@contrast/assess 1.30.0 → 1.32.0

package/lib/dataflow/propagation/install/string/match.test.js

@@ -0,0 +1,361 @@
+'use strict';
+
+const { expect } = require('chai');
+const { inspect } = require('util');
+const { DataflowTag: { UNTRUSTED } } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string match', function () {
+  let core, simulateRequestScope, trackString, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      trackString,
+      simulateRequestScope
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.regExpExec.install();
+    core.assess.dataflow.propagation.stringInstrumentation.match.install();
+    core.assess.dataflow.propagation.stringInstrumentation.substring.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.regExpExec.uninstall();
+    core.assess.dataflow.propagation.stringInstrumentation.match.uninstall();
+    core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
+  });
+
+  describe('base cases', function () {
+    [
+      [],
+      [undefined],
+      ['']
+    ].forEach((val) => {
+      it(`returns empty string match for ${inspect(val[0])}`, function () {
+        simulateRequestScope(() => {
+          const ret = 'foo'.match(val[0]);
+          expect(ret[0]).to.equal('');
+          expect(tracker.getData(ret[0])).to.be.null;
+        });
+      });
+    });
+
+    it('returns null when no match is found', function () {
+      simulateRequestScope(() => {
+        const ret = ''.match('foo');
+        expect(ret).to.be.null;
+      });
+    });
+
+    it('returns first match string', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match(/f/);
+        expect(ret).to.deep.equal(['f']);
+        expect(tracker.getData(ret[0])).to.be.null;
+      });
+    });
+
+    it('returns all match strings', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match(/o/g);
+        expect(ret).to.deep.equal(['o', 'o']);
+        ret.forEach((val) => {
+          expect(tracker.getData(val)).to.be.null;
+        });
+      });
+    });
+
+    it('converts string to regex and returns match ', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match('f');
+        expect(ret).to.deep.equal(['f']);
+        expect(tracker.getData(ret[0])).to.be.null;
+      });
+    });
+
+    it('returns first match string using capture groups', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match(/(f)|(o)/);
+        expect(ret).to.deep.equal(['f', 'f', undefined]);
+        expect(ret.groups).to.be.undefined;
+        ret.forEach((val) => {
+          expect(tracker.getData(val)).to.be.null;
+        });
+      });
+    });
+
+    it('returns first match string using named capture groups', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match(/(?<foo>f)|(?<bar>o)/);
+        expect(ret).to.deep.equal(['f', 'f', undefined]);
+        expect(ret.groups.foo).to.equal('f');
+        ret.forEach((val) => {
+          expect(tracker.getData(val)).to.be.null;
+        });
+      });
+    });
+
+    it('returns match from custom matcher', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.match({
+          [Symbol.match](_str) {
+            return ['foo'];
+          },
+        });
+        expect(ret).to.deep.equal(['foo']);
+        expect(tracker.getData(ret[0])).to.be.null;
+      });
+    });
+  });
+
+  describe('propagation', function () {
+    it('keeps track of tracked first matched string', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo');
+
+        const ret = extern.match(/foo/);
+        const retFirstArgInfo = tracker.getData(ret[0]);
+
+        expect(ret).to.deep.equal(['foo']);
+        expect(retFirstArgInfo.tags).to.deep.equal({
+          [UNTRUSTED]: [0, 2]
+        });
+        expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+      });
+    });
+
+    it('keeps track of tracked of all globally matched strings', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo');
+
+        const ret = extern.match(/foo/g);
+
+        expect(ret).to.deep.equal(['foo', 'foo']);
+        ret.forEach((val) => {
+          const valInfo = tracker.getData(val);
+
+          expect(valInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(valInfo.name).to.equal('String.prototype.match');
+        });
+      });
+    });
+
+    it('keeps track of partially tracked matched strings', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo', {
+          tags: {
+            [UNTRUSTED]: [0, 5]
+          }
+        });
+
+        const ret = extern.match(/foo/g);
+        const retFirstArgInfo = tracker.getData(ret[0]);
+
+        expect(ret).to.deep.equal(['foo', 'foo']);
+        expect(retFirstArgInfo.tags).to.deep.equal({
+          [UNTRUSTED]: [0, 2]
+        });
+        expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+        expect(tracker.getData(ret[1])).to.be.null;
+      });
+    });
+
+    it('keeps track of tracked strings with multiple ranges', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo', {
+          tags: {
+            foo: [0, 2, 6, 8],
+            bar: [3, 5],
+            foobar: [0, 5],
+            barfoo: [3, 8]
+          }
+        });
+
+        const ret = extern.match(/foo/g);
+        const retFirstArgInfo = tracker.getData(ret[0]);
+        const retSecondArgInfo = tracker.getData(ret[1]);
+
+        expect(ret).to.deep.equal(['foo', 'foo']);
+        expect(retFirstArgInfo.tags).to.deep.equal({
