@contrast/assess 1.18.0 → 1.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/lib/constants.js +26 -0
- package/lib/crypto-analysis/common.js +20 -0
- package/lib/crypto-analysis/index.js +44 -0
- package/lib/crypto-analysis/install/crypto.js +156 -0
- package/lib/crypto-analysis/install/math.js +104 -0
- package/lib/dataflow/index.js +1 -1
- package/lib/dataflow/propagation/common.js +1 -1
- package/lib/dataflow/propagation/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse-fn.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse.js +15 -14
- package/lib/dataflow/propagation/install/JSON/stringify.js +2 -2
- package/lib/dataflow/propagation/install/array-prototype-join.js +1 -1
- package/lib/dataflow/propagation/install/buffer.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/add.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/index.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/number.js +4 -3
- package/lib/dataflow/propagation/install/contrast-methods/string.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/tag.js +1 -1
- package/lib/dataflow/propagation/install/decode-uri-component.js +1 -1
- package/lib/dataflow/propagation/install/ejs/escape-xml.js +3 -3
- package/lib/dataflow/propagation/install/ejs/index.js +2 -1
- package/lib/dataflow/propagation/install/ejs/template.js +79 -0
- package/lib/dataflow/propagation/install/encode-uri.js +1 -1
- package/lib/dataflow/propagation/install/escape-html.js +1 -1
- package/lib/dataflow/propagation/install/escape.js +1 -1
- package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js +1 -1
- package/lib/dataflow/propagation/install/isnumeric-0.js +3 -3
- package/lib/dataflow/propagation/install/joi/any.js +1 -1
- package/lib/dataflow/propagation/install/joi/boolean.js +1 -1
- package/lib/dataflow/propagation/install/joi/expression.js +1 -1
- package/lib/dataflow/propagation/install/joi/index.js +1 -1
- package/lib/dataflow/propagation/install/joi/keys.js +1 -1
- package/lib/dataflow/propagation/install/joi/number.js +1 -1
- package/lib/dataflow/propagation/install/joi/object.js +1 -1
- package/lib/dataflow/propagation/install/joi/string-schema.js +1 -1
- package/lib/dataflow/propagation/install/joi/utils.js +1 -1
- package/lib/dataflow/propagation/install/joi/values.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/common.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/index.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-map.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-mixed.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-string.js +1 -1
- package/lib/dataflow/propagation/install/mustache-escape.js +1 -1
- package/lib/dataflow/propagation/install/mysql-connection-escape.js +1 -1
- package/lib/dataflow/propagation/install/parse-int.js +3 -3
- package/lib/dataflow/propagation/install/path/basename.js +1 -1
- package/lib/dataflow/propagation/install/path/common.js +1 -1
- package/lib/dataflow/propagation/install/path/dirname.js +1 -1
- package/lib/dataflow/propagation/install/path/extname.js +1 -1
- package/lib/dataflow/propagation/install/path/format.js +1 -1
- package/lib/dataflow/propagation/install/path/index.js +1 -1
- package/lib/dataflow/propagation/install/path/join-and-resolve.js +1 -1
- package/lib/dataflow/propagation/install/path/normalize.js +1 -1
- package/lib/dataflow/propagation/install/path/parse.js +1 -1
- package/lib/dataflow/propagation/install/path/relative.js +1 -1
- package/lib/dataflow/propagation/install/path/toNamespacedPath.js +1 -1
- package/lib/dataflow/propagation/install/pug/index.js +3 -3
- package/lib/dataflow/propagation/install/pug-runtime-escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/index.js +1 -1
- package/lib/dataflow/propagation/install/querystring/parse.js +1 -1
- package/lib/dataflow/propagation/install/querystring/stringify.js +1 -1
- package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js +1 -1
- package/lib/dataflow/propagation/install/send.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/index.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/query-generator.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/sql-string.js +1 -1
