@contrast/assess 1.16.1 → 1.17.0

package/lib/dataflow/propagation/index.js

@@ -30,11 +30,12 @@ module.exports = function(core) {
   require('./install/array-prototype-join')(core);
   require('./install/buffer')(core);
   require('./install/decode-uri-component')(core);
-  require('./install/encode-uri-component')(core);
+  require('./install/encode-uri')(core);
   require('./install/escape-html')(core);
   require('./install/escape')(core);
   require('./install/handlebars-utils-escape-expression')(core);
   require('./install/isnumeric-0')(core);
+  require('./install/mustache-escape')(core);
   require('./install/mysql-connection-escape')(core);
   require('./install/parse-int')(core);
   require('./install/pug-runtime-escape')(core);

package/lib/dataflow/propagation/install/encode-uri.js

@@ -0,0 +1,110 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  DataflowTag: { URL_ENCODED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const {
+  createEscapeTagRanges
+} = require('../../tag-utils');
+const { patchType, createObjectLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.encodeURI = {
+    install() {
+
+      [
+        {
+          methodName: 'encodeURIComponent',
+          tag: URL_ENCODED
+        },
+        {
+          methodName: 'encodeURI',
+          tag: WEAK_URL_ENCODED
+        }
+      ].forEach(({ methodName, tag }) => {
+        const name = `global.${methodName}`;
+        patcher.patch(global, methodName, {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            // This native method seems to create a new string instance
+            // as even when it returns the argument without any change
+            // the result is not tracked, so we don't need to check for that
+            const history = [argInfo];
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
+
+            newTags[tag] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'global',
+              methodName,
+              context: `${methodName}('${argInfo.value}')`,
+              object: {
+                value: createObjectLabel('global'),
+                tracked: false
+              },
+              result: {
+                value: result,
+                tracked: true
+              },
+              args: [{ value: argInfo.value, tracked: true }],
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              addedTags: [tag],
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            const { extern } = tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      });
+    },
+    uninstall() {
+      global.encodeURI = patcher.unwrap(global.encodeURI);
+      global.encodeURIComponent = patcher.unwrap(global.encodeURIComponent);
+    },
+  };
+};

package/lib/dataflow/propagation/install/escape-html.js

@@ -19,7 +19,7 @@ const {
   DataflowTag: { HTML_ENCODED }
 } = require('@contrast/common');
 const {
-  createFullLengthCopyTags
+  createEscapeTagRanges
 } = require('../../tag-utils');
 const { patchType } = require('../common');
 
@@ -52,7 +52,7 @@ module.exports = function(core) {
 
             const resultInfo = tracker.getData(result);
             const history = [{ ...argInfo }];
-            const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
 
             newTags[HTML_ENCODED] = [0, result.length - 1];
 

package/lib/dataflow/propagation/install/mustache-escape.js

@@ -0,0 +1,101 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  DataflowTag: { HTML_ENCODED }
+} = require('@contrast/common');
+const {
+  createEscapeTagRanges
+} = require('../../tag-utils');
+const { patchType } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.mustacheEscape = {
+    install() {
+      depHooks.resolve({ name: 'mustache' }, (mustache) => {
+        const name = 'mustache.escape';
+
+        return patcher.patch(mustache, 'escape', {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            const resultInfo = tracker.getData(result);
+
+            const history = [{ ...argInfo }];
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
+            newTags[HTML_ENCODED] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'mustache',
+              methodName: 'escape',
+              context: `mustache.escape(${argInfo.value})`,
+              object: {
+                value: 'mustache',
+                tracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                tracked: true
+              },
+              args: [{ value: argInfo.value, tracked: true }],
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              addedTags: [HTML_ENCODED],
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            }
+
+            const { extern } = resultInfo || tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      }
+      );
+    },
+  };
+};

