@contrast/assess 1.19.0 → 1.20.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/lib/constants.js +1 -1
- package/lib/crypto-analysis/common.js +1 -1
- package/lib/crypto-analysis/index.js +1 -1
- package/lib/crypto-analysis/install/crypto.js +8 -3
- package/lib/crypto-analysis/install/math.js +8 -3
- package/lib/dataflow/index.js +1 -1
- package/lib/dataflow/propagation/common.js +1 -1
- package/lib/dataflow/propagation/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse-fn.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse.js +3 -3
- package/lib/dataflow/propagation/install/JSON/stringify.js +1 -1
- package/lib/dataflow/propagation/install/array-prototype-join.js +1 -1
- package/lib/dataflow/propagation/install/buffer.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/add.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/index.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/number.js +4 -3
- package/lib/dataflow/propagation/install/contrast-methods/string.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/tag.js +1 -1
- package/lib/dataflow/propagation/install/decode-uri-component.js +1 -1
- package/lib/dataflow/propagation/install/ejs/escape-xml.js +1 -1
- package/lib/dataflow/propagation/install/ejs/index.js +1 -1
- package/lib/dataflow/propagation/install/ejs/template.js +7 -5
- package/lib/dataflow/propagation/install/encode-uri.js +1 -1
- package/lib/dataflow/propagation/install/escape-html.js +1 -1
- package/lib/dataflow/propagation/install/escape.js +1 -1
- package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js +1 -1
- package/lib/dataflow/propagation/install/isnumeric-0.js +3 -3
- package/lib/dataflow/propagation/install/joi/any.js +1 -1
- package/lib/dataflow/propagation/install/joi/boolean.js +1 -1
- package/lib/dataflow/propagation/install/joi/expression.js +1 -1
- package/lib/dataflow/propagation/install/joi/index.js +1 -1
- package/lib/dataflow/propagation/install/joi/keys.js +1 -1
- package/lib/dataflow/propagation/install/joi/number.js +1 -1
- package/lib/dataflow/propagation/install/joi/object.js +1 -1
- package/lib/dataflow/propagation/install/joi/string-schema.js +1 -1
- package/lib/dataflow/propagation/install/joi/utils.js +1 -1
- package/lib/dataflow/propagation/install/joi/values.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/common.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/index.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-map.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-mixed.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-string.js +1 -1
- package/lib/dataflow/propagation/install/mustache-escape.js +1 -1
- package/lib/dataflow/propagation/install/mysql-connection-escape.js +1 -1
- package/lib/dataflow/propagation/install/parse-int.js +3 -3
- package/lib/dataflow/propagation/install/path/basename.js +1 -1
- package/lib/dataflow/propagation/install/path/common.js +1 -1
- package/lib/dataflow/propagation/install/path/dirname.js +1 -1
- package/lib/dataflow/propagation/install/path/extname.js +1 -1
- package/lib/dataflow/propagation/install/path/format.js +1 -1
- package/lib/dataflow/propagation/install/path/index.js +1 -1
- package/lib/dataflow/propagation/install/path/join-and-resolve.js +1 -1
- package/lib/dataflow/propagation/install/path/normalize.js +1 -1
- package/lib/dataflow/propagation/install/path/parse.js +1 -1
- package/lib/dataflow/propagation/install/path/relative.js +1 -1
- package/lib/dataflow/propagation/install/path/toNamespacedPath.js +1 -1
- package/lib/dataflow/propagation/install/pug/index.js +3 -3
- package/lib/dataflow/propagation/install/pug-runtime-escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/index.js +1 -1
- package/lib/dataflow/propagation/install/querystring/parse.js +1 -1
- package/lib/dataflow/propagation/install/querystring/stringify.js +1 -1
- package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js +1 -1
- package/lib/dataflow/propagation/install/send.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/index.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/query-generator.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/sql-string.js +1 -1
- package/lib/dataflow/propagation/install/sql-template-strings.js +1 -1
- package/lib/dataflow/propagation/install/string/concat.js +1 -1
- package/lib/dataflow/propagation/install/string/format-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/html-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/index.js +1 -1
- package/lib/dataflow/propagation/install/string/match-all.js +1 -1
- package/lib/dataflow/propagation/install/string/match.js +1 -1
- package/lib/dataflow/propagation/install/string/replace.js +1 -1
- package/lib/dataflow/propagation/install/string/slice.js +1 -1
