@contrast/assess 1.16.1 → 1.18.0

package/lib/dataflow/propagation/install/util-format.js

@@ -0,0 +1,120 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../common');
+const { inspect, isString } = require('@contrast/common');
+const { createAppendTags } = require('../../tag-utils');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.utilFormat = {
+    install() {
+      depHooks.resolve({ name: 'util' }, (util) => {
+        const name = 'util.format';
+
+        return patcher.patch(util, 'format', {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !isString(args[0]) || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            let idx = 0;
+            let newTags = {};
+            const history = [];
+            const eventArgs = [];
+            const formatChars = args[0].includes('%') ? args[0].match(/[^%]+/g).map((x) => x[0]) : [];
+            let i = formatChars.length > 0 ? 1 : 0;
+            for (i; i < args.length; i++) {
+              let arg = args[i];
+              const formatChar = formatChars[i - 1];
+              if (typeof arg === 'object') {
+
+                if (formatChar === 'j') {
+                  arg = JSON.stringify(arg);
+                } else if (formatChar.toLowerCase() === 'o') {
+                  // TO-DO: NODE-3235
+                }
+              }
+              const currIdx = result.indexOf(arg, idx);
+              if (currIdx > -1) {
+                idx = currIdx + arg.length;
+              } else {
+                continue;
+              }
+
+              const argInfo = tracker.getData(arg);
+              if (!argInfo) continue;
+
+              newTags = createAppendTags(newTags, argInfo.tags, currIdx);
+
+              history.push({ ...argInfo });
+              eventArgs.push({ value: argInfo ? argInfo.value : arg, tracked: !!argInfo });
+            }
+
+            const resultInfo = tracker.getData(result);
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'util',
+              methodName: 'format',
+              context: `util.format(${inspect(args.join(', '))})`,
+              object: {
+                value: 'util',
+                tracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                tracked: true
+              },
+              args: eventArgs,
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            } else {
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            }
+          }
+        });
+      }
+      );
+    },
+  };
+};

package/lib/dataflow/sinks/index.js

@@ -79,6 +79,7 @@ module.exports = function (core) {
   require('./install/mongodb')(core);
   require('./install/mssql')(core);
   require('./install/mysql')(core);
+  require('./install/node-serialize')(core);
   require('./install/postgres')(core);
   require('./install/sequelize')(core);
   require('./install/sqlite3')(core);

package/lib/dataflow/sinks/install/node-serialize.js

@@ -0,0 +1,103 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../common');
+const {
+  Rule: { UNTRUSTED_DESERIALIZATION },
+  isString,
+  DataflowTag: {
+    UNTRUSTED
+  }
+} = require('@contrast/common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createSinkEvent },
+      dataflow: {
+        tracker,
+        sinks: { isVulnerable, reportFindings }
+      },
+    },
+  } = core;
+
+  core.assess.dataflow.sinks.nodeSerialize = {
+    install() {
+      depHooks.resolve({ name: 'node-serialize' }, (nodeSerialize) => {
+        patcher.patch(nodeSerialize, 'unserialize', {
+          name: 'node-serialize.unserialize',
+          patchType,
+          pre(data) {
+            const store = sources.getStore()?.assess;
+            if (
+              !store ||
+              !data.args[0] ||
+              instrumentation.isLocked()
+            ) return;
+
+            const [input] = data.args;
+
+            if (!isString(input)) {
+              return;
+            }
+
+            const strInfo = tracker.getData(input);
+            if (!strInfo || !isVulnerable(UNTRUSTED, [], strInfo.tags)) {
+              return;
+            }
+
+            const sinkEvent = createSinkEvent({
+              name: 'node-serialize.unserialize',
+              moduleName: 'node-serialize',
+              methodName: 'unserialize',
+              context: `node-serialize.unserialize(${strInfo.value})`,
+              history: [strInfo],
+              object: {
+                value: 'node-serialize',
+                tracked: false
+              },
+              args: [
+                {
+                  value: strInfo.value,
+                  tracked: true
+                },
+              ],
+              tags: strInfo.tags,
+              source: 'P0',
+              stacktraceOpts: {
+                contructorOpt: data.hooked,
+                prependFrames: [data.orig]
+              },
+            });
+
+            if (sinkEvent) {
+              reportFindings({
+                ruleId: UNTRUSTED_DESERIALIZATION,
+                sinkEvent,
+              });
+            }
+          }
+        });
+      });
+    },
+  };
+
+  return core.assess.dataflow.sinks.nodeSerialize;
+};

