@contrast/assess 1.18.0 → 1.19.0

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -17,6 +17,7 @@
 
 const util = require('util');
 const {
+  Rule: { UNVALIDATED_REDIRECT: ruleId },
   DataflowTag: {
     UNTRUSTED,
     CUSTOM_ENCODED,
@@ -27,18 +28,25 @@ const {
   },
   isString
 } = require('@contrast/common');
-const { patchType, filterSafeTags } = require('../../common');
+const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
+const { patchType, filterSafeTags } = require('../../common');
 
-const ruleId = 'unvalidated-redirect';
-
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ *  logger: import('@contrast/logger').Logger,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+*/
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
     config,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -46,9 +54,8 @@ module.exports = function(core) {
       },
     },
   } = core;
-  const unvalidatedRedirect =
-    (core.assess.dataflow.sinks.express.unvalidatedRedirect = {});
 
+  const unvalidatedRedirect = core.assess.dataflow.sinks.express.unvalidatedRedirect = {};
   const inspect = patcher.unwrap(util.inspect);
 
   const safeTags = [
@@ -66,8 +73,7 @@ module.exports = function(core) {
         name: 'Express.Response.location',
         patchType,
         pre: (data) => {
-          const assessStore = sources.getStore()?.assess;
-          if (!assessStore) return;
+          if (!getSourceContext(RULE, ruleId)) return;
 
           let [url] = data.args;
           if (url === 'back') {

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -17,6 +17,7 @@
 
 const util = require('util');
 const {
+  Rule: { UNVALIDATED_REDIRECT: ruleId },
   DataflowTag: {
     UNTRUSTED,
     CUSTOM_ENCODED,
@@ -27,11 +28,10 @@ const {
   },
   isString
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { filterSafeTags, patchType } = require('../../common');
 
-const ruleId = 'unvalidated-redirect';
-
 const getURLArgument = (args) => {
   if (!Array.isArray(args)) {
     return { index: null, url: undefined };
@@ -51,13 +51,21 @@ const getURLArgument = (args) => {
   };
 };
 
+/**
+ *
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     config,
     depHooks,
     patcher,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -85,8 +93,7 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const assessStore = sources.getStore()?.assess;
-          if (!assessStore) return;
+          if (!getSourceContext(RULE, ruleId)) return;
 
           const { url, index: valueIndex } = getURLArgument(data.args);
           if (!url || !isString(url)) return;

package/lib/dataflow/sinks/install/fs.js

@@ -16,9 +16,6 @@
 'use strict';
 const { patchType } = require('../common');
 const {
-  FS_METHODS,
-  Rule,
-  isString,
   DataflowTag: {
     URL_ENCODED,
     LIMITED_CHARS,
@@ -26,16 +23,20 @@ const {
     SAFE_PATH,
     UNTRUSTED,
   },
+  FS_METHODS,
+  Rule: { PATH_TRAVERSAL: ruleId },
   inspect,
+  isString,
   join,
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { instrumentation, sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -61,8 +62,7 @@ module.exports = function(core) {
 
   const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
     const { name: methodName, indices } = method;
-    const store = sources.getStore()?.assess;
-    if (!store || instrumentation.isLocked()) return;
+    if (!getSourceContext(RULE, ruleId)) return;
 
     const values = getValues(indices, data.args);
     if (!values.length) return;
@@ -105,7 +105,7 @@ module.exports = function(core) {
 
       if (event) {
         reportFindings({
-          ruleId: Rule.PATH_TRAVERSAL,
+          ruleId,
           sinkEvent: event,
         });
       }

package/lib/dataflow/sinks/install/function.js

@@ -27,8 +27,9 @@ const {
     CUSTOM_VALIDATED,
     LIMITED_CHARS,
   },
-  Rule: { UNSAFE_CODE_EXECUTION }
+  Rule: { UNSAFE_CODE_EXECUTION: ruleId }
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
 const { patchType, filterSafeTags } = require('../common');
 
 const safeTags = [
@@ -44,8 +45,8 @@ module.exports = function (core) {
     config,
     logger,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -65,15 +66,10 @@ module.exports = function (core) {
         name: 'global.ContrastMethods.Function',
         patchType,
         pre({ args: origArgs, hooked, orig, name }) {
-          const store = sources.getStore()?.assess;
+          if (!getSourceContext(RULE, ruleId)) return;
+
           const fnBody = origArgs[origArgs.length - 1];
-          if (
-            !store ||
-            instrumentation.isLocked() ||
-            !fnBody ||
-            !isString(fnBody)
-          )
-            return;
+          if (!fnBody || !isString(fnBody)) return;
 
           const strInfo = tracker.getData(fnBody);
 
