@contrast/assess 1.27.2 → 1.28.1

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -18,12 +18,10 @@
 const querystring = require('querystring');
 const {
   DataflowTag: { URL_ENCODED },
-  inspect,
   join
 } = require('@contrast/common');
-
+const { createSubsetTags, createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
-const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
   const {
@@ -48,10 +46,11 @@ module.exports = function(core) {
       if (!tagRanges) return result;
 
       const resultInfo = tracker.getData(result);
-      const [, ...restOfArgsValues] = data.origArgs.map(inspect);
+      const [, ...restArgs] = data.origArgs.map(getAdjustedUntrackedValue);
+      const restArgStr = restArgs.length ? `,${join(restArgs)}` : '';
       const event = createPropagationEvent({
         name: data.name,
-        context: `querystring.parse('${trackingData.value}', ${join(restOfArgsValues, ', ')})`,
+        context: `querystring.parse('${trackingData.value}'${restArgStr})`,
         moduleName: 'querystring',
         methodName: 'parse',
         history: [trackingData],
@@ -60,7 +59,7 @@ module.exports = function(core) {
           tracked: true,
         },
         args: data.origArgs.map((_arg, idx) => ({
-          value: idx === 0 ? trackingData.value : restOfArgsValues[idx - 1],
+          value: idx === 0 ? trackingData.value : restArgs[idx - 1],
           tracked: !!idx === 0
         })).filter(el => el),
         result: {
@@ -116,7 +115,7 @@ module.exports = function(core) {
               }
 
               data.idx = 0;
-              data.origArgs = data.args;
+              data.origArgs = [...data.args];
               data.trackingData = trackingData;
 
               data.args[3] = {

package/lib/dataflow/propagation/install/querystring/stringify.js

@@ -15,7 +15,6 @@
 'use strict';
 
 const querystring = require('querystring');
-const { inspect } = require('util');
 const { isString } = require('@contrast/common');
 const utils = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -25,6 +24,7 @@ const moduleName = 'querystring';
 module.exports = function(core) {
   const {
     assess: {
+      inspect, // todo: remove
       dataflow: { tracker },
       eventFactory: { createPropagationEvent },
     },

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -14,8 +14,7 @@
  */
 
 'use strict';
-const { inspect } = require('@contrast/common');
-const { createSubsetTags } = require('../../tag-utils');
+const { createSubsetTags, getAdjustedUntrackedValue } = require('../../tag-utils');
 const { patchType } = require('../common');
 
 module.exports = function(core) {
@@ -58,7 +57,7 @@ module.exports = function(core) {
       ],
       tags,
       result: {
-        value: inspect(untrackedResult),
+        value: getAdjustedUntrackedValue(untrackedResult),
         tracked: false,
       },
       stacktraceOpts: {

package/lib/dataflow/propagation/install/string/concat.js

@@ -15,17 +15,16 @@
 
 'use strict';
 
-const {
-  createAppendTags
-} = require('../../../tag-utils');
-const { join, inspect } = require('@contrast/common');
+const { join } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -39,8 +38,8 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { args, obj, result, hooked, orig } = data;
-          if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+          const { obj, result, hooked, orig } = data;
+          if (!result || !getSourceContext(PROPAGATOR)) return;
 
           const rInfo = tracker.getData(result);
           if (rInfo) {
@@ -48,45 +47,45 @@ module.exports = function(core) {
             return;
           }
 
-          const argsData = [];
           const objInfo = tracker.getData(obj);
           const history = objInfo ? new Set([objInfo]) : new Set();
-          const newTags = { ...objInfo?.tags };
           let globalOffset = typeof obj !== 'function' ? obj.length : 0;
+          const args = [];
+          let tags = objInfo?.tags;
 
-          for (const str of args) {
-            const strInfo = tracker.getData(str);
+          for (const arg of data.args) {
+            const strInfo = tracker.getData(arg);
 
             if (strInfo) {
-              const strTags = strInfo?.tags || {};
+              args.push({ tracked: true, value: arg });
               history.add(strInfo);
-              Object.assign(newTags, createAppendTags(newTags, strTags, globalOffset));
+              tags = createAppendTags(tags, strInfo.tags, globalOffset);
+            } else {
+              args.push({ tracked: false, value: getAdjustedUntrackedValue(arg) });
             }
 
-            argsData.push({
-              value: strInfo?.value ?? str,
-              tracked: !!strInfo
-            });
-
-            globalOffset += `${str}`.length;
+            globalOffset += `${arg}`.length;
           }
 
