@contrast/assess 1.11.0 → 1.12.0

package/lib/dataflow/sinks/install/http/server-response.js

@@ -40,6 +40,7 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: {
@@ -48,7 +49,6 @@ module.exports = function(core) {
           reportSafePositive,
           isSafeContentType
         },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -39,10 +39,10 @@ module.exports = function(core) {
     config,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/marsdb.js

@@ -43,10 +43,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/mongodb.js

@@ -74,10 +74,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, runInActiveSink, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent }
+        sinks: { isVulnerable, runInActiveSink, isLocked, reportFindings, reportSafePositive }
       }
     }
   } = core;

package/lib/dataflow/sinks/install/mssql.js

@@ -39,10 +39,10 @@ module.exports = function(core) {
     config,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/mysql.js

@@ -46,10 +46,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, isLocked, reportFindings },
-        eventFactory: { createSinkEvent },
+        sinks: { isVulnerable, isLocked, reportFindings }
       },
     },
   } = core;

package/lib/dataflow/sinks/install/postgres.js

@@ -30,10 +30,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/sequelize.js

@@ -35,10 +35,10 @@ module.exports = function(core) {
     config,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, runInActiveSink, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/sqlite3.js

@@ -35,10 +35,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/vm.js

@@ -48,6 +48,7 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: {
@@ -57,7 +58,6 @@ module.exports = function(core) {
           reportFindings,
           reportSafePositive,
         },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sources/handler.js

@@ -25,10 +25,10 @@ const {
 module.exports = function(core) {
   const {
     assess: {
+      eventFactory,
       dataflow: {
         sources,
-        tracker,
-        eventFactory
+        tracker
       }
     },
     config,

package/lib/dataflow/sources/install/http.js

@@ -80,7 +80,7 @@ module.exports = function(core) {
         pre(data) {
           const [name = '', value] = data.args;
           if (toLowerCase(name) === 'content-type' && value) {
-            scopes.sources.getStore().assess.responseData.contentType = value;
+            store.assess.responseData.contentType = value;
           }
         }
       });

package/lib/dataflow/tracker.js

@@ -21,11 +21,7 @@ const { isString } = require('@contrast/common');
 module.exports = function tracker(core) {
   const {
     assess: {
-      dataflow: {
-        eventFactory: {
-          createdEvents
-        }
-      }
+      eventFactory: { createdEvents },
     },
     logger
   } = core;

package/lib/{dataflow/event-factory.js → event-factory.js}

@@ -26,7 +26,7 @@ module.exports = function(core) {
     scopes: { sources },
   } = core;
 
-  const eventFactory = core.assess.dataflow.eventFactory = {};
+  const eventFactory = core.assess.eventFactory = {};
 
   eventFactory.createdEvents = new WeakSet();
 
@@ -214,5 +214,61 @@ module.exports = function(core) {
     return event;
   };
 
+  eventFactory.createSessionEvent = function(data) {
+    const {
+      context,
+      name = '',
+      moduleName,
+      methodName,
+      object = { value: null, tracked: false },
+      args = [],
+      result = { value: null, tracked: false },
+      source,
+      stacktraceOpts,
+      framework,
+      options
+    } = data;
+
+    if (!name) {
+      logger.debug({ data }, 'no sink event name');
+      return null;
+    }
+
+    if (
+      (!source || !source.match(annotationRegExp))
+    ) {
+      logger.debug({ data }, 'malformed or missing sink event source field');
+      return null;
+    }
+
+    let stack;
+    if (config.assess.stacktraces !== 'NONE') {
+      stack = createSnapshot(stacktraceOpts)();
+    } else {
+      stack = [];
+    }
+
+    const event = {
+      args,
+      context,
+      history: [],
+      name,
+      moduleName,
+      methodName,
+      object,
+      result,
+      source,
+      stack,
+      tags: {},
+      time: Date.now(),
+      framework,
+      options,
+    };
+
+    eventFactory.createdEvents.add(event);
+
+    return event;
+  };
+
   return eventFactory;
 };

package/lib/index.js

@@ -19,6 +19,7 @@ const { callChildComponentMethodsSync } = require('@contrast/common');
 const sessionConfiguration = require('./session-configuration');
 const dataflow = require('./dataflow');
 const responseScanning = require('./response-scanning');
+const eventFactory = require('./event-factory');
 
 module.exports = function assess(core) {
   if (!core.config.assess.enable) return;
@@ -27,9 +28,10 @@ module.exports = function assess(core) {
 
