@contrast/assess 1.13.0 → 1.15.0

package/lib/dataflow/sinks/install/eval.js

@@ -25,10 +25,10 @@ const {
     CUSTOM_VALIDATED,
     LIMITED_CHARS,
   },
+  Rule: { UNSAFE_CODE_EXECUTION },
 } = require('@contrast/common');
 const { patchType, filterSafeTags } = require('../common');
 
-const ruleId = 'unsafe-code-execution';
 const safeTags = [
   CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION,
   CUSTOM_ENCODED,
@@ -37,7 +37,7 @@ const safeTags = [
   LIMITED_CHARS,
 ];
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     config,
     logger,
@@ -55,83 +55,79 @@ module.exports = function(core) {
   core.assess.dataflow.sinks.contrastEval = {
     install() {
       if (!global.ContrastMethods?.eval) {
-        logger.error(
-          'Cannot install `eval` instrumentation - Contrast method DNE'
-        );
+        logger.error('Cannot install `eval` instrumentation - Contrast method DNE');
         return;
       }
 
-      Object.assign(global.ContrastMethods, {
-        eval: patcher.patch(global.ContrastMethods.eval, {
-          name: 'global.ContrastMethods.eval',
-          patchType,
-          pre({ args: origArgs, hooked, orig, name }) {
-            const store = sources.getStore()?.assess;
-            const script = origArgs[0];
-            if (
-              !store ||
-              instrumentation.isLocked() ||
-              !script ||
-              !isString(script)
-            )
-              return;
+      patcher.patch(global.ContrastMethods, 'eval', {
+        name: 'global.ContrastMethods.eval',
+        patchType,
+        pre({ args, orig }) {
+          const store = sources.getStore()?.assess;
+          const script = args[0];
+          if (
+            !store ||
+            instrumentation.isLocked() ||
+            !script ||
+            !isString(script)
+          ) {
+            return;
+          }
 
-            const strInfo = tracker.getData(script);
+          const strInfo = tracker.getData(script);
 
-            if (!strInfo) return;
+          if (!strInfo) return;
 
-            const isArgVulnerable = isVulnerable(
-              UNTRUSTED,
-              safeTags,
-              strInfo.tags
-            );
+          const isArgVulnerable = isVulnerable(
+            UNTRUSTED,
+            safeTags,
+            strInfo.tags
+          );
 
-            if (!isArgVulnerable && config.assess.safe_positives.enable) {
-              const foundSafeTags = filterSafeTags(safeTags, strInfo);
-              const safeStrInfo = {
-                value: strInfo.value,
-                tags: strInfo.tags,
-              };
+          if (!isArgVulnerable && config.assess.safe_positives.enable) {
+            const foundSafeTags = filterSafeTags(safeTags, strInfo);
+            const safeStrInfo = {
+              value: strInfo.value,
+              tags: strInfo.tags,
+            };
 
-              reportSafePositive({
-                name,
-                ruleId,
-                safeTags: foundSafeTags,
-                strInfo: safeStrInfo,
-              });
-            }
+            reportSafePositive({
+              name: 'eval',
+              ruleId: UNSAFE_CODE_EXECUTION,
+              safeTags: foundSafeTags,
+              strInfo: safeStrInfo,
+            });
+          }
 
-            if (isArgVulnerable) {
-              const event = createSinkEvent({
-                name,
-                context: `${name}('${strInfo.value}')`,
-                history: [strInfo],
-                object: {
-                  value: 'global.ContrastMethods',
-                  tracked: false,
-                },
-                moduleName: 'global.ContrastMethods',
-                methodName: 'eval',
-                args: [{ value: strInfo.value, tracked: true }],
-                tags: strInfo.tags,
-                source: 'P0',
-                stacktraceOpts: {
-                  contructorOpt: hooked,
-                  prependFrames: [orig],
-                },
-              });
+          if (isArgVulnerable) {
+            const event = createSinkEvent({
+              name: 'eval',
+              context: `eval('${strInfo.value}')`,
+              history: [strInfo],
+              object: {
+                value: 'global',
+                tracked: false,
+              },
+              moduleName: 'global',
+              methodName: 'eval',
+              args: [{ value: strInfo.value, tracked: true }],
+              tags: strInfo.tags,
+              source: 'P0',
+              stacktraceOpts: {
+                contructorOpt: orig
+              },
+            });
 
