@contrast/assess 1.11.0 → 1.13.0

package/lib/dataflow/propagation/install/joi/values.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  isNonEmptyObject, isString, inspect, traverseValues, join
+} = require('@contrast/common');
+const { createMergedTags } = require('../../../tag-utils');
+const { patchType } = require('../../common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  function instrumentJoiValues(values) {
+    patcher.patch(values.prototype, 'get', {
+      name: 'joi.values',
+      patchType,
+      post(data) {
+        const {
+          args: [value, state, prefs],
+          result,
+        } = data;
+
+        if (
+          !value ||
+          !result ||
+          !sources.getStore()?.assess ||
+          instrumentation.isLocked()
+        ) return;
+
+        const metadata = {
+          state: inspect(state),
+          prefs: inspect(prefs),
+          orig: data.orig
+        };
+        const targetAbsolutePath = join(result.ref.absolute(state), '.');
+
+        if (isString(value)) {
+          validateStringValue(value, result.value, result.ref, targetAbsolutePath, metadata);
+        } else if (isNonEmptyObject(value)) {
+          traverseValues(value, (path, _type, v) => {
+            validateStringValue(v, result.value, result.ref, join([...targetAbsolutePath, ...path], '.'), metadata, path);
+          });
+        }
+      },
+    });
+  }
+
+  function validateStringValue(value, resValue, ref, targetAbsolutePath, metadata, path = []) {
+    const strInfo = ref && tracker.getData(value);
+    const resStringValue = path.reduce((acc, val) => acc[val] || acc, resValue);
+
+    if (strInfo) {
+      const validations = strInfo.eventualValidations?.[targetAbsolutePath];
+      const mappedValueInfo = ref.map && tracker.getData(resStringValue);
+      const adjustedValueInfo = ref.adjust && tracker.getData(resStringValue);
+
+      if (validations?.length && !ref.map && !ref.adjust) {
+        validations.forEach(validation => validation(strInfo));
+
+        delete strInfo.eventualValidations[targetAbsolutePath];
+        !Object.keys(strInfo.eventualValidations).length && delete strInfo.eventualValidations;
+      }
+
+      if (mappedValueInfo || adjustedValueInfo) {
+        const resultInfo = mappedValueInfo || adjustedValueInfo;
+        const mergedTags = createMergedTags(strInfo.tags, resultInfo.tags);
+        const addedTags = [
+          Object.keys(resultInfo.tags).filter((tag) => !(Object.keys(strInfo.tags).find(t => t === tag))),
+          Object.keys(strInfo.tags).filter((tag) => !(Object.keys(resultInfo.tags).find(t => t === tag)))
+        ];
+
+        [strInfo, resultInfo].forEach((info, idx) => {
+          const event = createPropagationEvent({
+            addedTags: [addedTags[idx]],
+            name: 'Joi.values.get',
+            moduleName: 'joi',
+            methodName: 'values.get',
+            history: [{ ...info }],
+            object: {
+              tracked: false,
+              value: 'Joi.string',
+            },
+            args: [
+              { tracked: true, value: info.value },
+              { tracked: false, value: metadata.state },
+              { tracked: false, value: metadata.prefs },
+            ],
+            result: {
+              tracked: false,
+              value: inspect({ value: resultInfo.value, ref }),
+            },
+            source: 'P0',
+            tags: mergedTags,
+            target: 'A',
+            stacktraceOpts: {
+              prependFrames: [metadata.orig],
+            },
+          });
+
+          if (event) {
+            Object.assign(info, event);
+          }
+        });
+      } else {
+        (ref.map || ref.adjust) && tracker.untrack(value);
+      }
+    }
+  }
+
+  return (core.assess.dataflow.propagation.joiInstrumentation.values = {
+    install() {
+      depHooks.resolve(
+        { name: 'joi', file: 'lib/values.js', version: '>=17.0.0' },
+        instrumentJoiValues
+      );
+    },
+  });
+};
+

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -24,9 +24,9 @@ module.exports = function (core) {
     patcher,
     depHooks,
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { mongooseInstrumentation },
       },
     },

package/lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -24,9 +24,9 @@ module.exports = function (core) {
     patcher,
     depHooks,
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { mongooseInstrumentation },
       },
     },

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -28,10 +28,8 @@ module.exports = function (core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -29,7 +29,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/path/basename.js

@@ -27,10 +27,8 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -28,10 +28,8 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/path/normalize.js

@@ -27,10 +27,8 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/pug/index.js

@@ -16,7 +16,7 @@
 
 const { patchType } = require('../../common');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const store = { lock: true, name: 'assess:propagators:pug-compile' };
   const {
     scopes: { sources, instrumentation },
@@ -28,7 +28,7 @@ module.exports = function(core) {
   const pugInstrumentation = {
     install() {
       depHooks.resolve(
-        { name: 'pug', file: 'lib/index.js' },
+        { name: 'pug' },
         (pug) => patcher.patch(pug, 'compile', {
           name: 'pug.compile',
           patchType,

