@contrast/assess 1.12.0 → 1.14.0

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
       context: `'${obj}'.exec('${strInfo.value}')`,
       history: [strInfo],
       object: {
-        value: obj,
+        value: 'RegExp',
         tracked: false,
       },
       args: [
@@ -162,11 +162,12 @@ module.exports = function(core) {
                 metadata
               });
 
-              if (event) {
-                const { extern } = tracker.track(res, event);
-                if (extern) {
-                  result.groups[key] = extern;
-                }
+              if (!event) return;
+
+              const { extern } = tracker.track(res, event);
+
+              if (extern) {
+                result.groups[key] = extern;
               }
             });
           }

package/lib/dataflow/propagation/install/send.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { patchType } = require('../common');
+const { slice } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    scopes: { sources, instrumentation },
+    depHooks,
+    patcher
+  } = core;
+
+  const send = {};
+  core.assess.dataflow.propagation.send = send;
+
+  function patchSendModule(sendModuleExport) {
+    return patcher.patch(sendModuleExport, {
+      name: 'send',
+      patchType,
+      post(data) {
+        patcher.patch(data.result, 'sendFile', {
+          name: 'send.sendFile',
+          patchType,
+          pre(data) {
+            const { args } = data;
+
+            if (!sources.getStore()?.assess || instrumentation.isLocked()) {
+              return;
+            }
+
+            const untrackedPath = slice(` ${args[0]}`, 1);
+            args[0] = untrackedPath;
+          },
+        });
+      },
+    });
+  }
+
+  send.install = function () {
+    depHooks.resolve({ name: 'send' }, (sendModule) =>
+      patchSendModule(sendModule)
+    );
+  };
+
+  return send;
+};

package/lib/dataflow/propagation/install/sequelize.js

@@ -32,7 +32,7 @@ module.exports = function(core) {
     },
   } = core;
 
-  function getFormatPostions(str) {
+  function getFormatPositions(str) {
     const positions = [];
     let index = -1;
 
@@ -50,7 +50,7 @@ module.exports = function(core) {
     return Array.from(matches, (match) => ({ [match[1]]: match.index }));
   }
 
-  return (core.assess.dataflow.propagation.sequelizeInstrumentation = {
+  return core.assess.dataflow.propagation.sequelizeInstrumentation = {
     install() {
       depHooks.resolve(
         { name: 'sequelize', file: 'lib/sql-string.js' },
@@ -133,7 +133,7 @@ module.exports = function(core) {
                 return;
               }
 
-              const positions = getFormatPostions(data.args[0]);
+              const positions = getFormatPositions(data.args[0]);
               const firstArgInfo = tracker.getData(data.args[0]);
 
               if (!positions.length) {
@@ -307,5 +307,5 @@ module.exports = function(core) {
         }
       );
     },
-  });
+  };
 };

package/lib/dataflow/propagation/install/string/match-all.js

@@ -195,11 +195,12 @@ module.exports = function(core) {
                   });
                 }
 
-                if (event) {
-                  const { extern } = tracker.track(res, event);
-                  if (extern) {
-                    resValue.groups[key] = extern;
-                  }
+                if (!event) return;
+
+                const { extern } = tracker.track(res, event);
+
+                if (extern) {
+                  resValue.groups[key] = extern;
                 }
               });
             }

package/lib/dataflow/propagation/install/string/match.js

@@ -30,6 +30,7 @@ module.exports = function(core) {
       },
     },
   } = core;
+
   const name = 'String.prototype.match';
 
   function getPropagationEvent(data, res, objInfo, start) {
@@ -49,7 +50,7 @@ module.exports = function(core) {
       moduleName: 'String',
       methodName: 'prototype.match',
       context: `'${objInfo.value}'.match(${args[0].value})`,
-      history: [objInfo],
+      history: [{ ...objInfo }],
       object: {
         value: objInfo.value,
         tracked: true,
@@ -131,11 +132,12 @@ module.exports = function(core) {
               event = getPropagationEvent(data, res, objInfo, start);
             }
 
-            if (event) {
-              const { extern } = tracker.track(res, event);
-              if (extern) {
-                data.result[i] = extern;
-              }
+            if (!event) continue;
+
+            const { extern } = tracker.track(res, event);
+
+            if (extern) {
+              data.result[i] = extern;
             }
           }
           if (hasCaptureGroups && result.groups) {
@@ -153,11 +155,12 @@ module.exports = function(core) {
                 event = getPropagationEvent(data, res, objInfo, start);
               }
 
-              if (event) {
-                const { extern } = tracker.track(res, event);
-                if (extern) {
-                  data.result.groups[key] = extern;
-                }
+              if (!event) return;
+
+              const { extern } = tracker.track(res, event);
+
+              if (extern) {
+                data.result.groups[key] = extern;
               }
             });
           }

package/lib/dataflow/propagation/install/string/replace.js

@@ -199,11 +199,12 @@ module.exports = function(core) {
             target: 'R',
           });
 
