@contrast/assess 1.14.0 → 1.15.0

package/lib/dataflow/propagation/install/JSON/parse-fn.js

@@ -217,7 +217,7 @@ function processInput(input) {
     return number(input, 0);
   }
 
-  if (firstElement === '"') {
+  if (firstElement === '"' && lastElement === '"') {
     return string(input, 1);
   }
 
@@ -228,7 +228,7 @@ function processInput(input) {
     case 'null':
       return nully();
     default:
-      throw new Error('bad JSON');
+      return string(input, 0);
   }
 }
 

package/lib/dataflow/propagation/install/escape-html.js

@@ -51,7 +51,7 @@ module.exports = function(core) {
             if (!argInfo) return;
 
             const resultInfo = tracker.getData(result);
-            const history = [argInfo];
+            const history = [{ ...argInfo }];
             const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
             newTags[HTML_ENCODED] = [0, result.length - 1];

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -17,8 +17,11 @@
 const { validators, untrackers, sanitizers, custom } = require('./methods');
 const { patchType } = require('../../common');
 
-module.exports = function(core) {
+function getPatcherArgs(obj) {
+  return typeof obj === 'object' ? [obj, 'default'] : [obj];
+}
 
+module.exports = function (core) {
   const {
     depHooks,
     patcher,
@@ -62,9 +65,8 @@ module.exports = function(core) {
         depHooks.resolve(
           { name: 'validator', file: `lib/${validator}` },
           (index) => {
-            const patchFn = typeof index === 'object' ? index.default : index;
             const name = `validator.${validator}`;
-            return patcher.patch(patchFn, {
+            return patcher.patch(...getPatcherArgs(index), {
               name,
               patchType,
               post(data) {
@@ -98,7 +100,7 @@ module.exports = function(core) {
       untrackers.forEach((untracker) => {
         depHooks.resolve(
           { name: 'validator', file: `lib/${untracker}` },
-          (index) => patcher.patch(index.default, {
+          (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${untracker}`,
             patchType,
             post(data) {
@@ -115,7 +117,7 @@ module.exports = function(core) {
       for (const sanitizer in sanitizers) {
         depHooks.resolve(
           { name: 'validator', file: `lib/${sanitizer}` },
-          (index) => patcher.patch(index.default, {
+          (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${sanitizer}`,
             patchType,
             post(data) {
@@ -147,7 +149,7 @@ module.exports = function(core) {
       for (const method in custom) {
         depHooks.resolve(
           { name: 'validator', file: `lib/${method}` },
-          (index) => patcher.patch(index.default, {
+          (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${method}`,
             patchType,
             post(data) {

package/lib/session-configuration/handlers.js

@@ -34,7 +34,7 @@ module.exports = function (core) {
     sessionConfiguration.reportFindings(sourceContext, {
       ruleId,
       sinkEvent,
-      props: {
+      properties: {
         evidence: cookieValue,
       },
     });

package/lib/session-configuration/index.js

@@ -22,6 +22,7 @@ module.exports = function(core) {
 
   require('./handlers')(core);
   require('./install/express-session')(core);
+  require('./install/hapi')(core);
 
   sessionConfiguration.install = function() {
     callChildComponentMethodsSync(sessionConfiguration, 'install');

package/lib/session-configuration/install/hapi.js

@@ -0,0 +1,108 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const util = require('util');
+const { patchType } = require('../common');
+
+module.exports = function (core) {
+  const {
+    assess: {
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+    scopes: { sources },
+  } = core;
+
+  const hapiSession = core.assess.sessionConfiguration.hapiSession = {};
+
+  const inspect = patcher.unwrap(util.inspect);
+
+  hapiSession.install = function () {
+
+    return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <21' }, (hapi) => {
+      ['server', 'Server'].forEach((server) => {
+        patcher.patch(hapi, server, {
+          name: `hapi.${server}`,
+          patchType,
+          post(data) {
+            patcher.patch(data.result, 'state', {
+              name: 'state',
+              patchType,
+              post(data) {
+    
+                const options = data.args[1];
+    
+                const httpOnly = Object.prototype.hasOwnProperty.call(options, 'isHttpOnly') ? options.isHttpOnly : true;
+                const isSecure = Object.prototype.hasOwnProperty.call(options, 'isSecure') ? options.isSecure : true;
+    
+                if (httpOnly && isSecure) return;
+    
+                const sessionEvent = createSessionEvent({
+                  args: [{
+                    tracked: false,
+                    value: inspect(options),
+                  }],
+                  context: `state(${inspect(data.args)})`,
+                  history: [],
+                  name: `hapi.${server}.state`,
+                  moduleName: 'hapi',
+                  methodName: '',
+                  object: {
+                    tracked: false,
+                    value: `hapi.${server}`,
+                  },
+                  result: {
+                    tracked: false,
+                    value: undefined,
+                  },
+                  source: 'P1',
+                  stacktraceOpts: {
+                    constructorOpt: data.hooked,
+                  },
+                  framework: 'hapi',
+                  options
+                });
+    
+                data.obj.ext('onPostResponse', ({ response: { headers } }) => {
+                  const value = headers?.['set-cookie']?.[0];
+                  if (!value) return;
+    
+                  const sourceContext = sources.getStore()?.assess;
+                  if (!sourceContext) return;
+    
+                  if (!httpOnly) {
+                    handleHttpOnly(sourceContext, `set-cookie: ${value}`, sessionEvent);
+                  }
+    
+                  if (!isSecure) {
+                    handleSecure(sourceContext, `set-cookie: ${value}`, sessionEvent);
+                  }
+                });
+              }
+            });
+          }
+        });  
+      });
+    });
+  };
+
+  return hapiSession;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",