@contrast/assess 1.19.0 → 1.20.0

package/lib/session-configuration/handlers.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -17,70 +17,88 @@
 
 const {
   Event,
-  SessionConfigurationRule: { HTTPONLY, SECURE_FLAG_MISSING },
+  SessionConfigurationRule,
+  isString,
 } = require('@contrast/common');
 
+const { HTTPONLY, SECURE_FLAG_MISSING } = SessionConfigurationRule;
+
 module.exports = function (core) {
   const {
     assess: { sessionConfiguration },
     messages,
   } = core;
 
-  const checkCookieValue = (ruleId, sinkEvent, cookieValue, sourceContext) => {
-    if (
-      !sourceContext.policy?.enabledRules?.has(ruleId) ||
-      cookieValue.includes(ruleId === HTTPONLY ? 'httponly' : 'secure')
-    ) return;
-
-    sessionConfiguration.reportFindings(sourceContext, {
-      ruleId,
-      sinkEvent,
-      properties: {
-        evidence: cookieValue,
-      },
-    });
-  };
+  function* ensureIterable(value) {
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        yield value[i];
+      }
+    } else {
+      yield value;
+    }
+  }
 
-  const handleCookie = (
-    sourceContext,
-    cookieValue,
-    ruleId,
-    sessionEvent
-  ) => {
-    if (Array.isArray(cookieValue)) {
-      return cookieValue.forEach((value) =>
-        checkCookieValue(ruleId, sessionEvent, value, sourceContext)
-      );
+  /**
+   * @param {SessionConfigurationRule} ruleId
+   * @param {import('@contrast/assess').SourceContext} sourceContext
+   * @returns {import('@contrast/assess').SessionRuleState}
+   */
+  function ensureState(ruleId, sourceContext) {
+    if (!sourceContext.ruleState[ruleId]) {
+      sourceContext.ruleState[ruleId] = {
+        reported: false,
+        valuesAnalyzed: new Set(),
+      };
     }
+    return sourceContext.ruleState[ruleId];
+  }
 
-    checkCookieValue(ruleId, sessionEvent, cookieValue, sourceContext);
-  };
+  function isVulnerable(ruleId, value) {
+    if (!isString(value)) return false;
+
+    const search = ruleId === HTTPONLY ? 'HttpOnly;'
+      : ruleId === SECURE_FLAG_MISSING ? 'Secure;'
+        : undefined;
+
+    return search && value.indexOf(search) === -1;
+  }
+
+  function handle(ruleId, sourceContext, cookie, sessionEvent) {
+    const state = ensureState(ruleId, sourceContext);
+
+    if (!sourceContext?.policy?.enabledRules?.has?.(ruleId) || state.reported) return;
+
+    for (const value of ensureIterable(cookie)) {
+      if (state.valuesAnalyzed.has(value)) continue;
+
+      state.valuesAnalyzed.add(value);
+      if (!isVulnerable(ruleId, value)) continue;
+
+      else {
+        sessionConfiguration.reportFindings({
+          ruleId,
+          sinkEvent: sessionEvent,
+          properties: {
+            evidence: value,
+          },
+        });
+        state.reported = true;
+        break;
+      }
+    }
+  }
 
-  sessionConfiguration.handleHttpOnly = function (
-    sourceContext,
-    cookieValue,
-    sessionEvent
-  ) {
-    handleCookie(sourceContext, cookieValue, HTTPONLY, sessionEvent);
+  sessionConfiguration.handleHttpOnly = function(sourceContext, cookie, sessionEvent) {
+    handle(HTTPONLY, sourceContext, cookie, sessionEvent);
   };
 
-  sessionConfiguration.handleSecure = function (
-    sourceContext,
-    cookieValue,
-    sessionEvent
-  ) {
-    handleCookie(sourceContext, cookieValue, SECURE_FLAG_MISSING, sessionEvent);
+  sessionConfiguration.handleSecure = function (sourceContext, cookie, sessionEvent) {
+    handle(SECURE_FLAG_MISSING, sourceContext, cookie, sessionEvent);
   };
 