-          if (event) {
-            const { extern } = tracker.track(result, event);
-            if (extern) {
-              data.result = extern;
-            }
+          if (!event) return;
+
+          const { extern } = tracker.track(result, event);
+
+          if (extern) {
+            data.result = extern;
           }
         }
       });

package/lib/dataflow/propagation/install/string/slice.js

@@ -98,6 +98,9 @@ module.exports = function(core) {
               prependFrames: [orig]
             }
           });
+
+          if (!event) return;
+
           const { extern } = tracker.track(result, event);
 
           if (extern) {

package/lib/dataflow/propagation/install/string/split.js

@@ -95,11 +95,12 @@ module.exports = function(core) {
                 target: 'R'
               });
 
-              if (event) {
-                const { extern } = tracker.track(res, event);
-                if (extern) {
-                  data.result[i] = extern;
-                }
+              if (!event) continue;
+
+              const { extern } = tracker.track(res, event);
+
+              if (extern) {
+                data.result[i] = extern;
               }
             }
           }

package/lib/dataflow/propagation/install/string/substring.js

@@ -108,9 +108,7 @@ module.exports = function(core) {
               target: 'R',
             });
 
-            if (!event) {
-              return;
-            }
+            if (!event) return;
 
             const { extern } = tracker.track(result, event);
 

package/lib/dataflow/propagation/install/string/trim.js

@@ -82,6 +82,8 @@ module.exports = function(core) {
         target: 'R'
       });
 
+      if (!event) return;
+
       const { extern } = tracker.track(result, event);
 
       if (extern) {

package/lib/dataflow/propagation/install/url/parse.js

@@ -106,16 +106,11 @@ module.exports = function(core) {
                         prependFrames: [orig]
                       },
                     });
-                    if (!event) return;
 
-                    if (partInfo) {
-                      Object.assign(partInfo, event);
-                    }
-                    const { extern } = partInfo || tracker.track(part, event);
+                    if (!event) return;
 
-                    if (extern) {
-                      result[key] = extern;
-                    }
+                    Object.assign(partInfo, event);
+                    result[key] = substr;
                   }
                 } else {
                   traverse(substr, url, key, 0);

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -90,10 +90,8 @@ module.exports = function(core) {
                   if (event) Object.assign(paramInfo, event);
                 }
 
-                const trackedKey = keyInfo?.extern;
-                const trackedParam = paramInfo?.extern;
-                if (trackedKey) result.delete(key);
-                result.set(trackedKey || key, trackedParam || param);
+                if (keyInfo) result.delete(key);
+                result.set(key, param);
               });
             }
 
@@ -106,11 +104,13 @@ module.exports = function(core) {
                 if (!event) return;
 
                 Object.assign(paramInfo, event);
-                const { extern } = paramInfo || tracker.track(params[key], event);
+                let value = params[key];
 
-                if (extern) {
-                  result.set(key, extern);
+                if (!paramInfo) {
+                  ({ extern: value } = tracker.track(params[key], event));
                 }
+
+                result.set(key, value);
               });
             }
 

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -132,13 +132,13 @@ module.exports = function(core) {
                   'R'
                 );
                 let resultTracked = tracker.getData(data.result);
-                if (!resultTracked) {
-                  resultTracked = tracker.track(data.result, event);
-                  if (resultTracked.extern) data.result = resultTracked.extern;
-                }
+
                 if (event) {
+                  resultTracked = resultTracked || tracker.track(data.result, event);
                   Object.assign(resultTracked, event);
                 }
+
+                if (resultTracked.extern) data.result = resultTracked.extern;
               }
             }
           }));

package/lib/dataflow/sinks/index.js

@@ -20,7 +20,7 @@ const { callChildComponentMethodsSync, Event, Rule } = require('@contrast/common
 const { isVulnerable } = require('../utils/is-vulnerable');
 const { isSafeContentType } = require('../utils/is-safe-content-type');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     logger,
     messages,
@@ -30,7 +30,7 @@ module.exports = function(core) {
   const sinkScopes = {
     [Rule.SQL_INJECTION]: new AsyncLocalStorage(),
     [Rule.NOSQL_INJECTION_MONGO]: new AsyncLocalStorage(),
-    ['unsafe-code-execution']: new AsyncLocalStorage()
+    [Rule.UNSAFE_CODE_EXECUTION]: new AsyncLocalStorage()
   };
   const sinks = core.assess.dataflow.sinks = {
     isVulnerable,
@@ -83,7 +83,7 @@ module.exports = function(core) {
   require('./install/sqlite3')(core);
   require('./install/vm')(core);
 
-  sinks.install = function() {
+  sinks.install = function () {
     callChildComponentMethodsSync(core.assess.dataflow.sinks, 'install');
   };
 

package/lib/dataflow/sinks/install/eval.js

@@ -25,10 +25,10 @@ const {
     CUSTOM_VALIDATED,
     LIMITED_CHARS,
   },
+  Rule: { UNSAFE_CODE_EXECUTION },
 } = require('@contrast/common');
 const { patchType, filterSafeTags } = require('../common');
 