- package/lib/dataflow/propagation/install/string/split.js +2 -2
- package/lib/dataflow/propagation/install/string/substring.js +1 -1
- package/lib/dataflow/propagation/install/string/trim.js +1 -1
- package/lib/dataflow/propagation/install/unescape.js +1 -1
- package/lib/dataflow/propagation/install/url/domain-parsers.js +1 -1
- package/lib/dataflow/propagation/install/url/index.js +1 -1
- package/lib/dataflow/propagation/install/url/parse.js +1 -1
- package/lib/dataflow/propagation/install/url/searchParams.js +1 -1
- package/lib/dataflow/propagation/install/url/url.js +1 -1
- package/lib/dataflow/propagation/install/util-format.js +1 -1
- package/lib/dataflow/propagation/install/validator/hooks.js +1 -1
- package/lib/dataflow/propagation/install/validator/index.js +1 -1
- package/lib/dataflow/propagation/install/validator/methods.js +1 -1
- package/lib/dataflow/sinks/common.js +1 -1
- package/lib/dataflow/sinks/index.js +1 -1
- package/lib/dataflow/sinks/install/child-process.js +1 -1
- package/lib/dataflow/sinks/install/eval.js +1 -1
- package/lib/dataflow/sinks/install/express/index.js +1 -1
- package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/fastify/index.js +1 -1
- package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/fs.js +1 -1
- package/lib/dataflow/sinks/install/function.js +1 -1
- package/lib/dataflow/sinks/install/http/index.js +1 -1
- package/lib/dataflow/sinks/install/http/request.js +1 -1
- package/lib/dataflow/sinks/install/http/server-response.js +1 -1
- package/lib/dataflow/sinks/install/koa/index.js +1 -1
- package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/libxmljs.js +1 -1
- package/lib/dataflow/sinks/install/marsdb.js +4 -4
- package/lib/dataflow/sinks/install/mongodb.js +7 -7
- package/lib/dataflow/sinks/install/mssql.js +1 -1
- package/lib/dataflow/sinks/install/mysql.js +1 -1
- package/lib/dataflow/sinks/install/node-serialize.js +1 -1
- package/lib/dataflow/sinks/install/postgres.js +1 -1
- package/lib/dataflow/sinks/install/sequelize.js +7 -8
- package/lib/dataflow/sinks/install/sqlite3.js +1 -1
- package/lib/dataflow/sinks/install/vm.js +1 -1
- package/lib/dataflow/sources/common.js +1 -1
- package/lib/dataflow/sources/handler.js +11 -10
- package/lib/dataflow/sources/index.js +2 -2
- package/lib/dataflow/sources/install/body-parser1.js +11 -13
- package/lib/dataflow/sources/install/{busboy1.js → busboy.js} +15 -15
- package/lib/dataflow/sources/install/cookie-parser1.js +7 -6
- package/lib/dataflow/sources/install/express/index.js +1 -1
- package/lib/dataflow/sources/install/express/params.js +9 -10
- package/lib/dataflow/sources/install/express/parsedUrl.js +1 -1
- package/lib/dataflow/sources/install/fastify/fastify.js +6 -7
- package/lib/dataflow/sources/install/fastify/index.js +1 -1
- package/lib/dataflow/sources/install/formidable1.js +8 -6
- package/lib/dataflow/sources/install/http.js +4 -4
- package/lib/dataflow/sources/install/koa/index.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-bodyparsers.js +10 -9
- package/lib/dataflow/sources/install/koa/koa-multer.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-routers.js +6 -8
- package/lib/dataflow/sources/install/koa/koa2.js +42 -38
- package/lib/dataflow/sources/install/multer1.js +1 -1
- package/lib/dataflow/sources/install/qs6.js +7 -6
- package/lib/dataflow/sources/install/querystring.js +4 -4
- package/lib/dataflow/tag-utils.js +1 -1
- package/lib/dataflow/tracker.js +1 -1
- package/lib/dataflow/utils/is-safe-content-type.js +1 -1
- package/lib/dataflow/utils/is-vulnerable.js +1 -1
- package/lib/event-factory.js +35 -33
- package/lib/get-policy.js +1 -1
- package/lib/get-source-context.js +1 -1
- package/lib/index.d.ts +16 -2
- package/lib/index.js +1 -1
- package/lib/make-source-context.js +6 -2
- package/lib/response-scanning/handlers/index.js +1 -1
- package/lib/response-scanning/handlers/utils.js +1 -1
- package/lib/response-scanning/index.js +1 -1
- package/lib/response-scanning/install/http.js +1 -1
- package/lib/rule-scopes.js +1 -1
- package/lib/session-configuration/common.js +1 -1
- package/lib/session-configuration/handlers.js +67 -49
- package/lib/session-configuration/index.js +3 -1
- package/lib/session-configuration/install/express-session.js +15 -24
- package/lib/session-configuration/install/fastify-cookie.js +110 -0
- package/lib/session-configuration/install/hapi.js +8 -11
- package/lib/session-configuration/install/koa.js +101 -0
- package/package.json +1 -1
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -74,7 +74,7 @@ module.exports = function(core) {
|
|
|
74
74
|
const event = createPropagationEvent({
|
|
75
75
|
name,
|
|
76
76
|
moduleName: 'String',
|
|
77
|
-
methodName: 'prototype.