-  // _sourceContext is unused
-  sessionConfiguration.reportFindings = function (
-    _sourceContext,
-    vulnerabilityMetadata
-  ) {
-    messages.emit(
-      Event.ASSESS_SESSION_CONFIGURATION_FINDING,
-      vulnerabilityMetadata
-    );
+  sessionConfiguration.reportFindings = function (finding) {
+    messages.emit(Event.ASSESS_SESSION_CONFIGURATION_FINDING, finding);
   };
 
   return sessionConfiguration;

package/lib/session-configuration/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -22,7 +22,9 @@ module.exports = function(core) {
 
   require('./handlers')(core);
   require('./install/express-session')(core);
+  require('./install/fastify-cookie')(core);
   require('./install/hapi')(core);
+  require('./install/koa')(core);
 
   sessionConfiguration.install = function() {
     callChildComponentMethodsSync(sessionConfiguration, 'install');

package/lib/session-configuration/install/express-session.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -50,36 +50,27 @@ module.exports = function (core) {
         patchType,
         post(data) {
           const options = data.args[0];
-
-          // obfuscate the cookie secret
-          if (Array.isArray(data.args) && data.args[0] && data.args[0].secret) {
-            data.args[0].secret = '[HIDDEN]';
-          }
-
-          const { cookie } = options || {};
-          const hasOwnPropertyHttpOnly = cookie && Object.prototype.hasOwnProperty.call(
-            cookie,
-            'httpOnly'
-          );
+          const cookie = options?.cookie || {};
 
           // httpOnly is true by default if it's not provided
-          const checkForHTTPOnly =
-            cookie && hasOwnPropertyHttpOnly
-              ? !(cookie.httpOnly === true)
-              : false;
-
+          const checkForHTTPOnly = 'httpOnly' in cookie ? cookie.httpOnly !== true : false;
           // secure is false by default
-          const checkForSecure = cookie ? !(cookie.secure === true) : true;
+          if (!checkForHTTPOnly && cookie?.secure) return;
 
-          // skip instrumentation since the options are set correctly
-          if (!checkForHTTPOnly && !checkForSecure) return;
+          const displayOptions = {
+            cookie: {
+              httpOnly: cookie?.httpOnly,
+              secure: cookie?.secure
+            }
+          };
+          const optionsString = inspect(displayOptions);
 
           const sessionEvent = createSessionEvent({
             args: [{
               tracked: false,
-              value: inspect(options),
+              value: optionsString,
             }],
-            context: `expressSession(${inspect(data.args)})`,
+            context: `expressSession(${optionsString})`,
             history: [],
             name: 'express.hookedSessionConstructor',
             moduleName: 'express-session',
@@ -97,7 +88,7 @@ module.exports = function (core) {
               constructorOpt: data.hooked,
             },
             framework: 'express',
-            options,
+            options: displayOptions,
           });
 
           patcher.patch(data, 'result', {
@@ -119,7 +110,7 @@ module.exports = function (core) {
                     handleHttpOnly(sourceContext, value, sessionEvent);
                   }
 
-                  if (checkForSecure) {
+                  if (!cookie?.secure) {
                     handleSecure(sourceContext, value, sessionEvent);
                   }
                 }

package/lib/session-configuration/install/fastify-cookie.js

@@ -0,0 +1,110 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { inspect } = require('util');
+const { toLowerCase } = require('@contrast/common');
+const { patchType } = require('../common');
+
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  scopes: import('@contrast/scopes').Scopes,
+ * }} core
+ */
+module.exports = function (core) {
+  const {
+    assess: {
+      getSourceContext,
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+  } = core;
+
+  return core.assess.sessionConfiguration.fastifyCookie = {
+    install () {
+      depHooks.resolve({ name: '@fastify/cookie' }, (_export) => {
+        const patched = patcher.patch(_export, {
+          name: 'express.hookedSessionConstructor',
+          patchType,
+          pre(data) {
+            const [server, options] = data.args;
+
+            // neither default to safe (truthy) values
+            const httpOnly = options?.parseOptions?.httpOnly;
+            const secure = options?.parseOptions?.secure;
+            if (httpOnly && secure) return;
+
+            const displayArg = inspect({ parseOptions: { httpOnly, secure } });
+            const sessionEvent = createSessionEvent({
+              args: [{
+                tracked: false,
+                value: displayArg
+              }],
+              context: `fastifyCookie(${displayArg})`,
+              history: [],
+              name: 'fastifyCookie',
+              moduleName: '@fastify/cookie',
+              methodName: '',
+              object: {
+                tracked: false,
+                value: '@fastify/cookie',
+              },
+              result: {
+                tracked: false,
+              },
+              source: 'P0',
+              stack: [],
+              tags: {},
+              framework: '@fastify/cookie',
+            });
+
+            server.addHook('onRequest', async (request, reply) => {
+              patcher.patch(reply, 'header', {
+                patchType,
+                name: 'fastify.Reply.header',
+                pre(data) {
+                  const [key, value] = data.args;
+                  if (toLowerCase(key) !== 'set-cookie') return;
+
+                  const sourceContext = getSourceContext();
+                  if (!sourceContext) return;
+
+                  if (!httpOnly) {
+                    handleHttpOnly(sourceContext, value, sessionEvent);
+                  }
+
+                  if (!secure) {
+                    handleSecure(sourceContext, value, sessionEvent);
+                  }
+                }
+              });
+            });
+          }
+        });
+
+        _export.default = patched;
+        _export.fastifyCookie = patched;
+
+        return patched;
+      });
+    }
+  };
+};

