@contrast/assess 1.10.0 → 1.12.0

package/lib/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -19,6 +19,7 @@ const { callChildComponentMethodsSync } = require('@contrast/common');
 const sessionConfiguration = require('./session-configuration');
 const dataflow = require('./dataflow');
 const responseScanning = require('./response-scanning');
+const eventFactory = require('./event-factory');
 
 module.exports = function assess(core) {
   if (!core.config.assess.enable) return;
@@ -27,9 +28,10 @@ module.exports = function assess(core) {
 
   // Does this order matter? Probably not
   // 1. dataflow
-  sessionConfiguration(core);
+  eventFactory(core);
   dataflow(core);
   responseScanning(core);
+  sessionConfiguration(core);
 
   // crypto
   // static (in coordination with rewriter)

package/lib/response-scanning/handlers/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,6 +15,12 @@
 
 'use strict';
 
+const {
+  toLowerCase,
+  stringify,
+  substring,
+  ResponseScanningRule
+} = require('@contrast/common');
 const {
   escapeHtml,
   isHtmlContent,
@@ -26,7 +32,6 @@ const {
   getCspHeaders,
   checkCspSources
 } = require('./utils');
-const { toLowerCase, substring, ResponseScanningRule } = require('@contrast/common');
 
 module.exports = function(core) {
   const {
@@ -106,7 +111,7 @@ module.exports = function(core) {
       reportFindings(sourceContext, {
         ruleId: ResponseScanningRule.CACHE_CONTROLS_MISSING,
         vulnerabilityMetadata: {
-          data: JSON.stringify(instructions)
+          data: stringify(instructions)
         }
       });
     }
@@ -176,7 +181,10 @@ module.exports = function(core) {
       delete vulnerabilityMetadata.referrerSecure;
       delete vulnerabilityMetadata.referrerValue;
 
-      reportFindings(sourceContext, { ruleId: ResponseScanningRule.CSP_HEADER_INSECURE, vulnerabilityMetadata });
+      reportFindings(sourceContext, {
+        ruleId: ResponseScanningRule.CSP_HEADER_INSECURE,
+        vulnerabilityMetadata: { data: JSON.stringify(vulnerabilityMetadata) }
+      });
     }
   };
 
@@ -210,7 +218,27 @@ module.exports = function(core) {
     }
   };
 
-  responseScanning.handlePoweredByHeader = function(sourceContext, { responseHeaders }) {
+  responseScanning.handleXContentTypeHeaderMissing = function(sourceContext, { responseHeaders }) {
+    const headerName = 'x-content-type-options';
+    let header = responseHeaders[headerName];
+
+    if (header) {
+      header = toLowerCase(header);
+      if (header === 'nosniff') {
+        return;
+      }
+    }
+
+    reportFindings(sourceContext, {
+      ruleId: ResponseScanningRule.XCONTENTTYPE_HEADER_MISSING,
+      vulnerabilityMetadata: {
+        data: header || ''
+      }
+    });
+  };
+
+  // NODE-3135
+  responseScanning.handleXPoweredByHeader = function(sourceContext, { responseHeaders }) {
     const headerName = 'x-powered-by';
     let header = responseHeaders[headerName];
 
@@ -226,7 +254,7 @@ module.exports = function(core) {
       ];
 
       reportFindings(sourceContext, {
-        ruleId: ResponseScanningRule.POWERED_BY_HEADER,
+        ruleId: ResponseScanningRule.X_POWERED_BY_HEADER,
         vulnerabilityMetadata: {
           data: JSON.stringify(instructions)
         }
@@ -234,37 +262,15 @@ module.exports = function(core) {
     }
   };
 
-  responseScanning.handleXContentTypeHeaderMissing = function(sourceContext, { responseHeaders }) {
-    const headerName = 'x-content-type-options';
-    let header = responseHeaders[headerName];
-
-    if (header) {
-      header = toLowerCase(header);
-      if (header === 'nosniff') {
-        return;
-      }
-    }
-
-    reportFindings(sourceContext, {
-      ruleId: ResponseScanningRule.XCONTENTTYPE_HEADER_MISSING,
-      vulnerabilityMetadata: {
-        data: header || ''
-      }
-    });
-  };
-
   responseScanning.handleXxsProtectionHeaderDisabled = function(sourceContext, { responseHeaders }) {
     const header = responseHeaders['x-xss-protection'];
 