-              if (event) {
-                reportFindings({
-                  ruleId,
-                  sinkEvent: event,
-                });
-              }
+            if (event) {
+              reportFindings({
+                ruleId: UNSAFE_CODE_EXECUTION,
+                sinkEvent: event,
+              });
             }
-          },
-        }),
+          }
+        },
       });
-    },
+    }
   };
 
   return core.assess.dataflow.sinks.contrastEval;

package/lib/dataflow/sinks/install/function.js

@@ -27,10 +27,10 @@ const {
     CUSTOM_VALIDATED,
     LIMITED_CHARS,
   },
+  Rule: { UNSAFE_CODE_EXECUTION }
 } = require('@contrast/common');
 const { patchType, filterSafeTags } = require('../common');
 
-const ruleId = 'unsafe-code-execution';
 const safeTags = [
   CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION,
   CUSTOM_ENCODED,
@@ -39,7 +39,7 @@ const safeTags = [
   LIMITED_CHARS,
 ];
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     config,
     logger,
@@ -57,103 +57,99 @@ module.exports = function(core) {
   core.assess.dataflow.sinks.contrastFunction = {
     install() {
       if (!global.ContrastMethods?.Function) {
-        logger.error(
-          'Cannot install `Function` instrumentation - Contrast method DNE'
-        );
+        logger.error('Cannot install `Function` instrumentation - Contrast method DNE');
         return;
       }
 
-      Object.assign(global.ContrastMethods, {
-        Function: patcher.patch(global.ContrastMethods.Function, {
-          name: 'global.ContrastMethods.Function',
-          patchType,
-          pre({ args: origArgs, hooked, orig, name }) {
-            const store = sources.getStore()?.assess;
-            const fnBody = origArgs[origArgs.length - 1];
-            if (
-              !store ||
-              instrumentation.isLocked() ||
-              !fnBody ||
-              !isString(fnBody)
-            )
-              return;
-
-            const strInfo = tracker.getData(fnBody);
-
-            if (!strInfo) return;
-
-            const isArgVulnerable = isVulnerable(UNTRUSTED, safeTags, strInfo.tags);
-
-            if (!isArgVulnerable && config.assess.safe_positives.enable) {
-              const foundSafeTags = filterSafeTags(safeTags, strInfo);
-              const safeStrInfo = {
-                value: strInfo.value,
-                tags: strInfo.tags,
-              };
-
-              reportSafePositive({
-                name,
-                ruleId,
-                safeTags: foundSafeTags,
-                strInfo: safeStrInfo,
-              });
-            }
-
-            if (isArgVulnerable) {
-              const args = origArgs.map((arg, idx) => {
-                if (idx === origArgs.length - 1) {
-                  return {
-                    value: strInfo.value,
-                    tracked: true,
-                    inspectedValue: `'${strInfo.value}'`,
-                  };
-                }
-
-                const inspectedValue = inspect(arg);
-                const argInfo = arg && isString(arg) ? tracker.getData(arg) : null;
-
+      patcher.patch(global.ContrastMethods, 'Function', {
+        name: 'global.ContrastMethods.Function',
+        patchType,
+        pre({ args: origArgs, hooked, orig, name }) {
+          const store = sources.getStore()?.assess;
+          const fnBody = origArgs[origArgs.length - 1];
+          if (
+            !store ||
+            instrumentation.isLocked() ||
+            !fnBody ||
+            !isString(fnBody)
+          )
+            return;
+
+          const strInfo = tracker.getData(fnBody);
+
+          if (!strInfo) return;
+
+          const isArgVulnerable = isVulnerable(UNTRUSTED, safeTags, strInfo.tags);
+
+          if (!isArgVulnerable && config.assess.safe_positives.enable) {
+            const foundSafeTags = filterSafeTags(safeTags, strInfo);
+            const safeStrInfo = {
+              value: strInfo.value,
+              tags: strInfo.tags,
+            };
+
+            reportSafePositive({
+              name,
+              ruleId: UNSAFE_CODE_EXECUTION,
+              safeTags: foundSafeTags,
+              strInfo: safeStrInfo,
+            });
+          }
+
+          if (isArgVulnerable) {
+            const args = origArgs.map((arg, idx) => {
+              if (idx === origArgs.length - 1) {
                 return {
-                  value: argInfo ? argInfo.value : inspectedValue,
-                  tracked: !!argInfo,
-                  inspectedValue
+                  value: strInfo.value,
+                  tracked: true,
+                  inspectedValue: `'${strInfo.value}'`,
                 };
-              });
-              const event = createSinkEvent({
-                name,
-                context: `${name}(${join(
-                  args.map((a) => a.inspectedValue),
-                  ', '
-                )})`,
-                history: [strInfo],
-                object: {
-                  value: 'global.ContrastMethods',
-                  tracked: false,
-                },
-                moduleName: 'global.ContrastMethods',
-                methodName: 'Function',
-                args: args.map((a) => ({
-                  value: a.value,
-                  tracked: a.tracked,
-                })),
-                tags: strInfo.tags,
-                source: `P${origArgs.length - 1}`,
-                stacktraceOpts: {
-                  contructorOpt: hooked,
-                  prependFrames: [orig],
-                },
-              });
-
-              if (event) {
-                reportFindings({
-                  ruleId,
-                  sinkEvent: event,
-                });
               }
+
+              const inspectedValue = inspect(arg);
+              const argInfo = arg && isString(arg) ? tracker.getData(arg) : null;
+
+              return {
+                value: argInfo ? argInfo.value : inspectedValue,
+                tracked: !!argInfo,
+                inspectedValue
+              };
+            });
+            const event = createSinkEvent({
+              name,
+              context: `${name}(${join(
+                args.map((a) => a.inspectedValue),
+                ', '
+              )})`,
+              history: [strInfo],
+              object: {
+                value: 'global.ContrastMethods',
+                tracked: false,
+              },
+              moduleName: 'global.ContrastMethods',
+              methodName: 'Function',
+              args: args.map((a) => ({
+                value: a.value,
+                tracked: a.tracked,
+              })),
+              tags: strInfo.tags,
+              source: `P${origArgs.length - 1}`,
+              stacktraceOpts: {
+                contructorOpt: hooked,
+                prependFrames: [orig],
+              },
+            });
+
+            if (event) {
+              reportFindings({
+                ruleId: UNSAFE_CODE_EXECUTION,
+                sinkEvent: event,
+              });
             }
-          },
-        }),
+          }
+        },
       });
-    },
+    }
   };
 
