@contrast/assess 1.3.0 → 1.4.0

package/lib/dataflow/propagation/install/string/index.js

@@ -28,12 +28,13 @@ module.exports = function(core) {
   };
 
   require('./concat')(core);
+  require('./format-methods')(core);
+  require('./html-methods')(core);
+  require('./match')(core);
   require('./replace')(core);
+  require('./split')(core);
   require('./substring')(core);
   require('./trim')(core);
-  require('./html-methods')(core);
-  require('./format-methods')(core);
-  require('./split')(core);
 
   return stringInstrumentation;
 };

package/lib/dataflow/propagation/install/string/match.js

@@ -0,0 +1,122 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { join } = require('@contrast/common');
+const { patchType } = require('../../common');
+const { createSubsetTags } = require('../../../tag-utils');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
+
+  function getPropagationEvent(data, res, objInfo, start) {
+    const { name, args, result, hooked, orig } = data;
+    const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
+    if (!tags) return;
+
+    return createPropagationEvent({
+      name,
+      history: [objInfo],
+      object: {
+        value: objInfo.value,
+        isTracked: true,
+      },
+      args: args.map((arg) => {
+        const argInfo = tracker.getData(arg);
+        return {
+          value: argInfo ? argInfo.value : arg.toString(),
+          isTracked: !!argInfo
+        };
+      }),
+      tags,
+      result: {
+        value: join(result),
+        isTracked: false
+      },
+      stacktraceOpts: {
+        constructorOpt: hooked,
+        prependFrames: [orig]
+      },
+      source: 'O',
+      target: 'R'
+    });
+  }
+
+  return core.assess.dataflow.propagation.stringInstrumentation.match = {
+    install() {
+      const name = 'String.prototype.match';
+
+      patcher.patch(String.prototype, 'match', {
+        name,
+        patchType,
+        post(data) {
+          const { args, obj, result } = data;
+          if (
+            !obj ||
+            !result ||
+            args.length === 0 ||
+            result.length === 0 ||
+            !sources.getStore() ||
+            typeof obj !== 'string' ||
+            instrumentation.isLocked() ||
+            (args.length === 1 && args[0] == null)
+          ) return;
+
+          const objInfo = tracker.getData(obj);
+          if (!objInfo) return;
+
+          let idx = 0;
+          const hasCaptureGroups = 'groups' in result;
+          for (let i = 0; i < result.length; i++) {
+            const res = result[i];
+            if (!res) continue;
+            const start = obj.indexOf(res, idx);
+            idx += hasCaptureGroups ? 0 : res.length;
+            const event = getPropagationEvent(data, res, objInfo, start);
+            if (event) {
+              const { extern } = tracker.track(res, event);
+              if (extern) {
+                data.result[i] = extern;
+              }
+            }
+          }
+          if (hasCaptureGroups && result.groups) {
+            Object.keys(result.groups).forEach((key) => {
+              const res = result.groups[key];
+              if (!res) return;
+              const start = obj.indexOf(res);
+              const event = getPropagationEvent(data, res, objInfo, start);
+              if (event) {
+                const { extern } = tracker.track(res, event);
+                if (extern) {
+                  data.result.groups[key] = extern;
+                }
+              }
+            });
+          }
+        },
+      });
+    },
+    uninstall() {
+      String.prototype.match = patcher.unwrap(String.prototype.match);
+    },
+  };
+};

package/lib/dataflow/signatures/index.js

@@ -933,6 +933,16 @@ module.exports = function(core) {
         target: 'R'
       }
     ],
+    [
+      'String.prototype.match',
+      {
+        moduleName: 'String',
+        methodName: 'prototype.match',
+        isModule: false,
+        source: 'O',
+        target: 'R'
+      }
+    ],
     [
       'sqlite3.Database.prototype.all',
       {

package/lib/dataflow/sources/install/http.js

@@ -132,43 +132,15 @@ module.exports = function(core) {
   }
 
   function install() {
-    [{
-      moduleName: 'http'
-    },
-    {
-      moduleName: 'https'
-    },
-    {
-      moduleName: 'spdy'
-    },
-    {
-      moduleName: 'http2',
-      patchObjectsProps: [
-        {
-          methods: ['createServer', 'createSecureServer'],
-          patchType,
-          patchObjects: [
-            {
-              name: 'Server.prototype',
-              methods: ['emit'],
-              patchType,
-              around
-            }
-          ]
-        }
-      ]
-    }].forEach(({ moduleName, patchObjectsProps }) => {
-      const patchObjects = patchObjectsProps || [
-        {
+    ['http', 'https', 'spdy', 'http2'].forEach((moduleName) => {
+      instrument({
+        moduleName,
+        patchObjects: [{
           name: 'Server.prototype',
           methods: ['emit'],
           patchType,
           around
-        }
-      ];
-      instrument({
-        moduleName,
-        patchObjects
+        }]
       });
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "",
   "main": "lib/index.js",
   "scripts": {
@@ -15,7 +15,7 @@
   "dependencies": {
     "@contrast/distringuish": "^4.1.0",
     "@contrast/scopes": "1.3.0",
-    "@contrast/common": "1.6.0",
+    "@contrast/common": "1.7.0",
     "parseurl": "^1.3.3"
   }
 }