package/lib/dataflow/propagation/install/path/extname.js

@@ -0,0 +1,113 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString } = require('@contrast/common');
+const { createSubsetTags } = require('../../../tag-utils');
+const {
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.extname = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'extname', {
+            name: `path.${os}.extname`,
+            patchType,
+            post(data) {
+              const { args, result, name, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathStr = args[0];
+
+              if (!pathStr || !isString(pathStr)) return;
+
+              const strInfo = tracker.getData(pathStr);
+
+              if (!strInfo) return;
+
+              let newTags = createSubsetTags(strInfo.tags, pathStr.indexOf(result), result.length);
+
+              newTags = excludeExtensionDotFromTags({
+                result,
+                tags: newTags,
+                isWin32
+              });
+
+              const event = newTags && createPropagationEvent({
+                name,
+                moduleName: 'path',
+                methodName: 'extname',
+                context: `path.extname('${strInfo.value}')`,
+                history: [strInfo],
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: [
+                  {
+                    value: strInfo.value,
+                    tracked: true,
+                  },
+                ],
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags: newTags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.extname;
+};

package/lib/dataflow/propagation/install/path/format.js

@@ -0,0 +1,133 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString, inspect } = require('@contrast/common');
+const { createMergedTags } = require('../../../tag-utils');
+const {
+  createArgTagsInResult,
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.format = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'format', {
+            name: `path.${os}.format`,
+            patchType,
+            post(data) {
+              const { args, result, name: patchName, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathProps = [];
+              const { dir, root, base, name, ext } = args[0];
+              base ? pathProps.push(base) : pathProps.push(ext, name);
+              pathProps.push(dir ?? root);
+
+              const eventArgs = [];
+              const history = [];
+              let fullTags = {};
+              let lastIndex = result.length;
+
+              for (const prop of pathProps) {
+                let newTags = {};
+                const propInfo = isString(prop) && tracker.getData(prop);
+                if (!propInfo) {
+                  eventArgs.unshift({ value: prop, tracked: false });
+                  continue;
+                }
+
+                eventArgs.unshift({ value: propInfo.value, tracked: true });
+                history.unshift(propInfo);
+
+                ({ newTags, lastIndex } = createArgTagsInResult({
+                  argStr: prop,
+                  argTags: propInfo.tags,
+                  result,
+                  lastIndex,
+                  isWin32,
+                }));
+
+                fullTags = createMergedTags(fullTags, newTags);
+              }
+
+              fullTags = excludeExtensionDotFromTags({
+                result,
+                tags: fullTags,
+                isWin32,
+              });
+
+              if (!fullTags || !Object.keys(fullTags).length) return;
+
+              const event = createPropagationEvent({
+                name: patchName,
+                moduleName: 'path',
+                methodName: 'format',
+                context: `path.format('${inspect(...args)}')`,
+                history,
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: eventArgs,
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags: fullTags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.format;
+};

package/lib/dataflow/propagation/install/path/index.js

@@ -26,9 +26,13 @@ module.exports = function(core) {
 
   require('./basename')(core);
   require('./dirname')(core);
+  require('./extname')(core);
+  require('./format')(core);
   require('./join-and-resolve')(core);
   require('./normalize')(core);
+  require('./parse')(core);
   require('./relative')(core);
+  require('./toNamespacedPath')(core);
 
   return pathInstrumentation;
 };