   return core.assess.dataflow.sinks.contrastFunction;

package/lib/dataflow/sinks/install/vm.js

@@ -25,6 +25,7 @@ const {
     CUSTOM_VALIDATED,
     LIMITED_CHARS,
   },
+  Rule: { UNSAFE_CODE_EXECUTION },
   isNonEmptyObject,
   inspect,
   traverseValues,
@@ -32,7 +33,6 @@ const {
   split,
 } = require('@contrast/common');
 const { createAdjustedQueryTags } = require('../../tag-utils');
-const ruleId = 'unsafe-code-execution';
 const safeTags = [
   CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION,
   CUSTOM_ENCODED,
@@ -41,7 +41,7 @@ const safeTags = [
   LIMITED_CHARS,
 ];
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
     config,
     depHooks,
@@ -137,7 +137,7 @@ module.exports = function(core) {
     if (
       !store ||
       instrumentation.isLocked() ||
-      isLocked('unsafe-code-execution')
+      isLocked(UNSAFE_CODE_EXECUTION)
     ) {
       return next();
     }
@@ -189,13 +189,13 @@ module.exports = function(core) {
 
       reportSafePositive({
         name,
-        ruleId,
+        ruleId: UNSAFE_CODE_EXECUTION,
         safeTags: Array.from(foundSafeTags),
         strInfo,
       });
 
       return name === 'vm.runInNewContext'
-        ? runInActiveSink('unsafe-code-execution', () => next())
+        ? runInActiveSink(UNSAFE_CODE_EXECUTION, () => next())
         : next();
     }
 