+          const objVal = objInfo ? `'${objInfo.value}'` : getAdjustedUntrackedValue(obj);
+          const context = `${objVal}.concat(${join(args.map((a) => a.value))})`;
+
           if (history.size) {
             const event = createPropagationEvent({
               name,
               moduleName: 'String',
               methodName: 'prototype.concat',
-              context: `${inspect(objInfo?.value) || String(obj)}.concat(${inspect(join(argsData.map(d => d.value)), ', ')})`,
+              context,
               object: {
-                value: objInfo?.value || String(obj),
+                value: objInfo?.value ?? getAdjustedUntrackedValue(obj),
                 tracked: !!objInfo
               },
               result: {
                 value: result,
                 tracked: true
               },
-              args: argsData,
-              tags: newTags,
+              args,
+              tags,
               history: Array.from(history),
               source: objInfo ? (history.size > 1 ? 'A' : 'O') : 'P',
               target: 'R',

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -15,10 +15,8 @@
 
 'use strict';
 
-const {
-  createAppendTags
-} = require('../../../tag-utils');
-const { inspect } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createAppendTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 const htmlTagsLengths = {
   anchor: 11,
@@ -33,9 +31,10 @@ const htmlTagsLengths = {
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      inspect, // todo: remove
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -65,7 +64,7 @@ module.exports = function(core) {
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
-          if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+          if (!result || !getSourceContext(PROPAGATOR)) return;
 
           const objInfo = tracker.getData(obj);
           const history = objInfo ? new Set([objInfo]) : new Set();
@@ -122,7 +121,7 @@ module.exports = function(core) {
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
-            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!result || !getSourceContext(PROPAGATOR)) return;
 
             const objInfo = tracker.getData(obj);
 

package/lib/dataflow/propagation/install/string/index.js

@@ -15,8 +15,8 @@
 
 'use strict';
 
-const { callChildComponentMethodsSync } = require('@contrast/common');
-const { inspect, split } = require('@contrast/common');
+const { callChildComponentMethodsSync, split } = require('@contrast/common');
+const { getAdjustedUntrackedValue } = require('../../../tag-utils');
 
 module.exports = function(core) {
   const {
@@ -55,7 +55,7 @@ module.exports = function(core) {
         ) return;
 
         const args = [{
-          value: inspect(methodArg),
+          value: getAdjustedUntrackedValue(methodArg),
           tracked: false
         }];
 

package/lib/dataflow/propagation/install/string/match-all.js

@@ -14,15 +14,16 @@
  */
 
 'use strict';
-const { inspect } = require('@contrast/common');
-const { patchType } = require('../../common');
+
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
+const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
@@ -55,15 +56,10 @@ module.exports = function(core) {
         value: objInfo.value,
         tracked: true,
       },
-      args: [
-        {
-          value: arg,
-          tracked: false,
-        },
-      ],
+      args: [{ tracked: false, value: arg }],
       tags,
       result: {
-        value: inspect(untrackedResult),
+        value: '[RegExp String Iterator] {}',
         tracked: false,
       },
       stacktraceOpts: {
@@ -75,7 +71,7 @@ module.exports = function(core) {
     });
   }
 
-  return (stringInstrumentation.matchAll = {
+  return stringInstrumentation.matchAll = {
     install() {
       patcher.patch(String.prototype, 'matchAll', {
         name,
@@ -87,8 +83,7 @@ module.exports = function(core) {
             !obj ||
             !args[0] ||
             typeof obj !== 'string' ||
-            !sources.getStore()?.assess ||
-            instrumentation.isLocked()
+            !getSourceContext(PROPAGATOR)
           )
             return origFn();
 
@@ -131,7 +126,7 @@ module.exports = function(core) {
             resValue.indices && (untrackedResult.indices = resValue.indices);
 
             let searchIdx = resValue.index;
-            const metadata = { arg: inspect(args[0]), hooked, orig };
+            const metadata = { arg: `${args[0]}`, hooked, orig };
 
             for (let i = 0; i < resValue.length; i++) {
               let match = resValue[i];
@@ -233,5 +228,5 @@ module.exports = function(core) {
     uninstall() {
       String.prototype.matchAll = patcher.unwrap(String.prototype.matchAll);
     },
-  });
+  };
 };