package/lib/dataflow/propagation/install/path/parse.js

@@ -0,0 +1,117 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString, inspect } = require('@contrast/common');
+const { createSubsetTags } = require('../../../tag-utils');
+const {
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.parse = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'parse', {
+            name: `path.${os}.parse`,
+            patchType,
+            post(data) {
+              const { args, result, name: patchName, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const [path] = args;
+
+              if (!path || !isString(path)) return;
+
+              const strInfo = tracker.getData(path);
+              if (!strInfo) return;
+
+              Object.keys(result).forEach((key) => {
+
+                const val = result[key];
+
+                let newTags = createSubsetTags(strInfo.tags, path.indexOf(val), val.length);
+
+                newTags = excludeExtensionDotFromTags({
+                  result: val,
+                  tags: newTags,
+                  isWin32
+                });
+
+                const event = newTags && createPropagationEvent({
+                  name: patchName,
+                  moduleName: 'path',
+                  methodName: 'parse',
+                  context: `path.parse('${strInfo.value}')`,
+                  history: [strInfo],
+                  object: {
+                    value: 'path',
+                    isTracked: false,
+                  },
+                  args: [
+                    {
+                      value: strInfo.value,
+                      tracked: true
+                    }
+                  ],
+                  result: {
+                    value: inspect(result),
+                    tracked: true,
+                  },
+                  tags: newTags,
+                  source: 'P',
+                  target: 'R',
+                  stacktraceOpts: {
+                    constructorOpt: hooked,
+                    prependFrames: [orig],
+                  },
+                });
+
+                if (!event) return;
+
+                const { extern } = tracker.track(val, event);
+
+                if (extern) {
+                  data.result[key] = extern;
+                }
+              });
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.parse;
+};

package/lib/dataflow/propagation/install/path/toNamespacedPath.js

@@ -0,0 +1,128 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { isString } = require('@contrast/common');
+const { patchType } = require('../../common');
+const {
+  createArgTagsInResult,
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.toNamespacedPath = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+
+          patcher.patch(path[os], 'toNamespacedPath', {
+            name: `path.${os}.toNamespacedPath`,
+            patchType,
+            post(data) {
+              const { args, result, name, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathStr = args[0];
+
+              if (!pathStr || !isString(pathStr)) return;
+
+              const strInfo = tracker.getData(pathStr);
+              const resultInfo = tracker.getData(result);
+
+              if (!strInfo) return;
+
+              let { tags } = strInfo;
+              if (os === 'win32') {
+                let { newTags } = createArgTagsInResult({
+                  argStr: pathStr,
+                  argTags: strInfo?.tags || {},
+                  result,
+                  lastIndex: result.length,
+                  isWin32: true,
+                });
+
+                newTags = excludeExtensionDotFromTags({
+                  result,
+                  tags: newTags,
+                  isWin32: true
+                });
+
+                tags = newTags;
+              }
+
+              const event = tags && createPropagationEvent({
+                name,
+                moduleName: 'path',
+                methodName: 'toNamespacedPath',
+                context: `path.toNamespacedPath('${strInfo.value}')`,
+                history: [{ ...strInfo }],
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: [
+                  {
+                    value: strInfo.value,
+                    tracked: true,
+                  },
+                ],
+                result: {
+                  value: resultInfo ? resultInfo.value : result,
+                  tracked: true,
+                },
+                tags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              if (resultInfo) {
+                Object.assign(resultInfo, event);
+              }
+
+              const { extern } = resultInfo || tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.toNamespacedPath;
+};