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -29,7 +29,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -31,7 +31,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -23,10 +23,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 

package/lib/dataflow/propagation/install/send.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { patchType } = require('../common');
+const { slice } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    scopes: { sources, instrumentation },
+    depHooks,
+    patcher
+  } = core;
+
+  const send = {};
+  core.assess.dataflow.propagation.send = send;
+
+  function patchSendModule(sendModuleExport) {
+    return patcher.patch(sendModuleExport, {
+      name: 'send',
+      patchType,
+      post(data) {
+        patcher.patch(data.result, 'sendFile', {
+          name: 'send.sendFile',
+          patchType,
+          pre(data) {
+            const { args } = data;
+
+            if (!sources.getStore()?.assess || instrumentation.isLocked()) {
+              return;
+            }
+
+            const untrackedPath = slice(` ${args[0]}`, 1);
+            args[0] = untrackedPath;
+          },
+        });
+      },
+    });
+  }
+
+  send.install = function () {
+    depHooks.resolve({ name: 'send' }, (sendModule) =>
+      patchSendModule(sendModule)
+    );
+  };
+
+  return send;
+};

package/lib/dataflow/propagation/install/sequelize.js

@@ -27,14 +27,12 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
   } = core;
 
-  function getFormatPostions(str) {
+  function getFormatPositions(str) {
     const positions = [];
     let index = -1;
 
@@ -52,7 +50,7 @@ module.exports = function(core) {
     return Array.from(matches, (match) => ({ [match[1]]: match.index }));
   }
 
-  return (core.assess.dataflow.propagation.sequelizeInstrumentation = {
+  return core.assess.dataflow.propagation.sequelizeInstrumentation = {
     install() {
       depHooks.resolve(
         { name: 'sequelize', file: 'lib/sql-string.js' },
@@ -135,7 +133,7 @@ module.exports = function(core) {
                 return;
               }
 
-              const positions = getFormatPostions(data.args[0]);
+              const positions = getFormatPositions(data.args[0]);
               const firstArgInfo = tracker.getData(data.args[0]);
 
               if (!positions.length) {
@@ -309,5 +307,5 @@ module.exports = function(core) {
         }
       );
     },
-  });
+  };
 };

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -26,7 +26,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/concat.js

@@ -26,7 +26,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -22,7 +22,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -36,7 +36,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
   function adjustTags(method, objTags, argLength, argTags = null) {

package/lib/dataflow/propagation/install/string/index.js

@@ -23,7 +23,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
   const stringInstrumentation = core.assess.dataflow.propagation.stringInstrumentation = {

package/lib/dataflow/propagation/install/string/match-all.js

@@ -23,9 +23,9 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { stringInstrumentation },
       },
     },

package/lib/dataflow/propagation/install/string/match.js

@@ -23,9 +23,9 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { stringInstrumentation },
       },
     },

package/lib/dataflow/propagation/install/string/replace.js

@@ -28,7 +28,8 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     },
     scopes: { sources, instrumentation }
   } = core;

package/lib/dataflow/propagation/install/string/slice.js

@@ -22,7 +22,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/split.js

@@ -25,7 +25,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/substring.js

@@ -24,7 +24,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/string/trim.js

@@ -25,7 +25,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/unescape.js

@@ -28,7 +28,8 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -26,7 +26,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/url/parse.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -24,7 +24,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -24,7 +24,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 
@@ -75,18 +76,24 @@ module.exports = function(core) {
                 const endIdx = query.indexOf('=');
                 const key = query.substring(startIdx, endIdx);
                 const param = query.substring(endIdx + 1, query.length);
-                const paramInfo = tracker.getData(param);
-                if (!paramInfo) return;
 
-                const event = getPropagationEvent(params, paramInfo, data);
-                if (!event);
+                const keyInfo = tracker.getData(key);
+                const paramInfo = tracker.getData(param);
 
-                Object.assign(paramInfo, event);
-                const { extern } = paramInfo || tracker.track(param, event);
+                if (keyInfo) {
+                  const event = getPropagationEvent(params, keyInfo, data);
+                  if (event) Object.assign(keyInfo, event);
+                }
 
-                if (extern) {
-                  result.set(key, extern);
+                if (paramInfo) {
+                  const event = getPropagationEvent(params, paramInfo, data);
+                  if (event) Object.assign(paramInfo, event);
                 }
+
+                const trackedKey = keyInfo?.extern;
+                const trackedParam = paramInfo?.extern;
+                if (trackedKey) result.delete(key);
+                result.set(trackedKey || key, trackedParam || param);
               });
             }
 

package/lib/dataflow/propagation/install/url/url.js

@@ -24,7 +24,8 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -23,7 +23,8 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
   } = core;
 

package/lib/dataflow/sinks/install/child-process.js

@@ -30,10 +30,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;

package/lib/dataflow/sinks/install/eval.js

@@ -44,10 +44,10 @@ module.exports = function(core) {
     patcher,
     scopes: { sources, instrumentation },
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
     },
   } = core;