+          foo: [0, 2],
+          foobar: [0, 2]
+        });
+        expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+        expect(retSecondArgInfo.tags).to.deep.equal({
+          foo: [0, 2],
+          barfoo: [0, 2]
+        });
+        expect(retSecondArgInfo.name).to.equal('String.prototype.match');
+      });
+    });
+
+    describe('empty or full matches', function () {
+      it('handles full string matches', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match(/(?<full>foobar)/);
+          const matchInfo = tracker.getData(ret[0]);
+          const captrueMatchInfo = tracker.getData(ret[1]);
+          const fullGroupInfo = tracker.getData(ret.groups.full);
+
+          expect(ret).to.deep.equal([
+            'foobar',
+            'foobar',
+          ]);
+          expect(matchInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(matchInfo.name).to.equal('String.prototype.match');
+          expect(captrueMatchInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(captrueMatchInfo.name).to.equal('String.prototype.match');
+          expect(ret.groups.full).to.equal('foobar');
+          expect(fullGroupInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(fullGroupInfo.name).to.equal('String.prototype.match');
+        });
+      });
+
+      it('handles empty string matches', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match(/(?<empty>)/);
+          const matchInfo = tracker.getData(ret[0]);
+          const captrueMatchInfo = tracker.getData(ret[1]);
+          const emptyGroupInfo = tracker.getData(ret.groups.empty);
+
+          expect(ret).to.deep.equal([
+            '',
+            '',
+          ]);
+          expect(matchInfo).to.be.null;
+          expect(captrueMatchInfo).to.be.null;
+          expect(ret.groups.empty).to.equal('');
+          expect(emptyGroupInfo).to.be.null;
+        });
+      });
+    });
+
+    describe('capture groups', function () {
+      it('keeps track of tracked strings within matched capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match(/(foo)|(bar)/);
+          const retFirstArgInfo = tracker.getData(ret[0]);
+          const retSecondArgInfo = tracker.getData(ret[1]);
+
+          expect(ret).to.deep.equal(['foo', 'foo', undefined]);
+          expect(ret.groups).to.be.undefined;
+          expect(retFirstArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+          expect(retSecondArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retSecondArgInfo.name).to.equal('String.prototype.match');
+        });
+      });
+
+      it('keeps track of tracked strings within matched named capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match(/(?<fooOrBar>foo|bar)/);
+          const retFirstArgInfo = tracker.getData(ret[0]);
+          const retSecondArgInfo = tracker.getData(ret[1]);
+          const groupsValueInfo = tracker.getData(ret.groups.fooOrBar);
+
+          expect(ret).to.deep.equal(['foo', 'foo']);
+          expect(ret.groups.fooOrBar).to.equal('foo');
+          expect(retFirstArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+          expect(retSecondArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retSecondArgInfo.name).to.equal('String.prototype.match');
+          expect(groupsValueInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(groupsValueInfo.name).to.equal('String.prototype.match');
+        });
+      });
+
+      it('keeps track of tracked strings within multiple matched named capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match(/(?<fizzOrBuzz>fizz|buzz)|(?<fooOrBar>foo|bar)/);
+          const retFirstArgInfo = tracker.getData(ret[0]);
+          const retThirdArgInfo = tracker.getData(ret[2]);
+          const groupsValueInfo = tracker.getData(ret.groups.fooOrBar);
+
+          expect(ret).to.deep.equal(['foo', undefined, 'foo']);
+          expect(ret.groups).to.deep.equal({ fizzOrBuzz: undefined, fooOrBar: 'foo' });
+          expect(retFirstArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retFirstArgInfo.name).to.equal('String.prototype.match');
+          expect(retThirdArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retThirdArgInfo.name).to.equal('String.prototype.match');
+          expect(groupsValueInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(groupsValueInfo.name).to.equal('String.prototype.match');
+        });
+      });
+    });
+
+    describe('custom matcher', function () {
+      it('keeps track of tracked string returned by custom matcher', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foo');
+
+          const ret = 'foo'.match({
+            [Symbol.match](_str) {
+              return [extern];
+            },
+          });
+
+          expect(ret).to.deep.equal(['foo']);
+          expect(tracker.getData(ret[0]).tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+        });
+      });
+
+      it('keeps track of tracked string copied by custom matcher', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.match({
+            [Symbol.match](str) {
+              return [str.substring(0, 3)];
+            },
+          });
+          const retInfo = tracker.getData(ret[0]);
+
+          expect(ret).to.deep.equal(['foo']);
+          expect(retInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retInfo.history[0].name).to.equal('String.prototype.match');
+        });
+      });
+    });
+  });
+});