@contrast/assess 1.16.1 → 1.18.0

package/lib/dataflow/propagation/index.js

@@ -24,29 +24,31 @@ module.exports = function(core) {
   require('./install/ejs')(core);
   require('./install/mongoose')(core);
   require('./install/pug')(core);
+  require('./install/sequelize')(core);
   require('./install/string')(core);
   require('./install/url')(core);
   require('./install/validator')(core);
   require('./install/array-prototype-join')(core);
   require('./install/buffer')(core);
   require('./install/decode-uri-component')(core);
-  require('./install/encode-uri-component')(core);
+  require('./install/encode-uri')(core);
   require('./install/escape-html')(core);
   require('./install/escape')(core);
   require('./install/handlebars-utils-escape-expression')(core);
   require('./install/isnumeric-0')(core);
+  require('./install/mustache-escape')(core);
   require('./install/mysql-connection-escape')(core);
   require('./install/parse-int')(core);
   require('./install/pug-runtime-escape')(core);
   require('./install/sql-template-strings')(core);
   require('./install/unescape')(core);
   require('./install/querystring')(core);
-  require('./install/sequelize')(core);
   require('./install/JSON')(core);
   require('./install/path')(core);
   require('./install/reg-exp-prototype-exec')(core);
   require('./install/joi')(core);
   require('./install/send')(core);
+  require('./install/util-format')(core);
 
   propagation.install = function() {
     callChildComponentMethodsSync(propagation, 'install');

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -102,7 +102,7 @@ module.exports = function(core) {
               },
               args,
               tags: newTags,
-              history: Array.from(history),
+              history: Array.from(history).map((el) => Object.assign({}, el)),
               source: delimiterInfo ? (history.size > 1 ? 'A' : 'P') : 'O',
               target: 'R',
               stacktraceOpts: {

package/lib/dataflow/propagation/install/encode-uri.js

@@ -0,0 +1,110 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  DataflowTag: { URL_ENCODED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const {
+  createEscapeTagRanges
+} = require('../../tag-utils');
+const { patchType, createObjectLabel } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.encodeURI = {
+    install() {
+
+      [
+        {
+          methodName: 'encodeURIComponent',
+          tag: URL_ENCODED
+        },
+        {
+          methodName: 'encodeURI',
+          tag: WEAK_URL_ENCODED
+        }
+      ].forEach(({ methodName, tag }) => {
+        const name = `global.${methodName}`;
+        patcher.patch(global, methodName, {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            // This native method seems to create a new string instance
+            // as even when it returns the argument without any change
+            // the result is not tracked, so we don't need to check for that
+            const history = [argInfo];
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
+
+            newTags[tag] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'global',
+              methodName,
+              context: `${methodName}('${argInfo.value}')`,
+              object: {
+                value: createObjectLabel('global'),
+                tracked: false
+              },
+              result: {
+                value: result,
+                tracked: true
+              },
+              args: [{ value: argInfo.value, tracked: true }],
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              addedTags: [tag],
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            const { extern } = tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      });
+    },
+    uninstall() {
+      global.encodeURI = patcher.unwrap(global.encodeURI);
+      global.encodeURIComponent = patcher.unwrap(global.encodeURIComponent);
+    },
+  };
+};

package/lib/dataflow/propagation/install/escape-html.js

@@ -19,7 +19,7 @@ const {
   DataflowTag: { HTML_ENCODED }
 } = require('@contrast/common');
 const {
-  createFullLengthCopyTags
+  createEscapeTagRanges
 } = require('../../tag-utils');
 const { patchType } = require('../common');
 
@@ -52,7 +52,7 @@ module.exports = function(core) {
 
             const resultInfo = tracker.getData(result);
             const history = [{ ...argInfo }];
-            const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
 
             newTags[HTML_ENCODED] = [0, result.length - 1];
 

package/lib/dataflow/propagation/install/mustache-escape.js

@@ -0,0 +1,101 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  DataflowTag: { HTML_ENCODED }
+} = require('@contrast/common');
+const {
+  createEscapeTagRanges
+} = require('../../tag-utils');
+const { patchType } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.mustacheEscape = {
+    install() {
+      depHooks.resolve({ name: 'mustache' }, (mustache) => {
+        const name = 'mustache.escape';
+
+        return patcher.patch(mustache, 'escape', {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            const argInfo = tracker.getData(args[0]);
+
+            if (!argInfo) return;
+
+            const resultInfo = tracker.getData(result);
+
+            const history = [{ ...argInfo }];
+            const newTags = createEscapeTagRanges(args[0], result, argInfo.tags);
+            newTags[HTML_ENCODED] = [0, result.length - 1];
+
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'mustache',
+              methodName: 'escape',
+              context: `mustache.escape(${argInfo.value})`,
+              object: {
+                value: 'mustache',
+                tracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                tracked: true
+              },
+              args: [{ value: argInfo.value, tracked: true }],
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              addedTags: [HTML_ENCODED],
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            }
+
+            const { extern } = resultInfo || tracker.track(result, event);
+
+            if (extern) {
+              data.result = extern;
+            }
+          }
+        });
+      }
+      );
+    },
+  };
+};