@@ -90,7 +86,7 @@ module.exports = function (core) {
 
             reportSafePositive({
               name,
-              ruleId: UNSAFE_CODE_EXECUTION,
+              ruleId,
               safeTags: foundSafeTags,
               strInfo: safeStrInfo,
             });
@@ -142,7 +138,7 @@ module.exports = function (core) {
 
             if (event) {
               reportFindings({
-                ruleId: UNSAFE_CODE_EXECUTION,
+                ruleId,
                 sinkEvent: event,
               });
             }

package/lib/dataflow/sinks/install/http/request.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const Url = require('url');
 const {
   inspect,
   isString,
@@ -25,19 +26,27 @@ const {
     CUSTOM_VALIDATED_SSRF,
     CUSTOM_VALIDATED,
     LIMITED_CHARS
-  }
+  },
+  Rule: { SSRF: ruleId },
 } = require('@contrast/common');
-const Url = require('url');
-const trustedLibs = [/^(?!.*(newrelic)).*http.*$/];
-const { patchType } = require('../../common');
+const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createAppendTags } = require('../../../tag-utils');
+const { patchType } = require('../../common');
+
+const trustedLibs = [/^(?!.*(newrelic)).*http.*$/];
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+*/
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -92,8 +101,7 @@ module.exports = function(core) {
           name,
           patchType,
           pre(data) {
-            const sourceContext = sources.getStore()?.assess;
-            if (!sourceContext) return;
+            if (!getSourceContext(RULE, ruleId)) return;
 
             const [req] = data.args;
             if (!req) return;
@@ -136,7 +144,7 @@ module.exports = function(core) {
 
                 if (event) {
                   reportFindings({
-                    ruleId: 'ssrf',
+                    ruleId,
                     sinkEvent: event
                   });
                 }

package/lib/dataflow/sinks/install/http/server-response.js

@@ -31,15 +31,24 @@ const {
   },
   Rule: { REFLECTED_XSS: ruleId },
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../../constants');
+
 const { patchType, filterSafeTags } = require('../../common');
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     config,
     depHooks,
     patcher,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -68,7 +77,7 @@ module.exports = function(core) {
   ];
 
   const preHook = (name, method) => (data) => {
-    const sourceContext = sources.getStore()?.assess;
+    const sourceContext = getSourceContext(RULE, ruleId);
     if (!sourceContext) return;
 
     const payload = data.args[0];

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -25,20 +25,29 @@ const {
     LIMITED_CHARS,
     URL_ENCODED,
   },
+  Rule: { UNVALIDATED_REDIRECT: ruleId },
   isString
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { filterSafeTags, patchType } = require('../../common');
 
-const ruleId = 'unvalidated-redirect';
-
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ *  logger: import('@contrast/logger').Logger,
+ *  messages: import('@contrast/common').Messages,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
     config,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -46,11 +55,8 @@ module.exports = function(core) {
       },
     },
   } = core;
-  const unvalidatedRedirect =
-    (core.assess.dataflow.sinks.koa.unvalidatedRedirect = {});
 
   const inspect = patcher.unwrap(util.inspect);
-
   const safeTags = [
     CUSTOM_ENCODED,
     CUSTOM_VALIDATED,
@@ -59,6 +65,8 @@ module.exports = function(core) {
     URL_ENCODED,
   ];
 