-    // This header is set by default, so `header` should always be present.
-    if (header && header.startsWith('1')) {
-      return;
-    }
+    if (header?.startsWith?.('1')) return;
 
     reportFindings(sourceContext, {
       ruleId: ResponseScanningRule.XXSPROTECTION_HEADER_DISABLED,
       vulnerabilityMetadata: {
-        data: header
+        data: header,
       }
     });
   };

package/lib/response-scanning/handlers/utils.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/response-scanning/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/response-scanning/install/http.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -30,7 +30,7 @@ module.exports = function(core) {
         handleParameterPollution,
         handleCspHeader,
         handleHstsHeaderMissing,
-        handlePoweredByHeader,
+        handleXPoweredByHeader,
         handleXContentTypeHeaderMissing,
         handleXxsProtectionHeaderDisabled,
       }
@@ -76,7 +76,7 @@ module.exports = function(core) {
     handleParameterPollution(sourceContext, evaluationContext);
     handleCspHeader(sourceContext, evaluationContext);
     handleHstsHeaderMissing(sourceContext, evaluationContext);
-    handlePoweredByHeader(sourceContext, evaluationContext);
+    handleXPoweredByHeader(sourceContext, evaluationContext);
     handleXContentTypeHeaderMissing(sourceContext, evaluationContext);
     handleXxsProtectionHeaderDisabled(sourceContext, evaluationContext);
   }

package/lib/session-configuration/common.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+module.exports = {
+  patchType: 'session-configuration'
+};

package/lib/session-configuration/handlers.js

@@ -0,0 +1,86 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  Event,
+  SessionConfigurationRule: { HTTPONLY, SECURE_FLAG_MISSING },
+} = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    assess: { sessionConfiguration },
+    messages,
+  } = core;
+
+  const checkCookieValue = (ruleId, sinkEvent, cookieValue, sourceContext) => {
+    if (cookieValue.includes(ruleId === HTTPONLY ? 'httponly' : 'secure')) {
+      return;
+    }
+
+    sessionConfiguration.reportFindings(sourceContext, {
+      ruleId,
+      sinkEvent,
+      props: {
+        evidence: cookieValue,
+      },
+    });
+  };
+
+  const handleCookie = (
+    sourceContext,
+    cookieValue,
+    ruleId,
+    sessionEvent
+  ) => {
+    if (Array.isArray(cookieValue)) {
+      return cookieValue.forEach((value) =>
+        checkCookieValue(ruleId, sessionEvent, value, sourceContext)
+      );
+    }
+
+    checkCookieValue(ruleId, sessionEvent, cookieValue, sourceContext);
+  };
+
+  sessionConfiguration.handleHttpOnly = function (
+    sourceContext,
+    cookieValue,
+    sessionEvent
+  ) {
+    handleCookie(sourceContext, cookieValue, HTTPONLY, sessionEvent);
+  };
+
+  sessionConfiguration.handleSecure = function (
+    sourceContext,
+    cookieValue,
+    sessionEvent
+  ) {
+    handleCookie(sourceContext, cookieValue, SECURE_FLAG_MISSING, sessionEvent);
+  };
+
+  // _sourceContext is unused
+  sessionConfiguration.reportFindings = function (
+    _sourceContext,
+    vulnerabilityMetadata
+  ) {
+    messages.emit(
+      Event.ASSESS_SESSION_CONFIGURATION_FINDING,
+      vulnerabilityMetadata
+    );
+  };
+
+  return sessionConfiguration;
+};

package/lib/session-configuration/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,16 +15,13 @@
 
 'use strict';
 
-const { callChildComponentMethodsSync, Event } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
-  const { messages } = core;
-  const sessionConfiguration = core.assess.sessionConfiguration = {
-    reportFindings(_sourceContext, vulnerabilityMetadata) {
-      messages.emit(Event.ASSESS_SESSION_CONFIGURATION_FINDING, vulnerabilityMetadata);
-    },
-  };
-  require('./install/http')(core);
+  const sessionConfiguration = core.assess.sessionConfiguration = {};
+
+  require('./handlers')(core);
+  require('./install/express-session')(core);
 
   sessionConfiguration.install = function() {
     callChildComponentMethodsSync(sessionConfiguration, 'install');