package/lib/dataflow/propagation/install/path/extname.js

@@ -0,0 +1,113 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString } = require('@contrast/common');
+const { createSubsetTags } = require('../../../tag-utils');
+const {
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.extname = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'extname', {
+            name: `path.${os}.extname`,
+            patchType,
+            post(data) {
+              const { args, result, name, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathStr = args[0];
+
+              if (!pathStr || !isString(pathStr)) return;
+
+              const strInfo = tracker.getData(pathStr);
+
+              if (!strInfo) return;
+
+              let newTags = createSubsetTags(strInfo.tags, pathStr.indexOf(result), result.length);
+
+              newTags = excludeExtensionDotFromTags({
+                result,
+                tags: newTags,
+                isWin32
+              });
+
+              const event = newTags && createPropagationEvent({
+                name,
+                moduleName: 'path',
+                methodName: 'extname',
+                context: `path.extname('${strInfo.value}')`,
+                history: [strInfo],
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: [
+                  {
+                    value: strInfo.value,
+                    tracked: true,
+                  },
+                ],
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags: newTags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.extname;
+};

package/lib/dataflow/propagation/install/path/format.js

@@ -0,0 +1,133 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString, inspect } = require('@contrast/common');
+const { createMergedTags } = require('../../../tag-utils');
+const {
+  createArgTagsInResult,
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.format = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'format', {
+            name: `path.${os}.format`,
+            patchType,
+            post(data) {
+              const { args, result, name: patchName, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathProps = [];
+              const { dir, root, base, name, ext } = args[0];
+              base ? pathProps.push(base) : pathProps.push(ext, name);
+              pathProps.push(dir ?? root);
+
+              const eventArgs = [];
+              const history = [];
+              let fullTags = {};
+              let lastIndex = result.length;
+
+              for (const prop of pathProps) {
+                let newTags = {};
+                const propInfo = isString(prop) && tracker.getData(prop);
+                if (!propInfo) {
+                  eventArgs.unshift({ value: prop, tracked: false });
+                  continue;
+                }
+
+                eventArgs.unshift({ value: propInfo.value, tracked: true });
+                history.unshift(propInfo);
+
+                ({ newTags, lastIndex } = createArgTagsInResult({
+                  argStr: prop,
+                  argTags: propInfo.tags,
+                  result,
+                  lastIndex,
+                  isWin32,
+                }));
+
+                fullTags = createMergedTags(fullTags, newTags);
+              }
+
+              fullTags = excludeExtensionDotFromTags({
+                result,
+                tags: fullTags,
+                isWin32,
+              });
+
+              if (!fullTags || !Object.keys(fullTags).length) return;
+
+              const event = createPropagationEvent({
+                name: patchName,
+                moduleName: 'path',
+                methodName: 'format',
+                context: `path.format('${inspect(...args)}')`,
+                history,
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: eventArgs,
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags: fullTags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.format;
+};

package/lib/dataflow/propagation/install/path/index.js

@@ -26,9 +26,13 @@ module.exports = function(core) {
 
   require('./basename')(core);
   require('./dirname')(core);
+  require('./extname')(core);
+  require('./format')(core);
   require('./join-and-resolve')(core);
   require('./normalize')(core);
+  require('./parse')(core);
   require('./relative')(core);
+  require('./toNamespacedPath')(core);
 
   return pathInstrumentation;
 };

package/lib/dataflow/propagation/install/path/parse.js

@@ -0,0 +1,117 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { patchType } = require('../../common');
+const { isString, inspect } = require('@contrast/common');
+const { createSubsetTags } = require('../../../tag-utils');
+const {
+  excludeExtensionDotFromTags
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.parse = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'parse', {
+            name: `path.${os}.parse`,
+            patchType,
+            post(data) {
+              const { args, result, name: patchName, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const [path] = args;
+
+              if (!path || !isString(path)) return;
+
+              const strInfo = tracker.getData(path);
+              if (!strInfo) return;
+
+              Object.keys(result).forEach((key) => {
+
+                const val = result[key];
+
+                let newTags = createSubsetTags(strInfo.tags, path.indexOf(val), val.length);
+
+                newTags = excludeExtensionDotFromTags({
+                  result: val,
+                  tags: newTags,
+                  isWin32
+                });
+
+                const event = newTags && createPropagationEvent({
+                  name: patchName,
+                  moduleName: 'path',
+                  methodName: 'parse',
+                  context: `path.parse('${strInfo.value}')`,
+                  history: [strInfo],
+                  object: {
+                    value: 'path',
+                    isTracked: false,
+                  },
+                  args: [
+                    {
+                      value: strInfo.value,
+                      tracked: true
+                    }
+                  ],
+                  result: {
+                    value: inspect(result),
+                    tracked: true,
+                  },
+                  tags: newTags,
+                  source: 'P',
+                  target: 'R',
+                  stacktraceOpts: {
+                    constructorOpt: hooked,
+                    prependFrames: [orig],
+                  },
+                });
+
+                if (!event) return;
+
+                const { extern } = tracker.track(val, event);
+
+                if (extern) {
+                  data.result[key] = extern;
+                }
+              });
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.parse;
+};