|
|
77
|
+
methodName: 'prototype.split',
|
|
78
78
|
context: `'${objInfo.value}'.split(${join(args.map(a => a.value), ', ')})`,
|
|
79
79
|
history: [objInfo],
|
|
80
80
|
object: {
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -44,7 +44,7 @@ const querySafeTags = [
|
|
|
44
44
|
* }} core
|
|
45
45
|
* @returns {import('@contrast/common').Installable}
|
|
46
46
|
*/
|
|
47
|
-
module.exports = function(core) {
|
|
47
|
+
module.exports = function (core) {
|
|
48
48
|
const {
|
|
49
49
|
depHooks,
|
|
50
50
|
logger,
|
|
@@ -82,7 +82,7 @@ module.exports = function(core) {
|
|
|
82
82
|
const name = `marsdb.Collection.prototype.${method}`;
|
|
83
83
|
|
|
84
84
|
if (!proto[method]) {
|
|
85
|
-
logger.trace(
|
|
85
|
+
logger.trace('method %s not found - skipping instrumentation', name);
|
|
86
86
|
return;
|
|
87
87
|
}
|
|
88
88
|
|
|
@@ -133,7 +133,7 @@ module.exports = function(core) {
|
|
|
133
133
|
});
|
|
134
134
|
}
|
|
135
135
|
|
|
136
|
-
instr.install = function() {
|
|
136
|
+
instr.install = function () {
|
|
137
137
|
depHooks.resolve({ name: 'marsdb' }, (marsdb) => {
|
|
138
138
|
collectionMethods.forEach((method) => patchCollection(marsdb, method));
|
|
139
139
|
});
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -75,7 +75,7 @@ const querySafeTags = [
|
|
|
75
75
|
* }} core
|
|
76
76
|
* @returns {import('@contrast/common').Installable}
|
|
77
77
|
*/
|
|
78
|
-
module.exports = function(core) {
|
|
78
|
+
module.exports = function (core) {
|
|
79
79
|
const {
|
|
80
80
|
config,
|
|
81
81
|
depHooks,
|
|
@@ -237,7 +237,7 @@ module.exports = function(core) {
|
|
|
237
237
|
|
|
238
238
|
function createAroundHook(entity, name, method, getInfoMethod, vulnerableArgIdxs) {
|
|
239
239
|
const argsIdxsToCheck = vulnerableArgIdxs || [0];
|
|
240
|
-
return function(next, data) {
|
|
240
|
+
return function (next, data) {
|
|
241
241
|
if (!getSourceContext(RULE, ruleId)) return next();
|
|
242
242
|
|
|
243
243
|
const { obj, args: origArgs } = data;
|
|
@@ -324,7 +324,7 @@ module.exports = function(core) {
|
|
|
324
324
|
reportFindings({ ruleId, sinkEvent });
|
|
325
325
|
}
|
|
326
326
|
} catch (err) {
|
|
327
|
-
core.logger.error({
|
|
327
|
+
core.logger.error({ err, funcKey: data.funcKey }, 'assess sink analysis failed');
|
|
328
328
|
}
|
|
329
329
|
|
|
330
330
|
return methodsWithNestedCalls.includes(method)
|
|
@@ -333,7 +333,7 @@ module.exports = function(core) {
|
|
|
333
333
|
};
|
|
334
334
|
}
|
|
335
335
|
|
|
336
|
-
instr.install = function() {
|
|
336
|
+
instr.install = function () {
|
|
337
337
|
depHooks.resolve({ name: 'mongodb' }, (mongodb, version) => {
|
|
338
338
|
patchCollection(mongodb, version);
|
|
339
339
|
patchDatabase(mongodb, version);
|
|