package/lib/dataflow/propagation/install/querystring/escape.js

@@ -0,0 +1,97 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { inspect } = require('util');
+const { DataflowTag: { URL_ENCODED } } = require('@contrast/common');
+const { createFullLengthCopyTags } = require('../../../tag-utils');
+const { patchType } = require('../../common');
+
+module.exports = function(core) {
+  const {
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    },
+    depHooks,
+    patcher,
+    scopes,
+  } = core;
+
+  return core.assess.dataflow.propagation.querystringInstrumentation.escape = {
+    install() {
+      depHooks.resolve({ name: 'querystring' }, (_export) => {
+        patcher.patch(_export, 'escape', {
+          name: 'querystring.escape',
+          patchType,
+          post(data) {
+            const [value] = data.args;
+            if (!value?.length || !data.result?.length) return value;
+
+            const strInfo = tracker.getData(value);
+            if (!strInfo) return;
+
+            const sourceContext = scopes.sources.getStore()?.assess;
+            if (!sourceContext) return;
+
+            let tags;
+            if (value !== data.result) {
+              tags = createFullLengthCopyTags({
+                ...strInfo.tags,
+                [URL_ENCODED]: [0, 0],
+              }, data.result.length);
+            } else {
+              tags = {
+                ...strInfo.tags,
+                [URL_ENCODED]: [0, data.result.length - 1],
+              };
+            }
+
+            const argVal = inspect(strInfo.value);
+            const event = createPropagationEvent({
+              args: [{ tracked: true, value: argVal }],
+              context: `querystring.escape(${argVal})`,
+              history: [strInfo],
+              moduleName: 'querystring',
+              methodName: 'escape',
+              object: { tracked: false, value: 'querystring' },
+              result: { tracked: true, value: data.result },
+              name: 'querystring.escape',
+              source: 'P',
+              tags,
+              target: 'R',
+            });
+
+            if (event) {
+              const retInfo = tracker.getData(data.result);
+              let extern;
+
+              // if no transformation took place this will happen
+              if (retInfo) {
+                extern = tracker.track(retInfo.value, event)?.extern;
+              } else {
+                extern = tracker.track(data.result, event)?.extern;
+              }
+
+              if (extern) data.result = extern;
+            }
+          },
+        });
+      });
+    },
+    uninstall() {
+    }
+  };
+};

package/lib/dataflow/propagation/install/querystring/index.js

@@ -24,7 +24,9 @@ module.exports = function(core) {
     }
   };
 
+  require('./escape')(core);
   require('./parse')(core);
+  require('./stringify')(core);
 
   return querystringInstrumentation;
 };

package/lib/dataflow/propagation/install/querystring/stringify.js

@@ -0,0 +1,158 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const querystring = require('querystring');
+const { inspect } = require('util');
+const { isString } = require('@contrast/common');
+const utils = require('../../../tag-utils');
+const { patchType } = require('../../common');
+
+const moduleName = 'querystring';
+
+module.exports = function(core) {
+  const {
+    assess: {
+      dataflow: { tracker },
+      eventFactory: { createPropagationEvent },
+    },
+    depHooks,
+    patcher,
+    scopes,
+  } = core;
+
+  /**
+   * Adds custom encoding function to capture key/value tags and history during stringification
+   */
+  function pre(data) {
+    const sourceContext = scopes.sources.getStore()?.assess;
+    if (!sourceContext) return;
+
+    const [input] = data.args;
+    const escape = typeof data.args[3]?.encodeURIComponent === 'function'
+      ? data.args[3].encodeURIComponent
+      : querystring.escape;
+
+    let [, sep, equals] = data.args;
+    // check this
+    if (!isString(sep)) sep = '&';
+    if (!isString(equals)) equals = '=';
+
+    let counter = 0;
+    let offset = 0;
+    const keyState = {
+      value: '',
+      lastCount: 0,
+      nextCount: 0,
+      strInfo: null,
+    };
+
+    // state for post hook
+    data._args = [...data.args];
+    data._history = new Set();
+    data._tags = {};
+
+    // todo NODE-2835: account for custom encoding functions to apply URL_ENCODED
+    function encodeURIComponent(...args) {
+      const [rawValue] = args;
+      const encodedValue = escape(args[0]);
+
+      if (counter === keyState.nextCount) {
+        keyState.value = encodedValue;
+        keyState.lastCount = keyState.nextCount;
+        keyState.nextCount = counter + (Array.isArray(input[rawValue]) ? input[rawValue].length + 1 : 2);
+        keyState.strInfo = tracker.getData(encodedValue);
+      } else {
+        const strInfo = tracker.getData(encodedValue);
+
+        // capture key tags and increment counter for [key]=
+        if (keyState.strInfo) {
+          data._tags = utils.createAppendTags(data._tags, keyState.strInfo.tags, offset);
+          data._history.add(keyState.strInfo);
+        }
+        offset += keyState.value.length + equals.length;
+
+        // capture value tags and increment counter for [value]&
+        if (strInfo) {
+          const tags = Object.create(null);
+          for (const tag of Object.keys(strInfo.tags)) {
+            tags[tag] = [0, encodedValue.length - 1];
+          }
+
+          data._tags = utils.createAppendTags(data._tags, tags, offset);
+          data._history.add(strInfo);
+        }
+        offset += encodedValue.length + sep.length;
+      }
+
+      counter++;
+
+      return encodedValue;
+    }
+
+    data.args[3] = { ...data.args[3], encodeURIComponent };
+  }
+
+  /**
+   * if history/tags were captured, build event and track result
+   */
+  function post(data) {
+    if (!data._history?.size) return;
+
+    const { name } = data;
+    const args = data._args.map((a, i) => ({ tracked: i === 0, value: inspect(a) }));
+    const argString = args.reduce((acc, arg, i, arr) => acc + arg.value + (i === arr.length - 1 ? '' : ', '), '');
+    const context = `${name}(${argString})`;
+    const event = createPropagationEvent({
+      context,
+      args,
+      name,
+      moduleName,
+      // since this is an alias, it is always 'stringify'
+      methodName: data.orig.name,
+      history: Array.from(data._history),
+      object: { tracked: false, value: moduleName },
+      result: { tracked: true, value: data.result },
+      source: 'P',
+      stacktraceOpts: {
+        constructorOpt: data.hooked,
+        prependFrames: [data.orig],
+      },
+      tags: data._tags,
+      target: 'R',
+    });
+
+    if (event) {
+      const { extern } = tracker.track(data.result, event);
+      if (extern) data.result = extern;
+    }
+  }
+
+  return core.assess.dataflow.propagation.querystringInstrumentation.stringify = {
+    install() {
+      depHooks.resolve({ name: moduleName }, (_export) => {
+        for (const methodName of ['encode', 'stringify']) {
+          patcher.patch(_export, methodName, {
+            name: `querystring.${methodName}`,
+            patchType,
+            pre,
+            post
+          });
+        }
+      });
+    },
+    uninstall() { }
+  };
+};