+  const unvalidatedRedirect = core.assess.dataflow.sinks.koa.unvalidatedRedirect = {};
+
   unvalidatedRedirect.install = function() {
     depHooks.resolve({ name: 'koa', file: 'lib/response', version: '<2.9.0' }, (Response) => {
       const name = 'Koa.Response.redirect';
@@ -66,8 +74,7 @@ module.exports = function(core) {
         name,
         patchType,
         pre(data) {
-          const assessStore = sources.getStore()?.assess;
-          if (!assessStore) return;
+          if (!getSourceContext(RULE, ruleId)) return;
 
           let isBackRoute = false;
           let [url] = data.args;

package/lib/dataflow/sinks/install/libxmljs.js

@@ -15,9 +15,8 @@
 
 'use strict';
 
-const { patchType } = require('../common');
 const {
-  Rule: { XXE },
+  Rule: { XXE: ruleId },
   isString,
   DataflowTag: {
     UNTRUSTED,
@@ -26,18 +25,29 @@ const {
   },
   inspect
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
+const { patchType } = require('../common');
 
 const safeTags = [
   LIMITED_CHARS,
   ALPHANUM_SPACE_HYPHEN
 ];
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ *  logger: import('@contrast/logger').Logger,
+ *  messages: import('@contrast/common').Messages,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -60,12 +70,7 @@ module.exports = function(core) {
         name: `${moduleName}.${method}`,
         patchType,
         pre(data) {
-          const store = sources.getStore()?.assess;
-          if (
-            !store ||
-            !data.args[0] ||
-            instrumentation.isLocked()
-          ) return;
+          if (!getSourceContext(RULE, ruleId) || !data.args[0]) return;
 
           const [xmlString, opts] = data.args;
 
@@ -104,7 +109,7 @@ module.exports = function(core) {
 
           if (event) {
             reportFindings({
-              ruleId: XXE,
+              ruleId,
               sinkEvent: event,
             });
           }

package/lib/dataflow/sinks/install/marsdb.js

@@ -15,10 +15,9 @@
 'use strict';
 
 const util = require('util');
-const { patchType } = require('../common');
 const {
   traverseValues,
-  Rule,
+  Rule: { NOSQL_INJECTION_MONGO: ruleId },
   DataflowTag: {
     ALPHANUM_SPACE_HYPHEN,
     LIMITED_CHARS,
@@ -27,6 +26,8 @@ const {
     CUSTOM_VALIDATED_NOSQL_INJECTION,
   },
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
+const { patchType } = require('../common');
 
 const collectionMethods = ['find', 'findOne', 'update', 'remove'];
 const querySafeTags = [
@@ -36,13 +37,20 @@ const querySafeTags = [
   CUSTOM_VALIDATED_NOSQL_INJECTION,
 ];
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  logger: import('@contrast/logger').Logger,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     depHooks,
     logger,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -82,10 +90,7 @@ module.exports = function(core) {
       name,
       patchType,
       around(next, data) {
-        const sourceCtx = sources.getStore()?.assess;
-        if (!sourceCtx || instrumentation.isLocked()) {
-          return next();
-        }
+        if (!getSourceContext(RULE, ruleId)) return next();
 
         const argIdx = 0;
         const result = getVulnerabilityInfo(data.args[argIdx]);
@@ -120,7 +125,7 @@ module.exports = function(core) {
         });
 
         if (sinkEvent) {
-          reportFindings({ ruleId: Rule.NOSQL_INJECTION_MONGO, sinkEvent });
+          reportFindings({ ruleId, sinkEvent });
         }
 
         return next();

package/lib/dataflow/sinks/install/mongodb.js

@@ -24,12 +24,13 @@ const {
     LIMITED_CHARS,
     STRING_TYPE_CHECKED,
   },
-  Rule: { NOSQL_INJECTION_MONGO },
+  Rule: { NOSQL_INJECTION_MONGO: ruleId },
   isNonEmptyObject,
   traverseValues,
   isString,
   inspect
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
 const utils = require('../../tag-utils');
 const { patchType, filterSafeTags } = require('../common');
 
@@ -66,19 +67,28 @@ const querySafeTags = [
   STRING_TYPE_CHECKED,
 ];
 
