@contrast/assess 1.24.0 → 1.24.1

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -62,7 +62,7 @@ module.exports = function(core) {
         args: data.origArgs.map((_arg, idx) => ({
           value: idx === 0 ? trackingData.value : restOfArgsValues[idx - 1],
           tracked: !!idx === 0
-        })),
+        })).filter(el => el),
         result: {
           value: result,
           tracked: !!resultInfo

package/lib/dataflow/propagation/install/string/replace.js

@@ -46,6 +46,7 @@ module.exports = function(core) {
     const namedGroups = hasNamedGroup ? lastEl : null;
     return { match, captureGroups, matchIdx, str, namedGroups };
   }
+
   function replaceSpecialCharacters(replacement, { captureGroups, match, str, namedGroups }, replacementType) {
     const origReplace = patcher.unwrap(String.prototype.replace);
     let ret = replacement;
@@ -82,7 +83,7 @@ module.exports = function(core) {
     if (numberedGroupMatches) {
       numberedGroupMatches.forEach((numberedGroup) => {
         const group = Number(substring(numberedGroup, 1));
-        ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1]);
+        ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1] || '');
       });
     }
 
@@ -94,6 +95,7 @@ module.exports = function(core) {
 
     return ret;
   }
+
   function getReplacementInfo(data, replacerArgs, parsedArgs) {
     let replacement = data._replacementType === 'function' ?
       data._replacement.call(global, ...replacerArgs) :

package/lib/dataflow/propagation/install/url/parse.js

@@ -51,6 +51,31 @@ module.exports = function(core) {
     ]
   ];
 
+  function getPropagationEvent(argInfo, partInfo, { name, result, hooked, orig }, parseQueryString = false) {
+    return createPropagationEvent({
+      name,
+      moduleName: 'url',
+      methodName: 'parse',
+      context: `url.parse('${argInfo.value += parseQueryString ? "', true" : ''})`,
+      object: {
+        value: 'url',
+        tracked: false
+      },
+      result: {
+        value: inspect(result),
+        tracked: true
+      },
+      args: [{ value: partInfo.value, tracked: true }],
+      tags: partInfo.tags,
+      history: [{ ...partInfo }],
+      source: 'P',
+      target: 'R',
+      stacktraceOpts: {
+        constructorOpt: hooked,
+        prependFrames: [orig]
+      },
+    });
+  }
 
   return core.assess.dataflow.propagation.urlInstrumentation.parse = {
     install() {
@@ -65,47 +90,41 @@ module.exports = function(core) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
 
-            const url = args[0];
+            const [url, parseQueryString] = args;
             const argInfo = tracker.getData(url);
 
             if (!argInfo) return;
 
+            const metadata = { name, result, hooked, orig };
             const traverse = function(href, url, keys, idx = 0) {
               let substr = href;
               keys.forEach((key) => {
                 if (typeof key === 'string') {
                   const part = result[key];
                   if (part) {
-                    const index = href.indexOf(part, idx - 1);
-                    substr = href.substring(index, index + part.length);
-                    idx += part.length;
+
+                    if (key === 'query' && parseQueryString) {
+                      Object.keys(part).forEach((key) => {
+                        const partInfo = tracker.getData(part[key]);
+
+                        if (!partInfo) return;
+
+                        const event = getPropagationEvent(argInfo, partInfo, metadata, parseQueryString);
+                        if (!event) return;
+
+                        Object.assign(partInfo, event);
+                      });
+                      return;
+                    } else {
+                      const index = href.indexOf(part, idx - 1);
+                      substr = href.substring(index, index + part.length);
+                      idx += part.length;
+                    }
 
                     const partInfo = tracker.getData(substr);
                     if (!partInfo) return;
 
-                    const event = createPropagationEvent({
-                      name,
-                      moduleName: 'url',
-                      methodName: 'parse',
-                      context: `url.parse('${argInfo.value}')`,
-                      object: {
-                        value: 'url',
-                        tracked: false
-                      },
-                      result: {
-                        value: inspect(result),
-                        tracked: true
-                      },
-                      args: [{ value: partInfo.value, tracked: true }],
-                      tags: partInfo.tags,
-                      history: [partInfo],
-                      source: 'P',
-                      target: 'R',
-                      stacktraceOpts: {
-                        constructorOpt: hooked,
-                        prependFrames: [orig]
-                      },
-                    });
+                    const event = getPropagationEvent(argInfo, partInfo, metadata);
 
                     if (!event) return;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.24.0",
+  "version": "1.24.1",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",