package/lib/dataflow/tag-utils.js

@@ -24,6 +24,12 @@ function ensureObject(tags) {
 }
 
 function atomicAppend(firstTagRanges, secondTagRanges, offset) {
+  if (!firstTagRanges.length) {
+    const ret = secondTagRanges.map((v) => v + offset);
+    return ret;
+  }
+
+
   const newTagRanges = [...firstTagRanges];
 
   for (let i = 0; i < secondTagRanges.length; i++) {
@@ -271,6 +277,40 @@ function createAdjustedQueryTags(path, tags, value, argString) {
   return idx > 0 ? createAppendTags([], tags, idx) : [...tags];
 }
 
+function createEscapeTagRanges(input, result, tags) {
+  const inputArr = input.split('');
+  const escapedArr = result.split('');
+  const overlap = inputArr.filter((x) => {
+    if (escapedArr.includes(x)) {
+      return x;
+    }
+  });
+  if (overlap.length === 0) {
+    return [];
+  }
+  const newTagRanges = [];
+  let firstIndex = escapedArr.indexOf(overlap[0]);
+  let currIndex = firstIndex;
+  let nextIndex;
+  for (let i = 1; i < overlap.length; i++) {
+    nextIndex = escapedArr.indexOf(overlap[i], currIndex + 1);
+    if (nextIndex !== currIndex + 1) {
+      newTagRanges.push(firstIndex, currIndex);
+      firstIndex = nextIndex;
+    }
+    if (i === overlap.length - 1) {
+      newTagRanges.push(firstIndex, nextIndex);
+    }
+    currIndex = nextIndex;
+  }
+
+  const ret = Object.create(null);
+  for (const tagName of Object.keys(tags)) {
+    ret[tagName] = newTagRanges;
+  }
+  return ret;
+}
+
 module.exports = {
   createSubsetTags,
   createAppendTags,
@@ -278,5 +318,6 @@ module.exports = {
   createMergedTags,
   createTagsWithExclusion,
   createAdjustedQueryTags,
-  createOverlappingTags
+  createOverlappingTags,
+  createEscapeTagRanges
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.16.1",
+  "version": "1.18.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -1,98 +0,0 @@
-/*
- * Copyright: 2023 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-
-'use strict';
-
-const {
-  DataflowTag: { URL_ENCODED }
-} = require('@contrast/common');
-const {
-  createFullLengthCopyTags
-} = require('../../tag-utils');
-const { patchType, createObjectLabel } = require('../common');
-
-module.exports = function(core) {
-  const {
-    scopes: { sources, instrumentation },
-    patcher,
-    assess: {
-      eventFactory: { createPropagationEvent },
-      dataflow: { tracker }
-    }
-  } = core;
-
-  return core.assess.dataflow.propagation.encodeURIComponent = {
-    install() {
-      const name = 'global.encodeURIComponent';
-
-      patcher.patch(global, 'encodeURIComponent', {
-        name,
-        patchType,
-        post(data) {
-          const { args, result, hooked, orig } = data;
-          if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
-
-          const argInfo = tracker.getData(args[0]);
-
-          if (!argInfo) return;
-
-          // This native method seems to create a new string instance
-          // as even when it returns the argument without any change
-          // the result is not tracked, so we don't need to check for that
-          const history = [argInfo];
-          const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
-
-          newTags[URL_ENCODED] = [0, result.length - 1];
-
-          const event = createPropagationEvent({
-            name,
-            moduleName: 'global',
-            methodName: 'encodeURIComponent',
-            context: `encodeURIComponent('${argInfo.value}')`,
-            object: {
-              value: createObjectLabel('global'),
-              tracked: false
-            },
-            result: {
-              value: result,
-              tracked: true
-            },
-            args: [{ value: argInfo.value, tracked: true }],
-            tags: newTags,
-            history,
-            source: 'P',
-            target: 'R',
-            addedTags: [URL_ENCODED],
-            stacktraceOpts: {
-              constructorOpt: hooked,
-              prependFrames: [orig]
-            },
-          });
-
-          if (!event) return;
-
-          const { extern } = tracker.track(result, event);
-
-          if (extern) {
-            data.result = extern;
-          }
-        }
-      });
-    },
-    uninstall() {
-      global.encodeURIComponent = patcher.unwrap(global.encodeURIComponent);
-    },
-  };
-};