package/lib/session-configuration/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2023 Contrast Security, Inc
+ * Copyright: 2024 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -36,7 +36,6 @@ module.exports = function (core) {
   const inspect = patcher.unwrap(util.inspect);
 
   hapiSession.install = function () {
-
     return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <21' }, (hapi) => {
       ['server', 'Server'].forEach((server) => {
         patcher.patch(hapi, server, {
@@ -47,14 +46,12 @@ module.exports = function (core) {
               name: 'state',
               patchType,
               post(data) {
-    
                 const options = data.args[1];
-    
                 const httpOnly = Object.prototype.hasOwnProperty.call(options, 'isHttpOnly') ? options.isHttpOnly : true;
                 const isSecure = Object.prototype.hasOwnProperty.call(options, 'isSecure') ? options.isSecure : true;
-    
+
                 if (httpOnly && isSecure) return;
-    
+
                 const sessionEvent = createSessionEvent({
                   args: [{
                     tracked: false,
@@ -80,18 +77,18 @@ module.exports = function (core) {
                   framework: 'hapi',
                   options
                 });
-    
+
                 data.obj.ext('onPostResponse', ({ response: { headers } }) => {
                   const value = headers?.['set-cookie']?.[0];
                   if (!value) return;
-    
+
                   const sourceContext = sources.getStore()?.assess;
                   if (!sourceContext) return;
-    
+
                   if (!httpOnly) {
                     handleHttpOnly(sourceContext, `set-cookie: ${value}`, sessionEvent);
                   }
-    
+
                   if (!isSecure) {
                     handleSecure(sourceContext, `set-cookie: ${value}`, sessionEvent);
                   }
@@ -99,7 +96,7 @@ module.exports = function (core) {
               }
             });
           }
-        });  
+        });
       });
     });
   };

package/lib/session-configuration/install/koa.js

@@ -0,0 +1,101 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { inspect } = require('util');
+const { patchType } = require('../common');
+
+/**
+ * @param {{
+ *  assess: import('@contrast/assess').Assess,
+ *  scopes: import('@contrast/scopes').Scopes,
+ * }} core
+ */
+module.exports = function (core) {
+  const {
+    assess: {
+      getSourceContext,
+      eventFactory: { createSessionEvent },
+      sessionConfiguration: {
+        handleHttpOnly,
+        handleSecure,
+      },
+    },
+    depHooks,
+    patcher,
+  } = core;
+
+  return core.assess.sessionConfiguration.koa = {
+    install () {
+      depHooks.resolve({ name: 'koa', version: '>=2.3.0' }, (Koa) => {
+        patcher.patch(Koa.prototype, 'use', {
+          name: 'Koa.Application',
+          patchType,
+          pre(data) {
+            const origCtx = data.args[0];
+            data.args[0] = function(...args) {
+              patcher.patch(args[0].cookies, 'set', {
+                name: 'ctx.cookies',
+                patchType,
+                pre({ args }) {
+                  const sourceContext = getSourceContext();
+                  if (!sourceContext) return;
+
+                  const [name,, options] = args;
+
+                  const httpOnly = options?.httpOnly;
+                  const secure = options?.secure;
+                  if (httpOnly && secure) return;
+
+                  const displayArg = inspect(options);
+                  const sessionEvent = createSessionEvent({
+                    args: [{
+                      tracked: false,
+                      value: displayArg
+                    }],
+                    context: `ctx.cookies.set(${displayArg})`,
+                    history: [],
+                    name: 'koaCookie',
+                    moduleName: 'koa',
+                    methodName: '',
+                    object: {
+                      tracked: false,
+                      value: 'koa',
+                    },
+                    result: {
+                      tracked: false,
+                    },
+                    source: 'P',
+                    stack: [],
+                    tags: {},
+                    framework: 'koa',
+                  });
+                  if (!httpOnly) {
+                    handleHttpOnly(sourceContext, name, sessionEvent);
+                  }
+
+                  if (!secure) {
+                    handleSecure(sourceContext, name, sessionEvent);
+                  }
+                }
+              });
+              return origCtx.apply(this, args);
+            };
+          }
+        });
+      });
+    }
+  };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",