   // Does this order matter? Probably not
   // 1. dataflow
-  sessionConfiguration(core);
+  eventFactory(core);
   dataflow(core);
   responseScanning(core);
+  sessionConfiguration(core);
 
   // crypto
   // static (in coordination with rewriter)

package/lib/session-configuration/common.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+module.exports = {
+  patchType: 'session-configuration'
+};

package/lib/session-configuration/handlers.js

@@ -0,0 +1,86 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  Event,
+  SessionConfigurationRule: { HTTPONLY, SECURE_FLAG_MISSING },
+} = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    assess: { sessionConfiguration },
+    messages,
+  } = core;
+
+  const checkCookieValue = (ruleId, sinkEvent, cookieValue, sourceContext) => {
+    if (cookieValue.includes(ruleId === HTTPONLY ? 'httponly' : 'secure')) {
+      return;
+    }
+
+    sessionConfiguration.reportFindings(sourceContext, {
+      ruleId,
+      sinkEvent,
+      props: {
+        evidence: cookieValue,
+      },
+    });
+  };
+
+  const handleCookie = (
+    sourceContext,
+    cookieValue,
+    ruleId,
+    sessionEvent
+  ) => {
+    if (Array.isArray(cookieValue)) {
+      return cookieValue.forEach((value) =>
+        checkCookieValue(ruleId, sessionEvent, value, sourceContext)
+      );
+    }
+
+    checkCookieValue(ruleId, sessionEvent, cookieValue, sourceContext);
+  };
+
+  sessionConfiguration.handleHttpOnly = function (
+    sourceContext,
+    cookieValue,
+    sessionEvent
+  ) {
+    handleCookie(sourceContext, cookieValue, HTTPONLY, sessionEvent);
+  };
+
+  sessionConfiguration.handleSecure = function (
+    sourceContext,
+    cookieValue,
+    sessionEvent
+  ) {
+    handleCookie(sourceContext, cookieValue, SECURE_FLAG_MISSING, sessionEvent);
+  };
+
+  // _sourceContext is unused
+  sessionConfiguration.reportFindings = function (
+    _sourceContext,
+    vulnerabilityMetadata
+  ) {
+    messages.emit(
+      Event.ASSESS_SESSION_CONFIGURATION_FINDING,
+      vulnerabilityMetadata
+    );
+  };
+
+  return sessionConfiguration;
+};

package/lib/session-configuration/index.js

@@ -15,16 +15,13 @@
 
 'use strict';
 
-const { callChildComponentMethodsSync, Event } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
-  const { messages } = core;
-  const sessionConfiguration = core.assess.sessionConfiguration = {
-    reportFindings(_sourceContext, vulnerabilityMetadata) {
-      messages.emit(Event.ASSESS_SESSION_CONFIGURATION_FINDING, vulnerabilityMetadata);
-    },
-  };
-  require('./install/http')(core);
+  const sessionConfiguration = core.assess.sessionConfiguration = {};
+
+  require('./handlers')(core);
+  require('./install/express-session')(core);
 
   sessionConfiguration.install = function() {
     callChildComponentMethodsSync(sessionConfiguration, 'install');