package/lib/dataflow/propagation/install/string/concat.js

@@ -43,7 +43,6 @@ module.exports = function(core) {
           if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
 
           const rInfo = tracker.getData(result);
-
           if (rInfo) {
             // this may happen w/ trackedStr.concat('') => trackedStr
             return;
@@ -77,7 +76,7 @@ module.exports = function(core) {
               name,
               moduleName: 'String',
               methodName: 'prototype.concat',
-              context: `${inspect(objInfo?.value) || String(obj)}.concat(${join(argsData.map(d => d.value), ', ')})`,
+              context: `${inspect(objInfo?.value) || String(obj)}.concat(${inspect(join(argsData.map(d => d.value)), ', ')})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo
@@ -98,7 +97,6 @@ module.exports = function(core) {
             });
 
             if (!event) return;
-
             const { extern } = tracker.track(result, event);
 
             if (extern) {

package/lib/dataflow/propagation/install/string/trim.js

@@ -51,15 +51,10 @@ module.exports = function(core) {
 
       const history = [objInfo];
       const start = presetStart || obj.indexOf(result);
-      const newTags = {};
       const objTags = objInfo.tags || {};
-      Object.assign(newTags, createSubsetTags(objTags, start, result.length));
+      const newTags = createSubsetTags(objTags, start, result.length);
 
-      if (!newTags.untrusted) {
-        return;
-      }
-
-      const event = createPropagationEvent({
+      const event = newTags && createPropagationEvent({
         name: `String.prototype.${methodName}`,
         moduleName: 'String',
         methodName: `prototype.${methodName}`,

package/lib/dataflow/tag-utils.js

@@ -24,6 +24,12 @@ function ensureObject(tags) {
 }
 
 function atomicAppend(firstTagRanges, secondTagRanges, offset) {
+  if (!firstTagRanges.length) {
+    const ret = secondTagRanges.map((v) => v + offset);
+    return ret;
+  }
+
+
   const newTagRanges = [...firstTagRanges];
 
   for (let i = 0; i < secondTagRanges.length; i++) {
@@ -271,6 +277,40 @@ function createAdjustedQueryTags(path, tags, value, argString) {
   return idx > 0 ? createAppendTags([], tags, idx) : [...tags];
 }
 
