@contrast/assess 1.29.1 → 1.30.0

package/lib/crypto-analysis/install/crypto.js

@@ -24,18 +24,30 @@ const { InstrumentationType: { RULE } } = require('../../constants');
 const { PATCH_TYPE: patchType } = require('../common');
 
 const SAFE_HASH_ALGORITHMS = new Set([
-  'RSA-SHA1-2',
-  'RSA-SHA224',
-  'RSA-SHA256',
-  'RSA-SHA384',
-  'RSA-SHA512',
+  // SHA224
+  'rsa-sha224',
+  'sha-224',
+  'sha2-224',
   'sha224',
-  'sha224WithRSAEncryption',
+  'sha224withrsaencryption',
+  // SHA256
+  'rsa-sha256',
+  'sha-256',
+  'sha2-256',
   'sha256',
-  'sha256WithRSAEncryption',
+  'sha256withrsaencryption',
+  // SHA384
+  'rsa-sha384',
+  'sha-384',
+  'sha2-384',
   'sha384',
-  'sha384WithRSAEncryption',
-  'sha512'
+  'sha384withrsaencryption',
+  // SHA512
+  'rsa-sha512',
+  'sha-512',
+  'sha2-512',
+  'sha512',
+  'sha512withrsaencryption',
 ]);
 const SAFE_HASH_LIBS = ['etag', 'browserify', 'deps-sort'];
 const SAFE_CIPHER_ALGORITHM_PREFIXES = ['des-ede', 'id-aes', 'aes', 'rsa'];
@@ -53,7 +65,6 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
       eventFactory,
       cryptoAnalysis,
       getSourceContext,
@@ -68,16 +79,14 @@ module.exports = function (core) {
           patchType,
           post(data) {
             const [alg] = data.args;
+            if (!isString(alg) || !getSourceContext(RULE, Rule.CRYPTO_BAD_MAC)) return;
 
-            if (
-              !isString(alg) ||
-              !getSourceContext(RULE, Rule.CRYPTO_BAD_MAC) ||
-              SAFE_HASH_ALGORITHMS.has(alg)
-            ) return;
+            const algLower = StringPrototypeToLowerCase.call(alg);
+            if (SAFE_HASH_ALGORITHMS.has(algLower)) return;
 
             const event = eventFactory.createCryptoAnalysisEvent({
               args: [{ tracked: false, value: alg }],
-              context: `crypto.createHash(${inspect(alg)})`,
+              context: `crypto.createHash(${algLower})`,
               methodName: 'createHash',
               moduleName: 'crypto',
               name: 'crypto.createHash',
@@ -130,7 +139,7 @@ module.exports = function (core) {
 
               const event = eventFactory.createCryptoAnalysisEvent({
                 args: [{ tracked: false, value: alg }],
-                context: `crypto.${method}(${inspect(alg)})`,
+                context: `crypto.${method}(${algLower})`,
                 methodName: method,
                 moduleName: 'crypto',
                 name: `crypto.${method}`,

package/lib/dataflow/sinks/install/http/server-response.js

@@ -77,11 +77,13 @@ module.exports = function(core) {
     WEAK_URL_ENCODED,
   ];
 
-  const preHook = (name, method) => (data) => {
+  const preHook = (moduleName, responseName, method) => ({ args, obj: response, result, hooked, orig }) => {
+    const methodName = `${responseName + (moduleName !== 'spdy' ? '.prototype' : '')}.${method}`;
+    const name = `${moduleName}.${methodName}`;
     const sourceContext = getSourceContext(RULE, ruleId);
     if (!sourceContext) return;
 
-    const payload = data.args[0];
+    const payload = args[0];
     if (!payload) return;
 
     const strInfo = tracker.getData(payload);
@@ -90,6 +92,7 @@ module.exports = function(core) {
     const { contentType } = sourceContext.responseData;
     if (contentType && isSafeContentType(contentType)) return;
 
+    if (moduleName === 'spdy') response.spdyStream.once('finish', () => response.emit('finish'));
     if (isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
       const event = createSinkEvent({
         args: [{
@@ -99,20 +102,20 @@ module.exports = function(core) {
         context: `res.${method}('${strInfo.value}')`,
         history: [strInfo],
         name,
-        moduleName: 'http',
-        methodName: `ServerResponse.prototype.${method}`,
+        moduleName,
+        methodName,
         object: {
           tracked: false,
-          value: 'http.ServerResponse'
+          value: `${moduleName}.${responseName}`
         },
         result: {
-          value: data.result,
+          value: result,
           tracked: false,
         },
         source: 'P0',
         stacktraceOpts: {
-          constructorOpt: data.hooked,
-          prependFrames: [data.orig]
+          constructorOpt: hooked,
+          prependFrames: [orig]
         },
         tags: strInfo.tags,
       });
@@ -139,21 +142,47 @@ module.exports = function(core) {
   http.install = function() {
     depHooks.resolve({ name: 'http' }, (http) => {
       {
-        const name = 'http.ServerResponse.prototype.write';
         const method = 'write';
         patcher.patch(http.ServerResponse.prototype, method, {
-          name,
+          name: 'http.ServerResponse.prototype.write',
           patchType,
-          pre: preHook(name, method),
+          pre: preHook('http', 'ServerResponse', method),
         });
       }
       {
-        const name = 'http.ServerResponse.prototype.end';
         const method = 'end';
         patcher.patch(http.ServerResponse.prototype, method, {
-          name,
+          name: 'http.ServerResponse.prototype.end',
           patchType,
-          pre: preHook(name, method),
+          pre: preHook('http', 'ServerResponse', method),
+        });
+      }
+    });
+    depHooks.resolve({ name: 'http2' }, (http2) => {
+      {
+        const method = 'write';
+        patcher.patch(http2.Http2ServerResponse.prototype, method, {
+          name: 'http2.Http2ServerResponse.prototype.write',
+          patchType,
+          pre: preHook('http2', 'Http2ServerResponse', method),
+        });
+      }
+      {
+        const method = 'end';
+        patcher.patch(http2.Http2ServerResponse.prototype, method, {
+          name: 'http2.Http2ServerResponse.prototype.end',
+          patchType,
+          pre: preHook('http2', 'Http2ServerResponse', method),
+        });
+      }
+    });
+    depHooks.resolve({ name: 'spdy', file: 'lib/spdy/response.js' }, (response) => {
+      {
+        const method = 'end';
+        patcher.patch(response, method, {
+          name: 'spdy.response.end',
+          patchType,
+          pre: preHook('spdy', 'response', method),
         });
       }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.29.1",
+  "version": "1.30.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,7 +17,7 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.21.2",
+    "@contrast/common": "1.21.3",
     "@contrast/distringuish": "^5.0.0",
     "@contrast/scopes": "1.4.1"
   }