@@ -346,7 +346,7 @@ module.exports = function(core) {
|
|
|
346
346
|
const name = `mongodb.Collection.prototype.${method}`;
|
|
347
347
|
|
|
348
348
|
if (!proto[method]) {
|
|
349
|
-
logger.trace({
|
|
349
|
+
logger.trace({ version }, 'method %s not found - skipping instrumentation', name);
|
|
350
350
|
continue;
|
|
351
351
|
}
|
|
352
352
|
|
|
@@ -384,7 +384,7 @@ module.exports = function(core) {
|
|
|
384
384
|
const name = `mongodb.Db.prototype.${method}`;
|
|
385
385
|
|
|
386
386
|
if (!proto[method]) {
|
|
387
|
-
logger.trace({
|
|
387
|
+
logger.trace({ version }, 'method %s not found - skipping instrumentation', name);
|
|
388
388
|
continue;
|
|
389
389
|
}
|
|
390
390
|
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2024 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -36,7 +36,7 @@ const { patchType, filterSafeTags } = require('../common');
|
|
|
36
36
|
* }} core
|
|
37
37
|
* @returns {import('@contrast/common').Installable}
|
|
38
38
|
*/
|
|
39
|
-
module.exports = function(core) {
|
|
39
|
+
module.exports = function (core) {
|
|
40
40
|
const {
|
|
41
41
|
depHooks,
|
|
42
42
|
patcher,
|
|
@@ -62,11 +62,10 @@ module.exports = function(core) {
|
|
|
62
62
|
|
|
63
63
|
const sequelize = (core.assess.dataflow.sinks.sequelize = {});
|
|
64
64
|
|
|
65
|
-
sequelize.install = function() {
|
|
66
|
-
const sequelizeQueryPatchName = 'sequelize.prototype.query';
|
|
65
|
+
sequelize.install = function () {
|
|
67
66
|
depHooks.resolve({ name: 'sequelize' }, (sequelize) => {
|
|
68
67
|
patcher.patch(sequelize.prototype, 'query', {
|
|
69
|
-
name:
|
|
68
|
+
name: 'sequelize.prototype.query',
|
|
70
69
|
patchType,
|
|
71
70
|
around(next, data) {
|
|
72
71
|
if (!getSourceContext(RULE, ruleId) || !data.args[0]) return next();
|
|
@@ -80,7 +79,7 @@ module.exports = function(core) {
|
|
|
80
79
|
|
|
81
80
|
if (queryInfo && !isVulnerableQuery && config.assess.safe_positives.enable) {
|
|
82
81
|
reportSafePositive({
|
|
83
|
-
name:
|
|
82
|
+
name: data.name,
|
|
84
83
|
ruleId,
|
|
85
84
|
safeTags: filterSafeTags(safeTags, queryInfo),
|
|
86
85
|
strInfo: {
|
|
@@ -110,7 +109,7 @@ module.exports = function(core) {
|
|
|
110
109
|
|
|
111
110
|
const event = createSinkEvent({
|
|
112
111
|
context: `sequelize.prototype.query(${contextArgs})`,
|
|
113
|
-
name:
|
|
112
|
+
name: data.name,
|
|
114
113
|
moduleName: 'sequelize',
|
|
115
114
|
methodName: 'prototype.query',
|
|
116
115
|
history: [queryInfo],
|
|
@@ -136,7 +135,7 @@ module.exports = function(core) {
|
|
|
136
135
|
/* c8 ignore next 3 */
|
|
137
136
|
} catch (err) {
|
|
138
137
|
core.logger.error(
|
|
139
|
-
{
|
|
138
|
+
{ err, funcKey: data.funcKey },
|
|
140
139
|
'assess sink analysis failed'
|
|
141
140
|
);
|
|
142
141
|
}
|