@contrast/assess 1.18.0 → 1.19.0

package/lib/response-scanning/install/http.js

@@ -17,12 +17,17 @@
 
 const { split, substring, toLowerCase, trim } = require('@contrast/common');
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ * }} core
+ */
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources },
     assess: {
+      getSourceContext,
       responseScanning: {
         handleAutoCompleteMissing,
         handleCacheControlsMissing,
@@ -36,6 +41,7 @@ module.exports = function(core) {
       }
     }
   } = core;
+
   const http = core.assess.responseScanning.httpInstrumentation = {};
 
   function parseHeaders(rawHeaders) {
@@ -90,7 +96,7 @@ module.exports = function(core) {
           name,
           patchType,
           post(data) {
-            const sourceContext = sources.getStore()?.assess;
+            const sourceContext = getSourceContext();
             if (!sourceContext) return;
 
             const evaluationContext = {
@@ -108,7 +114,7 @@ module.exports = function(core) {
           name,
           patchType,
           post(data) {
-            const sourceContext = sources.getStore()?.assess;
+            const sourceContext = getSourceContext();
             if (!sourceContext) return;
 
             const evaluationContext = {
@@ -130,7 +136,7 @@ module.exports = function(core) {
           name,
           patchType,
           post(data) {
-            const sourceContext = sources.getStore()?.assess;
+            const sourceContext = getSourceContext();
             if (!sourceContext) return;
 
             const headersSymbol = Object.getOwnPropertySymbols(data.obj).find(symbol => symbol.toString().includes('headers'));
@@ -149,7 +155,7 @@ module.exports = function(core) {
           name,
           patchType,
           post(data) {
-            const sourceContext = sources.getStore()?.assess;
+            const sourceContext = getSourceContext();
             if (!sourceContext) return;
 
             const headersSymbol = Object.getOwnPropertySymbols(data.result).find(symbol => symbol.toString().includes('headers'));
@@ -182,7 +188,7 @@ module.exports = function(core) {
                   name: 'Http2Stream.write',
                   patchType,
                   post(data) {
-                    const sourceContext = sources.getStore()?.assess;
+                    const sourceContext = getSourceContext();
                     if (!sourceContext) return;
 
                     const evaluationContext = {
@@ -198,7 +204,7 @@ module.exports = function(core) {
                   name: 'Http2Stream.end',
                   patchType,
                   post(data) {
-                    const sourceContext = sources.getStore()?.assess;
+                    const sourceContext = getSourceContext();
                     if (!sourceContext) return;
 
                     const evaluationContext = {

package/lib/rule-scopes.js

@@ -0,0 +1,48 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { AsyncLocalStorage } = require('async_hooks');
+/**
+ * @param {Object} core
+ * @param {import('@contrast/assess').Assess} core.assess
+ */
+module.exports = function (core) {
+
+  /** @type {Map<Rule,AsyncLocalStorage>} */
+  const scopes = new Map();
+  /** @type {{locked:boolean}}*/
+  const store = Object.freeze({ locked: true });
+
+  return core.assess.ruleScopes = {
+    /**
+     * @param {import('@contrast/common').Rule} ruleId
+     * @param {functionn} cb
+     */
+    run(ruleId, cb) {
+      if (!scopes.has(ruleId)) scopes.set(ruleId, new AsyncLocalStorage());
+      return scopes.get(ruleId).run(store, cb);
+    },
+
+    /**
+     * @param {Rule} ruleId
+     */
+    isLocked(ruleId) {
+      return !!scopes.get(ruleId)?.getStore?.()?.locked;
+    }
+  };
+
+};

package/lib/session-configuration/handlers.js

@@ -27,9 +27,10 @@ module.exports = function (core) {
   } = core;
 
   const checkCookieValue = (ruleId, sinkEvent, cookieValue, sourceContext) => {
-    if (cookieValue.includes(ruleId === HTTPONLY ? 'httponly' : 'secure')) {
-      return;
-    }
+    if (
+      !sourceContext.policy?.enabledRules?.has(ruleId) ||
+      cookieValue.includes(ruleId === HTTPONLY ? 'httponly' : 'secure')
+    ) return;
 
     sessionConfiguration.reportFindings(sourceContext, {
       ruleId,

package/lib/session-configuration/install/express-session.js

@@ -18,9 +18,16 @@ const util = require('util');
 const { toLowerCase } = require('@contrast/common');
 const { patchType } = require('../common');
 
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  scopes: import('@contrast/scopes').Scopes,
+ * }} core
+ */
 module.exports = function (core) {
   const {
     assess: {
+      getSourceContext,
       eventFactory: { createSessionEvent },
       sessionConfiguration: {
         handleHttpOnly,
@@ -29,7 +36,6 @@ module.exports = function (core) {
     },
     depHooks,
     patcher,
-    scopes: { sources },
   } = core;
 
   const expressSession = core.assess.sessionConfiguration.expressSession = {};
@@ -100,7 +106,7 @@ module.exports = function (core) {
             pre(data) {
               const [, res] = data.args;
 
-              const sourceContext = sources.getStore()?.assess;
+              const sourceContext = getSourceContext();
               if (!sourceContext) return;
 
               patcher.patch(res, 'setHeader', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,7 +17,7 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.15.1",
+    "@contrast/common": "1.16.0",
     "@contrast/distringuish": "^4.4.0",
     "@contrast/scopes": "1.4.0"
   }