package/lib/dataflow/propagation/install/string/match.js

@@ -14,9 +14,9 @@
  */
 
 'use strict';
-const { join, inspect } = require('@contrast/common');
+const { join } = require('@contrast/common');
 const { patchType } = require('../../common');
-const { createSubsetTags } = require('../../../tag-utils');
+const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 
 module.exports = function(core) {
   const {
@@ -36,13 +36,14 @@ module.exports = function(core) {
   function getPropagationEvent(data, res, objInfo, start) {
     const { args: origArgs, result, hooked, orig } = data;
     const tags = createSubsetTags(objInfo.tags, start, res.length);
+
     if (!tags) return;
 
     const args = [
       {
-        value: inspect(origArgs[0]),
+        value: getAdjustedUntrackedValue(origArgs[0]),
         tracked: false,
-      },
+      }
     ];
 
     return createPropagationEvent({

package/lib/dataflow/propagation/install/string/replace.js

@@ -18,20 +18,25 @@
 const {
   DataflowTag: { UNTRUSTED },
   match: origMatch,
+  join,
   substring
 } = require('@contrast/common');
-const { inspect, join } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const {
+  createSubsetTags,
+  createAppendTags,
+  getAdjustedUntrackedValue
+} = require('../../../tag-utils');
 const { patchType } = require('../../common');
-const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
   const {
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     },
-    scopes: { sources, instrumentation }
   } = core;
 
   function parseArgs(args) {
@@ -141,7 +146,7 @@ module.exports = function(core) {
         name,
         patchType,
         pre(data) {
-          if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
+          if (!getSourceContext(PROPAGATOR)) return;
 
           // setup state
           data._objInfo = tracker.getData(data.obj);
@@ -155,8 +160,6 @@ module.exports = function(core) {
         },
         post(data) {
           if (
-            !sources.getStore()?.assess ||
-            instrumentation.isLocked() ||
             !data.result ||
             // todo: can we reuse this optimization in other propagators? e.g those performing substring-like operations
             !data._accumTags?.[UNTRUSTED] ||
@@ -167,21 +170,24 @@ module.exports = function(core) {
             return;
           }
 
-          const { _replacementInfo, obj, args: origArgs, result, hooked, orig } = data;
-          const args = [{
-            value: inspect(origArgs[0]),
-            tracked: !!tracker.getData(origArgs[0])
-          },
-          {
-            value: data._replacement,
-            tracked: !!_replacementInfo
-          }];
+          const { obj, args: origArgs, result, hooked, orig } = data;
+          const args = [];
+          if (tracker.getData(origArgs[0])) {
+            args.push({ tracked: true, value: origArgs[0] });
+          } else {
+            args.push({ tracked: false, value: getAdjustedUntrackedValue(origArgs[0]) });
+          }
+          if (data._replacement) {
+            args.push({ tracked: true, value: data._replacement });
+          } else {
+            args.push({ tracked: false, value: getAdjustedUntrackedValue(data._replacement) });
+          }
 
           const event = createPropagationEvent({
             name,
             moduleName: 'String',
             methodName: 'prototype.replace',
-            context: `'${obj}'.replace(${join(args.map(a => a.value), ', ')})`,
+            context: `'${obj}'.replace(${join(args.map(a => a.value))})`,
             history: Array.from(data._history),
             object: {
               value: obj,

package/lib/dataflow/propagation/install/string/slice.js

@@ -13,15 +13,16 @@
  * way not consistent with the End User License Agreement.
  */
 'use strict';
+const { join } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
-const { inspect, join } = require('@contrast/common');
-const { createSubsetTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -55,7 +56,7 @@ module.exports = function(core) {
         patchType,
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
-          if (!result || !sources.getStore() || instrumentation.isLocked()) return;
+          if (!result || !getSourceContext(PROPAGATOR)) return;
 
           const objInfo = tracker.getData(obj);
           if (!objInfo) return;
@@ -71,8 +72,8 @@ module.exports = function(core) {
           if (!tags) return;
 
           const args = origArgs.map((arg) => ({
-            value: inspect(arg),
-            tracked: false
+            tracked: false,
+            value: getAdjustedUntrackedValue(arg)
           }));
 
           const event = createPropagationEvent({

package/lib/dataflow/propagation/install/string/split.js

@@ -15,16 +15,16 @@
 
 'use strict';
 