+function createEscapeTagRanges(input, result, tags) {
+  const inputArr = input.split('');
+  const escapedArr = result.split('');
+  const overlap = inputArr.filter((x) => {
+    if (escapedArr.includes(x)) {
+      return x;
+    }
+  });
+  if (overlap.length === 0) {
+    return [];
+  }
+  const newTagRanges = [];
+  let firstIndex = escapedArr.indexOf(overlap[0]);
+  let currIndex = firstIndex;
+  let nextIndex;
+  for (let i = 1; i < overlap.length; i++) {
+    nextIndex = escapedArr.indexOf(overlap[i], currIndex + 1);
+    if (nextIndex !== currIndex + 1) {
+      newTagRanges.push(firstIndex, currIndex);
+      firstIndex = nextIndex;
+    }
+    if (i === overlap.length - 1) {
+      newTagRanges.push(firstIndex, nextIndex);
+    }
+    currIndex = nextIndex;
+  }
+
+  const ret = Object.create(null);
+  for (const tagName of Object.keys(tags)) {
+    ret[tagName] = newTagRanges;
+  }
+  return ret;
+}
+
 module.exports = {
   createSubsetTags,
   createAppendTags,
@@ -278,5 +318,6 @@ module.exports = {
   createMergedTags,
   createTagsWithExclusion,
   createAdjustedQueryTags,
-  createOverlappingTags
+  createOverlappingTags,
+  createEscapeTagRanges
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -1,98 +0,0 @@
-/*
- * Copyright: 2023 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const {
-  DataflowTag: { URL_ENCODED }
-} = require('@contrast/common');
-const {
-  createFullLengthCopyTags
-} = require('../../tag-utils');
-const { patchType, createObjectLabel } = require('../common');
-
-module.exports = function(core) {
-  const {
-    scopes: { sources, instrumentation },
-    patcher,
-    assess: {
-      eventFactory: { createPropagationEvent },
-      dataflow: { tracker }
-    }
-  } = core;
-
-  return core.assess.dataflow.propagation.encodeURIComponent = {
-    install() {
-      const name = 'global.encodeURIComponent';
-
-      patcher.patch(global, 'encodeURIComponent', {
-        name,
-        patchType,
-        post(data) {
-          const { args, result, hooked, orig } = data;
-          if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
-
-          const argInfo = tracker.getData(args[0]);
-
-          if (!argInfo) return;
-
-          // This native method seems to create a new string instance
-          // as even when it returns the argument without any change
-          // the result is not tracked, so we don't need to check for that
-          const history = [argInfo];
-          const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
-
-          newTags[URL_ENCODED] = [0, result.length - 1];
-
-          const event = createPropagationEvent({
-            name,
-            moduleName: 'global',
-            methodName: 'encodeURIComponent',
-            context: `encodeURIComponent('${argInfo.value}')`,
-            object: {
-              value: createObjectLabel('global'),
-              tracked: false
-            },
-            result: {
-              value: result,
-              tracked: true
-            },
-            args: [{ value: argInfo.value, tracked: true }],
-            tags: newTags,
-            history,
-            source: 'P',
-            target: 'R',
-            addedTags: [URL_ENCODED],
-            stacktraceOpts: {
-              constructorOpt: hooked,
-              prependFrames: [orig]
-            },
-          });
-
-          if (!event) return;
-
-          const { extern } = tracker.track(result, event);
-
-          if (extern) {
-            data.result = extern;
-          }
-        }
-      });
-    },
-    uninstall() {
-      global.encodeURIComponent = patcher.unwrap(global.encodeURIComponent);
-    },
-  };
-};