set(obj, prop, value) {
-                return Reflect.set(obj, prop, value);
-              },
-              get(obj, prop, receiver) {
-                const val = obj[prop];
-                if (val instanceof Function) {
-                  return function (query) {
-                    if (typeof query === 'string') {
-                      const trackedProp = Reflect.get(obj, `_contrast_${query}`);
-                      if (trackedProp) return trackedProp;
-                    }
-                    return val.apply(this === receiver ? obj : this, query);
-                  };
-                }
-                return Reflect.get(obj, prop, receiver);
-              }
-            });
-
             const proxy = new Proxy(data.result, {
               set(obj, prop, value) {
                 return Reflect.set(obj, prop, value);
               },
               get(obj, prop) {
-                if (prop === 'searchParams') {
-                  return searchParamsProxy;
-                }
                 if (prop === 'toString' || prop === 'toJSON') {
                   return function() {
                     return Reflect.get(obj, '_contrast_href');
@@ -159,7 +138,7 @@ module.exports = function(core) {
             const traverse = function(href, url, keys, idx = 0) {
               let substr = href;
               keys.forEach((key) => {
-                if (typeof key === 'string' && key !== 'searchParams') {
+                if (typeof key === 'string') {
                   const part = url[key];
                   if (part !== 'null') {
 
@@ -180,38 +159,13 @@ module.exports = function(core) {
                     const event = getPropagationEvent(strInfo, partInfo, data);
                     if (!event) return;
 
-                    if (partInfo) {
-                      Object.assign(partInfo, event);
-                    }
-                    const { extern } = partInfo || tracker.track(part, event);
+                    Object.assign(partInfo, event);
+                    const { extern } = tracker.track(part, event);
 
                     if (extern) {
                       proxy[`_contrast_${key}`] = extern;
                     }
                   }
-                } else if (key === 'searchParams') {
-                  const queries = proxy.search.split('&');
-                  queries.forEach((query) => {
-                    const startIdx = query.indexOf('?') + 1;
-                    const endIdx = query.indexOf('=');
-                    const queryName = query.substring(startIdx, endIdx);
-                    const queryString = query.substring(endIdx + 1, query.length);
-                    const queryStringInfo = tracker.getData(queryString);
-                    if (!queryStringInfo) return;
-
-                    const event = getPropagationEvent(strInfo, queryStringInfo, data);
-
-                    if (!event) return;
-
-                    if (queryStringInfo) {
-                      Object.assign(queryStringInfo, event);
-                    }
-                    const { extern } = queryStringInfo || tracker.track(queryString, event);
-
-                    if (extern) {
-                      searchParamsProxy[`_contrast_${queryName}`] = extern;
-                    }
-                  });
                 } else {
                   traverse(substr, url, key, 0);
                 }
@@ -219,6 +173,10 @@ module.exports = function(core) {
             };
 
             traverse(url, result, keys, 0);
+
+            if (proxy.search) {
+              proxy._contrast_searchParams = new URLSearchParams(proxy.search);
+            }
             data.result = proxy;
           }
         });

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -23,7 +23,8 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/validator/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/validator/methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/common.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/child-process.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -30,10 +30,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/eval.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -44,10 +44,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/express/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -39,10 +39,10 @@ module.exports = function(core) {
     config,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
+        sinks: { isVulnerable, reportFindings, reportSafePositive }
       },
     },
   } = core;

package/lib/dataflow/sinks/install/fastify/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -58,10 +58,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/fs.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -36,10 +36,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/function.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -46,10 +46,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/http/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/sinks/install/http/request.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -38,13 +38,13 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: {
           isVulnerable,
           reportFindings
         },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;