- package/lib/dataflow/propagation/install/sql-template-strings.js +1 -1
- package/lib/dataflow/propagation/install/string/concat.js +1 -1
- package/lib/dataflow/propagation/install/string/format-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/html-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/index.js +1 -1
- package/lib/dataflow/propagation/install/string/match-all.js +1 -1
- package/lib/dataflow/propagation/install/string/match.js +1 -1
- package/lib/dataflow/propagation/install/string/replace.js +1 -1
- package/lib/dataflow/propagation/install/string/slice.js +1 -1
- package/lib/dataflow/propagation/install/string/split.js +1 -1
- package/lib/dataflow/propagation/install/string/substring.js +1 -1
- package/lib/dataflow/propagation/install/string/trim.js +1 -1
- package/lib/dataflow/propagation/install/unescape.js +1 -1
- package/lib/dataflow/propagation/install/url/domain-parsers.js +1 -1
- package/lib/dataflow/propagation/install/url/index.js +1 -1
- package/lib/dataflow/propagation/install/url/parse.js +1 -1
- package/lib/dataflow/propagation/install/url/searchParams.js +1 -1
- package/lib/dataflow/propagation/install/url/url.js +1 -1
- package/lib/dataflow/propagation/install/util-format.js +10 -4
- package/lib/dataflow/propagation/install/validator/hooks.js +1 -1
- package/lib/dataflow/propagation/install/validator/index.js +1 -1
- package/lib/dataflow/propagation/install/validator/methods.js +1 -1
- package/lib/dataflow/sinks/common.js +1 -1
- package/lib/dataflow/sinks/index.js +1 -1
- package/lib/dataflow/sinks/install/child-process.js +21 -15
- package/lib/dataflow/sinks/install/eval.js +17 -15
- package/lib/dataflow/sinks/install/express/index.js +1 -1
- package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +15 -9
- package/lib/dataflow/sinks/install/fastify/index.js +1 -1
- package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +13 -6
- package/lib/dataflow/sinks/install/fs.js +8 -8
- package/lib/dataflow/sinks/install/function.js +9 -13
- package/lib/dataflow/sinks/install/http/index.js +1 -1
- package/lib/dataflow/sinks/install/http/request.js +17 -9
- package/lib/dataflow/sinks/install/http/server-response.js +12 -3
- package/lib/dataflow/sinks/install/koa/index.js +1 -1
- package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +16 -9
- package/lib/dataflow/sinks/install/libxmljs.js +16 -11
- package/lib/dataflow/sinks/install/marsdb.js +17 -12
- package/lib/dataflow/sinks/install/mongodb.js +32 -22
- package/lib/dataflow/sinks/install/mssql.js +21 -10
- package/lib/dataflow/sinks/install/mysql.js +16 -9
- package/lib/dataflow/sinks/install/node-serialize.js +16 -18
- package/lib/dataflow/sinks/install/postgres.js +18 -5
- package/lib/dataflow/sinks/install/sequelize.js +23 -17
- package/lib/dataflow/sinks/install/sqlite3.js +21 -8
- package/lib/dataflow/sinks/install/vm.js +20 -18
- package/lib/dataflow/sources/common.js +1 -1
- package/lib/dataflow/sources/handler.js +11 -10
- package/lib/dataflow/sources/index.js +2 -2
- package/lib/dataflow/sources/install/body-parser1.js +11 -13
- package/lib/dataflow/sources/install/{busboy1.js → busboy.js} +15 -15
- package/lib/dataflow/sources/install/cookie-parser1.js +7 -6
- package/lib/dataflow/sources/install/express/index.js +1 -1
- package/lib/dataflow/sources/install/express/params.js +9 -10
- package/lib/dataflow/sources/install/express/parsedUrl.js +1 -1
- package/lib/dataflow/sources/install/fastify/fastify.js +6 -7
- package/lib/dataflow/sources/install/fastify/index.js +1 -1
- package/lib/dataflow/sources/install/formidable1.js +8 -6
- package/lib/dataflow/sources/install/http.js +17 -45
- package/lib/dataflow/sources/install/koa/index.js +2 -1
- package/lib/dataflow/sources/install/koa/koa-bodyparsers.js +10 -9
- package/lib/dataflow/sources/install/koa/koa-multer.js +102 -0
- package/lib/dataflow/sources/install/koa/koa-routers.js +6 -8
- package/lib/dataflow/sources/install/koa/koa2.js +42 -38
- package/lib/dataflow/sources/install/multer1.js +26 -52
- package/lib/dataflow/sources/install/qs6.js +7 -6
- package/lib/dataflow/sources/install/querystring.js +5 -8
- package/lib/dataflow/tag-utils.js +1 -1