-const ruleId = 'unsafe-code-execution';
 const safeTags = [
   CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION,
   CUSTOM_ENCODED,
@@ -37,7 +37,7 @@ const safeTags = [
   LIMITED_CHARS,
 ];
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     config,
     logger,
@@ -55,83 +55,79 @@ module.exports = function(core) {
   core.assess.dataflow.sinks.contrastEval = {
     install() {
       if (!global.ContrastMethods?.eval) {
-        logger.error(
-          'Cannot install `eval` instrumentation - Contrast method DNE'
-        );
+        logger.error('Cannot install `eval` instrumentation - Contrast method DNE');
         return;
       }
 
-      Object.assign(global.ContrastMethods, {
-        eval: patcher.patch(global.ContrastMethods.eval, {
-          name: 'global.ContrastMethods.eval',
-          patchType,
-          pre({ args: origArgs, hooked, orig, name }) {
-            const store = sources.getStore()?.assess;
-            const script = origArgs[0];
-            if (
-              !store ||
-              instrumentation.isLocked() ||
-              !script ||
-              !isString(script)
-            )
-              return;
+      patcher.patch(global.ContrastMethods, 'eval', {
+        name: 'global.ContrastMethods.eval',
+        patchType,
+        pre({ args, orig }) {
+          const store = sources.getStore()?.assess;
+          const script = args[0];
+          if (
+            !store ||
+            instrumentation.isLocked() ||
+            !script ||
+            !isString(script)
+          ) {
+            return;
+          }
 
-            const strInfo = tracker.getData(script);
+          const strInfo = tracker.getData(script);
 
-            if (!strInfo) return;
+          if (!strInfo) return;
 
-            const isArgVulnerable = isVulnerable(
-              UNTRUSTED,
-              safeTags,
-              strInfo.tags
-            );
+          const isArgVulnerable = isVulnerable(
+            UNTRUSTED,
+            safeTags,
+            strInfo.tags
+          );
 
-            if (!isArgVulnerable && config.assess.safe_positives.enable) {
-              const foundSafeTags = filterSafeTags(safeTags, strInfo);
-              const safeStrInfo = {
-                value: strInfo.value,
-                tags: strInfo.tags,
-              };
+          if (!isArgVulnerable && config.assess.safe_positives.enable) {
+            const foundSafeTags = filterSafeTags(safeTags, strInfo);
+            const safeStrInfo = {
+              value: strInfo.value,
+              tags: strInfo.tags,
+            };
 
-              reportSafePositive({
-                name,
-                ruleId,
-                safeTags: foundSafeTags,
-                strInfo: safeStrInfo,
-              });
-            }
+            reportSafePositive({
+              name: 'eval',
+              ruleId: UNSAFE_CODE_EXECUTION,
+              safeTags: foundSafeTags,
+              strInfo: safeStrInfo,
+            });
+          }
 
-            if (isArgVulnerable) {
-              const event = createSinkEvent({
-                name,
-                context: `${name}('${strInfo.value}')`,
-                history: [strInfo],
-                object: {
-                  value: 'global.ContrastMethods',
-                  tracked: false,
-                },
-                moduleName: 'global.ContrastMethods',
-                methodName: 'eval',
-                args: [{ value: strInfo.value, tracked: true }],
-                tags: strInfo.tags,
-                source: 'P0',
-                stacktraceOpts: {
-                  contructorOpt: hooked,
-                  prependFrames: [orig],
-                },
-              });
+          if (isArgVulnerable) {
+            const event = createSinkEvent({
+              name: 'eval',
+              context: `eval('${strInfo.value}')`,
+              history: [strInfo],
+              object: {
+                value: 'global',
+                tracked: false,
+              },
+              moduleName: 'global',
+              methodName: 'eval',
+              args: [{ value: strInfo.value, tracked: true }],
+              tags: strInfo.tags,
+              source: 'P0',
+              stacktraceOpts: {
+                contructorOpt: orig
+              },
+            });
 
-              if (event) {
-                reportFindings({
-                  ruleId,
-                  sinkEvent: event,
-                });
-              }
+            if (event) {
+              reportFindings({
+                ruleId: UNSAFE_CODE_EXECUTION,
+                sinkEvent: event,
+              });
             }
-          },
-        }),
+          }
+        },
       });
-    },
+    }
   };
 
   return core.assess.dataflow.sinks.contrastEval;

package/lib/dataflow/sinks/install/fs.js

@@ -34,7 +34,7 @@ module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources },
+    scopes: { instrumentation, sources },
     assess: {
       eventFactory: { createSinkEvent },
       dataflow: {
@@ -62,7 +62,7 @@ module.exports = function(core) {
   const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
     const { name: methodName, indices } = method;
     const store = sources.getStore()?.assess;
-    if (!store) return;
+    if (!store || instrumentation.isLocked()) return;
 
     const values = getValues(indices, data.args);
     if (!values.length) return;