@@ -233,14 +233,14 @@ module.exports = function(core) {
 
       if (event) {
         reportFindings({
-          ruleId,
+          ruleId: UNSAFE_CODE_EXECUTION,
           sinkEvent: event,
         });
       }
     }
 
     return name === 'vm.runInNewContext'
-      ? runInActiveSink('unsafe-code-execution', () => next())
+      ? runInActiveSink(UNSAFE_CODE_EXECUTION, () => next())
       : next();
   }
 

package/lib/dataflow/tracker.js

@@ -98,11 +98,9 @@ module.exports = function tracker(core) {
 
       const externMetadata = distringuish.getProperties(extern);
       metadata.value = value;
-      metadata.extern = extern;
 
       ret = Object.assign(externMetadata, metadata);
-
-      return ret;
+      return { ...ret, extern };
     } else if (typeof value === 'object') {
       const objInfo = objMap.get(value);
       if (objInfo) {

package/lib/session-configuration/handlers.js

@@ -34,7 +34,7 @@ module.exports = function (core) {
     sessionConfiguration.reportFindings(sourceContext, {
       ruleId,
       sinkEvent,
-      props: {
+      properties: {
         evidence: cookieValue,
       },
     });

package/lib/session-configuration/index.js

@@ -22,6 +22,7 @@ module.exports = function(core) {
 
   require('./handlers')(core);
   require('./install/express-session')(core);
+  require('./install/hapi')(core);
 
   sessionConfiguration.install = function() {
     callChildComponentMethodsSync(sessionConfiguration, 'install');

package/lib/session-configuration/install/hapi.js

@@ -0,0 +1,108 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const util = require('util');
+const { patchType } = require('../common');
+
+module.exports = function (core) {
+  const {
+    assess: {
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+    scopes: { sources },
+  } = core;
+
+  const hapiSession = core.assess.sessionConfiguration.hapiSession = {};
+
+  const inspect = patcher.unwrap(util.inspect);
+
+  hapiSession.install = function () {
+
+    return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <21' }, (hapi) => {
+      ['server', 'Server'].forEach((server) => {
+        patcher.patch(hapi, server, {
+          name: `hapi.${server}`,
+          patchType,
+          post(data) {
+            patcher.patch(data.result, 'state', {
+              name: 'state',
+              patchType,
+              post(data) {
+    
+                const options = data.args[1];
+    
+                const httpOnly = Object.prototype.hasOwnProperty.call(options, 'isHttpOnly') ? options.isHttpOnly : true;
+                const isSecure = Object.prototype.hasOwnProperty.call(options, 'isSecure') ? options.isSecure : true;
+    
+                if (httpOnly && isSecure) return;
+    
+                const sessionEvent = createSessionEvent({
+                  args: [{
+                    tracked: false,
+                    value: inspect(options),
+                  }],
+                  context: `state(${inspect(data.args)})`,
+                  history: [],
+                  name: `hapi.${server}.state`,
+                  moduleName: 'hapi',
+                  methodName: '',
+                  object: {
+                    tracked: false,
+                    value: `hapi.${server}`,
+                  },
+                  result: {
+                    tracked: false,
+                    value: undefined,
+                  },
+                  source: 'P1',
+                  stacktraceOpts: {
+                    constructorOpt: data.hooked,
+                  },
+                  framework: 'hapi',
+                  options
+                });
+    
+                data.obj.ext('onPostResponse', ({ response: { headers } }) => {
+                  const value = headers?.['set-cookie']?.[0];
+                  if (!value) return;
+    
+                  const sourceContext = sources.getStore()?.assess;
+                  if (!sourceContext) return;
+    
+                  if (!httpOnly) {
+                    handleHttpOnly(sourceContext, `set-cookie: ${value}`, sessionEvent);
+                  }
+    
+                  if (!isSecure) {
+                    handleSecure(sourceContext, `set-cookie: ${value}`, sessionEvent);
+                  }
+                });
+              }
+            });
+          }
+        });  
+      });
+    });
+  };
+
+  return hapiSession;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -13,10 +13,12 @@
     "npm": ">=6.13.7 <7 || >= 8.3.1",
     "node": ">= 14.15.0"
   },
+  "scripts": {
+    "test": "../scripts/test.sh"
+  },
   "dependencies": {
+    "@contrast/common": "1.15.1",
     "@contrast/distringuish": "^4.4.0",
-    "@contrast/scopes": "1.4.0",
-    "@contrast/common": "1.15.0",
-    "parseurl": "^1.3.3"
+    "@contrast/scopes": "1.4.0"
   }
 }