- package/lib/dataflow/tracker.js +1 -1
- package/lib/dataflow/utils/is-safe-content-type.js +1 -1
- package/lib/dataflow/utils/is-vulnerable.js +1 -1
- package/lib/event-factory.js +75 -26
- package/lib/get-policy.js +68 -0
- package/lib/get-source-context.js +62 -0
- package/lib/index.d.ts +64 -0
- package/lib/index.js +21 -20
- package/lib/make-source-context.js +78 -0
- package/lib/response-scanning/handlers/index.js +56 -29
- package/lib/response-scanning/handlers/utils.js +1 -1
- package/lib/response-scanning/index.js +1 -1
- package/lib/response-scanning/install/http.js +14 -8
- package/lib/rule-scopes.js +48 -0
- package/lib/session-configuration/common.js +1 -1
- package/lib/session-configuration/handlers.js +66 -47
- package/lib/session-configuration/index.js +3 -1
- package/lib/session-configuration/install/express-session.js +23 -26
- package/lib/session-configuration/install/fastify-cookie.js +110 -0
- package/lib/session-configuration/install/hapi.js +8 -11
- package/lib/session-configuration/install/koa.js +101 -0
- package/package.json +2 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
const { isString } = require('@contrast/common');
|
|
19
19
|
const { patchType } = require('../common');
|
|
20
20
|
|
|
21
|
-
module.exports = function(core) {
|
|
21
|
+
module.exports = function (core) {
|
|
22
22
|
const {
|
|
23
23
|
logger,
|
|
24
24
|
scopes: { sources, instrumentation },
|
|
@@ -50,7 +50,7 @@ module.exports = function(core) {
|
|
|
50
50
|
) return;
|
|
51
51
|
|
|
52
52
|
tracker.untrack(value);
|
|
53
|
-
logger.trace({ sanitizer: fullName, value }, 'untracked a string value');
|
|
53
|
+
logger.trace({ funcKey: data.funcKey, sanitizer: fullName, value }, 'untracked a string value');
|
|
54
54
|
}
|
|
55
55
|
});
|
|
56
56
|
});
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
const { isString } = require('@contrast/common');
|
|
19
19
|
const { patchType } = require('../common');
|
|
20
20
|
|
|
21
|
-
module.exports = function(core) {
|
|
21
|
+
module.exports = function (core) {
|
|
22
22
|
const {
|
|
23
23
|
logger,
|
|
24
24
|
scopes: { instrumentation, sources },
|
|
@@ -49,7 +49,7 @@ module.exports = function(core) {
|
|
|
49
49
|
// todo NODE-3118 to handle when value has trailing non-integer values
|
|
50
50
|
|
|
51
51
|
tracker.untrack(value);
|
|
52
|
-
logger.trace({ sanitizer: name, value }, 'untracked a string value');
|
|
52
|
+
logger.trace({ funcKey: data.funcKey, sanitizer: name, value }, 'untracked a string value');
|
|
53
53
|
}
|
|
54
54
|
});
|
|
55
55
|
},
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -44,8 +44,8 @@ module.exports = function (core) {
|
|
|
44
44
|
return instrumentation.run(store,
|
|
45
45
|
() => rewriter.rewrite(value, rewriterOpts).code
|
|
46
46
|
);
|
|
47
|
-
} catch (
|
|
48
|
-
logger.warn(
|
|
47
|
+
} catch (err) {
|
|
48
|
+
logger.warn({ err, funcKey: data.funcKey }, 'Failed to rewrite pug code');
|
|
49
49
|
return value;
|
|
50
50
|
}
|
|
51
51
|
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { patchType } = require('../common');
|
|
19
|
-
const {
|
|
19
|
+
const { isString } = require('@contrast/common');
|
|
20
20
|
const { createAppendTags } = require('../../tag-utils');
|
|
21
21
|
|
|
22
22
|
module.exports = function(core) {
|
|
@@ -47,7 +47,13 @@ module.exports = function(core) {
|
|
|
47
47
|
const history = [];
|
|
48
48
|
const eventArgs = [];
|
|
49
49
|
const formatChars = args[0].includes('%') ? args[0].match(/[^%]+/g).map((x) => x[0]) : [];
|
|
50
|
-
let i =
|
|
50
|
+
let i = 0;
|
|
51
|
+
|
|
52
|
+
if (formatChars.length > 0) {
|
|
53
|
+
i = 1;
|
|
54
|
+
eventArgs.push({ value: args[0], tracked: false });
|
|
55
|
+
}
|
|
56
|
+
|
|
51
57
|
for (i; i < args.length; i++) {
|
|
52
58
|
let arg = args[i];
|
|
53
59
|
const formatChar = formatChars[i - 1];
|
|
@@ -80,7 +86,7 @@ module.exports = function(core) {
|
|
|
80
86
|
name,
|
|
81
87
|
moduleName: 'util',
|
|
82
88
|
methodName: 'format',
|
|
83
|
-
context: `util.format(${
|
|
89
|
+
context: `util.format(${eventArgs.map((arg) => `'${arg.value}'`)})`,
|
|
84
90
|
object: {
|
|
85
91
|
value: 'util',
|
|
86
92
|
tracked: false
|