package/lib/session-configuration/install/express-session.js

@@ -0,0 +1,131 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const util = require('util');
+const { toLowerCase } = require('@contrast/common');
+const { patchType } = require('../common');
+
+module.exports = function (core) {
+  const {
+    assess: {
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+    scopes: { sources },
+  } = core;
+
+  const expressSession = core.assess.sessionConfiguration.expressSession = {};
+
+  const inspect = patcher.unwrap(util.inspect);
+
+  expressSession.install = function () {
+    return depHooks.resolve({ name: 'express-session' }, (session) => {
+      // Return the hooked function as the export.
+      const hooked = patcher.patch(session, {
+        name: 'express.hookedSessionConstructor',
+        patchType,
+        post(data) {
+          const options = data.args[0];
+
+          // obfuscate the cookie secret
+          if (Array.isArray(data.args) && data.args[0] && data.args[0].secret) {
+            data.args[0].secret = '[HIDDEN]';
+          }
+
+          const { cookie } = options || {};
+          const hasOwnPropertyHttpOnly = cookie && Object.prototype.hasOwnProperty.call(
+            cookie,
+            'httpOnly'
+          );
+
+          // httpOnly is true by default if it's not provided
+          const checkForHTTPOnly =
+            cookie && hasOwnPropertyHttpOnly
+              ? !(cookie.httpOnly === true)
+              : false;
+
+          // secure is false by default
+          const checkForSecure = cookie ? !(cookie.secure === true) : true;
+
+          // skip instrumentation since the options are set correctly
+          if (!checkForHTTPOnly && !checkForSecure) return;
+
+          const sessionEvent = createSessionEvent({
+            args: [{
+              tracked: false,
+              value: inspect(options),
+            }],
+            context: `expressSession(${inspect(data.args)})`,
+            history: [],
+            name: 'express.hookedSessionConstructor',
+            moduleName: 'express-session',
+            methodName: '',
+            object: {
+              tracked: false,
+              value: 'Express.Response',
+            },
+            result: {
+              tracked: false,
+              value: undefined,
+            },
+            source: 'P0',
+            stacktraceOpts: {
+              constructorOpt: data.hooked,
+            },
+            framework: 'express',
+            options,
+          });
+
+          patcher.patch(data, 'result', {
+            name: 'express-session.middleware',
+            patchType,
+            pre(data) {
+              const [, res] = data.args;
+
+              const sourceContext = sources.getStore()?.assess;
+              if (!sourceContext) return;
+
+              patcher.patch(res, 'setHeader', {
+                name: 'http.setHeader',
+                patchType,
+                pre({ args: [key, value] }) {
+                  if (toLowerCase(key) !== 'set-cookie') return;
+
+                  if (checkForHTTPOnly) {
+                    handleHttpOnly(sourceContext, value, sessionEvent);
+                  }
+
+                  if (checkForSecure) {
+                    handleSecure(sourceContext, value, sessionEvent);
+                  }
+                }
+              });
+            },
+          });
+        }
+      });
+
+      return hooked;
+    });
+  };
+
+  return expressSession;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "",
   "main": "lib/index.js",
   "scripts": {
@@ -13,7 +13,7 @@
     "node": ">= 14.15.0"
   },
   "dependencies": {
-    "@contrast/distringuish": "^4.1.0",
+    "@contrast/distringuish": "^4.4.0",
     "@contrast/scopes": "1.4.0",
     "@contrast/common": "1.14.0",
     "parseurl": "^1.3.3"

package/lib/session-configuration/install/http.js

@@ -1,79 +0,0 @@
-/*
- * Copyright: 2023 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const { SessionConfigurationRule, split, toLowerCase } = require('@contrast/common');
-
-module.exports = function(core) {
-  const {
-    depHooks,
-    patcher,
-    scopes: { sources },
-    assess: {
-      sessionConfiguration: {
-        reportFindings
-      }
-    }
-  } = core;
-  const http = core.assess.sessionConfiguration.httpInstrumentation = {};
-
-  const patchType = 'session-configuration';
-
-  http.install = function() {
-    [
-      { name: 'http', responseObj: 'ServerResponse' },
-      { name: 'https', responseObj: 'ServerResponse' },
-      { name: 'http2', responseObj: 'Http2ServerResponse' }
-    ].forEach(({ name, responseObj }) => {
-      depHooks.resolve({ name }, (module) => {
-        patcher.patch(module[responseObj].prototype, 'setHeader', {
-          name: `${name}.${responseObj}.prototype.setHeader`,
-          patchType,
-          post(data) {
-            const sourceContext = sources.getStore()?.assess;
-            if (!sourceContext) return;
-
-            const [key, val] = data.args;
-            if (key === 'Set-Cookie') {
-              const [cookies] = val;
-              const parsedCookies = split(toLowerCase(cookies), '; ');
-
-              if (!parsedCookies.includes('httponly')) {
-                reportFindings(sourceContext, {
-                  ruleId: SessionConfigurationRule.HTTPONLY,
-                  props: {
-                    evidence: cookies
-                  }
-                });
-              }
-
-              if (!parsedCookies.includes('secure')) {
-                reportFindings(sourceContext, {
-                  ruleId: SessionConfigurationRule.SECURE_FLAG_MISSING,
-                  props: {
-                    evidence: cookies
-                  }
-                });
-              }
-            }
-          }
-        });
-      });
-    });
-  };
-
-  return http;
-};