+const { join } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
-const { join, inspect } = require('@contrast/common');
-const { createSubsetTags } = require('../../../tag-utils');
-
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory,
       dataflow: { tracker }
     }
@@ -44,10 +44,9 @@ module.exports = function(core) {
             !result ||
             origArgs.length === 0 ||
             result.length === 0 ||
-            !sources.getStore() ||
             typeof obj !== 'string' ||
-            instrumentation.isLocked() ||
-            (origArgs.length === 1 && origArgs[0] == null)
+            (origArgs.length === 1 && origArgs[0] == null) ||
+            !getSourceContext(PROPAGATOR)
           ) return;
 
           const objInfo = tracker.getData(obj);
@@ -55,17 +54,16 @@ module.exports = function(core) {
 
           const args = origArgs.map((arg) => {
             const argInfo = tracker.getData(arg);
-            return {
-              value: argInfo ? argInfo.value : inspect(arg),
-              tracked: !!argInfo
-            };
+            return argInfo ?
+                { tracked: true, value: argInfo.value } :
+                { tracked: false, value: `'${arg}'` };
           });
 
           const event = eventFactory.createPropagationEvent({
             name,
             moduleName: 'String',
             methodName: 'prototype.split',
-            context: `'${objInfo.value}'.split(${join(args.map(a => a.value), ', ')})`,
+            context: `'${objInfo.value}'.split(${join(args.map(a => a.value))})`,
             history: [objInfo],
             object: {
               value: obj,
@@ -74,7 +72,7 @@ module.exports = function(core) {
             args,
             tags: {},
             result: {
-              value: join(result),
+              value: getAdjustedUntrackedValue(result),
               tracked: false
             },
             stacktraceOpts: {
@@ -96,9 +94,13 @@ module.exports = function(core) {
             const objSubstrInfo = tracker.getData(objSubstr);
             if (objSubstrInfo) {
               const tags = createSubsetTags(objInfo.tags, start, res.length);
-              if (!tags) continue;
 
-              const metadata = { ...event, tags };
+              if (!tags) continue;
+              const metadata = {
+                ...event,
+                result: { tracked: true, value: res },
+                tags,
+              };
               eventFactory.createdEvents.add(metadata);
               const { extern } = tracker.track(res, metadata);
 
@@ -115,4 +117,3 @@ module.exports = function(core) {
     },
   };
 };
-

package/lib/dataflow/propagation/install/string/substring.js

@@ -15,15 +15,16 @@
 
 'use strict';
 
-const { createSubsetTags } = require('../../../tag-utils');
-const { join, inspect } = require('@contrast/common');
+const { join } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -63,7 +64,7 @@ module.exports = function(core) {
           patchType,
           post(data) {
             const { obj, args: origArgs, result, name, hooked, orig } = data;
-            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!result || !getSourceContext(PROPAGATOR)) return;
 
             const objInfo = tracker.getData(obj);
             if (!objInfo) return;
@@ -81,14 +82,15 @@ module.exports = function(core) {
             if (!tags) return;
 
             const args = origArgs.map((arg) => ({
-              value: inspect(arg),
-              tracked: false
+              tracked: false,
+              value: getAdjustedUntrackedValue(arg)
             }));
+
             const event = createPropagationEvent({
               name,
               moduleName: 'String',
               methodName: 'prototype.substring',
-              context: `'${objInfo.value}'.substring(${join(args.map(a => a.value), ', ')})`,
+              context: `'${objInfo.value}'.substring(${join(args.map(a => a.value))})`,
               history: [objInfo],
               object: {
                 value: obj,
@@ -125,4 +127,3 @@ module.exports = function(core) {
     },
   };
 };
-

package/lib/dataflow/propagation/install/string/trim.js

@@ -15,16 +15,15 @@
 
 'use strict';
 
-const {
-  createSubsetTags,
-} = require('../../../tag-utils');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
+const { createSubsetTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -34,7 +33,7 @@ module.exports = function(core) {
     return function(data) {
       const { obj, result, hooked, orig } = data;
 
-      if (!result?.length || !sources.getStore()?.assess || instrumentation.isLocked()) {
+      if (!result?.length || !getSourceContext(PROPAGATOR)) {
         return;
       }
       const rInfo = tracker.getData(result);

package/lib/dataflow/propagation/install/url/parse.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { patchType } = require('../../common');
-const { inspect } = require('@contrast/common');
 
 module.exports = function(core) {
   const {
@@ -24,6 +23,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
+      inspect, // todo: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { patchType } = require('../../common');
-const { inspect, isString } = require('@contrast/common');
+const { isString } = require('@contrast/common');
 
 module.exports = function(core) {
   const {
@@ -24,6 +24,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
+      inspect, // todo: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }