@contrast/assess 1.17.0 → 1.18.0

package/lib/dataflow/propagation/index.js

@@ -24,6 +24,7 @@ module.exports = function(core) {
   require('./install/ejs')(core);
   require('./install/mongoose')(core);
   require('./install/pug')(core);
+  require('./install/sequelize')(core);
   require('./install/string')(core);
   require('./install/url')(core);
   require('./install/validator')(core);
@@ -42,12 +43,12 @@ module.exports = function(core) {
   require('./install/sql-template-strings')(core);
   require('./install/unescape')(core);
   require('./install/querystring')(core);
-  require('./install/sequelize')(core);
   require('./install/JSON')(core);
   require('./install/path')(core);
   require('./install/reg-exp-prototype-exec')(core);
   require('./install/joi')(core);
   require('./install/send')(core);
+  require('./install/util-format')(core);
 
   propagation.install = function() {
     callChildComponentMethodsSync(propagation, 'install');

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -102,7 +102,7 @@ module.exports = function(core) {
               },
               args,
               tags: newTags,
-              history: Array.from(history),
+              history: Array.from(history).map((el) => Object.assign({}, el)),
               source: delimiterInfo ? (history.size > 1 ? 'A' : 'P') : 'O',
               target: 'R',
               stacktraceOpts: {

package/lib/dataflow/propagation/install/sequelize/index.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { callChildComponentMethodsSync } = require('@contrast/common');
+
+module.exports = function(core) {
+  const component = core.assess.dataflow.propagation.sequelizeInstrumentation = {
+    install() {
+      callChildComponentMethodsSync(component, 'install');
+    },
+  };
+
+  require('./query-generator')(core);
+  require('./sql-string')(core);
+
+  return component;
+};

package/lib/dataflow/propagation/install/sequelize/query-generator.js

@@ -0,0 +1,90 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const {
+  DataflowTag: { SQL_ENCODED }
+} = require('@contrast/common');
+const { patchType } = require('../../common');
+
+const DIALECTS = [
+  // 'db2',
+  // 'mariadb',
+  'mssql',
+  'mysql',
+  // 'oracle',
+  'postgres',
+  // 'snowflake',
+  'sqlite',
+];
+
+module.exports = function(core) {
+  const {
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    },
+    depHooks,
+    patcher,
+  } = core;
+
+  return core.assess.dataflow.propagation.sequelizeInstrumentation.queryGenerators = {
+    install() {
+      for (const dialect of DIALECTS) {
+        depHooks.resolve(
+          { name: 'sequelize', file: `lib/dialects/${dialect}/query-generator.js` },
+          (_export) => {
+            const constructor = _export.name;
+
+            patcher.patch(_export.prototype, 'quoteIdentifier', {
+              name: `sequelize.${constructor}.prototype.quoteIdentifier`,
+              patchType,
+              post(data) {
+                const strInfo = tracker.getData(data.result);
+                if (!strInfo) return;
+
+                const { value } = strInfo;
+                const event = createPropagationEvent({
+                  // context: ``,
+                  args: [{ tracked: true, value: data.args[0] }],
+                  history: [strInfo],
+                  moduleName: 'sequelize',
+                  methodName: `${constructor}.prototype.quoteIdentifier`,
+                  object: { tracked: false, value: constructor },
+                  source: 'P',
+                  result: { tracked: true, value },
+                  tags: {
+                    ...strInfo.tags,
+                    [SQL_ENCODED]: [0, value.length - 1],
+                  },
+                  target: 'R',
+                  name: 'foo',
+                });
+
+                if (event) {
+                  const { extern } = tracker.track(value, event);
+                  if (extern) {
+                    data.result = extern;
+                  }
+                }
+              }
+            });
+          }
+        );
+      }
+    },
+    uninstall() {}
+  };
+};

package/lib/dataflow/propagation/install/{sequelize.js → sequelize/sql-string.js}

@@ -19,7 +19,7 @@ const {
   isString,
   DataflowTag: { SQL_ENCODED },
 } = require('@contrast/common');
-const { patchType, createModuleLabel } = require('../common');
+const { patchType, createModuleLabel } = require('../../common');
 
 module.exports = function(core) {
   const {
@@ -50,7 +50,7 @@ module.exports = function(core) {
     return Array.from(matches, (match) => ({ [match[1]]: match.index }));
   }
 