+/**
+ *
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     config,
     depHooks,
     logger,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, runInActiveSink, isLocked, reportFindings, reportSafePositive }
-      }
+        sinks: { isVulnerable, reportFindings, reportSafePositive }
+      },
+      ruleScopes,
     }
   } = core;
 
@@ -228,17 +238,13 @@ module.exports = function(core) {
   function createAroundHook(entity, name, method, getInfoMethod, vulnerableArgIdxs) {
     const argsIdxsToCheck = vulnerableArgIdxs || [0];
     return function(next, data) {
-      const { obj, args: origArgs } = data;
-      const sourceCtx = sources.getStore()?.assess;
-
-      if (isLocked(NOSQL_INJECTION_MONGO) || instrumentation.isLocked() || !sourceCtx) {
-        return next();
-      }
+      if (!getSourceContext(RULE, ruleId)) return next();
 
+      const { obj, args: origArgs } = data;
+      const safeReports = [];
       let vulnInfo;
       let reportSafe;
       let vulnArgIdx;
-      const safeReports = [];
 
       try {
         for (const argIdx of argsIdxsToCheck) {
@@ -272,13 +278,15 @@ module.exports = function(core) {
 
             reportSafePositive({
               name,
-              ruleId: NOSQL_INJECTION_MONGO,
+              ruleId,
               safeTags,
               strInfo: strInfo.length === 1 ? strInfo[0] : strInfo
             });
           }
 
-          return methodsWithNestedCalls.includes(method) ? runInActiveSink(NOSQL_INJECTION_MONGO, async () => await next()) : next();
+          return methodsWithNestedCalls.includes(method)
+            ? ruleScopes.run(ruleId, async () => await next())
+            : next();
         }
 
         const { path, strInfo } = vulnInfo;
@@ -313,13 +321,15 @@ module.exports = function(core) {
         });
 
         if (sinkEvent) {
-          reportFindings({ ruleId: NOSQL_INJECTION_MONGO, sinkEvent });
+          reportFindings({ ruleId, sinkEvent });
         }
       } catch (err) {
         core.logger.error({ name, err }, 'assess sink analysis failed');
       }
 
-      return methodsWithNestedCalls.includes(method) ? runInActiveSink(NOSQL_INJECTION_MONGO, async () => await next()) : next();
+      return methodsWithNestedCalls.includes(method)
+        ? ruleScopes.run(ruleId, async () => await next())
+        : next();
     };
   }
 

package/lib/dataflow/sinks/install/mssql.js

@@ -16,10 +16,17 @@
 'use strict';
 
 const {
-  DataflowTag: { UNTRUSTED, SQL_ENCODED, LIMITED_CHARS, CUSTOM_VALIDATED, CUSTOM_ENCODED },
-  Rule: { SQL_INJECTION },
+  DataflowTag: {
+    CUSTOM_VALIDATED,
+    CUSTOM_ENCODED,
+    LIMITED_CHARS,
+    SQL_ENCODED,
+    UNTRUSTED,
+  },
+  Rule: { SQL_INJECTION: ruleId },
   isString
 } = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
 const { createModuleLabel } = require('../../propagation/common');
 const { patchType, filterSafeTags } = require('../common');
 
@@ -30,15 +37,20 @@ const safeTags = [
   CUSTOM_ENCODED,
 ];
 
-const ruleId = SQL_INJECTION;
-
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  config: import('@contrast/config').Config,
+ * }} core
+ * @returns {import('@contrast/common').Installable}
+ */
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
     config,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -48,12 +60,11 @@ module.exports = function(core) {
   } = core;
 
   const pre = (name, method, obj, version) => (data) => {
-    const store = sources.getStore()?.assess;
     if (
-      !store ||
+      !getSourceContext(RULE, ruleId) ||
       !data.args[0] ||
       !isString(data.args[0]) ||
-      isLocked(SQL_INJECTION)
+      isLocked(ruleId)
     ) return;
 
     const strInfo = tracker.getData(data.args[0]);
@@ -86,7 +97,7 @@ module.exports = function(core) {
 
       if (event) {
         reportFindings({
-          ruleId: SQL_INJECTION,
+          ruleId,
           sinkEvent: event,
         });
       }