package/lib/session-configuration/install/express-session.js

@@ -0,0 +1,131 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const util = require('util');
+const { toLowerCase } = require('@contrast/common');
+const { patchType } = require('../common');
+
+module.exports = function (core) {
+  const {
+    assess: {
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+    scopes: { sources },
+  } = core;
+
+  const expressSession = core.assess.sessionConfiguration.expressSession = {};
+
+  const inspect = patcher.unwrap(util.inspect);
+
+  expressSession.install = function () {
+    return depHooks.resolve({ name: 'express-session' }, (session) => {
+      // Return the hooked function as the export.
+      const hooked = patcher.patch(session, {
+        name: 'express.hookedSessionConstructor',
+        patchType,
+        post(data) {
+          const options = data.args[0];
+
+          // obfuscate the cookie secret
+          if (Array.isArray(data.args) && data.args[0] && data.args[0].secret) {
+            data.args[0].secret = '[HIDDEN]';
+          }
+
+          const { cookie } = options || {};
+          const hasOwnPropertyHttpOnly = cookie && Object.prototype.hasOwnProperty.call(
+            cookie,
+            'httpOnly'
+          );
+
+          // httpOnly is true by default if it's not provided
+          const checkForHTTPOnly =
+            cookie && hasOwnPropertyHttpOnly
+              ? !(cookie.httpOnly === true)
+              : false;
+
+          // secure is false by default
+          const checkForSecure = cookie ? !(cookie.secure === true) : true;
+
+          // skip instrumentation since the options are set correctly
+          if (!checkForHTTPOnly && !checkForSecure) return;
+
+          const sessionEvent = createSessionEvent({
+            args: [{
+              tracked: false,
+              value: inspect(options),
+            }],
+            context: `expressSession(${inspect(data.args)})`,
+            history: [],
+            name: 'express.hookedSessionConstructor',
+            moduleName: 'express-session',
+            methodName: '',
+            object: {
+              tracked: false,
+              value: 'Express.Response',
+            },
+            result: {
+              tracked: false,
+              value: undefined,
+            },
+            source: 'P0',
+            stacktraceOpts: {
+              constructorOpt: data.hooked,
+            },
+            framework: 'express',
+            options,
+          });
+
+          patcher.patch(data, 'result', {
+            name: 'express-session.middleware',
+            patchType,
+            pre(data) {
+              const [, res] = data.args;
+
+              const sourceContext = sources.getStore()?.assess;
+              if (!sourceContext) return;
+
+              patcher.patch(res, 'setHeader', {
+                name: 'http.setHeader',
+                patchType,
+                pre({ args: [key, value] }) {
+                  if (toLowerCase(key) !== 'set-cookie') return;
+
+                  if (checkForHTTPOnly) {
+                    handleHttpOnly(sourceContext, value, sessionEvent);
+                  }
+
+                  if (checkForSecure) {
+                    handleSecure(sourceContext, value, sessionEvent);
+                  }
+                }
+              });
+            },
+          });
+        }
+      });
+
+      return hooked;
+    });
+  };
+
+  return expressSession;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "",
   "main": "lib/index.js",
   "scripts": {
@@ -13,9 +13,9 @@
     "node": ">= 14.15.0"
   },
   "dependencies": {
-    "@contrast/distringuish": "^4.1.0",
+    "@contrast/distringuish": "^4.4.0",
     "@contrast/scopes": "1.4.0",
-    "@contrast/common": "1.13.0",
+    "@contrast/common": "1.14.0",
     "parseurl": "^1.3.3"
   }
 }

package/lib/session-configuration/install/http.js

@@ -1,79 +0,0 @@
-/*
- * Copyright: 2022 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { SessionConfigurationRule, split, toLowerCase } = require('@contrast/common');
-
-module.exports = function(core) {
-  const {
-    depHooks,
-    patcher,
-    scopes: { sources },
-    assess: {
-      sessionConfiguration: {
-        reportFindings
-      }
-    }
-  } = core;
-  const http = core.assess.sessionConfiguration.httpInstrumentation = {};
-
-  const patchType = 'session-configuration';
-
-  http.install = function() {
-    [
-      { name: 'http', responseObj: 'ServerResponse' },
-      { name: 'https', responseObj: 'ServerResponse' },
-      { name: 'http2', responseObj: 'Http2ServerResponse' }
-    ].forEach(({ name, responseObj }) => {
-      depHooks.resolve({ name }, (module) => {
-        patcher.patch(module[responseObj].prototype, 'setHeader', {
-          name: `${name}.${responseObj}.prototype.setHeader`,
-          patchType,
-          post(data) {
-            const sourceContext = sources.getStore()?.assess;
-            if (!sourceContext) return;
-
-            const [key, val] = data.args;
-            if (key === 'Set-Cookie') {
-              const [cookies] = val;
-              const parsedCookies = split(toLowerCase(cookies), '; ');
-
-              if (!parsedCookies.includes('httponly')) {
-                reportFindings(sourceContext, {
-                  ruleId: SessionConfigurationRule.HTTPONLY,
-                  props: {
-                    evidence: cookies
-                  }
-                });
-              }
-
-              if (!parsedCookies.includes('secure')) {
-                reportFindings(sourceContext, {
-                  ruleId: SessionConfigurationRule.SECURE_FLAG_MISSING,
-                  props: {
-                    evidence: cookies
-                  }
-                });
-              }
-            }
-          }
-        });
-      });
-    });
-  };
-
-  return http;
-};