-  return core.assess.dataflow.propagation.sequelizeInstrumentation = {
+  return core.assess.dataflow.propagation.sequelizeInstrumentation.sqlString = {
     install() {
       depHooks.resolve(
         { name: 'sequelize', file: 'lib/sql-string.js' },
@@ -89,7 +89,7 @@ module.exports = function(core) {
                 moduleName: 'sequelize',
                 methodName: 'escape',
                 object: {
-                  value: createModuleLabel('sequelize/lib/sql-string.escape', version),
+                  value: 'sequelize/lib/sql-string.js',
                   tracked: false,
                 },
                 result: {

package/lib/dataflow/propagation/install/util-format.js

@@ -0,0 +1,120 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../common');
+const { inspect, isString } = require('@contrast/common');
+const { createAppendTags } = require('../../tag-utils');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
+    }
+  } = core;
+
+  return core.assess.dataflow.propagation.utilFormat = {
+    install() {
+      depHooks.resolve({ name: 'util' }, (util) => {
+        const name = 'util.format';
+
+        return patcher.patch(util, 'format', {
+          name,
+          patchType,
+          post(data) {
+            const { args, result, hooked, orig } = data;
+            if (!result || !args[0] || !isString(args[0]) || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+
+            let idx = 0;
+            let newTags = {};
+            const history = [];
+            const eventArgs = [];
+            const formatChars = args[0].includes('%') ? args[0].match(/[^%]+/g).map((x) => x[0]) : [];
+            let i = formatChars.length > 0 ? 1 : 0;
+            for (i; i < args.length; i++) {
+              let arg = args[i];
+              const formatChar = formatChars[i - 1];
+              if (typeof arg === 'object') {
+
+                if (formatChar === 'j') {
+                  arg = JSON.stringify(arg);
+                } else if (formatChar.toLowerCase() === 'o') {
+                  // TO-DO: NODE-3235
+                }
+              }
+              const currIdx = result.indexOf(arg, idx);
+              if (currIdx > -1) {
+                idx = currIdx + arg.length;
+              } else {
+                continue;
+              }
+
+              const argInfo = tracker.getData(arg);
+              if (!argInfo) continue;
+
+              newTags = createAppendTags(newTags, argInfo.tags, currIdx);
+
+              history.push({ ...argInfo });
+              eventArgs.push({ value: argInfo ? argInfo.value : arg, tracked: !!argInfo });
+            }
+
+            const resultInfo = tracker.getData(result);
+            const event = createPropagationEvent({
+              name,
+              moduleName: 'util',
+              methodName: 'format',
+              context: `util.format(${inspect(args.join(', '))})`,
+              object: {
+                value: 'util',
+                tracked: false
+              },
+              result: {
+                value: resultInfo ? resultInfo.value : result,
+                tracked: true
+              },
+              args: eventArgs,
+              tags: newTags,
+              history,
+              source: 'P',
+              target: 'R',
+              stacktraceOpts: {
+                constructorOpt: hooked,
+                prependFrames: [orig]
+              },
+            });
+
+            if (!event) return;
+
+            if (resultInfo) {
+              Object.assign(resultInfo, event);
+            } else {
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            }
+          }
+        });
+      }
+      );
+    },
+  };
+};

package/lib/dataflow/sinks/index.js

@@ -79,6 +79,7 @@ module.exports = function (core) {
   require('./install/mongodb')(core);
   require('./install/mssql')(core);
   require('./install/mysql')(core);
+  require('./install/node-serialize')(core);
   require('./install/postgres')(core);
   require('./install/sequelize')(core);
   require('./install/sqlite3')(core);

package/lib/dataflow/sinks/install/node-serialize.js

@@ -0,0 +1,103 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../common');
+const {
+  Rule: { UNTRUSTED_DESERIALIZATION },
+  isString,
+  DataflowTag: {
+    UNTRUSTED
+  }
+} = require('@contrast/common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      eventFactory: { createSinkEvent },
+      dataflow: {
+        tracker,
+        sinks: { isVulnerable, reportFindings }
+      },
+    },
+  } = core;
+
+  core.assess.dataflow.sinks.nodeSerialize = {
+    install() {
+      depHooks.resolve({ name: 'node-serialize' }, (nodeSerialize) => {
+        patcher.patch(nodeSerialize, 'unserialize', {
+          name: 'node-serialize.unserialize',
+          patchType,
+          pre(data) {
+            const store = sources.getStore()?.assess;
+            if (
+              !store ||
+              !data.args[0] ||
+              instrumentation.isLocked()
+            ) return;
+
+            const [input] = data.args;
+
+            if (!isString(input)) {
+              return;
+            }
+
+            const strInfo = tracker.getData(input);
+            if (!strInfo || !isVulnerable(UNTRUSTED, [], strInfo.tags)) {
+              return;
+            }
+
+            const sinkEvent = createSinkEvent({
+              name: 'node-serialize.unserialize',
+              moduleName: 'node-serialize',
+              methodName: 'unserialize',
+              context: `node-serialize.unserialize(${strInfo.value})`,
+              history: [strInfo],
+              object: {
+                value: 'node-serialize',
+                tracked: false
+              },
+              args: [
+                {
+                  value: strInfo.value,
+                  tracked: true
+                },
+              ],
+              tags: strInfo.tags,
+              source: 'P0',
+              stacktraceOpts: {
+                contructorOpt: data.hooked,
+                prependFrames: [data.orig]
+              },
+            });
+
+            if (sinkEvent) {
+              reportFindings({
+                ruleId: UNTRUSTED_DESERIALIZATION,
+                sinkEvent,
+              });
+            }
+          }
+        });
+      });
+    },
+  };
+
+  return core.assess.dataflow.sinks.nodeSerialize;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",